List of policies actions

CK

Action	Description	Resource types	Condition keys
AbortMultipartUploadInStep	Grants permission to abort a multipart upload in a step	step	ck:Roles
CompleteMultipartUploadInStep	Grants permission to complete a multipart upload in a step	step	ck:Roles
CreateKit	Grants permission to create a kit	kit
CreateMultipartUploadInStep	Grants permission to create a multipart upload in a step	step	ck:Roles
DeleteKit	Grants permission to delete a kit	kit
ExecuteKit	Grants permission to execute a kit	kit
ExecuteStep	Grants permission to execute a step	step	ck:Roles
GetExecutedProcess	Grants permission to retrieve an executed process	executed-process	ck:Roles
GetKit	Grants permission to retrieve a kit	kit
GetObjectInStep	Grants permission to download an object in a step	step	ck:Roles
GetStep	Grants permission to retrieve a step	step	ck:Roles
ListAuditLogs	Grants permission to ListAuditLogs
ListExecutedProcesses	Grants permission to list all executed processes
ListKitsExecutedProcesses	Grants permission to list executed processes on a kit	kit
ListKits	Grants permission to list all kits
ListKitsStats	Grants permission to list all kits' statistics
ListObjectVersionsInStep	Grants permission to list object's versions in a step	step	ck:Roles
PutObjectInStep	Grants permission to upload an object in a step	step	ck:Roles
UpdateKit	Grants permission to update a kit	kit
UpdateStepStatus	Grants permission to update the status of a step	step	ck:Roles
UpdateStepRoles	Grants permission to update the roles in a step	step	ck:Roles
UploadPartInStep	Grants permission to upload a part in a step	step	ck:Roles

IAM

Action	Description	Resource types	Condition keys
AddClientIDToOpenIDConnectProvider	Grants permission to add a new client ID (audience) to the list of registered IDs for the specified IAM OpenID Connect (OIDC) provider resource	oidc-provider
AddUserToGroup	Grants permission to add an IAM user to the specified IAM group	group
AttachGroupPolicy	Grants permission to attach a managed policy to the specified IAM group	group
CreateAccessKey	Grants permission to create access key and secret access key for the specified IAM user	user
CreateGroup	Grants permission to create a new group	group
CreateOpenIDConnectProvider	Grants permission to create an IAM resource that describes an identity provider (IdP) that supports OpenID Connect (OIDC)	oidc-provider
CreatePolicy	Grants permission to create a new managed policy	policy
CreatePolicyVersion	Grants permission to create a new version of the specified managed policy	policy
CreateUser	Grants permission to create a new IAM user	user	iam:PermissionsBoundary
DeleteAccessKey	Grants permission to delete the access key pair that is associated with the specified IAM user	user
DeleteGroup	Grants permission to delete the specified IAM group	group
DeleteOpenIDConnectProvider	Grants permission to delete an OpenID Connect identity provider (IdP) resource object in IAM	oidc-provider
DeletePolicy	Grants permission to delete the specified managed policy and remove it from any IAM entities (users, groups, or roles) to which it is attached	policy
DeletePolicyVersion	Grants permission to delete a version from the specified managed policy	policy
DeleteUser	Grants permission to delete the specified IAM user	user
DeleteUserPermissionsBoundary	Grants permission to remove the permissions boundary from the specified IAM user	user	iam:PermissionsBoundary
DetachGroupPolicy	Grants permission to detach a managed policy from the specified IAM group	group
GetOpenIDConnectProvider	Grants permission to retrieve information about the specified OpenID Connect (OIDC) provider resource in IAM	oidc-provider
GetPolicy	Grants permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached	policy
GetPolicyVersion	Grants permission to retrieve information about a version of the specified managed policy, including the policy document	policy
GetUser	Grants permission to retrieve information about the specified IAM user, including the user's creation date, path, unique ID, and ARN	user
ListAccessKeys	Grants permission to list information about the access key IDs that are associated with the specified IAM user	user
ListAllAccessKeys	Grants permission to list information about all access key IDs in the account
ListAttachedGroupPolicies	Grants permission to list all managed policies that are attached to the specified IAM group	group
ListEntitiesForPolicy	Grants permission to list all IAM identities to which the specified managed policy is attached	policy
ListGroups	Grants permission to list the IAM groups that have the specified path prefix
ListGroupsForUser	Grants permission to list the IAM groups that the specified IAM user belongs to	user
ListOpenIDConnectProviders	Grants permission to list the tags that are attached to the specified OpenID Connect provider	oidc-provider
ListPolicies	Grants permission to list all managed policies
ListPolicyVersions	Grants permission to list information about the versions of the specified managed policy, including the version that is currently set as the policy's default version	policy
ListUsers	Grants permission to list the IAM users that have the specified path prefix
PutUserPermissionsBoundary	Grants permission to set a managed policy as a permissions boundary for an IAM user	user	iam:PermissionsBoundary
RemoveClientIDFromOpenIDConnectProvider	Grants permission to remove the client ID (audience) from the list of client IDs in the specified IAM OpenID Connect (OIDC) provider resource	oidc-provider
RemoveUserFromGroup	Grants permission to remove an IAM user from the specified group	group
SetDefaultPolicyVersion	Grants permission to set the version of the specified policy as the policy's default version	policy
SimulatePrincipalPolicy	Grants permission to simulate whether an identity-based policy that is attached to a specified IAM entity (user or role) provides permissions for specific API operations and resources	group user
UpdateAccessKey	Grants permission to update the status of the specified access key as Active or Inactive	user
UpdateOpenIDConnectProviderThumbprint	Grants permission to update the entire list of server certificate thumbprints that are associated with an OpenID Connect (OIDC) provider resource	oidc-provider

S3

Action	Description	Resource types	Condition keys
AbortMultipartUpload	Grants permission to abort a multipart upload	object
CreateBucket	Grants permission to create a new bucket	bucket
DeleteBucket	Grants permission to delete the bucket named in the URI	bucket
DeleteObject	Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object	object
DeleteObjectVersion	Grants permission to remove a specific version of an object	object
GetBucketLocation	Grants permission to return the Region that an Amazon S3 bucket resides in	bucket
GetBucketVersioning	Grants permission to return the versioning state of an Amazon S3 bucket	bucket
GetObject	Grants permission to retrieve objects from Amazon S3	object
GetObjectVersion	Grants permission to retrieve a specific version of an object	object
ListAllMyBuckets	Grants permission to list all buckets owned by the authenticated sender of the request
ListBucket	Grants permission to list some or all of the objects in an Amazon S3 bucket (up to 1000)	bucket
ListBucketMultipartUploads	Grants permission to list in-progress multipart uploads	bucket
ListBucketVersions	Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket	bucket
ListMultipartUploadParts	Grants permission to list the parts that have been uploaded for a specific multipart upload	object
PutBucketVersioning	Grants permission to set the versioning state of an existing Amazon S3 bucket	bucket
PutObject	Grants permission to add an object to a bucket	object

STS

Action	Description	Resource types	Condition keys
AssumeRoleWithWebIdentity	Grants permission to obtain a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider	role
LoginWithWebIdentity	Grants permission to obtain a set of temporary security credentials for users who have been authenticated using the Astran builtin identity provider	user
TagSession	Grants permission to add tags to a STS session	user