Actions, resources, and condition keys for Amazon Neptune Analytics

Amazon Neptune Analytics (service prefix: neptune-graph) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by Amazon Neptune Analytics
Resource types defined by Amazon Neptune Analytics
Condition keys for Amazon Neptune Analytics

Actions defined by Amazon Neptune Analytics

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Note

All IAM actions except 'ReadDataViaQuery', 'WriteDataViaQuery' and 'DeleteDataViaQuery' have a corresponding API operation

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
CancelImportTask	Grants permission to cancel an ongoing import task	Write	import-task*
CancelQuery	Grants permission to cancel a query	Write	graph*
CancelQuery	Grants permission to cancel a query	Write		aws:ResourceTag/${TagKey}
CreateGraph	Grants permission to create a new graph	Write	graph*		iam:CreateServiceLinkedRole kms:CreateGrant kms:Decrypt kms:DescribeKey
CreateGraph	Grants permission to create a new graph	Write		aws:RequestTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity
CreateGraphSnapshot	Grants permission to create a new snapshot from an existing graph	Write	graph*
			graph-snapshot
				aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateGraphUsingImportTask	Grants permission to create a new graph while importing data into the new graph	Write	import-task*		iam:CreateServiceLinkedRole iam:PassRole kms:CreateGrant kms:Decrypt kms:DescribeKey
			graph
				aws:RequestTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity
CreatePrivateGraphEndpoint	Grants permission to create a new private graph endpoint to access the graph from within a vpc	Write	graph*		ec2:CreateVpcEndpoint ec2:DescribeAvailabilityZones ec2:DescribeSecurityGroups ec2:DescribeSubnets ec2:DescribeVpcAttribute ec2:DescribeVpcEndpoints ec2:DescribeVpcs ec2:ModifyVpcEndpoint route53:AssociateVPCWithHostedZone
CreatePrivateGraphEndpoint		Write		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
DeleteDataViaQuery	Grants permission to delete data via query APIs on the graph	Write	graph*
DeleteDataViaQuery		Write		aws:ResourceTag/${TagKey}
DeleteGraph	Grants permission to delete a graph	Write	graph*
DeleteGraph	Grants permission to delete a graph	Write		aws:ResourceTag/${TagKey}
DeleteGraphSnapshot	Grants permission to delete a snapshot	Write	graph-snapshot*
DeleteGraphSnapshot	Grants permission to delete a snapshot	Write		aws:ResourceTag/${TagKey}
DeletePrivateGraphEndpoint	Grants permission to delete a private graph endpoint of a graph	Write	graph*		ec2:DeleteVpcEndpoints ec2:DescribeAvailabilityZones ec2:DescribeSecurityGroups ec2:DescribeSubnets ec2:DescribeVpcAttribute ec2:DescribeVpcEndpoints ec2:DescribeVpcs ec2:ModifyVpcEndpoint route53:DisassociateVPCFromHostedZone
DeletePrivateGraphEndpoint		Write		aws:ResourceTag/${TagKey}
GetEngineStatus	Grants permission to get the engine status of the graph	Read	graph*
GetEngineStatus	Grants permission to get the engine status of the graph	Read		aws:ResourceTag/${TagKey}
GetGraph	Grants permission to get details about a graph	Read	graph*
GetGraph	Grants permission to get details about a graph	Read		aws:ResourceTag/${TagKey}
GetGraphSnapshot	Grants permission to get details about a snapshot	Read	graph-snapshot*
GetGraphSnapshot	Grants permission to get details about a snapshot	Read		aws:ResourceTag/${TagKey}
GetGraphSummary	Grants permission to get the summary for the data in the graph	Read	graph*
GetGraphSummary		Read		aws:ResourceTag/${TagKey}
GetImportTask	Grants permission to get details about an import task	Read	import-task*
GetPrivateGraphEndpoint	Grants permission to get details about a private graph endpoint of a graph	Read	graph*
GetPrivateGraphEndpoint		Read		aws:ResourceTag/${TagKey}
GetQueryStatus	Grants permission to check the status of a given query	Read	graph*
GetQueryStatus	Grants permission to check the status of a given query	Read		aws:ResourceTag/${TagKey}
GetStatisticsStatus	Grants permission to get the statistics for the data in the graph	Read	graph*
GetStatisticsStatus		Read		aws:ResourceTag/${TagKey}
ListGraphSnapshots	Grants permission to list the snapshots in your account	Read	graph-snapshot*
ListGraphs	Grants permission to list the graphs in your account	Read	graph*
ListImportTasks	Grants permission to list the import tasks in your account	Read	import-task*
ListPrivateGraphEndpoints	Grants permission to list the private graph endpoints for a given graph	Read	graph*
ListPrivateGraphEndpoints		Read		aws:ResourceTag/${TagKey}
ListQueries	Grants permission to check the status of all active queries	Read	graph*
ListQueries	Grants permission to check the status of all active queries	Read		aws:ResourceTag/${TagKey}
ListTagsForResource	Grants permission to lists tag for a Neptune Analytics resource	Read	graph
			graph-snapshot
				aws:ResourceTag/${TagKey}
ReadDataViaQuery	Grants permission to read data via query APIs on the graph	Read	graph*
ReadDataViaQuery	Grants permission to read data via query APIs on the graph	Read		aws:ResourceTag/${TagKey}
ResetGraph	Grants permission to reset a graph which deletes all data within the graph	Write	graph*
ResetGraph		Write		aws:ResourceTag/${TagKey}
RestoreGraphFromSnapshot	Grants permission to create a new graph from an existing snapshot	Write	graph-snapshot*		kms:CreateGrant kms:Decrypt kms:DescribeKey
			graph
				aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity
StartImportTask	Grants permission to import data into an existing graph	Write	graph*		iam:PassRole
TagResource	Grants permission to tag a Neptune Analytics resource	Tagging	graph
			graph-snapshot
				aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to untag a Neptune Analytics resource	Tagging	graph
			graph-snapshot
				aws:TagKeys
UpdateGraph	Grants permission to modify a graph	Write	graph*
UpdateGraph	Grants permission to modify a graph	Write		aws:ResourceTag/${TagKey} neptune-graph:PublicConnectivity
WriteDataViaQuery	Grants permission to write data via query APIs on the graph	Write	graph*
WriteDataViaQuery	Grants permission to write data via query APIs on the graph	Write		aws:ResourceTag/${TagKey}

Resource types defined by Amazon Neptune Analytics

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
graph	`arn:${Partition}:neptune-graph:${Region}:${Account}:graph/${ResourceId}`	aws:ResourceTag/${TagKey}
graph-snapshot	`arn:${Partition}:neptune-graph:${Region}:${Account}:graph-snapshot/${ResourceId}`	aws:ResourceTag/${TagKey}
import-task	`arn:${Partition}:neptune-graph:${Region}:${Account}:import-task/${ResourceId}`

Condition keys for Amazon Neptune Analytics

Amazon Neptune Analytics defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag's key and value in a request	String
aws:ResourceTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:TagKeys	Filters access by the tag keys in a request	ArrayOfString
neptune-graph:PublicConnectivity	Filters access by the value of the public connectivity parameter provided in the request or its default value, if unspecified. All access to graphs is IAM authenticated	Bool

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Neptune

AWS Network Firewall