AWS Network Security Manager (network-security-manager)

Additions

Actions

• CreateDeployment
  
  • Description:  Grants permission to create a deployment
  • Access:  Write
  • Resources: 

    Name: policy

    Required: Yes

    Name: policy-snapshot

    Required: Yes

    Name: scope

    Required: Yes

    Name: scope-snapshot

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateDeploymentSnapshot
  
  • Description:  Grants permission to create a snapshot of a deployment
  • Access:  Write
  • Resources: 

    Name: deployment

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreatePolicy
  
  • Description:  Grants permission to create a policy
  • Access:  Write
  • Resources: 

    Name: rule

    Required: No

    Name: rule-snapshot

    Required: No

    Name: template

    Required: No

    Name: template-snapshot

    Required: No

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreatePolicySnapshot
  
  • Description:  Grants permission to create a snapshot of a policy
  • Access:  Write
  • Resources: 

    Name: policy

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateRule
  
  • Description:  Grants permission to create a rule
  • Access:  Write
  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateRuleSnapshot
  
  • Description:  Grants permission to create a snapshot of a rule
  • Access:  Write
  • Resources: 

    Name: rule

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateScope
  
  • Description:  Grants permission to create a scope
  • Access:  Write
  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateScopeSnapshot
  
  • Description:  Grants permission to create a snapshot of a scope
  • Access:  Write
  • Resources: 

    Name: scope

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateTemplate
  
  • Description:  Grants permission to create a template
  • Access:  Write
  • Resources: 

    Name: rule

    Required: Yes

    Name: rule-snapshot

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateTemplateSnapshot
  
  • Description:  Grants permission to create a snapshot of a template
  • Access:  Write
  • Resources: 

    Name: template

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• DeleteAdminAccount
  
  • Description:  Grants permission to remove a Network Security Manager administrator account
  • Access:  Write
• DeleteDeployment
  
  • Description:  Grants permission to delete a deployment
  • Access:  Write
  • Resources: 

    Name: deployment

    Required: Yes

    Name: deployment-snapshot

    Required: Yes

• DeletePolicy
  
  • Description:  Grants permission to delete a policy
  • Access:  Write
  • Resources: 

    Name: policy

    Required: Yes

    Name: policy-snapshot

    Required: Yes

• DeleteRule
  
  • Description:  Grants permission to delete a rule
  • Access:  Write
  • Resources: 

    Name: rule

    Required: Yes

    Name: rule-snapshot

    Required: Yes

• DeleteScope
  
  • Description:  Grants permission to delete a scope
  • Access:  Write
  • Resources: 

    Name: scope

    Required: Yes

    Name: scope-snapshot

    Required: Yes

• DeleteTemplate
  
  • Description:  Grants permission to delete a template
  • Access:  Write
  • Resources: 

    Name: template

    Required: Yes

    Name: template-snapshot

    Required: Yes

• GenerateRuleConfiguration
  
  • Description:  Grants permission to generate a rule configuration from a natural-language prompt
  • Access:  Write
• GetAdminAccount
  
  • Description:  Grants permission to retrieve a Network Security Manager administrator account
  • Access:  Read
• GetDeployment
  
  • Description:  Grants permission to retrieve a deployment
  • Access:  Read
  • Resources: 

    Name: deployment

    Required: Yes

    Name: deployment-snapshot

    Required: Yes

• GetPolicy
  
  • Description:  Grants permission to retrieve a policy
  • Access:  Read
  • Resources: 

    Name: policy

    Required: Yes

    Name: policy-snapshot

    Required: Yes

• GetRule
  
  • Description:  Grants permission to retrieve a rule
  • Access:  Read
  • Resources: 

    Name: rule

    Required: Yes

    Name: rule-snapshot

    Required: Yes

• GetScope
  
  • Description:  Grants permission to retrieve a scope
  • Access:  Read
  • Resources: 

    Name: scope

    Required: Yes

    Name: scope-snapshot

    Required: Yes

• GetTemplate
  
  • Description:  Grants permission to retrieve a template
  • Access:  Read
  • Resources: 

    Name: template

    Required: Yes

    Name: template-snapshot

    Required: Yes

• ListAdminAccounts
  
  • Description:  Grants permission to list Network Security Manager administrator accounts
  • Access:  List
• ListAggregateResourceSynchronizationStatuses
  
  • Description:  Grants permission to list aggregate resource synchronization statuses across the caller's deployments
  • Access:  Read
• ListDeploymentSnapshots
  
  • Description:  Grants permission to list the snapshots of a deployment
  • Access:  Read
  • Resources: 

    Name: deployment

    Required: Yes

• ListDeployments
  
  • Description:  Grants permission to list deployments
  • Access:  List
• ListPolicies
  
  • Description:  Grants permission to list policies
  • Access:  List
• ListPolicySnapshots
  
  • Description:  Grants permission to list the snapshots of a policy
  • Access:  Read
  • Resources: 

    Name: policy

    Required: Yes

• ListResourceAssociations
  
  • Description:  Grants permission to list the associations of a Network Security Manager resource
  • Access:  Read
  • Resources: 

    Name: deployment

    Required: Yes

    Name: deployment-snapshot

    Required: Yes

    Name: policy

    Required: Yes

    Name: policy-snapshot

    Required: Yes

    Name: rule

    Required: Yes

    Name: rule-snapshot

    Required: Yes

    Name: scope

    Required: Yes

    Name: scope-snapshot

    Required: Yes

    Name: template

    Required: Yes

    Name: template-snapshot

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ListResourceSynchronizationStatuses
  
  • Description:  Grants permission to list resource synchronization statuses for a deployment
  • Access:  Read
  • Resources: 

    Name: deployment

    Required: Yes

    Name: deployment-snapshot

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ListRuleSnapshots
  
  • Description:  Grants permission to list the snapshots of a rule
  • Access:  Read
  • Resources: 

    Name: rule

    Required: Yes

• ListRules
  
  • Description:  Grants permission to list rules
  • Access:  List
• ListScopeSnapshots
  
  • Description:  Grants permission to list the snapshots of a scope
  • Access:  Read
  • Resources: 

    Name: scope

    Required: Yes

• ListScopes
  
  • Description:  Grants permission to list scopes
  • Access:  List
• ListTagsForResource
  
  • Description:  Grants permission to list the tags of a Network Security Manager resource
  • Access:  Read
  • Resources: 

    Name: deployment

    Required: No

    Name: deployment-snapshot

    Required: No

    Name: policy

    Required: No

    Name: policy-snapshot

    Required: No

    Name: rule

    Required: No

    Name: rule-snapshot

    Required: No

    Name: scope

    Required: No

    Name: scope-snapshot

    Required: No

    Name: template

    Required: No

    Name: template-snapshot

    Required: No

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ListTemplateSnapshots
  
  • Description:  Grants permission to list the snapshots of a template
  • Access:  Read
  • Resources: 

    Name: template

    Required: Yes

• ListTemplates
  
  • Description:  Grants permission to list templates
  • Access:  List
• PutAdminAccount
  
  • Description:  Grants permission to set a Network Security Manager administrator account
  • Access:  Write
• TagResource
  
  • Description:  Grants permission to add or overwrite tags on a Network Security Manager resource
  • Access:  Tagging
  • Resources: 

    Name: deployment

    Required: No

    Name: deployment-snapshot

    Required: No

    Name: policy

    Required: No

    Name: policy-snapshot

    Required: No

    Name: rule

    Required: No

    Name: rule-snapshot

    Required: No

    Name: scope

    Required: No

    Name: scope-snapshot

    Required: No

    Name: template

    Required: No

    Name: template-snapshot

    Required: No

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:ResourceTag/${TagKey}

    aws:TagKeys

• UntagResource
  
  • Description:  Grants permission to remove tags from a Network Security Manager resource
  • Access:  Tagging
  • Resources: 

    Name: deployment

    Required: No

    Name: deployment-snapshot

    Required: No

    Name: policy

    Required: No

    Name: policy-snapshot

    Required: No

    Name: rule

    Required: No

    Name: rule-snapshot

    Required: No

    Name: scope

    Required: No

    Name: scope-snapshot

    Required: No

    Name: template

    Required: No

    Name: template-snapshot

    Required: No

  • Conditions: 

    aws:ResourceTag/${TagKey}

    aws:TagKeys

• UpdateDeployment
  
  • Description:  Grants permission to update a deployment
  • Access:  Write
  • Resources: 

    Name: deployment

    Required: Yes

    Name: policy

    Required: No

    Name: policy-snapshot

    Required: No

    Name: scope

    Required: No

    Name: scope-snapshot

    Required: No

• UpdatePolicy
  
  • Description:  Grants permission to update a policy
  • Access:  Write
  • Resources: 

    Name: policy

    Required: Yes

    Name: rule

    Required: No

    Name: rule-snapshot

    Required: No

    Name: template

    Required: No

    Name: template-snapshot

    Required: No

• UpdateRule
  
  • Description:  Grants permission to update a rule
  • Access:  Write
  • Resources: 

    Name: rule

    Required: Yes

• UpdateScope
  
  • Description:  Grants permission to update a scope
  • Access:  Write
  • Resources: 

    Name: scope

    Required: Yes

• UpdateTemplate
  
  • Description:  Grants permission to update a template
  • Access:  Write
  • Resources: 

    Name: rule

    Required: No

    Name: rule-snapshot

    Required: No

    Name: template

    Required: Yes

Resources

• deployment
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:deployment:${DeploymentId}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• deployment-snapshot
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:deployment:${DeploymentId}:${VersionNumber}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• policy
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:policy:${PolicyId}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• policy-snapshot
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:policy:${PolicyId}:${VersionNumber}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• rule
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:rule:${RuleId}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• rule-snapshot
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:rule:${RuleId}:${VersionNumber}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• scope
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:scope:${ScopeId}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• scope-snapshot
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:scope:${ScopeId}:${VersionNumber}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• template
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:template:${TemplateId}
  • Conditions: 

    aws:ResourceTag/${TagKey}

• template-snapshot
  
  • Arn:  arn:${Partition}:network-security-manager:${Region}:${Account}:template:${TemplateId}:${VersionNumber}
  • Conditions: 

    aws:ResourceTag/${TagKey}

Conditions

• aws:RequestTag/${TagKey}
  
  • Description:  Filters access by the tags that are passed in the request
  • Type:  String
• aws:ResourceTag/${TagKey}
  
  • Description:  Filters access by the tags associated with the resource
  • Type:  String
• aws:TagKeys
  
  • Description:  Filters access by the tag keys that are passed in the request
  • Type:  ArrayOfString