Description: Lists all of the available service-specific resources, actions, and condition keys that can be used in IAM policies to control access to Amazon Pinpoint.
Keywords: IAM,AWS Identity and Access Management,IAM user,user,IAM group,group,IAM role,role,permission policy,trust policy,policy,access key,password

Actions, resources, and condition keys for Amazon Pinpoint - AWS Identity and Access Management

# Actions, resources, and condition keys for Amazon Pinpoint

Tip

This page is moving to a new location on November 16, 2020. Please update your bookmark to use the new page at https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpoint.html .

Amazon Pinpoint (service prefix: `mobiletargeting` ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service .

- View a list of the API operations available for this service .

- Learn how to secure this service and its resources by using IAM permission policies.

Topics

- Actions defined by Amazon Pinpoint
- Resource types defined by Amazon Pinpoint
- Condition keys for Amazon Pinpoint

## Actions defined by Amazon Pinpoint

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table .

Actions | Description | Access level | Resource types (*required) | Condition keys | Dependent actions
--- | --- | --- | --- | --- | ---
CreateApp | Create an app. | Write |  | aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateCampaign | Create a campaign for an app. | Write | apps* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateEmailTemplate | Create an email template. | Write |  | aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateExportJob | Create an export job that exports endpoint definitions to Amazon S3. | Write | apps* |  |
CreateImportJob | Import endpoint definitions from to create a segment. | Write | apps* |  |
CreateJourney | Create a Journey for an app. | Write | apps* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreatePushTemplate | Create a push notification template. | Write |  | aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateRecommenderConfiguration | Create an Amazon Pinpoint configuration for a recommender model. | Write |  |  |
CreateSegment | Create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action. | Write | apps* |  |
| aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateSmsTemplate | Create an sms message template. | Write |  | aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
CreateVoiceTemplate | Create a voice message template. | Write |  | aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey} |
DeleteAdmChannel | Delete the ADM channel for an app. | Write | apps* |  |
DeleteApnsChannel | Delete the APNs channel for an app. | Write | apps* |  |
DeleteApnsSandboxChannel | Delete the APNs sandbox channel for an app. | Write | apps* |  |
DeleteApnsVoipChannel | Delete the APNs VoIP channel for an app. | Write | apps* |  |
DeleteApnsVoipSandboxChannel | Delete the APNs VoIP sandbox channel for an app. | Write | apps* |  |
DeleteApp | Delete a specific campaign. | Write | apps* |  |
DeleteBaiduChannel | Delete the Baidu channel for an app. | Write | apps* |  |
DeleteCampaign | Delete a specific campaign. | Write | apps* |  |
campaigns* |  |
DeleteEmailChannel | Delete the email channel for an app. | Write | apps* |  |
DeleteEmailTemplate | Delete an email template or an email template version. | Write | templates* |  |
DeleteEndpoint | Delete an endpoint. | Write | apps* |  |
DeleteEventStream | Delete the event stream for an app. | Write | apps* |  |
DeleteGcmChannel | Delete the GCM channel for an app. | Write | apps* |  |
DeleteJourney | Delete a specific journey. | Write | apps* |  |
journeys* |  |
DeletePushTemplate | Delete a push notification template or a push notification template version. | Write | templates* |  |
DeleteRecommenderConfiguration | Delete an Amazon Pinpoint configuration for a recommender model. | Write | recommenders* |  |
DeleteSegment | Delete a specific segment. | Write | apps* |  |
segments* |  |
DeleteSmsChannel | Delete the SMS channel for an app. | Write | apps* |  |
DeleteSmsTemplate | Delete an sms message template or an sms message template version. | Write | templates* |  |
DeleteUserEndpoints | Delete all of the endpoints that are associated with a user ID. | Write | apps* |  |
DeleteVoiceChannel | Delete the Voice channel for an app. | Write | apps* |  |
DeleteVoiceTemplate | Delete a voice message template or a voice message template version. | Write | templates* |  |
GetAdmChannel | Retrieve information about the Amazon Device Messaging (ADM) channel for an app. | Read | apps* |  |
GetApnsChannel | Retrieve information about the APNs channel for an app. | Read | apps* |  |
GetApnsSandboxChannel | Retrieve information about the APNs sandbox channel for an app. | Read | apps* |  |
GetApnsVoipChannel | Retrieve information about the APNs VoIP channel for an app. | Read | apps* |  |
GetApnsVoipSandboxChannel | Retrieve information about the APNs VoIP sandbox channel for an app. | Read | apps* |  |
GetApp | Retrieve information about a specific app in your Amazon Pinpoint account. | Read | apps* |  |
GetApplicationSettings | Retrieve the default settings for an app. | List | apps* |  |
GetApps | Retrieve a list of apps in your Amazon Pinpoint account. | List | apps* |  |
GetBaiduChannel | Retrieve information about the Baidu channel for an app. | Read | apps* |  |
GetCampaign | Retrieve information about a specific campaign. | Read | apps* |  |
campaigns* |  |
GetCampaignActivities | Retrieve information about the activities performed by a campaign. | List | apps* |  |
campaigns* |  |
GetCampaignVersion | Retrieve information about a specific campaign version. | Read | apps* |  |
campaigns* |  |
GetCampaignVersions | Retrieve information about the current and prior versions of a campaign. | List | apps* |  |
campaigns* |  |
GetCampaigns | Retrieve information about all campaigns for an app. | List | apps* |  |
GetChannels | Get all channels information for your app. | List | apps* |  |
GetEmailChannel | Obtain information about the email channel in an app. | Read | apps* |  |
GetEmailTemplate | Retrieve information about a specific or the active version of an email template. | Read | templates* |  |
GetEndpoint | Retrieve information about a specific endpoint. | Read | apps* |  |
GetEventStream | Retrieve information about the event stream for an app. | Read | apps* |  |
GetExportJob | Obtain information about a specific export job. | Read | apps* |  |
GetExportJobs | Retrieve a list of all of the export jobs for an app. | List | apps* |  |
GetGcmChannel | Retrieve information about the GCM channel for an app. | Read | apps* |  |
GetImportJob | Retrieve information about a specific import job. | Read | apps* |  |
GetImportJobs | Retrieve information about all import jobs for an app. | List | apps* |  |
GetJourney | Retrieve information about a specific journey. | Read | apps* |  |
journeys* |  |
GetPushTemplate | Retrieve information about a specific or the active version of an push notification template. | Read | templates* |  |
GetRecommenderConfiguration | Retrieve information about an Amazon Pinpoint configuration for a recommender model. | Read | recommenders* |  |
GetRecommenderConfigurations | Retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account. | List |  |  |
GetSegment | Retrieve information about a specific segment. | Read | apps* |  |
segments* |  |
GetSegmentExportJobs | Retrieve information about jobs that export endpoint definitions from segments to Amazon S3. | List | apps* |  |
segments* |  |
GetSegmentImportJobs | Retrieve information about jobs that create segments by importing endpoint definitions from . | List | apps* |  |
segments* |  |
GetSegmentVersion | Retrieve information about a specific segment version. | Read | apps* |  |
segments* |  |
GetSegmentVersions | Retrieve information about the current and prior versions of a segment. | List | apps* |  |
segments* |  |
GetSegments | Retrieve information about the segments for an app. | List | apps* |  |
GetSmsChannel | Obtain information about the SMS channel in an app. | Read | apps* |  |
GetSmsTemplate | Retrieve information about a specific or the active version of an sms message template. | Read | templates* |  |
GetUserEndpoints | Retrieve information about the endpoints that are associated with a user ID. | Read | apps* |  |
GetVoiceChannel | Obtain information about the Voice channel in an app. | Read | apps* |  |
GetVoiceTemplate | Retrieve information about a specific or the active version of a voice message template. | Read | templates* |  |
ListJourneys | Retrieve information about all journeys for an app. | List | apps* |  |
ListTagsForResource | List tags for a resource. | List | apps |  |
campaigns |  |
segments |  |
ListTemplateVersions | Retrieve all versions about a specific template. | List | templates* |  |
ListTemplates | Retrieve metadata about the queried templates. | List | templates* |  |
PhoneNumberValidate | Obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider. | Read | apps* |  |
PutEventStream | Create or update an event stream for an app. | Write | apps* |  |
PutEvents | Create or update events for an app. | Write | apps* |  |
RemoveAttributes | Used to remove the attributes for an app. | Write | apps* |  |
SendMessages | Send an SMS message or push notification to specific endpoints. | Write | apps* |  |
SendUsersMessages | Send an SMS message or push notification to all endpoints that are associated with a specific user ID. | Write | apps* |  |
TagResource | Adds tags to a resource. | Tagging | apps |  |
campaigns |  |
segments |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UntagResource | Removes tags from a resource. | Tagging | apps |  |
campaigns |  |
segments |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateAdmChannel | Update the Amazon Device Messaging (ADM) channel for an app. | Write | apps* |  |
UpdateApnsChannel | Update the Apple Push Notification service (APNs) channel for an app. | Write | apps* |  |
UpdateApnsSandboxChannel | Update the Apple Push Notification service (APNs) sandbox channel for an app. | Write | apps* |  |
UpdateApnsVoipChannel | Update the Apple Push Notification service (APNs) VoIP channel for an app. | Write | apps* |  |
UpdateApnsVoipSandboxChannel | Update the Apple Push Notification service (APNs) VoIP sandbox channel for an app. | Write | apps* |  |
UpdateApplicationSettings | Update the default settings for an app. | Write | apps* |  |
UpdateBaiduChannel | Update the Baidu channel for an app. | Write | apps* |  |
UpdateCampaign | Update a specific campaign. | Write | apps* |  |
campaigns* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateEmailChannel | Update the email channel for an app. | Write | apps* |  |
UpdateEmailTemplate | Update a specific email template under the same version or generate a new version. | Write | templates* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateEndpoint | Create an endpoint or update the information for an endpoint. | Write | apps* |  |
UpdateEndpointsBatch | Create or update endpoints as a batch operation. | Write | apps* |  |
UpdateGcmChannel | Update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app. | Write | apps* |  |
UpdateJourney | Update a specific journey. | Write | apps* |  |
journeys* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateJourneyState | Update a specific journey state. | Write | apps* |  |
journeys* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdatePushTemplate | Update a specific push notification template under the same version or generate a new version. | Write | templates* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateRecommenderConfiguration | Update an Amazon Pinpoint configuration for a recommender model. | Write | recommenders* |  |
UpdateSegment | Update a specific segment. | Write | apps* |  |
segments* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateSmsChannel | Update the SMS channel for an app. | Write | apps* |  |
UpdateSmsTemplate | Update a specific sms message template under the same version or generate a new version. | Write | templates* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateTemplateActiveVersion | Upate the active version parameter of a specific template. | Write | templates* |  |
UpdateVoiceChannel | Update the Voice channel for an app. | Write | apps* |  |
UpdateVoiceTemplate | Update a specific voice message template under the same version or generate a new version. | Write | templates* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |

## Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table .

Resource types | ARN | Condition keys
--- | --- | ---
apps | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}` | aws:ResourceTag/${TagKey}
campaigns | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/campaigns/$ { CampaignId}` | aws:ResourceTag/${TagKey}
journeys | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/journeys/$ { JourneyId}` | aws:ResourceTag/${TagKey}
segments | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:apps/$ { AppId}/segments/$ { SegmentId}` | aws:ResourceTag/${TagKey}
templates | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:templates/$ { TemplateName}/$ { ChannelType}` | aws:ResourceTag/${TagKey}
recommenders | `arn:$ { Partition}:mobiletargeting:$ { Region}:$ { Account}:recommenders/$ { RecommenderId}` |

## Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table .

To view the global condition keys that are available to all services, see Available global condition keys .

Condition keys | Description | Type
--- | --- | ---
aws:RequestTag/${TagKey} | Filters access by a key that is present in the request the user makes to the pinpoint service. | String
aws:ResourceTag/${TagKey} | Filters access by a tag key and value pair. | String
aws:TagKeys | Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service. | String

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.