Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Agent Registry

AWS Agent Registry (service prefix: agent-registry) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Agent Registry
Actions defined by AWS Agent Registry
Resource types defined by AWS Agent Registry
Condition keys for AWS Agent Registry

API operations defined by AWS Agent Registry

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
BatchGetDiscoverableRegistryRecord	agent-registry	agent-registry:GetDiscoverableRegistryRecord			Read
ListDiscoverableRegistryRecords	agent-registry	agent-registry:ListDiscoverableRegistryRecords			List
SearchDiscoverableRegistryRecords	agent-registry	agent-registry:SearchDiscoverableRegistryRecords			Read
CreateRegistry	agent-registry-control	agent-registry:CreateRegistry			Write
CreateRegistry	agent-registry-control	agent-registry:TagResource			Tagging, Write
CreateRegistryRecord	agent-registry-control	agent-registry:CreateRegistryRecord			Write
		agent-registry:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	agent-registry.amazonaws.com	Write
DeleteRegistry	agent-registry-control	agent-registry:DeleteRegistry			Write
DeleteRegistryRecord	agent-registry-control	agent-registry:DeleteRegistryRecord			Write
GetRegistry	agent-registry-control	agent-registry:GetRegistry			Read
GetRegistryRecord	agent-registry-control	agent-registry:GetRegistryRecord			Read
ListRegistries	agent-registry-control	agent-registry:ListRegistries			List
ListRegistryRecords	agent-registry-control	agent-registry:ListRegistryRecords			List
ListTagsForResource	agent-registry-control	agent-registry:ListTagsForResource			List
SubmitRegistryRecordForApproval	agent-registry-control	agent-registry:SubmitRegistryRecordForApproval			Write
TagResource	agent-registry-control	agent-registry:TagResource			Tagging, Write
UntagResource	agent-registry-control	agent-registry:UntagResource			Tagging, Write
UpdateRegistry	agent-registry-control	agent-registry:UpdateRegistry			Write
UpdateRegistryRecord	agent-registry-control	agent-registry:UpdateRegistryRecord			Write
UpdateRegistryRecord	agent-registry-control	iam:PassRole	iam:PassedToService	agent-registry.amazonaws.com	Write
UpdateRegistryRecordStatus	agent-registry-control	agent-registry:UpdateRegistryRecordStatus			Write

Actions defined by AWS Agent Registry

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateRegistry	Grants permission to create a new registry		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRegistryRecord	Grants permission to create a new registry record	registry*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteRegistry	Grants permission to delete an existing registry	registry*	aws:ResourceTag/${TagKey}	Write
DeleteRegistryRecord	Grants permission to delete an existing registry record	registry-record*	aws:ResourceTag/${TagKey}	Write
GetDiscoverableRegistryRecord	Grants permission to retrieve an individual approved registry record. This is a permission-only action used for fine-grained access control with BatchGetApprovedRegistryRecord	registry-record*	aws:ResourceTag/${TagKey}	Read
GetRegistry	Grants permission to retrieve an existing registry	registry*	aws:ResourceTag/${TagKey}	Read
GetRegistryRecord	Grants permission to retrieve an existing registry record	registry-record*	aws:ResourceTag/${TagKey}	Read
InvokeRegistryMcp	Grants permission to invoke an MCP operation against an existing registry	registry*	aws:ResourceTag/${TagKey}	Read
ListDiscoverableRegistryRecords	Grants permission to list approved registry records in a registry	registry*	aws:ResourceTag/${TagKey}	List
ListRegistries	Grants permission to list existing registries			List
ListRegistryRecords	Grants permission to list existing registry records in a registry	registry*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for an Agent Registry resource	registry	aws:ResourceTag/${TagKey}	List
ListTagsForResource		registry-record	aws:ResourceTag/${TagKey}	List
SearchDiscoverableRegistryRecords	Grants permission to search for registry records	registry*	aws:ResourceTag/${TagKey}	Read
SubmitRegistryRecordForApproval	Grants permission to submit a registry record for approval	registry-record*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag an Agent Registry resource	registry	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to tag an Agent Registry resource	registry-record	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag an Agent Registry resource	registry	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag an Agent Registry resource	registry-record	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateRegistry	Grants permission to update an existing registry	registry*	aws:ResourceTag/${TagKey}	Write
UpdateRegistryRecord	Grants permission to update an existing registry record	registry-record*	aws:ResourceTag/${TagKey}	Write
UpdateRegistryRecordStatus	Grants permission to update the status of a registry record	registry-record*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Agent Registry

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
registry	arn:${Partition}:agent-registry:${Region}:${Account}:registry/${RegistryId}	aws:ResourceTag/${TagKey}
registry-record	arn:${Partition}:agent-registry:${Region}:${Account}:registry/${RegistryId}/record/${RecordId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Agent Registry

AWS Agent Registry defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by creating requests based on the allowed set of values for each of the mandatory tags	String
aws:ResourceTag/${TagKey}	Filters access by having actions based on the tag value associated with the resource	String
aws:TagKeys	Filters access by creating requests based on the presence of mandatory tags in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Activate (activate)

AWS Amplify (amplify)