Actions, resources, and condition keys for Amazon Chime - Service Authorization Reference

# Actions, resources, and condition keys for Amazon Chime

Amazon Chime (service prefix: `chime` ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service .

- View a list of the API operations available for this service .

- Learn how to secure this service and its resources by using IAM permission policies.

Topics

- Actions defined by Amazon Chime
- Resource types defined by Amazon Chime
- Condition keys for Amazon Chime

## Actions defined by Amazon Chime

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table .

Actions | Description | Access level | Resource types (*required) | Condition keys | Dependent actions
--- | --- | --- | --- | --- | ---
AcceptDelegate | Grants permission to accept the delegate invitation to share management of an Amazon Chime account with another AWS Account | Write |  |  |
ActivateUsers | Grants permission to activate users in an Amazon Chime Enterprise account | Write |  |  |
AddDomain | Grants permission to add a domain to your Amazon Chime account | Write |  |  |
AddOrUpdateGroups | Grants permission to add new or update existing Active Directory or Okta user groups associated with your Amazon Chime Enterprise account | Write |  |  |
AssociatePhoneNumberWithUser | Grants permission to associate a phone number with an Amazon Chime user | Write |  |  |
AssociatePhoneNumbersWithVoiceConnector | Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector | Write |  |  |
AssociatePhoneNumbersWithVoiceConnectorGroup | Grants permission to associate multiple phone numbers with an Amazon Chime Voice Connector Group | Write |  |  |
AssociateSigninDelegateGroupsWithAccount | Grants permission to associate the specified sign-in delegate groups with the specified Amazon Chime account. | Write |  |  |
AuthorizeDirectory | Grants permission to authorize an Active Directory for your Amazon Chime Enterprise account | Write |  |  |
BatchCreateAttendee | Grants permission to create new attendees for an active Amazon Chime SDK meeting | Write | meeting* |  |
BatchCreateChannelMembership | Grants permission to add multiple users to a channel | Write | app-instance-user* |  |
channel* |  |
BatchCreateRoomMembership | Grants permission to batch add room members | Write |  |  |
BatchDeletePhoneNumber | Grants permission to move up to 50 phone numbers to the deletion queue | Write |  |  |
BatchSuspendUser | Grants permission to suspend up to 50 users from a Team or EnterpriseLWA Amazon Chime account | Write |  |  |
BatchUnsuspendUser | Grants permission to remove the suspension from up to 50 previously suspended users for the specified Amazon Chime EnterpriseLWA account | Write |  |  |
BatchUpdatePhoneNumber | Grants permission to update phone number details within the UpdatePhoneNumberRequestItem object for up to 50 phone numbers | Write |  |  |
BatchUpdateUser | Grants permission to update user details within the UpdateUserRequestItem object for up to 20 users for the specified Amazon Chime account | Write |  |  |
Connect | Grants permission to establish a web socket connection for app instance user to the messaging session endpoint | Write | app-instance-user* |  |
ConnectDirectory | Grants permission to connect an Active Directory to your Amazon Chime Enterprise account | Write |  |  | ds:ConnectDirectory
CreateAccount | Grants permission to create an Amazon Chime account under the administrator's AWS account | Write |  |  |
CreateApiKey | Grants permission to create a new SCIM access key for your Amazon Chime account and Okta configuration | Write |  |  |
CreateAppInstance | Grants permission to create an app instance under the AWS account | Write |  | aws:TagKeys aws:RequestTag/${TagKey} |
CreateAppInstanceAdmin | Grants permission to promote an AppInstanceUser to an AppInstanceAdmin | Write | app-instance* |  |
app-instance-user* |  |
CreateAppInstanceUser | Grants permission to create a user under an Amazon Chime AppInstance | Write |  | aws:TagKeys aws:RequestTag/${TagKey} |
CreateAttendee | Grants permission to create a new attendee for an active Amazon Chime SDK meeting | Write | meeting* |  |
CreateBot | Grants permission to create a bot for an Amazon Chime Enterprise account | Write |  |  |
CreateBotMembership | Grants permission to add a bot to a chat room in your Amazon Chime Enterprise account | Write |  |  |
CreateCDRBucket | Grants permission to create a new Call Detail Record S3 bucket | Write |  |  | s3:CreateBucket s3:ListAllMyBuckets
CreateChannel | Grants permission to create a channel for an app instance under the AWS account | Write | app-instance-user* |  |
| aws:TagKeys aws:RequestTag/${TagKey} |
CreateChannelBan | Grants permission to ban a user from a channel | Write | app-instance-user* |  |
channel* |  |
CreateChannelMembership | Grants permission to add a user to a channel | Write | app-instance-user* |  |
channel* |  |
CreateChannelModerator | Grants permission to create a channel moderator | Write | app-instance-user* |  |
channel* |  |
CreateMeeting | Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with no initial attendees | Write |  | aws:RequestTag/${TagKey} aws:TagKeys |
CreateMeetingDialOut | Grants permission to call a phone number to join the specified Amazon Chime SDK meeting | Write | meeting* |  |
CreateMeetingWithAttendees | Grants permission to create a new Amazon Chime SDK meeting in the specified media Region, with a set of attendees | Write |  | aws:RequestTag/${TagKey} aws:TagKeys |
CreatePhoneNumberOrder | Grants permission to create a phone number order with the Carriers | Write |  |  |
CreateProxySession | Grants permission to create a proxy session for the specified Amazon Chime Voice Connector | Write |  |  |
CreateRoom | Grants permission to create a room | Write |  |  |
CreateRoomMembership | Grants permission to add a room member | Write |  |  |
CreateSipMediaApplication | Grants permission to create an Amazon Chime SIP media application under the administrator's AWS account | Write |  |  |
CreateSipMediaApplicationCall | Grants permission to create outbound call for Amazon Chime SIP media application under the administrator's AWS account | Write |  |  |
CreateSipRule | Grants permission to create an Amazon Chime SIP rule under the administrator's AWS account | Write |  |  |
CreateUser | Grants permission to create a user under the specified Amazon Chime account. | Write |  |  |
CreateVoiceConnector | Grants permission to create a Amazon Chime Voice Connector under the administrator's AWS account | Write |  |  |
CreateVoiceConnectorGroup | Grants permission to create a Amazon Chime Voice Connector Group under the administrator's AWS account | Write |  |  |
DeleteAccount | Grants permission to delete the specified Amazon Chime account | Write |  |  |
DeleteAccountOpenIdConfig | Grants permission to delete the OpenIdConfig attributes from your Amazon Chime account | Write |  |  |
DeleteApiKey | Grants permission to delete the specified SCIM access key associated with your Amazon Chime account and Okta configuration | Write |  |  |
DeleteAppInstance | Grants permission to delete an AppInstance | Write | app-instance* |  |
DeleteAppInstanceAdmin | Grants permission to demote an AppInstanceAdmin to an AppInstanceUser | Write | app-instance* |  |
app-instance-user* |  |
DeleteAppInstanceStreamingConfigurations | Grants permission to disable data streaming for the app instance | Write | app-instance* |  |
DeleteAppInstanceUser | Grants permission to delete an AppInstanceUser | Write | app-instance-user* |  |
DeleteAttendee | Grants permission to delete the specified attendee from an Amazon Chime SDK meeting | Write | meeting* |  |
DeleteCDRBucket | Grants permission to delete a Call Detail Record S3 bucket from your Amazon Chime account | Write |  |  | s3:DeleteBucket
DeleteChannel | Grants permission to delete a channel | Write | app-instance-user* |  |
channel* |  |
DeleteChannelBan | Grants permission to remove a user from a channel's ban list | Write | app-instance-user* |  |
channel* |  |
DeleteChannelMembership | Grants permission to remove a member from a channel | Write | app-instance-user* |  |
channel* |  |
DeleteChannelMessage | Grants permission to delete a channel message | Write | app-instance-user* |  |
channel* |  |
DeleteChannelModerator | Grants permission to delete a channel moderator | Write | app-instance-user* |  |
channel* |  |
DeleteDelegate | Grants permission to delete delegated AWS account management from your Amazon Chime account | Write |  |  |
DeleteDomain | Grants permission to delete a domain from your Amazon Chime account | Write |  |  |
DeleteEventsConfiguration | Grants permission to delete an events configuration for a bot to receive outgoing events | Write |  |  |
DeleteGroups | Grants permission to delete Active Directory or Okta user groups from your Amazon Chime Enterprise account | Write |  |  |
DeleteMeeting | Grants permission to delete the specified Amazon Chime SDK meeting | Write | meeting* |  |
DeletePhoneNumber | Grants permission to move a phone number to the deletion queue | Write |  |  |
DeleteProxySession | Grants permission to delete a proxy session for the specified Amazon Chime Voice Connector | Write |  |  |
DeleteRoom | Grants permission to delete a room | Write |  |  |
DeleteRoomMembership | Grants permission to remove a room member | Write |  |  |
DeleteSipMediaApplication | Grants permission to delete Amazon Chime SIP media application under the administrator's AWS account | Write |  |  |
DeleteSipRule | Grants permission to delete Amazon Chime SIP rule under the administrator's AWS account | Write |  |  |
DeleteVoiceConnector | Grants permission to delete the specified Amazon Chime Voice Connector | Write |  |  |
DeleteVoiceConnectorEmergencyCallingConfiguration | Grants permission to delete emergency calling configuration for the specified Amazon Chime Voice Connector | Write |  |  |
DeleteVoiceConnectorGroup | Grants permission to delete the specified Amazon Chime Voice Connector Group | Write |  |  |
DeleteVoiceConnectorOrigination | Grants permission to delete the origination settings for the specified Amazon Chime Voice Connector | Write |  |  |
DeleteVoiceConnectorProxy | Grants permission to delete proxy configuration for the specified Amazon Chime Voice Connector | Write |  |  |
DeleteVoiceConnectorStreamingConfiguration | Grants permission to delete streaming configuration for the specified Amazon Chime Voice Connector | Write |  |  |
DeleteVoiceConnectorTermination | Grants permission to delete the termination settings for the specified Amazon Chime Voice Connector | Write |  |  |
DeleteVoiceConnectorTerminationCredentials | Grants permission to delete SIP termination credentials for the specified Amazon Chime Voice Connector | Write |  |  |
DescribeAppInstance | Grants permission to get the full details of an AppInstance | Read | app-instance* |  |
DescribeAppInstanceAdmin | Grants permission to get the full details of an AppInstanceAdmin | Read | app-instance* |  |
app-instance-user* |  |
DescribeAppInstanceUser | Grants permission to get the full details of an AppInstanceUser | Read | app-instance-user* |  |
DescribeChannel | Grants permission to get the full details of a channel | Read | app-instance-user* |  |
channel* |  |
DescribeChannelBan | Grants permission to get the full details of a channel ban | Read | app-instance-user* |  |
channel* |  |
DescribeChannelMembership | Grants permission to get the full details of a channel membership | Read | app-instance-user* |  |
channel* |  |
DescribeChannelMembershipForAppInstanceUser | Grants permission to get the details of a channel based on the membership of the specified AppInstanceUser | Read | app-instance-user* |  |
channel* |  |
DescribeChannelModeratedByAppInstanceUser | Grants permission to get the full details of a channel moderated by the specified AppInstanceUser | Read | app-instance-user* |  |
channel* |  |
DescribeChannelModerator | Grants permission to get the full details of a single ChannelModerator | Read | app-instance-user* |  |
channel* |  |
DisassociatePhoneNumberFromUser | Grants permission to disassociate the primary provisioned number from the specified Amazon Chime user | Write |  |  |
DisassociatePhoneNumbersFromVoiceConnector | Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector | Write |  |  |
DisassociatePhoneNumbersFromVoiceConnectorGroup | Grants permission to disassociate multiple phone numbers from the specified Amazon Chime Voice Connector Group | Write |  |  |
DisassociateSigninDelegateGroupsFromAccount | Grants permission to disassociate the specified sign-in delegate groups from the specified Amazon Chime account. | Write |  |  |
DisconnectDirectory | Grants permission to disconnect the Active Directory from your Amazon Chime Enterprise account | Write |  |  |
GetAccount | Grants permission to get details for the specified Amazon Chime account | Read |  |  |
GetAccountResource | Grants permission to get details for the account resource associated with your Amazon Chime account | Read |  |  |
GetAccountSettings | Grants permission to get account settings for the specified Amazon Chime account ID | Read |  |  |
GetAccountWithOpenIdConfig | Grants permission to get the account details and OpenIdConfig attributes for your Amazon Chime account | Read |  |  |
GetAppInstanceRetentionSettings | Grants permission to get retention settings for an app instance | Read | app-instance* |  |
GetAppInstanceStreamingConfigurations | Grants permission to get the streaming configurations for an app instance | Read | app-instance* |  |
GetAttendee | Grants permission to get attendee details for a specified meeting ID and attendee ID | Read | meeting* |  |
GetBot | Grants permission to retrieve details for the specified bot | Read |  |  |
GetCDRBucket | Grants permission to get details of a Call Detail Record S3 bucket associated with your Amazon Chime account | Read |  |  | s3:GetBucketAcl s3:GetBucketLocation s3:GetBucketLogging s3:GetBucketVersioning s3:GetBucketWebsite
GetChannelMessage | Grants permission to get the full details of a channel message | Read | app-instance-user* |  |
channel* |  |
GetDomain | Grants permission to get domain details for a domain associated with your Amazon Chime account | Read |  |  |
GetEventsConfiguration | Grants permission to retrieve details for an events configuration for a bot to receive outgoing events | Read |  |  |
GetGlobalSettings | Grants permission to get global settings related to Amazon Chime for the AWS account | Read |  |  |
GetMeeting | Grants permission to get the meeting record for a specified meeting ID | Read | meeting* |  |
GetMeetingDetail | Grants permission to get attendee, connection, and other details for a meeting | Read |  |  |
GetMessagingSessionEndpoint | Grants permission to get the endpoint for the messaging session | Read |  |  |
GetPhoneNumber | Grants permission to get details for the specified phone number | Read |  |  |
GetPhoneNumberOrder | Grants permission to get details for the specified phone number order | Read |  |  |
GetPhoneNumberSettings | Grants permission to get phone number settings related to Amazon Chime for the AWS account | Read |  |  |
GetProxySession | Grants permission to get details of the specified proxy session for the specified Amazon Chime Voice Connector | Read |  |  |
GetRetentionSettings | Gets the retention settings for the specified Amazon Chime account. | Read |  |  |
GetRoom | Grants permission to retrieve a room | Read |  |  |
GetSipMediaApplication | Grants permission to get details of Amazon Chime SIP media application under the administrator's AWS account | Read |  |  |
GetSipMediaApplicationLoggingConfiguration | Grants permission to get logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account | Read |  |  |
GetSipRule | Grants permission to get details of Amazon Chime SIP rule under the administrator's AWS account | Read |  |  |
GetTelephonyLimits | Grants permission to get telephony limits for the AWS account | Read |  |  |
GetUser | Grants permission to get details for the specified user ID | Read |  |  |
GetUserActivityReportData | Grants permission to get a summary of user activity on the user details page | Read |  |  |
GetUserByEmail | Grants permission to get user details for an Amazon Chime user based on the email address in an Amazon Chime Enterprise or Team account | Read |  |  |
GetUserSettings | Grants permission to get user settings related to the specified Amazon Chime user | Read |  |  |
GetVoiceConnector | Grants permission to get details for the specified Amazon Chime Voice Connector | Read |  |  |
GetVoiceConnectorEmergencyCallingConfiguration | Grants permission to get details of the emergency calling configuration for the specified Amazon Chime Voice Connector | Read |  |  |
GetVoiceConnectorGroup | Grants permission to get details for the specified Amazon Chime Voice Connector Group | Read |  |  |
GetVoiceConnectorLoggingConfiguration | Grants permission to get details of the logging configuration for the specified Amazon Chime Voice Connector | Read |  |  |
GetVoiceConnectorOrigination | Grants permission to get details of the origination settings for the specified Amazon Chime Voice Connector | Read |  |  |
GetVoiceConnectorProxy | Grants permission to get details of the proxy configuration for the specified Amazon Chime Voice Connector | Read |  |  |
GetVoiceConnectorStreamingConfiguration | Grants permission to get details of the streaming configuration for the specified Amazon Chime Voice Connector | Read |  |  |
GetVoiceConnectorTermination | Grants permission to get details of the termination settings for the specified Amazon Chime Voice Connector | Read |  |  |
GetVoiceConnectorTerminationHealth | Grants permission to get details of the termination health for the specified Amazon Chime Voice Connector | Read |  |  |
InviteDelegate | Grants permission to send an invitation to accept a request for AWS account delegation for an Amazon Chime account | Write |  |  |
InviteUsers | Grants permission to invite as many as 50 users to the specified Amazon Chime account | Write |  |  |
InviteUsersFromProvider | Grants permission to invite users from a third party provider to your Amazon Chime account | Write |  |  |
ListAccountUsageReportData | Grants permission to list Amazon Chime account usage reporting data | List |  |  |
ListAccounts | Grants permission to list the Amazon Chime accounts under the administrator's AWS account | List |  |  |
ListApiKeys | Grants permission to list the SCIM access keys defined for your Amazon Chime account and Okta configuration | List |  |  |
ListAppInstanceAdmins | Grants permission to list administrators in the app instance | List | app-instance* |  |
app-instance-user* |  |
ListAppInstanceUsers | Grants permission to list all AppInstanceUsers created under a single app instance | List | app-instance-user* |  |
ListAppInstances | Grants permission to list all Amazon Chime app instances created under a single AWS account | List | app-instance* |  |
ListAttendeeTags | Grants permission to list the tags applied to an Amazon Chime SDK attendee resource | List | meeting* |  |
ListAttendees | Grants permission to list up to 100 attendees for a specified Amazon Chime SDK meeting | List | meeting* |  |
ListBots | Grants permission to list the bots associated with the administrator's Amazon Chime Enterprise account | List |  |  |
ListCDRBucket | Grants permission to list Call Detail Record S3 buckets | List |  |  | s3:ListAllMyBuckets s3:ListBucket
ListCallingRegions | Grants permission to list the calling regions available for the administrator's AWS account | List |  |  |
ListChannelBans | Grants permission to list all the users banned from a particular channel | List | app-instance-user* |  |
channel* |  |
ListChannelMemberships | Grants permission to list all channel memberships in a channel | List | app-instance-user* |  |
channel* |  |
ListChannelMembershipsForAppInstanceUser | Grants permission to list all channels that a particular AppInstanceUser is a part of | List | app-instance-user* |  |
ListChannelMessages | Grants permission to list all the messages in a channel | List | app-instance-user* |  |
channel* |  |
ListChannelModerators | Grants permission to list all the moderators for a channel | List | app-instance-user* |  |
channel* |  |
ListChannels | Grants permission to list all the Channels created under a single Chime AppInstance | List | app-instance-user* |  |
channel* |  |
ListChannelsModeratedByAppInstanceUser | Grants permission to list all channels moderated by an app instance user | List | app-instance-user* |  |
ListDelegates | Grants permission to list account delegate information associated with your Amazon Chime account | List |  |  |
ListDirectories | Grants permission to list active Active Directories hosted in the Directory Service of your AWS account | List |  |  |
ListDomains | Grants permission to list domains associated with your Amazon Chime account | List |  |  |
ListGroups | Grants permission to list Active Directory or Okta user groups associated with your Amazon Chime Enterprise account | List |  |  |
ListMeetingEvents | Grants permission to list all events that occurred for a specified meeting | List |  |  |
ListMeetingTags | Grants permission to list the tags applied to an Amazon Chime SDK meeting resource. | List | meeting* |  |
ListMeetings | Grants permission to list up to 100 active Amazon Chime SDK meetings | List |  |  |
ListMeetingsReportData | Grants permission to list meetings ended during the specified date range | List |  |  |
ListPhoneNumberOrders | Grants permission to list the phone number orders under the administrator's AWS account | List |  |  |
ListPhoneNumbers | Grants permission to list the phone numbers under the administrator's AWS account | List |  |  |
ListProxySessions | Grants permission to list proxy sessions for the specified Amazon Chime Voice Connector | List |  |  |
ListRoomMemberships | Grants permission to list all room members | List |  |  |
ListRooms | Grants permission to list rooms | List |  |  |
ListSipMediaApplications | Grants permission to list all Amazon Chime SIP media applications under the administrator's AWS account | List |  |  |
ListSipRules | Grants permission to list all Amazon Chime SIP rules under the administrator's AWS account | List |  |  |
ListSupportedPhoneNumberCountries | Grants permission to list the phone number countries supported by the AWS account | List |  |  |
ListTagsForResource | Grants permission to list the tags applied to an Amazon Chime resource. | List | channel |  |
ListUsers | Grants permission to list the users that belong to the specified Amazon Chime account | List |  |  |
ListVoiceConnectorGroups | Grants permission to list the Amazon Chime Voice Connector Groups under the administrator's AWS account | List |  |  |
ListVoiceConnectorTerminationCredentials | Grants permission to list the SIP termination credentials for the specified Amazon Chime Voice Connector | List |  |  |
ListVoiceConnectors | Grants permission to list the Amazon Chime Voice Connectors under the administrator's AWS account | List |  |  |
LogoutUser | Grants permission to log out the specified user from all of the devices they are currently logged into | Write |  |  |
PutAppInstanceRetentionSettings | Grants permission to enable data retention for the app instance | Write | app-instance* |  |
PutAppInstanceStreamingConfigurations | Grants permission to configure data streaming for the app instance | Write | app-instance* |  |
PutEventsConfiguration | Grants permission to update details for an events configuration for a bot to receive outgoing events | Write |  |  |
PutRetentionSettings | Puts retention settings for the specified Amazon Chime account | Write |  |  |
PutSipMediaApplicationLoggingConfiguration | Grants permission to update logging configuration settings for Amazon Chime SIP media application under the administrator's AWS account | Write |  |  |
PutVoiceConnectorEmergencyCallingConfiguration | Grants permission to add emergency calling configuration for the specified Amazon Chime Voice Connector | Write |  |  |
PutVoiceConnectorLoggingConfiguration | Grants permission to add logging configuration for the specified Amazon Chime Voice Connector | Write |  |  | logs:CreateLogDelivery logs:CreateLogGroup logs:DeleteLogDelivery logs:DescribeLogGroups logs:GetLogDelivery logs:ListLogDeliveries
PutVoiceConnectorOrigination | Grants permission to update the origination settings for the specified Amazon Chime Voice Connector | Write |  |  |
PutVoiceConnectorProxy | Grants permission to add proxy configuration for the specified Amazon Chime Voice Connector | Write |  |  |
PutVoiceConnectorStreamingConfiguration | Grants permission to add streaming configuration for the specified Amazon Chime Voice Connector | Write |  |  |
PutVoiceConnectorTermination | Grants permission to update the termination settings for the specified Amazon Chime Voice Connector | Write |  |  |
PutVoiceConnectorTerminationCredentials | Grants permission to add SIP termination credentials for the specified Amazon Chime Voice Connector | Write |  |  |
RedactChannelMessage | Grants permission to redact message content | Write | app-instance-user* |  |
channel* |  |
RedactConversationMessage | Redacts the specified Chime conversation Message | Write |  |  |
RedactRoomMessage | Redacts the specified Chime room Message | Write |  |  |
RegenerateSecurityToken | Grants permission to regenerate the security token for the specified bot | Write |  |  |
RenameAccount | Grants permission to modify the account name for your Amazon Chime Enterprise or Team account | Write |  |  |
RenewDelegate | Grants permission to renew the delegation request associated with an Amazon Chime account | Write |  |  |
ResetAccountResource | Grants permission to reset the account resource in your Amazon Chime account | Write |  |  |
ResetPersonalPIN | Grants permission to reset the personal meeting PIN for the specified user on an Amazon Chime account | Write |  |  |
RestorePhoneNumber | Grants permission to restore the specified phone number from the deltion queue back to the phone number inventory | Write |  |  |
RetrieveDataExports | Grants permission to download the file containing links to all user attachments returned as part of the "Request attachments" action | List |  |  |
SearchAvailablePhoneNumbers | Grants permission to search phone numbers that can be ordered from the carrier | Read |  |  |
SendChannelMessage | Grants permission to send a message to a particular channel that the member is a part of | Write | app-instance-user* |  |
channel* |  |
StartDataExport | Grants permission to submit the "Request attachments" request | Write |  |  |
SubmitSupportRequest | Grants permission to submit a customer service support request | Write |  |  |
SuspendUsers | Grants permission to suspend users from an Amazon Chime Enterprise account | Write |  |  |
TagAttendee | Grants permission to apply the specified tags to the specified Amazon Chime SDK attendee | Tagging | meeting* |  |
TagMeeting | Grants permission to apply the specified tags to the specified Amazon Chime SDK meeting. | Tagging | meeting* |  |
| aws:TagKeys aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} |
TagResource | Grants permission to apply the specified tags to the specified Amazon Chime resource. | Tagging | channel |  |
| aws:TagKeys aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} |
UnauthorizeDirectory | Grants permission to unauthorize an Active Directory from your Amazon Chime Enterprise account | Write |  |  |
UntagAttendee | Grants permission to untag the specified tags from the specified Amazon Chime SDK attendee. | Tagging | meeting* |  |
UntagMeeting | Grants permission to untag the specified tags from the specified Amazon Chime SDK meeting. | Tagging | meeting* |  |
UntagResource | Grants permission to untag the specified tags from the specified Amazon Chime resource. | Tagging | channel |  |
UpdateAccount | Grants permission to update account details for the specified Amazon Chime account | Write |  |  |
UpdateAccountOpenIdConfig | Grants permission to update the OpenIdConfig attributes for your Amazon Chime account | Write |  |  |
UpdateAccountResource | Grants permission to update the account resource in your Amazon Chime account | Write |  |  |
UpdateAccountSettings | Grants permission to update the settings for the specified Amazon Chime account | Write |  |  |
UpdateAppInstance | Grants permission to update AppInstance metadata | Write | app-instance* |  |
UpdateAppInstanceUser | Grants permission to update the details for an AppInstanceUser | Write | app-instance-user* |  |
UpdateBot | Grants permission to update the status of the specified bot | Write |  |  |
UpdateCDRSettings | Grants permission to update your Call Detail Record S3 bucket | Write |  |  | s3:CreateBucket s3:DeleteBucket s3:ListAllMyBuckets
UpdateChannel | Grants permission to update a channel's attributes | Write | app-instance-user* |  |
channel* |  |
UpdateChannelMessage | Grants permission to update the content of a message | Write | app-instance-user* |  |
channel* |  |
UpdateChannelReadMarker | Grants permission to set the timestamp to the point when a user last read messages in a channel | Write | app-instance-user* |  |
channel* |  |
UpdateGlobalSettings | Grants permission to update the global settings related to Amazon Chime for the AWS account | Write |  |  |
UpdatePhoneNumber | Grants permission to update phone number details for the specified phone number | Write |  |  |
UpdatePhoneNumberSettings | Grants permission to update phone number settings related to Amazon Chime for the AWS account | Write |  |  |
UpdateProxySession | Grants permission to update a proxy session for the specified Amazon Chime Voice Connector | Write |  |  |
UpdateRoom | Grants permission to update a room | Write |  |  |
UpdateRoomMembership | Grants permission to update room membership role | Write |  |  |
UpdateSipMediaApplication | Grants permission to update properties of Amazon Chime SIP media application under the administrator's AWS account | Write |  |  |
UpdateSipMediaApplicationCall | Grants permission to update an Amazon Chime SIP media application call under the administrator's AWS account | Write |  |  |
UpdateSipRule | Grants permission to update properties of Amazon Chime SIP rule under the administrator's AWS account | Write |  |  |
UpdateSupportedLicenses | Grants permission to update the supported license tiers available for users in your Amazon Chime account | Write |  |  |
UpdateUser | Grants permission to update user details for a specified user ID | Write |  |  |
UpdateUserLicenses | Grants permission to update the licenses for your Amazon Chime users | Write |  |  |
UpdateUserSettings | Grants permission to update user settings related to the specified Amazon Chime user | Write |  |  |
UpdateVoiceConnector | Grants permission to update Amazon Chime Voice Connector details for the specified Amazon Chime Voice Connector | Write |  |  |
UpdateVoiceConnectorGroup | Grants permission to update Amazon Chime Voice Connector Group details for the specified Amazon Chime Voice Connector Group | Write |  |  |
ValidateAccountResource | Grants permission to validate the account resource in your Amazon Chime account | Read |  |  |

## Resource types defined by Amazon Chime

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table .

Resource types | ARN | Condition keys
--- | --- | ---
meeting | `arn:$ { Partition}:chime::$ { AccountId}:meeting/$ { MeetingId}` | aws:ResourceTag/${TagKey}
app-instance | `arn:$ { Partition}:chime:$ { Region}:$ { AccountId}:app-instance/$ { AppInstanceId}` | aws:ResourceTag/${TagKey}
app-instance-user | `arn:$ { Partition}:chime:$ { Region}:$ { AccountId}:app-instance/$ { AppInstanceId}/user/$ { AppInstanceUserId}` | aws:ResourceTag/${TagKey}
channel | `arn:$ { Partition}:chime:$ { Region}:$ { AccountId}:app-instance/$ { AppInstanceId}/channel/$ { ChannelId}` | aws:ResourceTag/${TagKey}

## Condition keys for Amazon Chime

Amazon Chime defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table .

To view the global condition keys that are available to all services, see Available global condition keys .

Condition keys | Description | Type
--- | --- | ---
aws:RequestTag/${TagKey} | Filters actions based on the presence of tag key-value pairs in the request | String
aws:ResourceTag/${TagKey} | Filters actions based on tag key-value pairs attached to the resource | String
aws:TagKeys | Filters actions based on the presence of tag keys in the request | String

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.