Actions, resources, and condition keys for AWS Transform custom

AWS Transform custom (service prefix: transform-custom) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by AWS Transform custom
Resource types defined by AWS Transform custom
Condition keys for AWS Transform custom

Actions defined by AWS Transform custom

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Access level column of the Actions table describes how the action is classified (List, Read, Permissions management, or Tagging). This classification can help you understand the level of access that an action grants when you use it in a policy. For more information about access levels, see Access levels in policy summaries.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

The Dependent actions column of the Actions table shows additional permissions that may be required to successfully call an action. These permissions may be needed in addition to the permission for the action itself. When an action specifies dependent actions, those dependencies may apply to additional resources defined for that action, not only the first resource listed in the table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
BatchCreateFindings	Grants permission to invoke BatchCreateFindings on AWS Transform custom	Write
BatchUpdateFindings	Grants permission to invoke BatchUpdateFindings on AWS Transform custom	Write
CompleteTransformationPackageUpload	Grants permission to invoke CompleteTransformationPackageUpload on AWS Transform custom	Write	package*
CompleteTransformationPackageUpload		Write		aws:ResourceTag/${TagKey}
ConverseStream	Grants permission to invoke ConverseStream on AWS Transform custom	Write
CreateAnalysis	Grants permission to invoke CreateAnalysis on AWS Transform custom	Write	analysis*
CreateAnalysis		Write		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateCampaign	Grants permission to invoke CreateCampaign on AWS Transform custom	Write	campaign*
CreateCampaign		Write		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateRemediation	Grants permission to invoke CreateRemediation on AWS Transform custom	Write	remediation*
CreateRemediation		Write		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateRepository	Grants permission to invoke CreateRepository on AWS Transform custom	Write	repository*
CreateRepository		Write		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateSource	Grants permission to invoke CreateSource on AWS Transform custom	Write	source*
CreateSource		Write		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateTransformationPackageUrl	Grants permission to invoke CreateTransformationPackageUrl on AWS Transform custom	Write	package*
CreateTransformationPackageUrl		Write		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
DeleteAnalysis	Grants permission to invoke DeleteAnalysis on AWS Transform custom	Write	analysis*
DeleteAnalysis		Write		aws:ResourceTag/${TagKey}
DeleteCampaign	Grants permission to invoke DeleteCampaign on AWS Transform custom	Write	campaign*
DeleteCampaign		Write		aws:ResourceTag/${TagKey}
DeleteFinding	Grants permission to invoke DeleteFinding on AWS Transform custom	Write	finding*
DeleteFinding		Write		aws:ResourceTag/${TagKey}
DeleteKnowledgeItem	Grants permission to invoke DeleteKnowledgeItem on AWS Transform custom	Write	knowledge-item*
DeleteKnowledgeItem		Write		aws:ResourceTag/${TagKey}
DeleteRemediation	Grants permission to invoke DeleteRemediation on AWS Transform custom	Write	remediation*
DeleteRemediation		Write		aws:ResourceTag/${TagKey}
DeleteRepository	Grants permission to invoke DeleteRepository on AWS Transform custom	Write	repository*
DeleteRepository		Write		aws:ResourceTag/${TagKey}
DeleteSource	Grants permission to invoke DeleteSource on AWS Transform custom	Write	source*
DeleteSource		Write		aws:ResourceTag/${TagKey}
DeleteTransformationPackage	Grants permission to invoke DeleteTransformationPackage on AWS Transform custom	Write	package*
DeleteTransformationPackage		Write		aws:ResourceTag/${TagKey}
ExecuteTransformation	Grants permission to invoke ExecuteTransformation on AWS Transform custom	Write	package*
ExecuteTransformation		Write		aws:ResourceTag/${TagKey}
GetAnalysis	Grants permission to invoke GetAnalysis on AWS Transform custom	Read	analysis*
GetAnalysis		Read		aws:ResourceTag/${TagKey}
GetCampaign	Grants permission to invoke GetCampaign on AWS Transform custom	Read	campaign*
GetCampaign		Read		aws:ResourceTag/${TagKey}
GetFinding	Grants permission to invoke GetFinding on AWS Transform custom	Read	finding*
GetFinding		Read		aws:ResourceTag/${TagKey}
GetFindingGroups	Grants permission to invoke GetFindingGroups on AWS Transform custom	Read
GetKnowledgeItem	Grants permission to invoke GetKnowledgeItem on AWS Transform custom	Read	knowledge-item*
GetKnowledgeItem		Read		aws:ResourceTag/${TagKey}
GetRemediation	Grants permission to invoke GetRemediation on AWS Transform custom	Read	remediation*
GetRemediation		Read		aws:ResourceTag/${TagKey}
GetRepository	Grants permission to invoke GetRepository on AWS Transform custom	Read	repository*
GetRepository		Read		aws:ResourceTag/${TagKey}
GetSource	Grants permission to invoke GetSource on AWS Transform custom	Read	source*
GetSource		Read		aws:ResourceTag/${TagKey}
GetTransformationPackageUrl	Grants permission to invoke GetTransformationPackageUrl on AWS Transform custom	Read	package*
GetTransformationPackageUrl		Read		aws:ResourceTag/${TagKey}
ListAnalyses	Grants permission to invoke ListAnalyses on AWS Transform custom	List
ListCampaignRepositories	Grants permission to invoke ListCampaignRepositories on AWS Transform custom	Read	campaign*
ListCampaignRepositories		Read		aws:ResourceTag/${TagKey}
ListCampaigns	Grants permission to invoke ListCampaign on AWS Transform custom	List
ListFindings	Grants permission to invoke ListFindings on AWS Transform custom	List
ListKnowledgeItems	Grants permission to invoke ListKnowledgeItems on AWS Transform custom	List
ListRemediations	Grants permission to invoke ListRemediations on AWS Transform custom	List
ListRepositories	Grants permission to invoke ListRepositories on AWS Transform custom	List
ListSources	Grants permission to invoke ListSources on AWS Transform custom	List
ListTagsForResource	Grants permission to invoke ListTagsForResource on AWS Transform custom	Read
ListTransformationPackageMetadata	Grants permission to invoke ListTransformationPackageMetadata on AWS Transform custom	List
ListTransformationPackageShares	Grants permission to list active shares of a Transformation Package	Read	package*
ListTransformationPackageShares		Read		aws:ResourceTag/${TagKey}
SendTelemetryEvent	Grants permission to send a CLI telemetry event	Write
ShareTransformationPackage	Grants permission to share a Transformation Package with another AWS account or AWS Organization	Write	package*
ShareTransformationPackage		Write		aws:ResourceTag/${TagKey}
TagResource	Grants permission to invoke TagResource on AWS Transform custom	Tagging	analysis
			campaign
			finding
			knowledge-item
			package
			remediation
			repository
			source
				aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UnshareTransformationPackage	Grants permission to revoke an existing share of a Transformation Package	Write	package*
UnshareTransformationPackage		Write		aws:ResourceTag/${TagKey}
UntagResource	Grants permission to invoke UntagResource on AWS Transform custom	Tagging	analysis
			campaign
			finding
			knowledge-item
			package
			remediation
			repository
			source
				aws:TagKeys
UpdateAnalysis	Grants permission to invoke UpdateAnalysis on AWS Transform custom	Write	analysis*
UpdateAnalysis		Write		aws:ResourceTag/${TagKey}
UpdateCampaign	Grants permission to invoke UpdateCampaign on AWS Transform custom	Write	campaign*
UpdateCampaign		Write		aws:ResourceTag/${TagKey}
UpdateCampaignRepositoryStatus	Grants permission to invoke UpdateCampaignRepositories on AWS Transform custom	Write	campaign*
UpdateCampaignRepositoryStatus		Write		aws:ResourceTag/${TagKey}
UpdateKnowledgeItemConfiguration	Grants permission to invoke UpdateKnowledgeItemConfiguration on AWS Transform custom	Write	package*
UpdateKnowledgeItemConfiguration		Write		aws:ResourceTag/${TagKey}
UpdateKnowledgeItemStatus	Grants permission to invoke UpdateKnowledgeItemStatus on AWS Transform custom	Write	knowledge-item*
UpdateKnowledgeItemStatus		Write		aws:ResourceTag/${TagKey}
UpdateRemediation	Grants permission to invoke UpdateRemediation on AWS Transform custom	Write	remediation*
UpdateRemediation		Write		aws:ResourceTag/${TagKey}
UpdateRepository	Grants permission to invoke UpdateRepository on AWS Transform custom	Write	repository*
UpdateRepository		Write		aws:ResourceTag/${TagKey}
UpdateSource	Grants permission to invoke UpdateSource on AWS Transform custom	Write	source*
UpdateSource		Write		aws:ResourceTag/${TagKey}

Resource types defined by AWS Transform custom

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
analysis	`arn:${Partition}:transform-custom:${Region}:${Account}:analysis/${AnalysisId}`	aws:ResourceTag/${TagKey}
campaign	`arn:${Partition}:transform-custom:${Region}:${Account}:campaign/${Name}`	aws:ResourceTag/${TagKey}
finding	`arn:${Partition}:transform-custom:${Region}:${Account}:finding/${FindingId}`	aws:ResourceTag/${TagKey}
knowledge-item	`arn:${Partition}:transform-custom:${Region}:${Account}:package/${TransformationPackageName}/knowledge-item/${Id}`	aws:ResourceTag/${TagKey}
package	`arn:${Partition}:transform-custom:${Region}:${Account}:package/${Name}`	aws:ResourceTag/${TagKey}
remediation	`arn:${Partition}:transform-custom:${Region}:${Account}:remediation/${RemediationId}`	aws:ResourceTag/${TagKey}
repository	`arn:${Partition}:transform-custom:${Region}:${Account}:repository/${RepositoryId}`	aws:ResourceTag/${TagKey}
source	`arn:${Partition}:transform-custom:${Region}:${Account}:source/${Name}`	aws:ResourceTag/${TagKey}

Condition keys for AWS Transform custom

AWS Transform custom defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see AWS global condition context keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Transform

Amazon Translate