Description: Lists all of the available service-specific resources, actions, and condition keys that can be used in IAM policies to control access to Amazon Pinpoint.

Actions, resources, and condition keys for Amazon Pinpoint - Service Authorization Reference

# Actions, resources, and condition keys for Amazon Pinpoint

Amazon Pinpoint (service prefix: `mobiletargeting` ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service .

- View a list of the API operations available for this service .

- Learn how to secure this service and its resources by using IAM permission policies.

###### Topics

- Actions defined by Amazon Pinpoint
- Resource types defined by Amazon Pinpoint
- Condition keys for Amazon Pinpoint

## Actions defined by Amazon Pinpoint

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the `Resource` element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's `Condition` element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

For details about the columns in the following table, see Actions table .

Actions | Description | Access level | Resource types (*required) | Condition keys | Dependent actions
--- | --- | --- | --- | --- | ---
CreateApp | Grants permission to create an app | Write | apps* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateCampaign | Grants permission to create a campaign for an app | Write | app* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateEmailTemplate | Grants permission to create an email template | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateExportJob | Grants permission to create an export job that exports endpoint definitions to Amazon S3 | Write | app* |  |
CreateImportJob | Grants permission to import endpoint definitions from to create a segment | Write | app* |  |
CreateInAppTemplate | Grants permission to create an in-app message template | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateJourney | Grants permission to create a Journey for an app | Write | journeys* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreatePushTemplate | Grants permission to create a push notification template | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateRecommenderConfiguration | Grants permission to create an Amazon Pinpoint configuration for a recommender model | Write | recommenders* |  |
CreateSegment | Grants permission to create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action | Write | app* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateSmsTemplate | Grants permission to create an sms message template | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateVoiceTemplate | Grants permission to create a voice message template | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
DeleteAdmChannel | Grants permission to delete the ADM channel for an app | Write | channel* |  |
DeleteApnsChannel | Grants permission to delete the APNs channel for an app | Write | channel* |  |
DeleteApnsSandboxChannel | Grants permission to delete the APNs sandbox channel for an app | Write | channel* |  |
DeleteApnsVoipChannel | Grants permission to delete the APNs VoIP channel for an app | Write | channel* |  |
DeleteApnsVoipSandboxChannel | Grants permission to delete the APNs VoIP sandbox channel for an app | Write | channel* |  |
DeleteApp | Grants permission to delete a specific campaign | Write | app* |  |
DeleteBaiduChannel | Grants permission to delete the Baidu channel for an app | Write | channel* |  |
DeleteCampaign | Grants permission to delete a specific campaign | Write | campaign* |  |
DeleteEmailChannel | Grants permission to delete the email channel for an app | Write | channel* |  |
DeleteEmailTemplate | Grants permission to delete an email template or an email template version | Write | template* |  |
DeleteEndpoint | Grants permission to delete an endpoint | Write | endpoint* |  |
DeleteEventStream | Grants permission to delete the event stream for an app | Write | event-stream* |  |
DeleteGcmChannel | Grants permission to delete the GCM channel for an app | Write | channel* |  |
DeleteInAppTemplate | Grants permission to delete an in-app message template or an in-app message template version | Write | template* |  |
DeleteJourney | Grants permission to delete a specific journey | Write | journey* |  |
DeletePushTemplate | Grants permission to delete a push notification template or a push notification template version | Write | template* |  |
DeleteRecommenderConfiguration | Grants permission to delete an Amazon Pinpoint configuration for a recommender model | Write | recommender* |  |
DeleteSegment | Grants permission to delete a specific segment | Write | segment* |  |
DeleteSmsChannel | Grants permission to delete the SMS channel for an app | Write | channel* |  |
DeleteSmsTemplate | Grants permission to delete an sms message template or an sms message template version | Write | template* |  |
DeleteUserEndpoints | Grants permission to delete all of the endpoints that are associated with a user ID | Write | user* |  |
DeleteVoiceChannel | Grants permission to delete the Voice channel for an app | Write | channel* |  |
DeleteVoiceTemplate | Grants permission to delete a voice message template or a voice message template version | Write | template* |  |
GetAdmChannel | Grants permission to retrieve information about the Amazon Device Messaging (ADM) channel for an app | Read | channel* |  |
GetApnsChannel | Grants permission to retrieve information about the APNs channel for an app | Read | channel* |  |
GetApnsSandboxChannel | Grants permission to retrieve information about the APNs sandbox channel for an app | Read | channel* |  |
GetApnsVoipChannel | Grants permission to retrieve information about the APNs VoIP channel for an app | Read | channel* |  |
GetApnsVoipSandboxChannel | Grants permission to retrieve information about the APNs VoIP sandbox channel for an app | Read | channel* |  |
GetApp | Grants permission to retrieve information about a specific app in your Amazon Pinpoint account | Read | app* |  |
GetApplicationDateRangeKpi | Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to an application | Read | application-metrics* |  |
GetApplicationSettings | Grants permission to retrieve the default settings for an app | List | app* |  |
GetApps | Grants permission to retrieve a list of apps in your Amazon Pinpoint account | Read | apps* |  |
GetBaiduChannel | Grants permission to retrieve information about the Baidu channel for an app | Read | channel* |  |
GetCampaign | Grants permission to retrieve information about a specific campaign | Read | campaign* |  |
GetCampaignActivities | Grants permission to retrieve information about the activities performed by a campaign | List | campaign* |  |
GetCampaignDateRangeKpi | Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to a campaign | Read | campaign-metrics* |  |
GetCampaignVersion | Grants permission to retrieve information about a specific campaign version | Read | campaign* |  |
GetCampaignVersions | Grants permission to retrieve information about the current and prior versions of a campaign | List | campaign* |  |
GetCampaigns | Grants permission to retrieve information about all campaigns for an app | List | app* |  |
GetChannels | Grants permission to get all channels information for your app | List | channels* |  |
GetEmailChannel | Grants permission to obtain information about the email channel in an app | Read | channel* |  |
GetEmailTemplate | Grants permission to retrieve information about a specific or the active version of an email template | Read | template* |  |
GetEndpoint | Grants permission to retrieve information about a specific endpoint | Read | endpoint* |  |
GetEventStream | Grants permission to retrieve information about the event stream for an app | Read | event-stream* |  |
GetExportJob | Grants permission to obtain information about a specific export job | Read | export-job* |  |
GetExportJobs | Grants permission to retrieve a list of all of the export jobs for an app | List | app* |  |
GetGcmChannel | Grants permission to retrieve information about the GCM channel for an app | Read | channel* |  |
GetImportJob | Grants permission to retrieve information about a specific import job | Read | import-job* |  |
GetImportJobs | Grants permission to retrieve information about all import jobs for an app | List | app* |  |
GetInAppMessages | Grants permission to retrive in-app messages for the given endpoint id | Read | app* |  |
GetInAppTemplate | Grants permission to retrieve information about a specific or the active version of an in-app message template | Read | template* |  |
GetJourney | Grants permission to retrieve information about a specific journey | Read | journey* |  |
GetJourneyDateRangeKpi | Grants permission to retrieve (queries) pre-aggregated data for a standard engagement metric that applies to a journey | Read | journey-metrics* |  |
GetJourneyExecutionActivityMetrics | Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity | Read | journey-execution-activity-metrics* |  |
GetJourneyExecutionMetrics | Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey | Read | journey-execution-metrics* |  |
GetJourneyRunExecutionActivityMetrics | Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity for a single journey run | Read | journey* |  |
GetJourneyRunExecutionMetrics | Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey for a single journey run | Read | journey* |  |
GetJourneyRuns | Grants permission to retrieve information about all journey runs for a journey | List | journey* |  |
GetPushTemplate | Grants permission to retrieve information about a specific or the active version of an push notification template | Read | template* |  |
GetRecommenderConfiguration | Grants permission to retrieve information about an Amazon Pinpoint configuration for a recommender model | Read | recommender* |  |
GetRecommenderConfigurations | Grants permission to retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account | List | recommenders* |  |
GetReports [permission only] | Grants permission to mobiletargeting:GetReports | Read | reports* |  |
GetSegment | Grants permission to retrieve information about a specific segment | Read | segment* |  |
GetSegmentExportJobs | Grants permission to retrieve information about jobs that export endpoint definitions from segments to Amazon S3 | List | segment* |  |
GetSegmentImportJobs | Grants permission to retrieve information about jobs that create segments by importing endpoint definitions from | List | segment* |  |
GetSegmentVersion | Grants permission to retrieve information about a specific segment version | Read | segment* |  |
GetSegmentVersions | Grants permission to retrieve information about the current and prior versions of a segment | List | segment* |  |
GetSegments | Grants permission to retrieve information about the segments for an app | List | app* |  |
GetSmsChannel | Grants permission to obtain information about the SMS channel in an app | Read | channel* |  |
GetSmsTemplate | Grants permission to retrieve information about a specific or the active version of an sms message template | Read | template* |  |
GetUserEndpoints | Grants permission to retrieve information about the endpoints that are associated with a user ID | Read | user* |  |
GetVoiceChannel | Grants permission to obtain information about the Voice channel in an app | Read | channel* |  |
GetVoiceTemplate | Grants permission to retrieve information about a specific or the active version of a voice message template | Read | template* |  |
ListJourneys | Grants permission to retrieve information about all journeys for an app | List | app* |  |
ListTagsForResource | Grants permission to list tags for a resource | Read | app |  |
campaign |  |
journey |  |
segment |  |
template |  |
ListTemplateVersions | Grants permission to retrieve all versions about a specific template | List | template* |  |
ListTemplates | Grants permission to retrieve metadata about the queried templates | List | templates* |  |
PhoneNumberValidate | Grants permission to obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider | Read | phone-number-validate* |  |
PutEventStream | Grants permission to create or update an event stream for an app | Write | event-stream* |  |
PutEvents | Grants permission to create or update events for an app | Write | events* |  |
RemoveAttributes | Grants permission to remove the attributes for an app | Write | attribute* |  |
SendMessages | Grants permission to send an SMS message or push notification to specific endpoints | Write | messages* |  |
SendOTPMessage | Grants permission to send an OTP code to a user of your application | Write | otp* |  |
SendUsersMessages | Grants permission to send an SMS message or push notification to all endpoints that are associated with a specific user ID | Write | messages* |  |
TagResource | Grants permission to add tags to a resource | Tagging | app |  |
campaign |  |
journey |  |
segment |  |
template |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UntagResource | Grants permission to remove tags from a resource | Tagging | app |  |
campaign |  |
journey |  |
segment |  |
template |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateAdmChannel | Grants permission to update the Amazon Device Messaging (ADM) channel for an app | Write | channel* |  |
UpdateApnsChannel | Grants permission to update the Apple Push Notification service (APNs) channel for an app | Write | channel* |  |
UpdateApnsSandboxChannel | Grants permission to update the Apple Push Notification service (APNs) sandbox channel for an app | Write | channel* |  |
UpdateApnsVoipChannel | Grants permission to update the Apple Push Notification service (APNs) VoIP channel for an app | Write | channel* |  |
UpdateApnsVoipSandboxChannel | Grants permission to update the Apple Push Notification service (APNs) VoIP sandbox channel for an app | Write | channel* |  |
UpdateApplicationSettings | Grants permission to update the default settings for an app | Write | app* |  |
UpdateBaiduChannel | Grants permission to update the Baidu channel for an app | Write | channel* |  |
UpdateCampaign | Grants permission to update a specific campaign | Write | campaign* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateEmailChannel | Grants permission to update the email channel for an app | Write | channel* |  |
UpdateEmailTemplate | Grants permission to update a specific email template under the same version or generate a new version | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateEndpoint | Grants permission to create an endpoint or update the information for an endpoint | Write | endpoint* |  |
UpdateEndpointsBatch | Grants permission to create or update endpoints as a batch operation | Write | app* |  |
UpdateGcmChannel | Grants permission to update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app | Write | channel* |  |
UpdateInAppTemplate | Grants permission to update a specific in-app message template under the same version or generate a new version | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateJourney | Grants permission to update a specific journey | Write | journey* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateJourneyState | Grants permission to update a specific journey state | Write | journey* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdatePushTemplate | Grants permission to update a specific push notification template under the same version or generate a new version | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateRecommenderConfiguration | Grants permission to update an Amazon Pinpoint configuration for a recommender model | Write | recommender* |  |
UpdateSegment | Grants permission to update a specific segment | Write | segment* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateSmsChannel | Grants permission to update the SMS channel for an app | Write | channel* |  |
UpdateSmsTemplate | Grants permission to update a specific sms message template under the same version or generate a new version | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateTemplateActiveVersion | Grants permission to update the active version parameter of a specific template | Write | template* |  |
UpdateVoiceChannel | Grants permission to update the Voice channel for an app | Write | channel* |  |
UpdateVoiceTemplate | Grants permission to update a specific voice message template under the same version or generate a new version | Write | template* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
VerifyOTPMessage | Grants permission to check the validity of One-Time Passwords (OTPs) | Write | verify-otp* |  |

## Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table .

Resource types | ARN | Condition keys
--- | --- | ---
app | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}` | aws:ResourceTag/${TagKey}
apps | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/*` |
campaign | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/campaigns/$ { CampaignId}` | aws:ResourceTag/${TagKey}
journey | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/journeys/$ { JourneyId}` | aws:ResourceTag/${TagKey}
journeys | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/journeys` |
segment | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/segments/$ { SegmentId}` | aws:ResourceTag/${TagKey}
template | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:templates/$ { TemplateName}/$ { TemplateType}` | aws:ResourceTag/${TagKey}
templates | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:templates` |
recommender | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:recommenders/$ { RecommenderId}` |
recommenders | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:recommenders/*` |
phone-number-validate | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:phone/number/validate` |
channels | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/channels` |
channel | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/channels/$ { ChannelType}` |
event-stream | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/eventstream` |
events | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/events` |
messages | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/messages` |
verify-otp | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/verify-otp` |
otp | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/otp` |
attribute | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/attributes/$ { AttributeType}` |
user | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/users/$ { UserId}` |
endpoint | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/endpoints/$ { EndpointId}` |
import-job | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/jobs/import/$ { JobId}` |
export-job | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/jobs/export/$ { JobId}` |
application-metrics | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/kpis/daterange/$ { KpiName}` |
campaign-metrics | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/campaigns/$ { CampaignId}/kpis/daterange/$ { KpiName}` |
journey-metrics | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/journeys/$ { JourneyId}/kpis/daterange/$ { KpiName}` |
journey-execution-metrics | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/journeys/$ { JourneyId}/execution-metrics` |
journey-execution-activity-metrics | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/journeys/$ { JourneyId}/activities/$ { JourneyActivityId}/execution-metrics` |
reports | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:reports` |

## Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table .

To view the global condition keys that are available to all services, see Available global condition keys .

Condition keys | Description | Type
--- | --- | ---
aws:RequestTag/${TagKey} | Filters access by a key that is present in the request the user makes to the pinpoint service | String
aws:ResourceTag/${TagKey} | Filters access by a tag key and value pair | String
aws:TagKeys | Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service | ArrayOfString

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.