Actions, Resources, and Condition Keys for Amazon Storage Gateway - AWS Identity and Access Management
Keywords: IAM,AWS Identity and Access Management,IAM user,user,IAM group,group,IAM role,role,permission policy,trust policy,policy,access key,password

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.

# Actions, Resources, and Condition Keys for Amazon Storage Gateway

Amazon Storage Gateway (service prefix: `storagegateway` ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service .

- View a list of the API operations available for this service .

- Learn how to secure this service and its resources by using IAM permission policies.

Topics

- Actions Defined by Amazon Storage Gateway
- Resource Types Defined by Amazon Storage Gateway
- Condition Keys for Amazon Storage Gateway

## Actions Defined by Amazon Storage Gateway

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource Types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The Actions Table .

Actions | Description | Access Level | Resource Types (*required) | Condition Keys | Dependent Actions
--- | --- | --- | --- | --- | ---
ActivateGateway | This operation activates the gateway you previously deployed on your host. | Write |  | aws:RequestTag/${TagKey} aws:TagKeys |
AddCache | This operation configures one or more gateway local disks as cache for a cached-volume gateway. | Write | gateway* |  |
AddTagsToResource | This operation adds one or more tags to the specified resource. | Tagging | gateway |  |
share |  |
tape |  |
volume |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
AddUploadBuffer | This operation configures one or more gateway local disks as upload buffer for a specified gateway. | Write | gateway* |  |
AddWorkingStorage | This operation configures one or more gateway local disks as working storage for a gateway. | Write | gateway* |  |
AttachVolume | This operation connects a volume to an iSCSI connection and then attaches the volume to the specified gateway. | Write | gateway* |  |
volume* |  |
CancelArchival | Cancels archiving of a virtual tape to the virtual tape shelf (VTS) after the archiving process is initiated. | Write | gateway* |  |
tape* |  |
CancelRetrieval | Cancels retrieval of a virtual tape from the virtual tape shelf (VTS) to a gateway after the retrieval process is initiated. | Write | gateway* |  |
tape* |  |
CreateCachediSCSIVolume | This operation creates a cached volume on a specified cached gateway. This operation is supported only for the gateway-cached volume architecture. | Write | gateway* |  |
volume* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateNFSFileShare | This operation creates a NFS file share on an existing file gateway. | Write | gateway* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateSMBFileShare | This operation creates a SMB file share on an existing file gateway. | Write | gateway* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateSnapshot | This operation initiates a snapshot of a volume. | Write | volume* |  |
CreateSnapshotFromVolumeRecoveryPoint | This operation initiates a snapshot of a gateway from a volume recovery point. | Write | volume* |  |
CreateStorediSCSIVolume | This operation creates a volume on a specified gateway. | Write | gateway* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateTapeWithBarcode | Creates a virtual tape by using your own barcode. | Write | gateway* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateTapes | Creates one or more virtual tapes. You write data to the virtual tapes and then archive the tapes. | Write | gateway* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
DeleteBandwidthRateLimit | This operation deletes the bandwidth rate limits of a gateway. | Write | gateway* |  |
DeleteChapCredentials | This operation deletes Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target and initiator pair. | Write | target* |  |
DeleteFileShare | This operation deletes a file share from a file gateway. | Write | share* |  |
DeleteGateway | This operation deletes a gateway. | Write | gateway* |  |
DeleteSnapshotSchedule | This operation deletes a snapshot of a volume. | Write | volume* |  |
DeleteTape | Deletes the specified virtual tape. | Write | gateway* |  |
tape* |  |
DeleteTapeArchive | Deletes the specified virtual tape from the virtual tape shelf (VTS). | Write |  |  |
DeleteVolume | This operation deletes the specified gateway volume that you previously created using the CreateCachediSCSIVolume or CreateStorediSCSIVolume API. | Write | volume* |  |
DescribeBandwidthRateLimit | This operation returns the bandwidth rate limits of a gateway. | Read | gateway* |  |
DescribeCache | This operation returns information about the cache of a gateway. This operation is supported only for the gateway-cached volume architecture. | Read | gateway* |  |
DescribeCachediSCSIVolumes | This operation returns a description of the gateway volumes specified in the request. This operation is supported only for the gateway-cached volume architecture. | Read | volume* |  |
DescribeChapCredentials | This operation returns an array of Challenge-Handshake Authentication Protocol (CHAP) credentials information for a specified iSCSI target, one for each target-initiator pair. | Read | target* |  |
DescribeGatewayInformation | This operation returns metadata about a gateway such as its name, network interfaces, configured time zone, and the state (whether the gateway is running or not). | Read | gateway* |  |
DescribeMaintenanceStartTime | This operation returns your gateway's weekly maintenance start time including the day and time of the week. | Read | gateway* |  |
DescribeNFSFileShares | This operation gets a description for one or more file shares from a file gateway. | Read | share* |  |
DescribeSMBFileShares | This operation gets a description for one or more file shares from a file gateway. | Read | share* |  |
DescribeSMBSettings | This operation gets a description of a Server Message Block (SMB) file share settings from a file gateway. | Read | gateway* |  |
DescribeSnapshotSchedule | This operation describes the snapshot schedule for the specified gateway volume. | Read | volume* |  |
DescribeStorediSCSIVolumes | This operation returns the description of the gateway volumes specified in the request. | Read | volume* |  |
DescribeTapeArchives | Returns a description of specified virtual tapes in the virtual tape shelf (VTS). | Read |  |  |
DescribeTapeRecoveryPoints | Returns a list of virtual tape recovery points that are available for the specified gateway-VTL. | Read | gateway* |  |
DescribeTapes | Returns a description of the specified Amazon Resource Name (ARN) of virtual tapes. | Read | gateway* |  |
DescribeUploadBuffer | This operation returns information about the upload buffer of a gateway. | Read | gateway* |  |
DescribeVTLDevices | Returns a description of virtual tape library (VTL) devices for the specified gateway. | Read | gateway* |  |
DescribeWorkingStorage | This operation returns information about the working storage of a gateway. | Read | gateway* |  |
DetachVolume | This operation disconnects a volume from an iSCSI connection and then detaches the volume from the specified gateway. | Write | volume* |  |
DisableGateway | Disables a gateway when the gateway is no longer functioning. | Write | gateway* |  |
JoinDomain | This operation enables you to join an Active Directory Domain. | Write | gateway* |  |
ListFileShares | This operation gets a list of the file shares for a specific file gateway, or the list of file shares that belong to the calling user account. | List | gateway* |  |
ListGateways | This operation lists gateways owned by an AWS account in a region specified in the request. The returned list is ordered by gateway Amazon Resource Name (ARN). | List |  |  |
ListLocalDisks | This operation returns a list of the gateway's local disks. | List | gateway* |  |
ListTagsForResource | This operation lists the tags that have been added to the specified resource. | Read | gateway |  |
share |  |
tape |  |
volume |  |
ListTapes | Lists virtual tapes in your virtual tape library (VTL) and your virtual tape shelf (VTS). | Read | tape* |  |
ListVolumeInitiators | This operation lists iSCSI initiators that are connected to a volume. | Read | volume* |  |
ListVolumeRecoveryPoints | This operation lists the recovery points for a specified gateway. | List | gateway* |  |
ListVolumes | This operation lists the iSCSI stored volumes of a gateway. | List | gateway* |  |
NotifyWhenUploaded | This action sends you a notification through CloudWatch Events when all files written to your NFS file share have been uploaded to Amazon S3. | Write | share* |  |
RefreshCache | This operation refreshes the cache for the specified file share. | Write | share* |  |
RemoveTagsFromResource | This operation removes one or more tags from the specified resource. | Tagging | gateway |  |
share |  |
tape |  |
volume |  |
| aws:TagKeys |
ResetCache | This operation resets all cache disks that have encountered a error and makes the disks available for reconfiguration as cache storage. | Write | gateway* |  |
RetrieveTapeArchive | Retrieves an archived virtual tape from the virtual tape shelf (VTS) to a gateway-VTL. | Write | gateway* |  |
tape* |  |
RetrieveTapeRecoveryPoint | Retrieves the recovery point for the specified virtual tape. | Write | gateway* |  |
tape* |  |
SetLocalConsolePassword | Sets the password for your VM local console. | Write | gateway* |  |
SetSMBGuestPassword | Sets the password for SMB Guest user. | Write | gateway* |  |
ShutdownGateway | This operation shuts down a gateway. | Write | gateway* |  |
StartGateway | This operation starts a gateway that you previously shut down. | Write | gateway* |  |
UpdateBandwidthRateLimit | This operation updates the bandwidth rate limits of a gateway. | Write | gateway* |  |
UpdateChapCredentials | This operation updates the Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target. | Write | target* |  |
UpdateGatewayInformation | This operation updates a gateway's metadata, which includes the gateway's name and time zone. | Write | gateway* |  |
UpdateGatewaySoftwareNow | This operation updates the gateway virtual machine (VM) software. | Write | gateway* |  |
UpdateMaintenanceStartTime | This operation updates a gateway's weekly maintenance start time information, including day and time of the week. The maintenance time is the time in your gateway's time zone. | Write | gateway* |  |
UpdateNFSFileShare | This operation updates a NFS file share. | Write | share* |  |
UpdateSMBFileShare | This operation updates a SMB file share. | Write | share* |  |
UpdateSnapshotSchedule | This operation updates a snapshot schedule configured for a gateway volume. | Write | volume* |  |
UpdateVTLDeviceType | This operation updates the type of medium changer in a gateway-VTL. | Write | device* |  |

## Resource Types Defined by Amazon Storage Gateway

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table .

Resource Types | ARN | Condition Keys
--- | --- | ---
device | `arn:$ { Partition}:storagegateway:$ { Region}:$ { Account}:gateway/$ { GatewayId}/device/$ { Vtldevice}` |
gateway | `arn:$ { Partition}:storagegateway:$ { Region}:$ { Account}:gateway/$ { GatewayId}` | aws:ResourceTag/${TagKey}
share | `arn:$ { Partition}:storagegateway:$ { Region}:$ { Account}:share/$ { ShareId}` | aws:ResourceTag/${TagKey}
tape | `arn:$ { Partition}:storagegateway:$ { Region}:$ { Account}:gateway/$ { TapeBarcode}` | aws:ResourceTag/${TagKey}
target | `arn:$ { Partition}:storagegateway:$ { Region}:$ { Account}:gateway/$ { GatewayId}/target/$ { IscsiTarget}` |
volume | `arn:$ { Partition}:storagegateway:$ { Region}:$ { Account}:gateway/$ { GatewayId}/volume/$ { VolumeId}` | aws:ResourceTag/${TagKey}

## Condition Keys for Amazon Storage Gateway

Amazon Storage Gateway defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table .

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference .

Condition Keys | Description | Type
--- | --- | ---
aws:RequestTag/$ { TagKey} | Filters create requests based on the allowed set of values for each of the tags. | String
aws:ResourceTag/$ { TagKey} | Filters actions based on tag-value associated with the resource. | String
aws:TagKeys | Filters create requests based on the presence of mandatory tags in the request. | String