Resource Management Service (RMS)

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by Config, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by Config, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for Config.

**Table 1** Actions supported by Config
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
rms:organizationConformancePacks:create	Grants permission to create organization conformancePack.	Write	-	-	-
rms:organizationConformancePacks:get	Grants permission to return the details of a specific organization conformancePack.	Read	organizationConformancePacks *	-	-
rms:organizationConformancePacks:delete	Grants permission to delete organization conformancePack.	Write	organizationConformancePacks *	-	-
rms:organizationConformancePacks:update	Grants permission to update organization conformancePack.	Write	organizationConformancePacks *	-	-
rms:organizationConformancePacks:list	Grants permission to return a list of organization conformancePack.	List	-	-	-
rms:conformancePacks:create	Grants permission to create conformancePack.	Write	-	-	-
rms:conformancePacks:get	Grants permission to return the details of a specific conformancePack.	Read	conformancePacks *	-	-
rms:conformancePacks:delete	Grants permission to delete conformancePack.	Write	conformancePacks *	-	-
rms:conformancePacks:update	Grants permission to update conformancePack.	Write	conformancePacks *	-	-
rms:conformancePacks:list	Grants permission to return a list of conformancePack.	List	-	-	-
rms:storedQueries:create	Grants permission to save a new query.	Write	-	-	-
rms:storedQueries:update	Grants permission to update an existing saved query.	Write	storedQueries *	-	-
rms:storedQueries:delete	Grants permission to delete the stored query.	Write	storedQueries *	-	-
rms:storedQueries:get	Grants permission to return the details of a specific stored query.	Read	storedQueries *	-	-
rms:storedQueries:list	Grants permission to list the stored queries.	List	-	-	-
rms:policyAssignments:create	Grants permission to create a policy assignments.	Write	-	g:TagKeys g:RequestTag/<tag-key>	-
rms:policyAssignments:update	Grants permission to update a policy assignments.	Write	policyAssignments *	g:ResourceTag/<tag-key>	-
rms:policyAssignments:update	Grants permission to update a policy assignments.	Write	-	g:TagKeys g:RequestTag/<tag-key>	-
rms:policyAssignments:delete	Grants permission to delete the specified policy assignment and all of its policy states.	Write	policyAssignments *	g:ResourceTag/<tag-key>	-
rms:policyAssignments:get	Grants permission to return details about your policy assignments.	Read	policyAssignments *	g:ResourceTag/<tag-key>	-
rms:organizationPolicyAssignments:put	Grants permission to create or update organization policy assignment.	Write	-	-	-
rms:organizationPolicyAssignments:delete	Grants permission to delete the specified organization policy assignment and all of its policy states from all member accounts in that organization.	Write	organizationPolicyAssignments *	-	-
rms:organizationPolicyAssignments:get	Grants permission to return the details of a specific organization policy assignments.	Read	organizationPolicyAssignments *	-	-
rms:organizationPolicyAssignments:list	Grants permission to return a list of organization policy assignments.	List	-	-	-
rms:policyStates:runEvaluation	Grants permission to evaluate your resources against the specified policy assignment.	Write	policyAssignments	g:ResourceTag/<tag-key>	-
rms:policyStates:update	Grants permission to be used by a FunctionGraph function to deliver evaluation results to RMS.	Write	-	-	-
rms:aggregators:create	Grants permission to create aggregators with the selected source accounts.	Write	-	-	-
rms:aggregators:update	Grants permission to update an existing aggregator.	Write	aggregators *	-	-
rms:aggregators:delete	Grants permission to delete the specified aggregator and remove aggregated resources.	Write	aggregators *	-	-
rms:aggregators:list	Grants permission to list the aggregators.	List	-	-	-
rms:aggregators:get	Grants permission to return the details of a specific aggregator.	Read	aggregators *	-	-
rms:aggregatorResources:list	Grants permission to list the aggregated resources.	List	-	-	-
rms:aggregatorResources:runQuery	Grants permission to accept a resource query language (ResourceQL) SELECT command, performs the corresponding search, and returns aggregated resource properties.	List	-	-	-
rms:aggregatorResources:get	Grants permission to return the details of specified aggregated resources.	Read	-	-	-
rms:aggregationAuthorizations:create	Grants permission to crate aggregation authorizations, allows specified account to aggregate resources.	Write	aggregationAuthorizations *	-	-
rms:aggregationAuthorizations:create		Write	-	rms:AuthorizedAccountOrgPath	-
rms:aggregationAuthorizations:list	Grants permission to list the aggregation authorizations.	List	-	-	-
rms:aggregationAuthorizations:delete	Grants permission to delete the aggregation authorization.	Write	aggregationAuthorizations *	-	-
rms:aggregationAuthorizations:delete	Grants permission to delete the aggregation authorization.	Write	-	rms:AuthorizedAccountOrgPath	-
rms:aggregationRequests:delete	Grants permission to delete the aggregation request.	Write	-	-	-
rms:aggregationRequests:list	Grants permission to list the aggregation requests.	List	-	-	-
rms:trackerConfig:put	Grants permission to add or update the tracker for starting record configurations of the resources you have selected to record.	Write	-	rms:TrackerBucketName rms:TrackerBucketPathPrefix	-
rms:trackerConfig:delete	Grants permission to delete the tracker for stopping record configurations of the resources you have selected to record.	Write	-	-	-
rms:trackerConfig:get	Grants permission to return the detail of specified tracker.	Read	-	-	-
rms:schemas:list	Grants permission to return the list for RMS schemas for ResourceQL.	List	-	-	-
rms:policyDefinitions:get	Grants permission to return the list for supported RMS managed policy definitions.	List	-	-	-
rms:resources:getHistory	Grants permission to return history of configuration for the specified resource.	List	-	-	-
rms:resources:getRelation	Grants permission to list relations of resource.	List	-	-	-
rms:resources:get	Grants permission to return the details of specified resources.	Read	-	-	-
rms:resources:list	Grants permission to return the list of all resources.	List	-	-	-
rms:resources:runQuery	Grants permission to accept a resource query language (ResourceQL) SELECT command, performs the corresponding search, and returns resource properties.	List	-	-	-
rms::tagResource	Grants permission to associate the specified tags to a resource.	Tagging	policyAssignments	g:ResourceTag/<tag-key>	rms:resources:tagResource
rms::tagResource		Tagging	-	g:RequestTag/<tag-key> g:TagKeys	rms:resources:tagResource
rms::unTagResource	Grants permission to delete specified tags from a resource.	Tagging	policyAssignments	g:ResourceTag/<tag-key>	rms:resources:unTagResource
rms::unTagResource	Grants permission to delete specified tags from a resource.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	rms:resources:unTagResource
rms::listTagsForResource	Grants permission to list the tags for a resource.	List	policyAssignments	g:ResourceTag/<tag-key>	rms:resources:listTagsForResource
rms::listTags	Grants permission to list the tags for all resources in the specified type.	List	-	-	rms:resources:listTags
rms::listResourcesByTag	Grants permission to list or count resources by the specified tags.	List	-	g:TagKeys	rms:resources:listResourcesByTag
rms:policyAssignmentsRemediation:putRemediationConfiguration	Grants permission to Create PolicyAssignments Remediation Configurations.	Write	policyAssignmentsRemediation *	-	-
rms:policyAssignmentsRemediation:deleteRemediationConfiguration	Grants permission to delete PolicyAssignments Remediation Configurations.	Write	policyAssignmentsRemediation *	-	-
rms:policyAssignmentsRemediation:getRemediationConfiguration	Grants permission to get PolicyAssignments Remediation Configurations.	Read	policyAssignmentsRemediation *	-	-
rms:policyAssignmentsRemediation:runRemediation	Grants permission to run PolicyAssignments Remediation Configurations.	Write	policyAssignmentsRemediation *	-	-
rms:policyAssignmentsRemediation:listRemediationExecutionStatuses	Grants permission to to View PolicyAssignments Remediation Execution Status.	List	policyAssignmentsRemediation *	-	-
rms:policyAssignmentsRemediation:createRemediationExceptions	Grants permission to to create PolicyAssignments Remediation Exceptions.	Write	policyAssignmentsRemediation *	-	-
rms:policyAssignmentsRemediation:deleteRemediationExceptions	Grants permission to to delete PolicyAssignments Remediation Exceptions.	Write	policyAssignmentsRemediation *	-	-
rms:policyAssignmentsRemediation:listRemediationExceptions	Grants permission to to View PolicyAssignments Remediation Exceptions.	List	policyAssignmentsRemediation *	-	-

Each API of Config usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by Config APIs
API	Action	Dependencies
POST /v1/resource-manager/organizations/{organization_id}/conformance-packs	rms:organizationConformancePacks:create	organizations:organizations:get organizations:accounts:list organizations:delegatedAdministrators:list organizations:trustedServices:enable organizations:trustedServices:list
DELETE /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id}	rms:organizationConformancePacks:delete	organizations:organizations:get
PUT /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id}	rms:organizationConformancePacks:update	organizations:organizations:get organizations:accounts:list organizations:delegatedAdministrators:list organizations:trustedServices:enable organizations:trustedServices:list
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs	rms:organizationConformancePacks:list	organizations:organizations:get
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id}	rms:organizationConformancePacks:get	organizations:organizations:get
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs/statuses	rms:organizationConformancePacks:list	organizations:organizations:get
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs/detailed-statuses	rms:organizationConformancePacks:get	organizations:organizations:get
POST /v1/resource-manager/domains/{domain_id}/conformance-packs	rms:conformancePacks:create	rf:stack:createStack rf:stack:getStackMetadata rf:stack:listStackResources
DELETE /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}	rms:conformancePacks:delete	rf:stack:deleteStack rf:stack:getStackMetadata
PUT /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}	rms:conformancePacks:update	rf:stack:deployStack rf:stack:getStackMetadata rf:stack:listStackResources
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}	rms:conformancePacks:get	-
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}/compliance	rms:conformancePacks:get	-
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}/compliance/details	rms:conformancePacks:get	-
GET /v1/resource-manager/domains/{domain_id}/conformance-packs	rms:conformancePacks:list	-
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/compliance/summary	rms:conformancePacks:list	-
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/scores	rms:conformancePacks:list	-
POST /v1/resource-manager/domains/{domain_id}/stored-queries	rms:storedQueries:create	-
PUT /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id}	rms:storedQueries:update	-
DELETE /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id}	rms:storedQueries:delete	-
GET /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id}	rms:storedQueries:get	-
GET /v1/resource-manager/domains/{domain_id}/stored-queries	rms:storedQueries:list	-
PUT /v1/resource-manager/domains/{domain_id}/policy-assignments	rms:policyAssignments:create	-
DELETE /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}	rms:policyAssignments:delete	-
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}	rms:policyAssignments:get	-
GET /v1/resource-manager/domains/{domain_id}/policy-assignments	rms:policyAssignments:get	-
PUT /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}	rms:policyAssignments:update	-
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/disable	rms:policyAssignments:update	-
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/enable	rms:policyAssignments:update	-
PUT /v1/resource-manager/organizations/{organization_id}/policy-assignments	rms:organizationPolicyAssignments:put	organizations:organizations:get organizations:accounts:list organizations:delegatedAdministrators:list organizations:trustedServices:enable organizations:trustedServices:list
GET /v1/resource-manager/organizations/{organization_id}/policy-assignments	rms:organizationPolicyAssignments:list	organizations:organizations:get
GET /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id}	rms:organizationPolicyAssignments:get	organizations:organizations:get
GET /v1/resource-manager/organizations/{organization_id}/policy-assignment-statuses	rms:organizationPolicyAssignments:list	organizations:organizations:get
GET /v1/resource-manager/organizations/{organization_id}/policy-assignment-detailed-status	rms:organizationPolicyAssignments:list	organizations:organizations:get
DELETE /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id}	rms:organizationPolicyAssignments:delete	organizations:organizations:get
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states	rms:policyStates:get	-
GET /v1/resource-manager/domains/{domain_id}/policy-states	rms:policyStates:get	-
GET /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/policy-states	rms:policyStates:get	-
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states/run-evaluation	rms:policyStates:runEvaluation	-
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states/evaluation-state	rms:policyStates:get	-
PUT /v1/resource-manager/domains/{domain_id}/policy-states	rms:policyStates:update	-
PUT /v1/resource-manager/domains/{domain_id}/aggregators	rms:aggregators:create	organizations:organizations:get organizations:accounts:list organizations:delegatedAdministrators:list organizations:trustedServices:enable organizations:trustedServices:list
PUT /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}	rms:aggregators:update	organizations:organizations:get organizations:accounts:list organizations:delegatedAdministrators:list organizations:trustedServices:enable organizations:trustedServices:list
DELETE /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}	rms:aggregators:delete	-
GET /v1/resource-manager/domains/{domain_id}/aggregators	rms:aggregators:list	-
GET /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}	rms:aggregators:get	-
GET /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}/aggregator-sources-status	rms:aggregators:get	-
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-states/compliance-summary	rms:aggregatorResources:list	organizations:organizations:get organizations:delegatedAdministrators:list organizations:trustedServices:list
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-assignments/compliance	rms:aggregatorResources:list	organizations:organizations:get organizations:delegatedAdministrators:list organizations:trustedServices:list
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-states/compliance-details	rms:aggregatorResources:list	organizations:organizations:get organizations:delegatedAdministrators:list organizations:trustedServices:list
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-assignment/detail	rms:aggregatorResources:list	organizations:organizations:get organizations:delegatedAdministrators:list organizations:trustedServices:list
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-resource-config	rms:aggregatorResources:get	-
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/aggregate-discovered-resources	rms:aggregatorResources:list	organizations:organizations:get organizations:delegatedAdministrators:list organizations:trustedServices:list
POST /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}/run-query	rms:aggregatorResources:runQuery	-
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/aggregate-discovered-resource-counts	rms:aggregatorResources:list	organizations:organizations:get organizations:delegatedAdministrators:list organizations:trustedServices:list
GET /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization	rms:aggregationAuthorizations:list	-
PUT /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization	rms:aggregationAuthorizations:create	-
DELETE /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization/{authorized_account_id}	rms:aggregationAuthorizations:delete	-
DELETE /v1/resource-manager/domains/{domain_id}/aggregators/pending-aggregation-request/{requester_account_id}	rms:aggregationRequests:delete	-
GET /v1/resource-manager/domains/{domain_id}/aggregators/pending-aggregation-request	rms:aggregationRequests:list	-
PUT /v1/resource-manager/domains/{domain_id}/tracker-config	rms:trackerConfig:put	-
DELETE /v1/resource-manager/domains/{domain_id}/tracker-config	rms:trackerConfig:delete	-
GET /v1/resource-manager/domains/{domain_id}/tracker-config	rms:trackerConfig:get	-
GET /v1/resource-manager/domains/{domain_id}/schemas	rms:schemas:list	-
GET /v1/resource-manager/policy-definitions	rms:policyDefinitions:get	-
GET /v1/resource-manager/policy-definitions/{policy_definition_id}	rms:policyDefinitions:get	-
GET /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/history	rms:resources:getHistory	-
GET /v1/resource-manager/domains/{domain_id}/all-resources/{resource_id}/relations	rms:resources:getRelation	-
GET /v1/resource-manager/domains/{domain_id}/provider/{provider}/type/{type}/resources/{resource_id}	rms:resources:get	-
GET /v1/resource-manager/domains/{domain_id}/all-resources	rms:resources:list	-
GET /v1/resource-manager/domains/{domain_id}/provider/{provider}/type/{type}/resources	rms:resources:list	-
POST /v1/resource-manager/domains/{domain_id}/run-query	rms:resources:runQuery	-
GET /v1/resource-manager/domains/{domain_id}/all-resources/summary	rms:resources:list	-
GET /v1/resource-manager/domains/{domain_id}/all-resources/tags	rms:resources:list	-
GET /v1/resource-manager/domains/{domain_id}/all-resources/count	rms:resources:list	-
GET /v1/resource-manager/domains/{domain_id}/all-resources/{resource_id}	rms:resources:get	-
GET /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/relations	rms:resources:summarize	-
POST /v1/resource-manager/{resource_type}/{resource_id}/tags/create	rms::tagResource	-
POST /v1/resource-manager/{resource_type}/{resource_id}/tags/delete	rms::unTagResource	-
GET /v1/resource-manager/{resource_type}/{resource_id}/tags	rms::listTagsForResource	-
GET /v1/resource-manager/{resource_type}/tags	rms::listTags	-
POST /v1/resource-manager/{resource_type}/resource-instances/count	rms::listResourcesByTag	-
POST /v1/resource-manager/{resource_type}/resource-instances/filter	rms::listResourcesByTag	-
PUT /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration	rms:policyAssignmentsRemediation:putRemediationConfiguration	iam:agencies:pass iam:agencies:createServiceLinkedAgencyV5
DELETE /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration	rms:policyAssignmentsRemediation:deleteRemediationConfiguration	-
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration	rms:policyAssignmentsRemediation:getRemediationConfiguration	-
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution	rms:policyAssignmentsRemediation:runRemediation	functiongraph:function:invokeAsync functiongraph:function:getFunctionConfig rf:stack:create rf:stack:delete rf:stack:getTemplate rf:stack:getMetadata rf:privateTemplate:showMetadata
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution-statuses	rms:policyAssignmentsRemediation:listRemediationExecutionStatuses	-
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution-statuses/summary	rms:policyAssignmentsRemediation:listRemediationExecutionStatuses	-
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception/create	rms:policyAssignmentsRemediation:createRemediationExceptions	-
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception/delete	rms:policyAssignmentsRemediation:deleteRemediationExceptions	-
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception	rms:policyAssignmentsRemediation:listRemediationExceptions	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for Config.

**Table 3** Resource types supported by Config
Resource Type	URN
policyAssignments	rms::<account-id>:policyAssignments:<policy-assignment-id>
aggregationAuthorizations	rms::<account-id>:aggregationAuthorizations:<authorized-account-id>
policyAssignmentsRemediation	rms::<account-id>:policyAssignmentsRemediation:<policy-assignment-id>
aggregators	rms::<account-id>:aggregators:<aggregator-id>
organizationConformancePacks	rms::<account-id>:organizationConformancePacks:<organization-id>/<organization-conformance-pack-id>
conformancePacks	rms::<account-id>:conformancePacks:<conformance-pack-id>
storedQueries	rms::<account-id>:storedQueries:<query-id>
organizationPolicyAssignments	rms::<account-id>:organizationPolicyAssignments:<organization-id>/<organization-policy-assignments-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, config) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by Config

The following table lists the condition keys that you can define in identity policies for Config. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by Config
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
rms:AuthorizedAccountOrgPath	string	Single-valued	Filters access based on the Organizations Path of the specified resource aggregate authorized account.
rms:TrackerBucketName	string	Single-valued	Filters access based on the specified dump target bucket name.
rms:TrackerBucketPathPrefix	string	Single-valued	Filters access based on the specified dump target bucket prefix.

Examples of Condition Keys

rms:AuthorizedAccountOrgPath

For example,preventing aggregation authorization to accounts outside the current organization.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "rms:aggregationAuthorizations:create"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringNotMatch": {
          "rms:AuthorizedAccountOrgPath": [
            "organization_id/root_id/ou_id" [Note: Enter organization path ID.]
          ]
        }
      }
    }
  ]
}

          

        

      
     

rms:TrackerBucketName

For example,trackerConfig is not allowed to deliver data to unexpected OBS buckets.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "rms:trackerConfig:put"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringNotMatch": {
          "rms:TrackerBucketName": [
            "BucketName"
          ]
        }
      }
    }
  ]
}

          

        

      
     

rms:TrackerBucketPathPrefix

For example,trackerConfig is not allowed to deliver data to unexpected OBS Path.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "rms:trackerConfig:put"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringNotMatch": {
          "rms:TrackerBucketPathPrefix": [
            "BucketFolder"
          ]
        }
      }
    }
  ]
}

          

        

      
     