Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Rekognition

Amazon Rekognition (service prefix: rekognition) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Rekognition
Actions defined by Amazon Rekognition
Resource types defined by Amazon Rekognition
Condition keys for Amazon Rekognition

API operations defined by Amazon Rekognition

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateFaces	rekognition:AssociateFaces			Write
CompareFaces	rekognition:CompareFaces			Read
CopyProjectVersion	rekognition:CopyProjectVersion			Write
	rekognition:CreateProjectVersion			Write
	rekognition:TagResource			Tagging, Write
CreateCollection	rekognition:CreateCollection			Write
CreateCollection	rekognition:TagResource			Tagging, Write
CreateDataset	rekognition:CreateDataset			Write
	rekognition:ListDatasetEntries			Read
	rekognition:TagResource			Tagging, Write
CreateFaceLivenessSession	rekognition:CreateFaceLivenessSession			Write
CreateProject	rekognition:CreateProject			Write
CreateProject	rekognition:TagResource			Tagging, Write
CreateProjectVersion	rekognition:CreateProjectVersion			Write
CreateProjectVersion	rekognition:TagResource			Tagging, Write
CreateStreamProcessor	rekognition:CreateStreamProcessor			Write
	rekognition:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
CreateUser	rekognition:CreateUser			Write
DeleteCollection	rekognition:DeleteCollection			Write
DeleteDataset	rekognition:DeleteDataset			Write
DeleteFaces	rekognition:DeleteFaces			Write
DeleteProject	rekognition:DeleteProject			Write
DeleteProjectPolicy	rekognition:DeleteProjectPolicy			Write
DeleteProjectVersion	rekognition:DeleteProjectVersion			Write
DeleteStreamProcessor	rekognition:DeleteStreamProcessor			Write
DeleteUser	rekognition:DeleteUser			Write
DescribeCollection	rekognition:DescribeCollection			Read
DescribeDataset	rekognition:DescribeDataset			Read
DescribeProjectVersions	rekognition:DescribeProjectVersions			Read
DescribeProjects	rekognition:DescribeProjects			Read
DescribeStreamProcessor	rekognition:DescribeStreamProcessor			Read
DetectCustomLabels	rekognition:DetectCustomLabels			Read
DetectFaces	rekognition:DetectFaces			Read
DetectLabels	rekognition:DetectLabels			Read
DetectModerationLabels	rekognition:DetectModerationLabels			Read
DetectProtectiveEquipment	rekognition:DetectProtectiveEquipment			Read
DetectText	rekognition:DetectText			Read
DisassociateFaces	rekognition:DisassociateFaces			Write
DistributeDatasetEntries	rekognition:DistributeDatasetEntries			Write
GetCelebrityInfo	rekognition:GetCelebrityInfo			Read
GetCelebrityRecognition	rekognition:GetCelebrityRecognition			Read
GetContentModeration	rekognition:GetContentModeration			Read
GetFaceDetection	rekognition:GetFaceDetection			Read
GetFaceLivenessSessionResults	rekognition:GetFaceLivenessSessionResults			Read
GetFaceSearch	rekognition:GetFaceSearch			Read
GetLabelDetection	rekognition:GetLabelDetection			Read
GetMediaAnalysisJob	rekognition:GetMediaAnalysisJob			Read
GetPersonTracking	rekognition:GetPersonTracking			Read
GetSegmentDetection	rekognition:GetSegmentDetection			Read
GetTextDetection	rekognition:GetTextDetection			Read
IndexFaces	rekognition:IndexFaces			Write
ListCollections	rekognition:ListCollections			Read
ListDatasetEntries	rekognition:ListDatasetEntries			Read
ListDatasetLabels	rekognition:ListDatasetLabels			Read
ListFaces	rekognition:ListFaces			Read
ListMediaAnalysisJobs	rekognition:ListMediaAnalysisJobs			Read
ListProjectPolicies	rekognition:ListProjectPolicies			Read
ListStreamProcessors	rekognition:ListStreamProcessors			List
ListTagsForResource	rekognition:ListTagsForResource			Read
ListUsers	rekognition:ListUsers			Read
PutProjectPolicy	rekognition:PutProjectPolicy			Write
RecognizeCelebrities	rekognition:RecognizeCelebrities			Read
SearchFaces	rekognition:SearchFaces			Read
SearchFacesByImage	rekognition:SearchFacesByImage			Read
SearchUsers	rekognition:SearchUsers			Read
SearchUsersByImage	rekognition:SearchUsersByImage			Read
StartCelebrityRecognition	rekognition:StartCelebrityRecognition			Write
StartCelebrityRecognition	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StartContentModeration	rekognition:StartContentModeration			Write
StartContentModeration	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StartFaceDetection	rekognition:StartFaceDetection			Write
StartFaceDetection	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StartFaceSearch	rekognition:StartFaceSearch			Write
StartFaceSearch	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StartLabelDetection	rekognition:StartLabelDetection			Write
StartLabelDetection	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StartMediaAnalysisJob	rekognition:StartMediaAnalysisJob			Write
StartPersonTracking	rekognition:StartPersonTracking			Write
StartPersonTracking	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StartProjectVersion	rekognition:StartProjectVersion			Write
StartSegmentDetection	rekognition:StartSegmentDetection			Write
StartSegmentDetection	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StartStreamProcessor	rekognition:StartStreamProcessor			Write
StartTextDetection	rekognition:StartTextDetection			Write
StartTextDetection	iam:PassRole	iam:PassedToService	rekognition.amazonaws.com	Write
StopProjectVersion	rekognition:StopProjectVersion			Write
StopStreamProcessor	rekognition:StopStreamProcessor			Write
TagResource	rekognition:TagResource			Tagging, Write
UntagResource	rekognition:UntagResource			Tagging, Write
UpdateDatasetEntries	rekognition:UpdateDatasetEntries			Write
UpdateStreamProcessor	rekognition:UpdateStreamProcessor			Write

Actions defined by Amazon Rekognition

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateFaces	Grants permission to associate multiple individual faces with a single user	collection*	aws:ResourceTag/${TagKey}	Write
CompareFaces	Grants permission to compare faces in the source input image with each face detected in the target input image			Read
CopyProjectVersion	Grants permission to copy an existing model version to a new model version	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CopyProjectVersion		projectversion*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCollection	Grants permission to create a collection in an AWS Region		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDataset	Grants permission to create a new Amazon Rekognition Custom Labels dataset	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFaceLivenessSession	Grants permission to create a face liveness session			Write
CreateProject	Grants permission to create an Amazon Rekognition Custom Labels project		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateProjectVersion	Grants permission to begin training a new version of a model	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStreamProcessor	Grants permission to create an Amazon Rekognition stream processor	collection*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUser	Grants permission to create a new user in a collection using a unique user ID you provide	collection*	aws:ResourceTag/${TagKey}	Write
DeleteCollection	Grants permission to delete the specified collection	collection*	aws:ResourceTag/${TagKey}	Write
DeleteDataset	Grants permission to delete an existing Amazon Rekognition Custom Labels dataset	dataset*	aws:ResourceTag/${TagKey}	Write
DeleteFaces	Grants permission to delete faces from a collection	collection*	aws:ResourceTag/${TagKey}	Write
DeleteProject	Grants permission to delete a project	project*	aws:ResourceTag/${TagKey}	Write
DeleteProjectPolicy	Grants permission to delete a resource policy attached to a project	project*	aws:ResourceTag/${TagKey}	Write
DeleteProjectVersion	Grants permission to delete a model	projectversion*	aws:ResourceTag/${TagKey}	Write
DeleteStreamProcessor	Grants permission to delete the specified stream processor	streamprocessor*	aws:ResourceTag/${TagKey}	Write
DeleteUser	Grants permission to delete a user from a collection based on the provided user ID	collection*	aws:ResourceTag/${TagKey}	Write
DescribeCollection	Grants permission to read details about a collection	collection*	aws:ResourceTag/${TagKey}	Read
DescribeDataset	Grants permission to describe an Amazon Rekognition Custom Labels dataset	dataset*	aws:ResourceTag/${TagKey}	Read
DescribeProjectVersions	Grants permission to list the versions of a model in an Amazon Rekognition Custom Labels project	project*	aws:ResourceTag/${TagKey}	Read
DescribeProjects	Grants permission to list Amazon Rekognition Custom Labels projects			Read
DescribeStreamProcessor	Grants permission to get information about the specified stream processor	streamprocessor*	aws:ResourceTag/${TagKey}	Read
DetectCustomLabels	Grants permission to detect custom labels in a supplied image	projectversion*	aws:ResourceTag/${TagKey}	Read
DetectFaces	Grants permission to detect human faces within an image provided as input			Read
DetectLabels	Grants permission to detect instances of real-world labels within an image provided as input			Read
DetectModerationLabels	Grants permission to detect moderation labels within the input image	projectversion	aws:ResourceTag/${TagKey}	Read
DetectProtectiveEquipment	Grants permission to detect Personal Protective Equipment in the input image			Read
DetectText	Grants permission to detect text in the input image and convert it into machine-readable text			Read
DisassociateFaces	Grants permission to remove the association between a user ID and a face ID	collection*	aws:ResourceTag/${TagKey}	Write
DistributeDatasetEntries	Grants permission to distribute the entries in a training dataset across the training dataset and the test dataset for a project	dataset*	aws:ResourceTag/${TagKey}	Write
GetCelebrityInfo	Grants permission to read the name, and additional information, of a celebrity			Read
GetCelebrityRecognition	Grants permission to read the celebrity recognition results found in a stored video by an asynchronous celebrity recognition job			Read
GetContentModeration	Grants permission to read the content moderation analysis results found in a stored video by an asynchronous content moderation job			Read
GetFaceDetection	Grants permission to read the faces detection results found in a stored video by an asynchronous face detection job			Read
GetFaceLivenessSessionResults	Grants permission to get results of a face liveness session			Read
GetFaceSearch	Grants permission to read the matching collection faces found in a stored video by an asynchronous face search job			Read
GetLabelDetection	Grants permission to read the label detected resuls found in a stored video by an asynchronous label detection job			Read
GetMediaAnalysisJob	Grants permission to read the reference to job results in S3 and additional information about a media analysis job			Read
GetPersonTracking	Grants permission to read the list of persons detected in a stored video by an asynchronous person tracking job			Read
GetSegmentDetection	Grants permission to get the vdeo segments found in a stored video by an asynchronous segment detection job			Read
GetTextDetection	Grants permission to get the text found in a stored video by an asynchronous text detection job			Read
IndexFaces	Grants permission to update an existing collection with faces detected in the input image	collection*	aws:ResourceTag/${TagKey}	Write
ListCollections	Grants permission to read the collection Id's in your account			Read
ListDatasetEntries	Grants permission to list the dataset entries in an existing Amazon Rekognition Custom Labels dataset	dataset*	aws:ResourceTag/${TagKey}	Read
ListDatasetLabels	Grants permission to list the labels in a dataset	dataset*	aws:ResourceTag/${TagKey}	Read
ListFaces	Grants permission to read metadata for faces in the specificed collection	collection*	aws:ResourceTag/${TagKey}	Read
ListMediaAnalysisJobs	Grants permission to read the list of media analysis jobs			Read
ListProjectPolicies	Grants permission to list the resource policies attached to a project	project*	aws:ResourceTag/${TagKey}	Read
ListStreamProcessors	Grants permission to get a list of your stream processors			List
ListTagsForResource	Grants permission to return a list of tags associated with a resource	collection	aws:ResourceTag/${TagKey}	Read
		dataset	aws:ResourceTag/${TagKey}
		project	aws:ResourceTag/${TagKey}
		projectversion	aws:ResourceTag/${TagKey}
		streamprocessor	aws:ResourceTag/${TagKey}
ListUsers	Grants permission to list UserIds and the UserStatus	collection*	aws:ResourceTag/${TagKey}	Read
PutProjectPolicy	Grants permission to attach a resource policy to a project	project*	aws:ResourceTag/${TagKey}	Write
RecognizeCelebrities	Grants permission to detect celebrities in the input image			Read
SearchFaces	Grants permission to search the specificed collection for the supplied face ID	collection*	aws:ResourceTag/${TagKey}	Read
SearchFacesByImage	Grants permission to search the specificed collection for the largest face in the input image	collection*	aws:ResourceTag/${TagKey}	Read
SearchUsers	Grants permission to search the specificed collection for user match result with given either face ID or user ID	collection*	aws:ResourceTag/${TagKey}	Read
SearchUsersByImage	Grants permission to search the specificed collection for user match result by using the largest face in the input image	collection*	aws:ResourceTag/${TagKey}	Read
StartCelebrityRecognition	Grants permission to start the asynchronous recognition of celebrities in a stored video			Write
StartContentModeration	Grants permission to start asynchronous detection of explicit or suggestive adult content in a stored video			Write
StartFaceDetection	Grants permission to start asynchronous detection of faces in a stored video			Write
StartFaceLivenessSession	Grants permission to start streaming video for a face liveness session			Write
StartFaceSearch	Grants permission to start an asynchronous search for faces in a collection that match the faces of persons detected in a stored video	collection*	aws:ResourceTag/${TagKey}	Write
StartLabelDetection	Grants permission to start asynchronous detection of labels in a stored video			Write
StartMediaAnalysisJob	Grants permission to start a media analysis job	projectversion	aws:ResourceTag/${TagKey}	Write
StartPersonTracking	Grants permission to start the asynchronous tracking of persons in a stored video			Write
StartProjectVersion	Grants permission to start running a model version	projectversion*	aws:ResourceTag/${TagKey}	Write
StartSegmentDetection	Grants permission to start the asynchronous detection of segments in a stored video			Write
StartStreamProcessor	Grants permission to start running a stream processor	streamprocessor*	aws:ResourceTag/${TagKey}	Write
StartTextDetection	Grants permission to start the asynchronous detection of text in a stored video			Write
StopProjectVersion	Grants permission to stop a running model version	projectversion*	aws:ResourceTag/${TagKey}	Write
StopStreamProcessor	Grants permission to stop a running stream processor	streamprocessor*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add one or more tags to a resource	collection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		dataset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		project	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		projectversion	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		streamprocessor	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove one or more tags from a resource	collection	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		dataset	aws:ResourceTag/${TagKey} aws:TagKeys
		project	aws:ResourceTag/${TagKey} aws:TagKeys
		projectversion	aws:ResourceTag/${TagKey} aws:TagKeys
		streamprocessor	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDatasetEntries	Grants permission to add or update one or more JSON Lines (entries) in a dataset	dataset*	aws:ResourceTag/${TagKey}	Write
UpdateStreamProcessor	Grants permission to modify properties for a stream processor	streamprocessor*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Rekognition

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
collection	arn:${Partition}:rekognition:${Region}:${Account}:collection/${CollectionId}	aws:ResourceTag/${TagKey}
dataset	arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/dataset/${DatasetType}/${CreationTimestamp}	aws:ResourceTag/${TagKey}
project	arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/${CreationTimestamp}	aws:ResourceTag/${TagKey}
projectversion	arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/version/${VersionName}/${CreationTimestamp}	aws:ResourceTag/${TagKey}
streamprocessor	arn:${Partition}:rekognition:${Region}:${Account}:streamprocessor/${StreamprocessorId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Rekognition

Amazon Rekognition defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by tags associated with the resource	String
aws:TagKeys	Filters access by tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Redshift Serverless (redshift-serverless)

Amazon Resource Group Tagging API (tag)