Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS DataSync

AWS DataSync (service prefix: datasync) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS DataSync

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelTaskExecution	datasync:CancelTaskExecution			Write
CreateAgent	datasync:CreateAgent			Write
CreateAgent	datasync:TagResource			Tagging, Write
CreateLocationAzureBlob	datasync:CreateLocationAzureBlob			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateLocationEfs	datasync:CreateLocationEfs			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateLocationFsxLustre	datasync:CreateLocationFsxLustre			Write
CreateLocationFsxLustre	datasync:TagResource			Tagging, Write
CreateLocationFsxOntap	datasync:CreateLocationFsxOntap			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateLocationFsxOpenZfs	datasync:CreateLocationFsxOpenZfs			Write
CreateLocationFsxOpenZfs	datasync:TagResource			Tagging, Write
CreateLocationFsxWindows	datasync:CreateLocationFsxWindows			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateLocationHdfs	datasync:CreateLocationHdfs			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateLocationNfs	datasync:CreateLocationNfs			Write
CreateLocationNfs	datasync:TagResource			Tagging, Write
CreateLocationObjectStorage	datasync:CreateLocationObjectStorage			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateLocationS3	datasync:CreateLocationS3			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateLocationSmb	datasync:CreateLocationSmb			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
CreateTask	datasync:CreateTask			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
DeleteAgent	datasync:DeleteAgent			Write
DeleteLocation	datasync:DeleteLocation			Write
DeleteTask	datasync:DeleteTask			Write
DescribeAgent	datasync:DescribeAgent			Read
DescribeLocationAzureBlob	datasync:DescribeLocationAzureBlob			Read
DescribeLocationEfs	datasync:DescribeLocationEfs			Read
DescribeLocationFsxLustre	datasync:DescribeLocationFsxLustre			Read
DescribeLocationFsxOntap	datasync:DescribeLocationFsxOntap			Read
DescribeLocationFsxOpenZfs	datasync:DescribeLocationFsxOpenZfs			Read
DescribeLocationFsxWindows	datasync:DescribeLocationFsxWindows			Read
DescribeLocationHdfs	datasync:DescribeLocationHdfs			Read
DescribeLocationNfs	datasync:DescribeLocationNfs			Read
DescribeLocationObjectStorage	datasync:DescribeLocationObjectStorage			Read
DescribeLocationS3	datasync:DescribeLocationS3			Read
DescribeLocationSmb	datasync:DescribeLocationSmb			Read
DescribeTask	datasync:DescribeTask			Read
DescribeTaskExecution	datasync:DescribeTaskExecution			Read
ListAgents	datasync:ListAgents			List
ListLocations	datasync:ListLocations			List
ListTagsForResource	datasync:ListTagsForResource			Read
ListTaskExecutions	datasync:ListTaskExecutions			List
ListTasks	datasync:ListTasks			List
StartTaskExecution	datasync:StartTaskExecution			Write
	datasync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
TagResource	datasync:TagResource			Tagging, Write
UntagResource	datasync:UntagResource			Tagging, Write
UpdateAgent	datasync:UpdateAgent			Write
UpdateLocationAzureBlob	datasync:UpdateLocationAzureBlob			Write
UpdateLocationAzureBlob	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateLocationEfs	datasync:UpdateLocationEfs			Write
UpdateLocationEfs	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateLocationFsxLustre	datasync:UpdateLocationFsxLustre			Write
UpdateLocationFsxOntap	datasync:UpdateLocationFsxOntap			Write
UpdateLocationFsxOntap	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateLocationFsxOpenZfs	datasync:UpdateLocationFsxOpenZfs			Write
UpdateLocationFsxWindows	datasync:UpdateLocationFsxWindows			Write
UpdateLocationFsxWindows	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateLocationHdfs	datasync:UpdateLocationHdfs			Write
UpdateLocationHdfs	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateLocationNfs	datasync:UpdateLocationNfs			Write
UpdateLocationObjectStorage	datasync:UpdateLocationObjectStorage			Write
UpdateLocationObjectStorage	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateLocationS3	datasync:UpdateLocationS3			Write
UpdateLocationS3	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateLocationSmb	datasync:UpdateLocationSmb			Write
UpdateLocationSmb	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateTask	datasync:UpdateTask			Write
UpdateTask	iam:PassRole	iam:PassedToService	datasync.amazonaws.com	Write
UpdateTaskExecution	datasync:UpdateTaskExecution			Write

Actions defined by AWS DataSync

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddStorageSystem	Grants permission to create a storage system	agent*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CancelTaskExecution	Grants permission to cancel execution of a sync task	taskexecution*	aws:ResourceTag/${TagKey}	Write
CreateAgent	Grants permission to activate an agent that you have deployed on your host		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationAzureBlob	Grants permission to create an endpoint for a Microsoft Azure Blob Storage container		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationEfs	Grants permission to create an endpoint for an Amazon EFS file system		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationFsxLustre	Grants permission to create an endpoint for an Amazon Fsx Lustre		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationFsxOntap	Grants permission to create an endpoint for Amazon FSx for ONTAP		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationFsxOpenZfs	Grants permission to create an endpoint for Amazon FSx for OpenZFS		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationFsxWindows	Grants permission to create an endpoint for an Amazon FSx Windows File Server file system		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationHdfs	Grants permission to create an endpoint for an Amazon Hdfs		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationNfs	Grants permission to create an endpoint for a NFS file system		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationObjectStorage	Grants permission to create an endpoint for a self-managed object storage bucket		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationS3	Grants permission to create an endpoint for an Amazon S3 bucket		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLocationSmb	Grants permission to create an endpoint for an SMB file system		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateTask	Grants permission to create a sync task	agent	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTask	Grants permission to create a sync task	location*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAgent	Grants permission to delete an agent	agent*	aws:ResourceTag/${TagKey}	Write
DeleteLocation	Grants permission to delete a location used by AWS DataSync	location*	aws:ResourceTag/${TagKey}	Write
DeleteTask	Grants permission to delete a sync task	task*	aws:ResourceTag/${TagKey}	Write
DescribeAgent	Grants permission to view metadata such as name, network interfaces, and the status (that is, whether the agent is running or not) about a sync agent	agent*	aws:ResourceTag/${TagKey}	Read
DescribeDiscoveryJob	Grants permission to describe metadata about a discovery job	discoveryjob*	aws:ResourceTag/${TagKey}	Read
DescribeLocationAzureBlob	Grants permission to view metadata, such as the path information about an Azure Blob Storage sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationEfs	Grants permission to view metadata, such as the path information about an Amazon EFS sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationFsxLustre	Grants permission to view metadata, such as the path information about an Amazon FSx Lustre sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationFsxOntap	Grants permission to view metadata, such as the path information about an Amazon FSx for ONTAP sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationFsxOpenZfs	Grants permission to view metadata, such as the path information about an Amazon FSx OpenZFS sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationFsxWindows	Grants permission to view metadata, such as the path information about an Amazon FSx Windows sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationHdfs	Grants permission to view metadata, such as the path information about an Amazon HDFS sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationNfs	Grants permission to view metadata, such as the path information, about a NFS sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationObjectStorage	Grants permission to view metadata about a self-managed object storage server location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationS3	Grants permission to view metadata, such as bucket name, about an Amazon S3 bucket sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeLocationSmb	Grants permission to view metadata, such as the path information, about an SMB sync location	location*	aws:ResourceTag/${TagKey}	Read
DescribeStorageSystem	Grants permission to view metadata about a storage system	storagesystem*	aws:ResourceTag/${TagKey}	Read
DescribeStorageSystemResourceMetrics	Grants permission to describe resource metrics collected by a discovery job	discoveryjob*	aws:ResourceTag/${TagKey}	List
DescribeStorageSystemResources	Grants permission to describe resources identified by a discovery job	discoveryjob*	aws:ResourceTag/${TagKey}	List
DescribeTask	Grants permission to view metadata about a sync task	task*	aws:ResourceTag/${TagKey}	Read
DescribeTaskExecution	Grants permission to view metadata about a sync task that is being executed	taskexecution*	aws:ResourceTag/${TagKey}	Read
GenerateRecommendations	Grants permission to generate recommendations for a resource identified by a discovery job	discoveryjob*	aws:ResourceTag/${TagKey}	Write
ListAgents	Grants permission to list agents owned by an AWS account in a region specified in the request			List
ListDiscoveryJobs	Grants permission to list discovery jobs			List
ListLocations	Grants permission to list source and destination sync locations			List
ListStorageSystems	Grants permission to list storage systems			List
ListTagsForResource	Grants permission to list tags that have been added to the specified resource	agent	aws:ResourceTag/${TagKey}	Read
		discoveryjob	aws:ResourceTag/${TagKey}
		location	aws:ResourceTag/${TagKey}
		storagesystem	aws:ResourceTag/${TagKey}
		task	aws:ResourceTag/${TagKey}
		taskexecution	aws:ResourceTag/${TagKey}
ListTaskExecutions	Grants permission to list executed sync tasks		aws:ResourceTag/${TagKey}	List
ListTasks	Grants permission to list of all the sync tasks			List
RemoveStorageSystem	Grants permission to delete a storage system	storagesystem*	aws:ResourceTag/${TagKey}	Write
StartDiscoveryJob	Grants permission to start a discovery job for a storage system	storagesystem*	aws:ResourceTag/${TagKey}	Write
StartTaskExecution	Grants permission to start a specific invocation of a sync task	task*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StopDiscoveryJob	Grants permission to stop a discovery job	discoveryjob*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to apply a key-value pair to an AWS resource	agent	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		discoveryjob	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		location	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		storagesystem	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		task	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		taskexecution	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove one or more tags from the specified resource	agent	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		discoveryjob	aws:ResourceTag/${TagKey} aws:TagKeys
		location	aws:ResourceTag/${TagKey} aws:TagKeys
		storagesystem	aws:ResourceTag/${TagKey} aws:TagKeys
		task	aws:ResourceTag/${TagKey} aws:TagKeys
		taskexecution	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAgent	Grants permission to update the name of an agent	agent*	aws:ResourceTag/${TagKey}	Write
UpdateDiscoveryJob	Grants permission to update a discovery job	discoveryjob*	aws:ResourceTag/${TagKey}	Write
UpdateLocationAzureBlob	Grants permission to update an Azure Blob Storage sync location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationEfs	Grants permission to update an EFS sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationFsxLustre	Grants permission to update an FSx Lustre sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationFsxOntap	Grants permission to update an FSx ONTAP sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationFsxOpenZfs	Grants permission to update an FSx OpenZFS sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationFsxWindows	Grants permission to update an FSx Windows sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationHdfs	Grants permission to update an HDFS sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationNfs	Grants permission to update an NFS sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationObjectStorage	Grants permission to update a self-managed object storage server location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationS3	Grants permission to update an S3 sync Location	location*	aws:ResourceTag/${TagKey}	Write
UpdateLocationSmb	Grants permission to update a SMB sync location	location*	aws:ResourceTag/${TagKey}	Write
UpdateStorageSystem	Grants permission to update a storage system	storagesystem*	aws:ResourceTag/${TagKey}	Write
UpdateTask	Grants permission to update metadata associated with a sync task	task*	aws:ResourceTag/${TagKey}	Write
UpdateTaskExecution	Grants permission to update execution of a sync task	taskexecution*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS DataSync

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
agent	arn:${Partition}:datasync:${Region}:${AccountId}:agent/${AgentId}	aws:ResourceTag/${TagKey}
discoveryjob	arn:${Partition}:datasync:${Region}:${AccountId}:system/${StorageSystemId}/job/${DiscoveryJobId}	aws:ResourceTag/${TagKey}
location	arn:${Partition}:datasync:${Region}:${AccountId}:location/${LocationId}	aws:ResourceTag/${TagKey}
storagesystem	arn:${Partition}:datasync:${Region}:${AccountId}:system/${StorageSystemId}	aws:ResourceTag/${TagKey}
task	arn:${Partition}:datasync:${Region}:${AccountId}:task/${TaskId}	aws:ResourceTag/${TagKey}
taskexecution	arn:${Partition}:datasync:${Region}:${AccountId}:task/${TaskId}/execution/${ExecutionId}	aws:ResourceTag/${TagKey}

Condition keys for AWS DataSync

AWS DataSync defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs associated with the resource	String
aws:TagKeys	Filters access by the tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Database Migration Service (dms)

AWS Deadline Cloud (deadline)