Actions Defined by AWS IoT SiteWise Resources Defined by AWS IoT SiteWise Condition Keys for AWS IoT SiteWise

Actions, Resources, and Condition Keys for AWS IoT SiteWise

AWS IoT SiteWise (service prefix: iotsitewise ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions Defined by AWS IoT SiteWise

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The Actions Table .

Actions Description Access Level Resource Types (*required) Condition Keys Dependent Actions
AssociateAssets Associate child assets to the parent via specified model hiearchy. Write

asset*

AssociateViewEntities Associates the specified entities within a view for the specified group. Write

group*

view*

asset

BatchAssociateProjectAssets Grants permission to associate assets to a specified project. Write

project*

BatchDisassociateProjectAssets Grants permission to disassociate assets from a specified project. Write

project*

BatchPutAssetPropertyValue Puts batch of property values for the specified properties. Write

asset*

CreateAccessPolicy Grants permission to create access policy for a specified portal or a project. Permissions management

portal

project

CreateAsset Creates an asset. Write

asset-model*

CreateAssetModel Creates an asset model. Write
CreateAssetTemplate Creates an asset template. Write
CreateDashboard Grants permission to create a dashboard within a specified project. Write

project*

CreateGroup Creates a group. Write
CreateMeasurementDataStore Registers a measurement data store. Write
CreateMetricType Creates a metric type. Write
CreatePortal Grants permission to create a portal. Write

sso:CreateManagedApplicationInstance

CreateProject Grants permission to create a project within a specified portal. Write

portal*

CreateView Creates a view. Write
DeleteAccessPolicy Grants permission to delete a specified access policy. Permissions management

accesspolicy*

DeleteAsset Deletes the specified asset. Write

asset*

DeleteAssetModel Deletes the specified asset model. Write

asset-model*

DeleteAssetTemplate Deletes the specified asset template. Write

asset-template*

DeleteDashboard Grants permission to delete a specified dashboard. Write

dashboard*

DeleteGroup Deletes the specified group. Write

group*

DeleteMeasurementDataStore Deregisters the specified measurement data store. Write

measurement-data-store*

DeleteMetricType Deletes the specified metric type. Write

metric-type*

DeletePortal Grants permission to delete a specified portal. Write

portal*

sso:DeleteManagedApplicationInstance

DeleteProject Grants permission to delete a specified project. Write

project*

DeleteView Deletes the specified view. Write

view*

DeregisterViewEntities Deregisters the specified assets and groups from the specified view. Write

view*

asset

group

DescribeAccessPolicy Grants permission to describe a specified access policy. Permissions management

accesspolicy*

DescribeAsset Describes the specified asset. Read

asset*

DescribeAssetModel Describes the specified asset model. Read

asset-model*

DescribeAssetProperty Describes the specified asset property. Read

asset*

DescribeAssetTemplates Describes the specified asset templates. Read

asset-template*

DescribeAssets Describes the specified assets. Read

asset*

DescribeDashboard Grants permission to describe a specified dashboard. Read

dashboard*

DescribeGroups Describes the groups for the account. Read

group*

DescribeLoggingOptions Describes the logging options for the account. Read
DescribeMeasurementDataStores Describes the specified measurement data stores. Read

measurement-data-store*

DescribeMetricTypes Describes the metric types for the account. Read

metric-type*

DescribePortal Grants permission to describe a specified portal. Read

portal*

DescribeProject Grants permission to describe a specified project. Read

project*

DescribeViews Describes the specified views. Read

view*

DisassociateAssets Disassociate child assets from the parent for specified model hiearchy. Write

asset*

DisassociateViewEntities Disassociates the specified entities within a view for the specified group. Write

group*

view*

asset

GetAssetPropertyAggregates Fetches the aggregated property values for the specified property. Read

asset*

GetAssetPropertyValue Fetches the latest property value for the specified property. Read

asset*

GetAssetPropertyValueHistory Fetches the property value history for the specified property. Read

asset*

GetMeasurementData Fetches the measurement data for the specified measurement and time interval. Read

measurement*

GetMetricData Fetches the metric data for the specified metric and time interval. Read

metric*

ListAccessPolicies Grants permission to list access policies for a specified portal or a project. Permissions management

portal

project

ListAssetModels Lists the asset models for the account. List
ListAssetTemplates Lists the asset templates for the account. List
ListAssets Lists the assets for the account. List

asset-model

ListAssociatedAssets Lists the assets associated to the parent via specified model hiearchy. List

asset*

ListDashboards Grants permission to list dashboards within a specified project. List

project*

ListGroups Lists the groups for the account. List
ListMeasurementDataStores Lists the measurement data stores for the account. List
ListMeasurementDataStreams Lists the measurement data streams for the specified measurement data store. List

measurement-data-store*

ListMetricTypes Lists the metric types for the account. List
ListPortals Grants permission to list portals in the account. List
ListProjectAssets Grants permission to list assets associated with a specified project. List

project*

ListProjects Grants permission to list projects within a specified portal. List

portal*

ListViewEntities Lists the assets and groups for the specified view. List

view*

asset

group

ListViews Lists the views for the account. List
PutLoggingOptions Sets the logging options. Write
RegisterViewEntities Registers the specified assets and groups with the specified view. Write

view*

asset

group

UpdateAccessPolicy Grants permission to update a specified access policy. Permissions management

accesspolicy*

UpdateAsset Updates the specified asset. Write

asset*

UpdateAssetModel Updates the specified asset model. Write

asset-model*

UpdateAssetProperty Updates the specified asset property. Write

asset*

UpdateAssetTemplate Updates the specified asset template. Write

asset-template*

UpdateDashboard Grants permission to update a specified dashboard. Write

dashboard*

UpdateGroup Updates the specified group. Write

group*

UpdateMeasurementDataStore Updates metadata about the measurement data store. Write

measurement-data-store*

UpdatePortal Grants permission to update a specified portal. Write

portal*

UpdateProject Grants permission to update a specified project. Write

project*

UpdateView Updates the specified view. Write

view*

Resources Defined by AWS IoT SiteWise

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table .

Resource Types ARN Condition Keys
asset arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:asset/$ { AssetId}
asset-template arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:asset-template/$ { AssetTemplateId}
asset-model arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:asset-model/$ { AssetModelId}
gateway arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:gateway/$ { GatewayId}
group arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:group/$ { GroupId}
measurement arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:measurement/$ { MeasurementId}
measurement-data-store arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:measurement-data-store/$ { MeasurementDataStoreId}
metric arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:metric/$ { MetricId}
metric-type arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:metric-type/$ { MetricTypeId}
view arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:view/$ { ViewId}
portal arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:portal/$ { PortalId}
project arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:project/$ { ProjectId}
dashboard arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:dashboard/$ { DashboardId}

iotsitewise:project

accesspolicy arn:$ { Partition}:iotsitewise:$ { Region}:$ { Account}:accesspolicy/$ { AccessPolicyId}

iotsitewise:portal

iotsitewise:project

Condition Keys for AWS IoT SiteWise

AWS IoT SiteWise defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table .

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference .

Condition Keys Description Type
iotsitewise:assetHierarchyPath String of asset IDs in the asset hierarchy separated by forward slash. String
iotsitewise:childAssetId ID of an asset being associated as a child to another asset. String
iotsitewise:group Group ID. String
iotsitewise:portal Portal ID. String
iotsitewise:project Project ID. String
iotsitewise:propertyId Property ID. String
iotsitewise:user User ID. String