Actions, resources, and condition keys for Amazon Lightsail - Service Authorization Reference

# Actions, resources, and condition keys for Amazon Lightsail

Amazon Lightsail (service prefix: `lightsail` ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service .

- View a list of the API operations available for this service .

- Learn how to secure this service and its resources by using IAM permission policies.

Topics

- Actions defined by Amazon Lightsail
- Resource types defined by Amazon Lightsail
- Condition keys for Amazon Lightsail

## Actions defined by Amazon Lightsail

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table .

Actions | Description | Access level | Resource types (*required) | Condition keys | Dependent actions
--- | --- | --- | --- | --- | ---
AllocateStaticIp | Creates a static IP address that can be attached to an instance | Write | StaticIp* |  |
AttachCertificateToDistribution | Grants permission to attach an SSL/TLS certificate to your Amazon Lightsail content delivery network (CDN) distribution | Write | Certificate* |  |
Distribution* |  |
AttachDisk | Attaches a disk to an instance | Write | Disk* |  |
Instance* |  |
AttachInstancesToLoadBalancer | Attaches one or more instances to a load balancer | Write | Instance* |  |
LoadBalancer* |  |
AttachLoadBalancerTlsCertificate | Attaches a TLS certificate to a load balancer | Write | LoadBalancer* |  |
AttachStaticIp | Attaches a static IP address to an instance | Write | Instance* |  |
StaticIp* |  |
CloseInstancePublicPorts | Closes a public port of an instance | Write | Instance* |  |
CopySnapshot | Copies a snapshot from one AWS Region to another in Amazon Lightsail | Write | DiskSnapshot |  |
InstanceSnapshot |  |
CreateCertificate | Grants permission to create an SSL/TLS certificate | Write | Certificate* |  |
CreateCloudFormationStack | Creates a new Amazon EC2 instance from an exported Amazon Lightsail snapshot | Write | ExportSnapshotRecord* |  |
CreateContactMethod | Grants permission to create an email or SMS text message contact method | Write |  |  |
CreateContainerService | Grants permission to create an Amazon Lightsail container service | Write | ContainerService* |  |
CreateContainerServiceDeployment | Grants permission to create a deployment for your Amazon Lightsail container service | Write | ContainerService* |  |
CreateContainerServiceRegistryLogin | Grants permission to create a temporary set of log in credentials that you can use to log in to the Docker process on your local machine | Write |  |  |
CreateDisk | Creates a disk | Write | Disk* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateDiskFromSnapshot | Creates a disk from snapshot | Write | Disk* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateDiskSnapshot | Creates a disk snapshot | Write | Disk* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateDistribution | Grants permission to create an Amazon Lightsail content delivery network (CDN) distribution | Write | Distribution* |  |
CreateDomain | Creates a domain resource for the specified domain name | Write | Domain* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateDomainEntry | Creates one or more DNS record entries for a domain resource: Address (A), canonical name (CNAME), mail exchanger (MX), name server (NS), start of authority (SOA), service locator (SRV), or text (TXT) | Write | Domain* |  |
CreateInstanceSnapshot | Creates an instance snapshot | Write | Instance* |  |
InstanceSnapshot* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateInstances | Creates one or more instances | Write | KeyPair* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateInstancesFromSnapshot | Creates one or more instances based on an instance snapshot | Write | Instance* |  |
InstanceSnapshot* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateKeyPair | Creates a key pair used to authenticate and connect to an instance | Write | KeyPair* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateLoadBalancer | Creates a load balancer | Write | LoadBalancer* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateLoadBalancerTlsCertificate | Creates a load balancer TLS certificate | Write | LoadBalancer* |  |
CreateRelationalDatabase | Creates a new relational database | Write | RelationalDatabase* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateRelationalDatabaseFromSnapshot | Creates a new relational database from a snapshot | Write | RelationalDatabase* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
CreateRelationalDatabaseSnapshot | Creates a relational database snapshot | Write | RelationalDatabaseSnapshot* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
DeleteAlarm | Grants permission to delete an alarm | Write | Alarm* |  |
DeleteAutoSnapshot | Grants permission to delete an automatic snapshot of an instance or disk | Write | Disk |  |
Instance |  |
DeleteCertificate | Grants permission to delete an SSL/TLS certificate | Write | Certificate* |  |
DeleteContactMethod | Grants permission to delete a contact method | Write | ContactMethod* |  |
DeleteContainerImage | Grants permission to delete a container image that is registered to your Amazon Lightsail container service | Write | ContainerService* |  |
DeleteContainerService | Grants permission to delete your Amazon Lightsail container service | Write | ContainerService* |  |
DeleteDisk | Deletes a disk | Write | Disk* |  |
DeleteDiskSnapshot | Deletes a disk snapshot | Write | Disk* |  |
DeleteDistribution | Grants permission to delete your Amazon Lightsail content delivery network (CDN) distribution | Write | Distribution* |  |
DeleteDomain | Deletes a domain resource and all of its DNS records | Write | Domain* |  |
DeleteDomainEntry | Deletes a DNS record entry for a domain resource | Write | Domain* |  |
DeleteInstance | Deletes an instance | Write | Instance* |  |
DeleteInstanceSnapshot | Deletes an instance snapshot | Write | InstanceSnapshot* |  |
DeleteKeyPair | Deletes a key pair used to authenticate and connect to an instance | Write | KeyPair* |  |
DeleteKnownHostKeys | Deletes the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance | Write | Instance* |  |
DeleteLoadBalancer | Deletes a load balancer | Write | LoadBalancer* |  |
DeleteLoadBalancerTlsCertificate | Deletes a load balancer TLS certificate | Write | LoadBalancer* |  |
DeleteRelationalDatabase | Deletes a relational database | Write | RelationalDatabase* |  |
DeleteRelationalDatabaseSnapshot | Deletes relational database snapshot | Write | RelationalDatabaseSnapshot* |  |
DetachCertificateFromDistribution | Grants permission to detach an SSL/TLS certificate from your Amazon Lightsail content delivery network (CDN) distribution | Write | Distribution* |  |
DetachDisk | Detaches a disk from an instance | Write | Disk* |  |
DetachInstancesFromLoadBalancer | Detaches one or more instances from a load balancer | Write | Instance* |  |
LoadBalancer* |  |
DetachStaticIp | Detaches a static IP from an instance to which it is attached | Write | Instance* |  |
StaticIp* |  |
DisableAddOn | Grants permission to disable an add-on for an Amazon Lightsail resource | Write | Disk |  |
Instance |  |
DownloadDefaultKeyPair | Downloads the default key pair used to authenticate and connect to instances in a specific AWS Region | Write | KeyPair* |  |
EnableAddOn | Grants permission to enable or modify an add-on for an Amazon Lightsail resource | Write | Disk |  |
Instance |  |
ExportSnapshot | Exports an Amazon Lightsail snapshot to Amazon EC2 | Write |  |  |
GetActiveNames | Returns the names of all active (not deleted) resources | Read |  |  |
GetAlarms | Grants permission to view information about the configured alarms | Read |  |  |
GetAutoSnapshots | Grants permission to view the available automatic snapshots for an instance or disk | Read |  |  |
GetBlueprints | Returns a list of instance images, or blueprints. You can use a blueprint to create a new instance already running a specific operating system, as well as a pre-installed application or development stack. The software that runs on your instance depends on the blueprint you define when creating the instance | Read |  |  |
GetBundles | Returns a list of instance bundles. You can use a bundle to create a new instance with a set of performance specifications, such as CPU count, disk size, RAM size, and network transfer allowance. The cost of your instance depends on the bundle you define when creating the instance | Read |  |  |
GetCertificates | Grants permission to view information about one or more Amazon Lightsail SSL/TLS certificates | Read |  |  |
GetCloudFormationStackRecords | Returns information about all CloudFormation stacks used to create Amazon EC2 resources from exported Amazon Lightsail snapshots | Read | CloudFormationStackRecord* |  |
GetContactMethods | Grants permission to view information about the configured contact methods | Read |  |  |
GetContainerAPIMetadata | Grants permission to view information about Amazon Lightsail containers, such as the current version of the Lightsail Control (lightsailctl) plugin | Read |  |  |
GetContainerImages | Grants permission to view the container images that are registered to your Amazon Lightsail container service | Read |  |  |
GetContainerLog | Grants permission to view the log events of a container of your Amazon Lightsail container service | Read |  |  |
GetContainerServiceDeployments | Grants permission to view the deployments for your Amazon Lightsail container service | Read |  |  |
GetContainerServiceMetricData | Grants permission to view the data points of a specific metric of your Amazon Lightsail container service | Read |  |  |
GetContainerServicePowers | Grants permission to view the list of powers that can be specified for your Amazon Lightsail container services | Read |  |  |
GetContainerServices | Grants permission to view information about one or more of your Amazon Lightsail container services | Read |  |  |
GetDisk | Returns information about a disk | Read | Disk* |  |
GetDiskSnapshot | Returns information about a disk snapshot | Read | Disk* |  |
GetDiskSnapshots | Returns information about all disk snapshots | Read | Disk* |  |
GetDisks | Returns information about all disks | Read |  |  |
GetDistributionBundles | Grants permission to view the list of bundles that can be applied to you Amazon Lightsail content delivery network (CDN) distributions | Read |  |  |
GetDistributionLatestCacheReset | Grants permission to view the timestamp and status of the last cache reset of a specific Amazon Lightsail content delivery network (CDN) distribution | Read |  |  |
GetDistributionMetricData | Grants permission to view the data points of a specific metric for an Amazon Lightsail content delivery network (CDN) distribution | Read |  |  |
GetDistributions | Grants permission to view information about one or more of your Amazon Lightsail content delivery network (CDN) distributions | Read |  |  |
GetDomain | Returns DNS records for a domain resource | Read | Domain* |  |
GetDomains | Returns DNS records for all domain resources | Read | Domain* |  |
GetExportSnapshotRecords | Returns information about all records to export Amazon Lightsail snapshots to Amazon EC2 | Read | ExportSnapshotRecord* |  |
GetInstance | Returns information about an instance | Read | Instance* |  |
GetInstanceAccessDetails | Returns temporary keys you can use to authenticate and connect to an instance | Write | Instance* |  |
GetInstanceMetricData | Returns the data points for the specified metric of an instance | Read | Instance* |  |
GetInstancePortStates | Returns the port states of an instance | Read | Instance* |  |
GetInstanceSnapshot | Returns information about an instance snapshot | Read | InstanceSnapshot* |  |
GetInstanceSnapshots | Returns information about all instance snapshots | Read | InstanceSnapshot* |  |
GetInstanceState | Returns the state of an instance | Read | Instance* |  |
GetInstances | Returns information about all instances | Read | Instance* |  |
GetKeyPair | Returns information about a key pair | Read | KeyPair* |  |
GetKeyPairs | Returns information about all key pairs | Read | KeyPair* |  |
GetLoadBalancer | Returns information about a load balancer | Read | LoadBalancer* |  |
GetLoadBalancerMetricData | Returns the data points for the specified metric of a load balancer | Read | LoadBalancer* |  |
GetLoadBalancerTlsCertificates | Returns information about a load balancer TLS certificate | Read | LoadBalancer* |  |
GetLoadBalancers | Returns information about load balancers | Read | LoadBalancer* |  |
GetOperation | Returns information about an operation. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on | Read |  |  |
GetOperations | Returns information about all operations. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on | Read |  |  |
GetOperationsForResource | Returns operations for a resource | Read | Domain |  |
Instance |  |
InstanceSnapshot |  |
KeyPair |  |
StaticIp |  |
GetRegions | Returns a list of all valid AWS Regions for Amazon Lightsail | Read |  |  |
GetRelationalDatabase | Returns information about a relational database | Read | RelationalDatabase* |  |
GetRelationalDatabaseBlueprints | Returns a list of relational database images, or blueprints. You can use a blueprint to create a new database running a specific database engine. The database engine that runs on your database depends on the blueprint you define when creating the relational database | Read |  |  |
GetRelationalDatabaseBundles | Returns a list of relational database bundles. You can use a bundle to create a new database with a set of performance specifications, such as CPU count, disk size, RAM size, network transfer allowance, and standard of high availability. The cost of your database depends on the bundle you define when creating the relational database | Read |  |  |
GetRelationalDatabaseEvents | Returns events for a relational database | Read |  |  |
GetRelationalDatabaseLogEvents | Returns events for the specified log stream of a relational database | Read |  |  |
GetRelationalDatabaseLogStreams | Returns the log streams available for a relational database | Read |  |  |
GetRelationalDatabaseMasterUserPassword | Returns the master user password of a relational database | Write |  |  |
GetRelationalDatabaseMetricData | Returns the data points for the specified metric of a relational database | Read |  |  |
GetRelationalDatabaseParameters | Returns the parameters of a relational database | Read |  |  |
GetRelationalDatabaseSnapshot | Returns information about a relational database snapshot | Read | RelationalDatabase* |  |
GetRelationalDatabaseSnapshots | Returns information about all relational database snapshots | Read | RelationalDatabase* |  |
GetRelationalDatabases | Return information about all relational databases | Read | RelationalDatabase* |  |
GetStaticIp | Returns information about a static IP | Read | StaticIp* |  |
GetStaticIps | Returns information about all static IPs | Read | StaticIp* |  |
ImportKeyPair | Imports a public key from a key pair | Write | KeyPair* |  |
IsVpcPeered | Returns a boolean value indicating whether the Amazon Lightsail virtual private cloud (VPC) is peered | Read |  |  |
OpenInstancePublicPorts | Adds, or opens a public port of an instance | Write | Instance* |  |
PeerVpc | Tries to peer the Amazon Lightsail virtual private cloud (VPC) with the default VPC | Write |  |  |
PutAlarm | Grants permission to creates or update an alarm, and associate it with the specified metric | Write | Alarm* |  |
PutInstancePublicPorts | Sets the specified open ports for an instance, and closes all ports for every protocol not included in the request | Write | Instance* |  |
RebootInstance | Reboots an instance that is in a running state | Write | Instance* |  |
RebootRelationalDatabase | Reboots a relational database that is in a running state | Write | RelationalDatabase* |  |
RegisterContainerImage | Grants permission to register a container image to your Amazon Lightsail container service | Write | ContainerService* |  |
ReleaseStaticIp | Deletes a static IP | Write | StaticIp* |  |
ResetDistributionCache | Grants permission to delete currently cached content from your Amazon Lightsail content delivery network (CDN) distribution | Write | Distribution* |  |
SendContactMethodVerification | Grants permission to send a verification request to an email contact method to ensure it's owned by the requester | Write | ContactMethod* |  |
SetIpAddressType | Grants permission to set the IP address type for a Amazon Lightsail resource | Write | Distribution |  |
Instance |  |
LoadBalancer |  |
StartInstance | Starts an instance that is in a stopped state | Write | Instance* |  |
StartRelationalDatabase | Starts a relational database that is in a stopped state | Write | RelationalDatabase* |  |
StopInstance | Stops an instance that is in a running state | Write | Instance* |  |
StopRelationalDatabase | Stops a relational database that is in a running state | Write | RelationalDatabase* |  |
TagResource | Tags a resource | Tagging | Disk |  |
DiskSnapshot |  |
Domain |  |
Instance |  |
InstanceSnapshot |  |
KeyPair |  |
LoadBalancer |  |
RelationalDatabase |  |
RelationalDatabaseSnapshot |  |
StaticIp |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
TestAlarm | Grants permission to test an alarm by displaying a banner on the Amazon Lightsail console or if a notification trigger is configured for the specified alarm, by sending a notification to the notification protocol | Write | Alarm* |  |
UnpeerVpc | Attempts to unpeer the Amazon Lightsail virtual private cloud (VPC) from the default VPC | Write |  |  |
UntagResource | Untags a resource | Tagging | Disk |  |
DiskSnapshot |  |
Domain |  |
Instance |  |
InstanceSnapshot |  |
KeyPair |  |
LoadBalancer |  |
RelationalDatabase |  |
RelationalDatabaseSnapshot |  |
StaticIp |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UpdateContainerService | Grants permission to update the configuration of your Amazon Lightsail container service, such as its power, scale, and public domain names | Write | ContainerService* |  |
UpdateDistribution | Grants permission to update an existing Amazon Lightsail content delivery network (CDN) distribution or its configuration | Write | Distribution* |  |
UpdateDistributionBundle | Grants permission to update the bundle of your Amazon Lightsail content delivery network (CDN) distribution | Write | Distribution* |  |
UpdateDomainEntry | Updates a domain recordset after it is created | Write | Domain* |  |
UpdateLoadBalancerAttribute | Updates a load balancer attribute, such as the health check path and session stickiness | Write | LoadBalancer* |  |
UpdateRelationalDatabase | Updates a relational database | Write | RelationalDatabase* |  |
UpdateRelationalDatabaseParameters | Updates the parameters of a relational database | Write |  |  |

## Resource types defined by Amazon Lightsail

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table .

Resource types | ARN | Condition keys
--- | --- | ---
Domain | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:Domain/$ { Id}` | aws:ResourceTag/${TagKey}
Instance | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:Instance/$ { Id}` | aws:ResourceTag/${TagKey}
InstanceSnapshot | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:InstanceSnapshot/$ { Id}` | aws:ResourceTag/${TagKey}
KeyPair | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:KeyPair/$ { Id}` | aws:ResourceTag/${TagKey}
StaticIp | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:StaticIp/$ { Id}` | aws:ResourceTag/${TagKey}
Disk | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:Disk/$ { Id}` | aws:ResourceTag/${TagKey}
DiskSnapshot | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:DiskSnapshot/$ { Id}` | aws:ResourceTag/${TagKey}
LoadBalancer | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:LoadBalancer/$ { Id}` | aws:ResourceTag/${TagKey}
LoadBalancerTlsCertificate | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:LoadBalancerTlsCertificate/$ { Id}` |
ExportSnapshotRecord | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:ExportSnapshotRecord/$ { Id}` |
CloudFormationStackRecord | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:CloudFormationStackRecord/$ { Id}` |
RelationalDatabase | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:RelationalDatabase/$ { Id}` | aws:ResourceTag/${TagKey}
RelationalDatabaseSnapshot | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:RelationalDatabaseSnapshot/$ { Id}` | aws:ResourceTag/${TagKey}
Alarm | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:Alarm/$ { Id}` |
Certificate | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:Certificate/$ { Id}` |
ContactMethod | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:ContactMethod/$ { Id}` |
ContainerService | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:ContainerService/$ { Id}` |
Distribution | `arn:$ { Partition}:lightsail:$ { Region}:$ { Account}:Distribution/$ { Id}` |

## Condition keys for Amazon Lightsail

Amazon Lightsail defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table .

To view the global condition keys that are available to all services, see Available global condition keys .

Condition keys | Description | Type
--- | --- | ---
aws:RequestTag/${TagKey} | Filters actions based on the presence of tag key-value pairs in the request | String
aws:ResourceTag/${TagKey} | Filters actions based on tag key-value pairs attached to the resource | String
aws:TagKeys | Filters actions based on the presence of tag keys in the request | String

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.