Post

Cloudtrail Event

Posted
Preview Image
By Muzammil Shaik 1998 min read
Accessanalyzer Account Acm Amp Amplify Amplifybackend Accessanalyzer Account Acm Amp Amplify Amplifybackend Apigateway Apigatewaymanagementapi Apigatewayv2 Appconfig Appflow Appintegrations Application-autoscaling Applicationcostprofiler Appmesh Apprunner Appstream Appsync Athena Auditmanager Autoscaling-plans Autoscaling Batch Braket Budgets Chime-sdk-identity Chime-sdk-meetings Chime-sdk-messaging Chime Cloud9 Cloudcontrol Cloudformation Cloudfront Cloudhsm Cloudhsmv2 Cloudsearch Cloudsearchdomain Cloudwatch Codeartifact Codebuild Codecommit Codedeploy Codeguru-reviewer Codeguruprofiler Codepipeline Codestar-connections Codestar-notifications Codestar Cognito-identity Cognito-sync Comprehendmedical Compute-optimizer Connect-contact-lens Connect Connectparticipant Cur Databrew Dataexchange Datapipeline Datasync Detective Devicefarm Devops-guru Directconnect Discovery Dlm Docdb Ds Dynamodb Dynamodbstreams Ebs Ec2-instance-connect Ecr-public Ecr Ecs Eks Elastic-inference Elasticache Elasticbeanstalk Elastictranscoder Elb Elbv2 Emr-containers Emr Es Events Finspace-data Finspace Firehose Fis Forecast Forecastquery Gamelift Glacier Globalaccelerator Grafana Greengrass Greengrassv2 Guardduty Health Healthlake Honeycode Iam Identitystore Imagebuilder Importexport Inspector Iot-data Iot-jobs-data Iot Iot1click-devices Iot1click-projects Iotanalytics Iotdeviceadvisor Iotevents-data Iotevents Iotfleethub Iotsecuretunneling Iotsitewise Iotthingsgraph Iotwireless Ivs Kafka Kafkaconnect Kendra Kinesis-video-media Kinesis-video-signaling Kinesis Kinesisanalytics Kinesisanalyticsv2 Kinesisvideo Kms Lakeformation Lambda Lex-models Lex-runtime Lexv2-models Lexv2-runtime License-manager Lightsail Logs Lookoutequipment Lookoutmetrics Lookoutvision Machinelearning Macie Macie2 Managedblockchain Marketplace-catalog Marketplace-entitlement Marketplacecommerceanalytics Mediaconnect Mediaconvert Medialive Mediapackage-vod Mediapackage Mediastore Mediatailor Memorydb Mgh Mgn Migrationhub-config Mobile Mq Mwaa Neptune Networkmanager Nimble Opensearch Opsworks Opsworkscm Organizations Outposts Panorama Personalize-events Personalize-runtime Personalize Pi Pinpoint-email Pinpoint-sms-voice Polly Pricing Proton Qldb-session Qldb Quicksight Ram Rds-data Rds Redshift-data Redshift Rekognition Resource-groups Resourcegroupstaggingapi Robomaker Route53-recovery-cluster Route53-recovery-control-config Route53-recovery-readiness Route53 Route53domains Route53resolver S3 S3control S3outposts Sagemaker-a2i-runtime Sagemaker-edge Sagemaker-featurestore-runtime Sagemaker-runtime Sagemaker Savingsplans Schemas Sdb Secretsmanager Securityhub Serverlessrepo Service-quotas Servicecatalog-appregistry Servicecatalog Servicediscovery Ses Sesv2 Shield Signer Sms-voice Sms Snow-device-management Snowball Sns Sqs Ssm-contacts Ssm-incidents Ssm Sso-admin Sso-oidc Sso Stepfunctions Sts Support Swf Synthetics Textract Timestream-query Timestream-write Transcribe Transfer Translate Voice-id Waf-regional Waf Wafv2 Wellarchitected Wisdom Workdocs Worklink Workmailmessageflow Workspaces Xray

Accessanalyzer Events

Service Event Name Description
accessanalyzer ApplyArchiveRule
CancelPolicyGeneration
Show Description Cancels the requested policy generation.
CreateAccessPreview
Show Description Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.
CreateAnalyzer
Show Description Creates an analyzer for your account.
CreateArchiveRule
DeleteAnalyzer
DeleteArchiveRule
GetAccessPreview
Show Description Retrieves information about an access preview for the specified analyzer.
GetAnalyzedResource
Show Description Retrieves information about a resource that was analyzed.
GetAnalyzer
Show Description Retrieves information about the specified analyzer.
GetArchiveRule
Show Description Retrieves information about an archive rule. To learn about filter keys that you can use to create an archive rule, see IAM Access Analyzer filter keys in the IAM User Guide.
GetFinding
Show Description Retrieves information about the specified finding.
GetGeneratedPolicy
Show Description Retrieves the policy that was generated using StartPolicyGeneration.
ListAccessPreviewFindings
Show Description Retrieves a list of access preview findings generated by the specified access preview.
ListAccessPreviews
Show Description Retrieves a list of access previews for the specified analyzer.
ListAnalyzedResources
Show Description Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer..
ListAnalyzers
Show Description Retrieves a list of analyzers.
ListArchiveRules
Show Description Retrieves a list of archive rules created for the specified analyzer.
ListFindings
Show Description Retrieves a list of findings generated by the specified analyzer. To learn about filter keys that you can use to retrieve a list of findings, see IAM Access Analyzer filter keys in the IAM User Guide.
ListPolicyGenerations
Show Description Lists all of the policy generations requested in the last seven days.
ListTagsForResource
Show Description Retrieves a list of tags applied to the specified resource.
StartPolicyGeneration
Show Description Starts the policy generation request.
StartResourceScan
TagResource
Show Description Adds a tag to the specified resource.
UntagResource
Show Description Removes a tag from the specified resource.
UpdateArchiveRule
UpdateFindings

Account Events

Service Event Name Description
account DeleteAlternateContact
GetAlternateContact
Show Description Retrieves the specified alternate contact attached to an Amazon Web Services account. For complete details about how to use the alternate contact operations, see Access or updating the alternate contacts.

Acm Events

Service Event Name Description
acm AddTagsToCertificate
DeleteCertificate
DescribeCertificate
Show Description Returns detailed metadata about the specified ACM certificate.
ExportCertificate
Show Description Exports a private certificate issued by a private certificate authority (CA) for use anywhere. The exported file contains the certificate, the certificate chain, and the encrypted private 2048-bit RSA key associated with the public key that is embedded in the certificate. For security, you must assign a passphrase for the private key when exporting it. For information about exporting and formatting a certificate using the ACM console or CLI, see Export a Private Certificate.
GetAccountConfiguration
Show Description Returns the account configuration options associated with an Amazon Web Services account.
GetCertificate
Show Description Retrieves an Amazon-issued certificate and its certificate chain. The chain consists of the certificate of the issuing CA and the intermediate certificates of any other subordinate CAs. All of the certificates are base64 encoded. You can use OpenSSL to decode the certificates and inspect individual fields.
ImportCertificate
Show Description Imports a certificate into Amazon Web Services Certificate Manager (ACM) to use with services that are integrated with ACM. Note that integrated services allow only certificate types and keys they support to be associated with their resources. Further, their support differs depending on whether the certificate is imported into IAM or into ACM. For more information, see the documentation for each service. For more information about importing certificates into ACM, see Importing Certificates in the Amazon Web Services Certificate Manager User Guide. ACM does not provide managed renewal for certificates that you import. Note the following guidelines when importing third party certificates:
  • You must enter the private key that matches the certificate you are importing.
  • The private key must be unencrypted. You cannot import a private key that is protected by a password or a passphrase.
  • The private key must be no larger than 5 KB (5,120 bytes).
  • If the certificate you are importing is not self-signed, you must enter its certificate chain.
  • If a certificate chain is included, the issuer must be the subject of one of the certificates in the chain.
  • The certificate, private key, and certificate chain must be PEM-encoded.
  • The current time must be between the Not Before and Not After certificate fields.
  • The Issuer field must not be empty.
  • The OCSP authority URL, if present, must not exceed 1000 characters.
  • To import a new certificate, omit the CertificateArn argument. Include this argument only when you want to replace a previously imported certificate.
  • When you import a certificate by using the CLI, you must specify the certificate, the certificate chain, and the private key by their file names preceded by fileb://. For example, you can specify a certificate saved in the C:\temp folder as fileb://C:\temp\certificate_to_import.pem. If you are making an HTTP or HTTPS Query request, include these arguments as BLOBs.
  • When you import a certificate by using an SDK, you must specify the certificate, the certificate chain, and the private key files in the manner required by the programming language you're using.
  • The cryptographic algorithm of an imported certificate must match the algorithm of the signing CA. For example, if the signing CA key type is RSA, then the certificate key type must also be RSA.
This operation returns the Amazon Resource Name (ARN) of the imported certificate.
ListCertificates
Show Description Retrieves a list of certificate ARNs and domain names. You can request that only certificates that match a specific status be listed. You can also filter by specific attributes of the certificate. Default filtering returns only RSA_2048 certificates. For more information, see Filters.
ListTagsForCertificate
Show Description Lists the tags that have been applied to the ACM certificate. Use the certificate's Amazon Resource Name (ARN) to specify the certificate. To add a tag to an ACM certificate, use the AddTagsToCertificate action. To delete a tag, use the RemoveTagsFromCertificate action.
PutAccountConfiguration
RemoveTagsFromCertificate
RenewCertificate
RequestCertificate
Show Description Requests an ACM certificate for use with other Amazon Web Services services. To request an ACM certificate, you must specify a fully qualified domain name (FQDN) in the DomainName parameter. You can also specify additional FQDNs in the SubjectAlternativeNames parameter. If you are requesting a private certificate, domain validation is not required. If you are requesting a public certificate, each domain name that you specify must be validated to verify that you own or control the domain. You can use DNS validation or email validation. We recommend that you use DNS validation. ACM issues public certificates after receiving approval from the domain owner. ACM behavior differs from the https://tools.ietf.org/html/rfc6125#appendix-B.2RFC 6125 specification of the certificate validation process. first checks for a subject alternative name, and, if it finds one, ignores the common name (CN)
ResendValidationEmail

Amp Events

Service Event Name Description
amp CreateAlertManagerDefinition
Show Description Create an alert manager definition.
CreateRuleGroupsNamespace
Show Description Create a rule group namespace.
CreateWorkspace
Show Description Creates a new AMP workspace.
DeleteAlertManagerDefinition
DeleteRuleGroupsNamespace
DeleteWorkspace
DescribeAlertManagerDefinition
Show Description Describes an alert manager definition.
DescribeRuleGroupsNamespace
Show Description Describe a rule groups namespace.
DescribeWorkspace
Show Description Describes an existing AMP workspace.
ListRuleGroupsNamespaces
Show Description Lists rule groups namespaces.
ListTagsForResource
Show Description Lists the tags you have assigned to the resource.
ListWorkspaces
Show Description Lists all AMP workspaces, including workspaces being created or deleted.
PutAlertManagerDefinition
Show Description Update an alert manager definition.
PutRuleGroupsNamespace
Show Description Update a rule groups namespace.
TagResource
Show Description Creates tags for the specified resource.
UntagResource
Show Description Deletes tags from the specified resource.

Amplify Events

Service Event Name Description
amplify CreateApp
Show Description Creates a new Amplify app.
CreateBackendEnvironment
Show Description Creates a new backend environment for an Amplify app.
CreateBranch
Show Description Creates a new branch for an Amplify app.
CreateDeployment
Show Description Creates a deployment for a manually deployed Amplify app. Manually deployed apps are not connected to a repository.
CreateDomainAssociation
Show Description Creates a new domain association for an Amplify app. This action associates a custom domain with the Amplify app
CreateWebhook
Show Description Creates a new webhook on an Amplify app.
DeleteApp
Show Description Deletes an existing Amplify app specified by an app ID.
DeleteBackendEnvironment
Show Description Deletes a backend environment for an Amplify app.
DeleteBranch
Show Description Deletes a branch for an Amplify app.
DeleteDomainAssociation
Show Description Deletes a domain association for an Amplify app.
DeleteJob
Show Description Deletes a job for a branch of an Amplify app.
DeleteWebhook
Show Description Deletes a webhook.
GenerateAccessLogs
Show Description Returns the website access logs for a specific time range using a presigned URL.
GetApp
Show Description Returns an existing Amplify app by appID.
GetArtifactUrl
Show Description Returns the artifact info that corresponds to an artifact id.
GetBackendEnvironment
Show Description Returns a backend environment for an Amplify app.
GetBranch
Show Description Returns a branch for an Amplify app.
GetDomainAssociation
Show Description Returns the domain information for an Amplify app.
GetJob
Show Description Returns a job for a branch of an Amplify app.
GetWebhook
Show Description Returns the webhook information that corresponds to a specified webhook ID.
ListApps
Show Description Returns a list of the existing Amplify apps.
ListArtifacts
Show Description Returns a list of artifacts for a specified app, branch, and job.
ListBackendEnvironments
Show Description Lists the backend environments for an Amplify app.
ListBranches
Show Description Lists the branches of an Amplify app.
ListDomainAssociations
Show Description Returns the domain associations for an Amplify app.
ListJobs
Show Description Lists the jobs for a branch of an Amplify app.
ListTagsForResource
Show Description Returns a list of tags for a specified Amazon Resource Name (ARN).
ListWebhooks
Show Description Returns a list of webhooks for an Amplify app.
StartDeployment
Show Description Starts a deployment for a manually deployed app. Manually deployed apps are not connected to a repository.
StartJob
Show Description Starts a new job for a branch of an Amplify app.
StopJob
Show Description Stops a job that is in progress for a branch of an Amplify app.
TagResource
Show Description Tags the resource with a tag key and value.
UntagResource
Show Description Untags a resource with a specified Amazon Resource Name (ARN).
UpdateApp
Show Description Updates an existing Amplify app.
UpdateBranch
Show Description Updates a branch for an Amplify app.
UpdateDomainAssociation
Show Description Creates a new domain association for an Amplify app.

Amplifybackend Events

Service Event Name Description
amplifybackend CloneBackend
Show Description This operation clones an existing backend.
CreateBackend
Show Description This operation creates a backend for an Amplify app. Backends are automatically created at the time of app creation.
CreateBackendAPI
Show Description Creates a new backend API resource.
CreateBackendAuth
Show Description Creates a new backend authentication resource.
CreateBackendConfig
Show Description Creates a config object for a backend.
CreateToken
Show Description Generates a one-time challenge code to authenticate a user into your Amplify Admin UI.
DeleteBackend
Show Description Removes an existing environment from your Amplify project.
DeleteBackendAPI
Show Description Deletes an existing backend API resource.
DeleteBackendAuth
Show Description Deletes an existing backend authentication resource.
DeleteToken
Show Description Deletes the challenge token based on the given appId and sessionId.
GenerateBackendAPIModels
Show Description Generates a model schema for an existing backend API resource.
GetBackend
Show Description Provides project-level details for your Amplify UI project.
GetBackendAPI
Show Description Gets the details for a backend API.
GetBackendAPIModels
Show Description Generates a model schema for existing backend API resource.
GetBackendAuth
Show Description Gets a backend auth details.
GetBackendJob
Show Description Returns information about a specific job.
GetToken
Show Description Gets the challenge token based on the given appId and sessionId.
ImportBackendAuth
Show Description Imports an existing backend authentication resource.
ListBackendJobs
Show Description Lists the jobs for the backend of an Amplify app.
RemoveAllBackends
Show Description Removes all backend environments from your Amplify project.
RemoveBackendConfig
Show Description Removes the AWS resources required to access the Amplify Admin UI.
UpdateBackendAPI
Show Description Updates an existing backend API resource.
UpdateBackendAuth
Show Description Updates an existing backend authentication resource.
UpdateBackendConfig
Show Description Updates the AWS resources required to access the Amplify Admin UI.

Apigateway Events

Service Event Name Description
apigateway CreateApiKey
Show Description Create an ApiKey resource.
AWS CLI
CreateAuthorizer
Show Description Adds a new Authorizer resource to an existing RestApi resource.
AWS CLI
CreateBasePathMapping
Show Description Creates a new BasePathMapping resource.
CreateDeployment
Show Description Creates a Deployment resource, which makes a specified RestApi callable over the internet.
CreateDocumentationPart
Show Description None
CreateDocumentationVersion
Show Description None
CreateDomainName
Show Description Creates a new domain name.
CreateModel
Show Description Adds a new Model resource to an existing RestApi resource.
CreateRequestValidator
Show Description Creates a ReqeustValidator of a given RestApi.
CreateResource
Show Description Creates a Resource resource.
CreateRestApi
Show Description Creates a new RestApi resource.
CreateStage
Show Description Creates a new Stage resource that references a pre-existing Deployment for the API.
CreateUsagePlan
Show Description Creates a usage plan with the throttle and quota limits, as well as the associated API stages, specified in the payload.
CreateUsagePlanKey
Show Description Creates a usage plan key for adding an existing API key to a usage plan.
CreateVpcLink
Show Description Creates a VPC link, under the caller's account in a selected region, in an asynchronous operation that typically takes 2-4 minutes to complete and become operational. The caller must have permissions to create and update VPC Endpoint services.
DeleteApiKey
DeleteAuthorizer
DeleteBasePathMapping
DeleteClientCertificate
DeleteDeployment
DeleteDocumentationPart
DeleteDocumentationVersion
DeleteDomainName
DeleteGatewayResponse
DeleteIntegration
DeleteIntegrationResponse
DeleteMethod
DeleteMethodResponse
DeleteModel
DeleteRequestValidator
DeleteResource
DeleteRestApi
DeleteStage
DeleteUsagePlan
DeleteUsagePlanKey
DeleteVpcLink
FlushStageAuthorizersCache
FlushStageCache
GenerateClientCertificate
Show Description Generates a ClientCertificate resource.
GetAccount
Show Description Gets information about the current Account resource.
GetApiKey
Show Description Gets information about the current ApiKey resource.
GetApiKeys
Show Description Gets information about the current ApiKeys resource.
GetAuthorizer
Show Description Describe an existing Authorizer resource.
AWS CLI
GetAuthorizers
Show Description Describe an existing Authorizers resource.
AWS CLI
GetBasePathMapping
Show Description Describe a BasePathMapping resource.
GetBasePathMappings
Show Description Represents a collection of BasePathMapping resources.
GetClientCertificate
Show Description Gets information about the current ClientCertificate resource.
GetClientCertificates
Show Description Gets a collection of ClientCertificate resources.
GetDeployment
Show Description Gets information about a Deployment resource.
GetDeployments
Show Description Gets information about a Deployments collection.
GetDocumentationPart
Show Description None
GetDocumentationParts
Show Description None
GetDocumentationVersion
Show Description None
GetDocumentationVersions
Show Description None
GetDomainName
Show Description Represents a domain name that is contained in a simpler, more intuitive URL that can be called.
GetDomainNames
Show Description Represents a collection of DomainName resources.
GetExport
Show Description Exports a deployed version of a RestApi in a specified format.
GetGatewayResponse
Show Description Gets a GatewayResponse of a specified response type on the given RestApi.
GetGatewayResponses
Show Description Gets the GatewayResponses collection on the given RestApi. If an API developer has not added any definitions for gateway responses, the result will be the API Gateway-generated default GatewayResponses collection for the supported response types.
GetIntegration
Show Description Get the integration settings.
GetIntegrationResponse
Show Description Represents a get integration response.
GetMethod
Show Description Describe an existing Method resource.
GetMethodResponse
Show Description Describes a MethodResponse resource.
GetModel
Show Description Describes an existing model defined for a RestApi resource.
GetModelTemplate
Show Description Generates a sample mapping template that can be used to transform a payload into the structure of a model.
GetModels
Show Description Describes existing Models defined for a RestApi resource.
GetRequestValidator
Show Description Gets a RequestValidator of a given RestApi.
GetRequestValidators
Show Description Gets the RequestValidators collection of a given RestApi.
GetResource
Show Description Lists information about a resource.
GetResources
Show Description Lists information about a collection of Resource resources.
GetRestApi
Show Description Lists the RestApi resource in the collection.
GetRestApis
Show Description Lists the RestApis resources for your collection.
GetSdk
Show Description Generates a client SDK for a RestApi and Stage.
GetSdkType
Show Description None
GetSdkTypes
Show Description None
GetStage
Show Description Gets information about a Stage resource.
GetStages
Show Description Gets information about one or more Stage resources.
GetTags
Show Description Gets the Tags collection for a given resource.
GetUsage
Show Description Gets the usage data of a usage plan in a specified time interval.
GetUsagePlan
Show Description Gets a usage plan of a given plan identifier.
GetUsagePlanKey
Show Description Gets a usage plan key of a given key identifier.
GetUsagePlanKeys
Show Description Gets all the usage plan keys representing the API keys added to a specified usage plan.
GetUsagePlans
Show Description Gets all the usage plans of the caller's account.
GetVpcLink
Show Description Gets a specified VPC link under the caller's account in a region.
GetVpcLinks
Show Description Gets the VpcLinks collection under the caller's account in a selected region.
ImportApiKeys
Show Description Import API keys from an external source, such as a CSV-formatted file.
ImportDocumentationParts
Show Description None
ImportRestApi
Show Description A feature of the API Gateway control service for creating a new API from an external API definition file.
PutGatewayResponse
Show Description Creates a customization of a GatewayResponse of a specified response type and status code on the given RestApi.
PutIntegration
Show Description Sets up a method's integration.
PutIntegrationResponse
Show Description Represents a put integration.
PutMethod
Show Description Add a method to an existing Resource resource.
PutMethodResponse
Show Description Adds a MethodResponse to an existing Method resource.
PutRestApi
Show Description A feature of the API Gateway control service for updating an existing API with an input of external API definitions. The update can take the form of merging the supplied definition into the existing API or overwriting the existing API.
TagResource
TestInvokeAuthorizer
Show Description Simulate the execution of an Authorizer in your RestApi with headers, parameters, and an incoming request body.
Use Lambda Function as Authorizer Use Cognito User Pool as Authorizer
TestInvokeMethod
Show Description Simulate the execution of a Method in your RestApi with headers, parameters, and an incoming request body.
UntagResource
UpdateAccount
Show Description Changes information about the current Account resource.
UpdateApiKey
Show Description Changes information about an ApiKey resource.
UpdateAuthorizer
Show Description Updates an existing Authorizer resource.
AWS CLI
UpdateBasePathMapping
Show Description Changes information about the BasePathMapping resource.
UpdateClientCertificate
Show Description Changes information about an ClientCertificate resource.
UpdateDeployment
Show Description Changes information about a Deployment resource.
UpdateDocumentationPart
Show Description None
UpdateDocumentationVersion
Show Description None
UpdateDomainName
Show Description Changes information about the DomainName resource.
UpdateGatewayResponse
Show Description Updates a GatewayResponse of a specified response type on the given RestApi.
UpdateIntegration
Show Description Represents an update integration.
UpdateIntegrationResponse
Show Description Represents an update integration response.
UpdateMethod
Show Description Updates an existing Method resource.
UpdateMethodResponse
Show Description Updates an existing MethodResponse resource.
UpdateModel
Show Description Changes information about a model.
UpdateRequestValidator
Show Description Updates a RequestValidator of a given RestApi.
UpdateResource
Show Description Changes information about a Resource resource.
UpdateRestApi
Show Description Changes information about the specified API.
UpdateStage
Show Description Changes information about a Stage resource.
UpdateUsage
Show Description Grants a temporary extension to the remaining quota of a usage plan associated with a specified API key.
UpdateUsagePlan
Show Description Updates a usage plan of a given plan Id.

Apigatewaymanagementapi Events

Service Event Name Description
apigatewaymanagementapi DeleteConnection
GetConnection
Show Description Get information about the connection with the provided id.

Apigatewayv2 Events

Service Event Name Description
apigatewayv2 CreateApi
Show Description Creates an Api resource.
CreateApiMapping
Show Description Creates an API mapping.
CreateAuthorizer
Show Description Creates an Authorizer for an API.
CreateDeployment
Show Description Creates a Deployment for an API.
CreateDomainName
Show Description Creates a domain name.
CreateIntegration
Show Description Creates an Integration.
CreateIntegrationResponse
Show Description Creates an IntegrationResponses.
CreateModel
Show Description Creates a Model for an API.
CreateRoute
Show Description Creates a Route for an API.
CreateRouteResponse
Show Description Creates a RouteResponse for a Route.
CreateStage
Show Description Creates a Stage for an API.
CreateVpcLink
Show Description Creates a VPC link.
DeleteAccessLogSettings
DeleteApi
DeleteApiMapping
DeleteAuthorizer
DeleteCorsConfiguration
DeleteDeployment
DeleteDomainName
DeleteIntegration
DeleteIntegrationResponse
DeleteModel
DeleteRoute
DeleteRouteRequestParameter
DeleteRouteResponse
DeleteRouteSettings
DeleteStage
DeleteVpcLink
Show Description Deletes a VPC link.
ExportApi
Show Description None
ResetAuthorizersCache
GetApi
Show Description Gets an Api resource.
GetApiMapping
Show Description Gets an API mapping.
GetApiMappings
Show Description Gets API mappings.
GetApis
Show Description Gets a collection of Api resources.
GetAuthorizer
Show Description Gets an Authorizer.
GetAuthorizers
Show Description Gets the Authorizers for an API.
GetDeployment
Show Description Gets a Deployment.
GetDeployments
Show Description Gets the Deployments for an API.
GetDomainName
Show Description Gets a domain name.
GetDomainNames
Show Description Gets the domain names for an AWS account.
GetIntegration
Show Description Gets an Integration.
GetIntegrationResponse
Show Description Gets an IntegrationResponses.
GetIntegrationResponses
Show Description Gets the IntegrationResponses for an Integration.
GetIntegrations
Show Description Gets the Integrations for an API.
GetModel
Show Description Gets a Model.
GetModelTemplate
Show Description Gets a model template.
GetModels
Show Description Gets the Models for an API.
GetRoute
Show Description Gets a Route.
GetRouteResponse
Show Description Gets a RouteResponse.
GetRouteResponses
Show Description Gets the RouteResponses for a Route.
GetRoutes
Show Description Gets the Routes for an API.
GetStage
Show Description Gets a Stage.
GetStages
Show Description Gets the Stages for an API.
GetTags
Show Description Gets a collection of Tag resources.
GetVpcLink
Show Description Gets a VPC link.
GetVpcLinks
Show Description Gets a collection of VPC links.
ImportApi
Show Description Imports an API.
ReimportApi
Show Description Puts an Api resource.
TagResource
Show Description Creates a new Tag resource to represent a tag.
UntagResource
UpdateApi
Show Description Updates an Api resource.
UpdateApiMapping
Show Description The API mapping.
UpdateAuthorizer
Show Description Updates an Authorizer.
UpdateDeployment
Show Description Updates a Deployment.
UpdateDomainName
Show Description Updates a domain name.
UpdateIntegration
Show Description Updates an Integration.
UpdateIntegrationResponse
Show Description Updates an IntegrationResponses.
UpdateModel
Show Description Updates a Model.
UpdateRoute
Show Description Updates a Route.
UpdateRouteResponse
Show Description Updates a RouteResponse.
UpdateStage
Show Description Updates a Stage.

Appconfig Events

Service Event Name Description
appconfig CreateApplication
Show Description An application in AppConfig is a logical unit of code that provides capabilities for your customers. For example, an application can be a microservice that runs on Amazon EC2 instances, a mobile application installed by your users, a serverless application using Amazon API Gateway and AWS Lambda, or any system you run on behalf of others.
CreateConfigurationProfile
Show Description Information that enables AppConfig to access the configuration source. Valid configuration sources include Systems Manager (SSM) documents, SSM Parameter Store parameters, and Amazon S3 objects. A configuration profile includes the following information.
  • The Uri location of the configuration data.
  • The AWS Identity and Access Management (IAM) role that provides access to the configuration data.
  • A validator for the configuration data. Available validators include either a JSON Schema or an AWS Lambda function.
For more information, see Create a Configuration and a Configuration Profile in the AWS AppConfig User Guide.
CreateDeploymentStrategy
Show Description A deployment strategy defines important criteria for rolling out your configuration to the designated targets. A deployment strategy includes: the overall duration required, a percentage of targets to receive the deployment during each interval, an algorithm that defines how percentage grows, and bake time.
CreateEnvironment
Show Description For each application, you define one or more environments. An environment is a logical deployment group of AppConfig targets, such as applications in a Beta or Production environment. You can also define environments for application subcomponents such as the Web, Mobile and Back-end components for your application. You can configure Amazon CloudWatch alarms for each environment. The system monitors alarms during a configuration deployment. If an alarm is triggered, the system rolls back the configuration.
CreateHostedConfigurationVersion
Show Description Create a new configuration in the AppConfig configuration store.
DeleteApplication
DeleteConfigurationProfile
DeleteDeploymentStrategy
DeleteEnvironment
DeleteHostedConfigurationVersion
GetApplication
Show Description Retrieve information about an application.
GetConfiguration
Show Description Receive information about a configuration. AWS AppConfig uses the value of the ClientConfigurationVersion parameter to identify the configuration version on your clients. If you don’t send ClientConfigurationVersion with each call to GetConfiguration, your clients receive the current configuration. You are charged each time your clients receive a configuration. To avoid excess charges, we recommend that you include the ClientConfigurationVersion value with every call to GetConfiguration. This value must be saved on your client. Subsequent calls to GetConfiguration must pass this value by using the ClientConfigurationVersion parameter.
GetConfigurationProfile
Show Description Retrieve information about a configuration profile.
GetDeployment
Show Description Retrieve information about a configuration deployment.
GetDeploymentStrategy
Show Description Retrieve information about a deployment strategy. A deployment strategy defines important criteria for rolling out your configuration to the designated targets. A deployment strategy includes: the overall duration required, a percentage of targets to receive the deployment during each interval, an algorithm that defines how percentage grows, and bake time.
GetEnvironment
Show Description Retrieve information about an environment. An environment is a logical deployment group of AppConfig applications, such as applications in a Production environment or in an EU_Region environment. Each configuration deployment targets an environment. You can enable one or more Amazon CloudWatch alarms for an environment. If an alarm is triggered during a deployment, AppConfig roles back the configuration.
GetHostedConfigurationVersion
Show Description Get information about a specific configuration version.
ListApplications
Show Description List all applications in your AWS account.
ListConfigurationProfiles
Show Description Lists the configuration profiles for an application.
ListDeploymentStrategies
Show Description List deployment strategies.
ListDeployments
Show Description Lists the deployments for an environment.
ListEnvironments
Show Description List the environments for an application.
ListHostedConfigurationVersions
Show Description View a list of configurations stored in the AppConfig configuration store by version.
ListTagsForResource
Show Description Retrieves the list of key-value tags assigned to the resource.
StartDeployment
Show Description Starts a deployment.
StopDeployment
Show Description Stops a deployment. This API action works only on deployments that have a status of DEPLOYING. This action moves the deployment to a status of ROLLED_BACK.
TagResource
UntagResource
UpdateApplication
Show Description Updates an application.
UpdateConfigurationProfile
Show Description Updates a configuration profile.
UpdateDeploymentStrategy
Show Description Updates a deployment strategy.
UpdateEnvironment
Show Description Updates an environment.

Appflow Events

Service Event Name Description
appflow CreateConnectorProfile
Show Description Creates a new connector profile associated with your Amazon Web Services account. There is a soft quota of 100 connector profiles per Amazon Web Services account. If you need more connector profiles than this quota allows, you can submit a request to the Amazon AppFlow team through the Amazon AppFlow support channel.
CreateFlow
Show Description Enables your application to create a new flow using Amazon AppFlow. You must create a connector profile before calling this API. Please note that the Request Syntax below shows syntax for multiple destinations, however, you can only transfer data to one item in this list at a time. Amazon AppFlow does not currently support flows to multiple destinations at once.
DeleteConnectorProfile
Show Description Enables you to delete an existing connector profile.
DeleteFlow
Show Description Enables your application to delete an existing flow. Before deleting the flow, Amazon AppFlow validates the request by checking the flow configuration and status. You can delete flows one at a time.
DescribeConnectorEntity
Show Description Provides details regarding the entity used with the connector, with a description of the data model for each entity.
DescribeConnectorProfiles
Show Description Returns a list of connector-profile details matching the provided connector-profile names and connector-types. Both input lists are optional, and you can use them to filter the result. If no names or connector-types are provided, returns all connector profiles in a paginated form. If there is no match, this operation returns an empty list.
DescribeConnectors
Show Description Describes the connectors vended by Amazon AppFlow for specified connector types. If you don't specify a connector type, this operation describes all connectors vended by Amazon AppFlow. If there are more connectors than can be returned in one page, the response contains a nextToken object, which can be be passed in to the next call to the DescribeConnectors API operation to retrieve the next page.
DescribeFlow
Show Description Provides a description of the specified flow.
DescribeFlowExecutionRecords
Show Description Fetches the execution history of the flow.
ListConnectorEntities
Show Description Returns the list of available connector entities supported by Amazon AppFlow. For example, you can query Salesforce for Account and Opportunity entities, or query ServiceNow for the Incident entity.
ListFlows
Show Description Lists all of the flows associated with your account.
ListTagsForResource
Show Description Retrieves the tags that are associated with a specified flow.
StartFlow
Show Description Activates an existing flow. For on-demand flows, this operation runs the flow immediately. For schedule and event-triggered flows, this operation activates the flow.
StopFlow
Show Description Deactivates the existing flow. For on-demand flows, this operation returns an unsupportedOperationException error message. For schedule and event-triggered flows, this operation deactivates the flow.
TagResource
Show Description Applies a tag to the specified flow.
UntagResource
Show Description Removes a tag from the specified flow.
UpdateConnectorProfile
Show Description Updates a given connector profile associated with your account.

Appintegrations Events

Service Event Name Description
appintegrations CreateDataIntegration
Show Description Creates and persists a DataIntegration resource. You cannot create a DataIntegration association for a DataIntegration that has been previously associated. Use a different DataIntegration, or recreate the DataIntegration using the CreateDataIntegration API.
CreateEventIntegration
Show Description Creates an EventIntegration, given a specified name, description, and a reference to an Amazon EventBridge bus in your account and a partner event source that pushes events to that bus. No objects are created in the your account, only metadata that is persisted on the EventIntegration control plane.
DeleteDataIntegration
Show Description Deletes the DataIntegration. Only DataIntegrations that don't have any DataIntegrationAssociations can be deleted. Deleting a DataIntegration also deletes the underlying Amazon AppFlow flow and service linked role. You cannot create a DataIntegration association for a DataIntegration that has been previously associated. Use a different DataIntegration, or recreate the DataIntegration using the CreateDataIntegration API.
DeleteEventIntegration
Show Description Deletes the specified existing event integration. If the event integration is associated with clients, the request is rejected.
GetDataIntegration
Show Description Returns information about the DataIntegration. You cannot create a DataIntegration association for a DataIntegration that has been previously associated. Use a different DataIntegration, or recreate the DataIntegration using the CreateDataIntegration API.
GetEventIntegration
Show Description Returns information about the event integration.
ListDataIntegrationAssociations
Show Description Returns a paginated list of DataIntegration associations in the account. You cannot create a DataIntegration association for a DataIntegration that has been previously associated. Use a different DataIntegration, or recreate the DataIntegration using the CreateDataIntegration API.
ListDataIntegrations
Show Description Returns a paginated list of DataIntegrations in the account. You cannot create a DataIntegration association for a DataIntegration that has been previously associated. Use a different DataIntegration, or recreate the DataIntegration using the CreateDataIntegration API.
ListEventIntegrationAssociations
Show Description Returns a paginated list of event integration associations in the account.
ListEventIntegrations
Show Description Returns a paginated list of event integrations in the account.
ListTagsForResource
Show Description Lists the tags for the specified resource.
TagResource
Show Description Adds the specified tags to the specified resource.
UntagResource
Show Description Removes the specified tags from the specified resource.
UpdateDataIntegration
Show Description Updates the description of a DataIntegration. You cannot create a DataIntegration association for a DataIntegration that has been previously associated. Use a different DataIntegration, or recreate the DataIntegration using the CreateDataIntegration API.

Application-autoscaling Events

Service Event Name Description
application-autoscaling DeleteScalingPolicy
Show Description Deletes the specified scaling policy for an Application Auto Scaling scalable target. Deleting a step scaling policy deletes the underlying alarm action, but does not delete the CloudWatch alarm associated with the scaling policy, even if it no longer has an associated action. For more information, see Delete a step scaling policy and Delete a target tracking scaling policy in the Application Auto Scaling User Guide.
DeleteScheduledAction
Show Description Deletes the specified scheduled action for an Application Auto Scaling scalable target. For more information, see Delete a scheduled action in the Application Auto Scaling User Guide.
DeregisterScalableTarget
Show Description Deregisters an Application Auto Scaling scalable target when you have finished using it. To see which resources have been registered, use DescribeScalableTargets. Deregistering a scalable target deletes the scaling policies and the scheduled actions that are associated with it.
DescribeScalableTargets
Show Description Gets information about the scalable targets in the specified namespace. You can filter the results using ResourceIds and ScalableDimension.
DescribeScalingActivities
Show Description Provides descriptive information about the scaling activities in the specified namespace from the previous six weeks. You can filter the results using ResourceId and ScalableDimension.
DescribeScalingPolicies
Show Description Describes the Application Auto Scaling scaling policies for the specified service namespace. You can filter the results using ResourceId, ScalableDimension, and PolicyNames. For more information, see Target tracking scaling policies and Step scaling policies in the Application Auto Scaling User Guide.
DescribeScheduledActions
Show Description Describes the Application Auto Scaling scheduled actions for the specified service namespace. You can filter the results using the ResourceId, ScalableDimension, and ScheduledActionNames parameters. For more information, see Scheduled scaling and Managing scheduled scaling in the Application Auto Scaling User Guide.
PutScalingPolicy
Show Description Creates or updates a scaling policy for an Application Auto Scaling scalable target. Each scalable target is identified by a service namespace, resource ID, and scalable dimension. A scaling policy applies to the scalable target identified by those three attributes. You cannot create a scaling policy until you have registered the resource as a scalable target. Multiple scaling policies can be in force at the same time for the same scalable target. You can have one or more target tracking scaling policies, one or more step scaling policies, or both. However, there is a chance that multiple policies could conflict, instructing the scalable target to scale out or in at the same time. Application Auto Scaling gives precedence to the policy that provides the largest capacity for both scale out and scale in. For example, if one policy increases capacity by 3, another policy increases capacity by 200 percent, and the current capacity is 10, Application Auto Scaling uses the policy with the highest calculated capacity (200% of 10 = 20) and scales out to 30. We recommend caution, however, when using target tracking scaling policies with step scaling policies because conflicts between these policies can cause undesirable behavior. For example, if the step scaling policy initiates a scale-in activity before the target tracking policy is ready to scale in, the scale-in activity will not be blocked. After the scale-in activity completes, the target tracking policy could instruct the scalable target to scale out again. For more information, see Target tracking scaling policies and Step scaling policies in the Application Auto Scaling User Guide. If a scalable target is deregistered, the scalable target is no longer available to execute scaling policies. Any scaling policies that were specified for the scalable target are deleted.
PutScheduledAction
Show Description Creates or updates a scheduled action for an Application Auto Scaling scalable target. Each scalable target is identified by a service namespace, resource ID, and scalable dimension. A scheduled action applies to the scalable target identified by those three attributes. You cannot create a scheduled action until you have registered the resource as a scalable target. When start and end times are specified with a recurring schedule using a cron expression or rates, they form the boundaries for when the recurring action starts and stops. To update a scheduled action, specify the parameters that you want to change. If you don't specify start and end times, the old values are deleted. For more information, see Scheduled scaling in the Application Auto Scaling User Guide. If a scalable target is deregistered, the scalable target is no longer available to run scheduled actions. Any scheduled actions that were specified for the scalable target are deleted.

Applicationcostprofiler Events

Service Event Name Description
applicationcostprofiler DeleteReportDefinition
Show Description Deletes the specified report definition in AWS Application Cost Profiler. This stops the report from being generated.
GetReportDefinition
Show Description Retrieves the definition of a report already configured in AWS Application Cost Profiler.
ImportApplicationUsage
Show Description Ingests application usage data from Amazon Simple Storage Service (Amazon S3). The data must already exist in the S3 location. As part of the action, AWS Application Cost Profiler copies the object from your S3 bucket to an S3 bucket owned by Amazon for processing asynchronously.
ListReportDefinitions
Show Description Retrieves a list of all reports and their configurations for your AWS account. The maximum number of reports is one.
PutReportDefinition
Show Description Creates the report definition for a report in Application Cost Profiler.

Appmesh Events

Service Event Name Description
appmesh CreateGatewayRoute
Show Description Creates a gateway route. A gateway route is attached to a virtual gateway and routes traffic to an existing virtual service. If a route matches a request, it can distribute traffic to a target virtual service. For more information about gateway routes, see Gateway routes.
CreateMesh
Show Description Creates a service mesh. A service mesh is a logical boundary for network traffic between services that are represented by resources within the mesh. After you create your service mesh, you can create virtual services, virtual nodes, virtual routers, and routes to distribute traffic between the applications in your mesh. For more information about service meshes, see Service meshes.
CreateRoute
Show Description Creates a route that is associated with a virtual router. You can route several different protocols and define a retry policy for a route. Traffic can be routed to one or more virtual nodes. For more information about routes, see Routes.
CreateVirtualGateway
Show Description Creates a virtual gateway. A virtual gateway allows resources outside your mesh to communicate to resources that are inside your mesh. The virtual gateway represents an Envoy proxy running in an Amazon ECS task, in a Kubernetes service, or on an Amazon EC2 instance. Unlike a virtual node, which represents an Envoy running with an application, a virtual gateway represents Envoy deployed by itself. For more information about virtual gateways, see Virtual gateways.
CreateVirtualNode
Show Description Creates a virtual node within a service mesh. A virtual node acts as a logical pointer to a particular task group, such as an Amazon ECS service or a Kubernetes deployment. When you create a virtual node, you can specify the service discovery information for your task group, and whether the proxy running in a task group will communicate with other proxies using Transport Layer Security (TLS). You define a listener for any inbound traffic that your virtual node expects. Any virtual service that your virtual node expects to communicate to is specified as a backend. The response metadata for your new virtual node contains the arn that is associated with the virtual node. Set this value to the full ARN; for example, arn:aws:appmesh:us-west-2:123456789012:myMesh/default/virtualNode/myApp) as the APPMESH_RESOURCE_ARN environment variable for your task group's Envoy proxy container in your task definition or pod spec. This is then mapped to the node.id and node.cluster Envoy parameters. By default, App Mesh uses the name of the resource you specified in APPMESH_RESOURCE_ARN when Envoy is referring to itself in metrics and traces. You can override this behavior by setting the APPMESH_RESOURCE_CLUSTER environment variable with your own name. For more information about virtual nodes, see Virtual nodes. You must be using 1.15.0 or later of the Envoy image when setting these variables. For more information aboutApp Mesh Envoy variables, see Envoy image in the AWS App Mesh User Guide.
CreateVirtualRouter
Show Description Creates a virtual router within a service mesh. Specify a listener for any inbound traffic that your virtual router receives. Create a virtual router for each protocol and port that you need to route. Virtual routers handle traffic for one or more virtual services within your mesh. After you create your virtual router, create and associate routes for your virtual router that direct incoming requests to different virtual nodes. For more information about virtual routers, see Virtual routers.
CreateVirtualService
Show Description Creates a virtual service within a service mesh. A virtual service is an abstraction of a real service that is provided by a virtual node directly or indirectly by means of a virtual router. Dependent services call your virtual service by its virtualServiceName, and those requests are routed to the virtual node or virtual router that is specified as the provider for the virtual service. For more information about virtual services, see Virtual services.
DeleteGatewayRoute
Show Description Deletes an existing gateway route.
DeleteMesh
Show Description Deletes an existing service mesh. You must delete all resources (virtual services, routes, virtual routers, and virtual nodes) in the service mesh before you can delete the mesh itself.
DeleteRoute
Show Description Deletes an existing route.
DeleteVirtualGateway
Show Description Deletes an existing virtual gateway. You cannot delete a virtual gateway if any gateway routes are associated to it.
DeleteVirtualNode
Show Description Deletes an existing virtual node. You must delete any virtual services that list a virtual node as a service provider before you can delete the virtual node itself.
DeleteVirtualRouter
Show Description Deletes an existing virtual router. You must delete any routes associated with the virtual router before you can delete the router itself.
DeleteVirtualService
Show Description Deletes an existing virtual service.
DescribeGatewayRoute
Show Description Describes an existing gateway route.
DescribeMesh
Show Description Describes an existing service mesh.
DescribeRoute
Show Description Describes an existing route.
DescribeVirtualGateway
Show Description Describes an existing virtual gateway.
DescribeVirtualNode
Show Description Describes an existing virtual node.
DescribeVirtualRouter
Show Description Describes an existing virtual router.
DescribeVirtualService
Show Description Describes an existing virtual service.
ListGatewayRoutes
Show Description Returns a list of existing gateway routes that are associated to a virtual gateway.
ListMeshes
Show Description Returns a list of existing service meshes.
ListRoutes
Show Description Returns a list of existing routes in a service mesh.
ListTagsForResource
Show Description List the tags for an App Mesh resource.
ListVirtualGateways
Show Description Returns a list of existing virtual gateways in a service mesh.
ListVirtualNodes
Show Description Returns a list of existing virtual nodes.
ListVirtualRouters
Show Description Returns a list of existing virtual routers in a service mesh.
ListVirtualServices
Show Description Returns a list of existing virtual services in a service mesh.
TagResource
Show Description Associates the specified tags to a resource with the specified resourceArn. If existing tags on a resource aren't specified in the request parameters, they aren't changed. When a resource is deleted, the tags associated with that resource are also deleted.
UntagResource
Show Description Deletes specified tags from a resource.
UpdateGatewayRoute
Show Description Updates an existing gateway route that is associated to a specified virtual gateway in a service mesh.
UpdateMesh
Show Description Updates an existing service mesh.
UpdateRoute
Show Description Updates an existing route for a specified service mesh and virtual router.
UpdateVirtualGateway
Show Description Updates an existing virtual gateway in a specified service mesh.
UpdateVirtualNode
Show Description Updates an existing virtual node in a specified service mesh.
UpdateVirtualRouter
Show Description Updates an existing virtual router in a specified service mesh.

Apprunner Events

Service Event Name Description
apprunner AssociateCustomDomain
Show Description Associate your own domain name with the App Runner subdomain URL of your App Runner service. After you call AssociateCustomDomain and receive a successful response, use the information in the CustomDomain record that's returned to add CNAME records to your Domain Name System (DNS). For each mapped domain name, add a mapping to the target App Runner subdomain and one or more certificate validation records. App Runner then performs DNS validation to verify that you own or control the domain name that you associated. App Runner tracks domain validity in a certificate stored in AWS Certificate Manager (ACM).
CreateAutoScalingConfiguration
Show Description Create an App Runner automatic scaling configuration resource. App Runner requires this resource when you create App Runner services that require non-default auto scaling settings. You can share an auto scaling configuration across multiple services. Create multiple revisions of a configuration by using the same AutoScalingConfigurationName and different AutoScalingConfigurationRevision values. When you create a service, you can set it to use the latest active revision of an auto scaling configuration or a specific revision. Configure a higher MinSize to increase the spread of your App Runner service over more Availability Zones in the Amazon Web Services Region. The tradeoff is a higher minimal cost. Configure a lower MaxSize to control your cost. The tradeoff is lower responsiveness during peak demand.
CreateConnection
Show Description Create an App Runner connection resource. App Runner requires a connection resource when you create App Runner services that access private repositories from certain third-party providers. You can share a connection across multiple services. A connection resource is needed to access GitHub repositories. GitHub requires a user interface approval process through the App Runner console before you can use the connection.
CreateService
Show Description Create an App Runner service. After the service is created, the action also automatically starts a deployment. This is an asynchronous operation. On a successful call, you can use the returned OperationId and the ListOperations call to track the operation's progress.
DeleteAutoScalingConfiguration
Show Description Delete an App Runner automatic scaling configuration resource. You can delete a specific revision or the latest active revision. You can't delete a configuration that's used by one or more App Runner services.
DeleteConnection
Show Description Delete an App Runner connection. You must first ensure that there are no running App Runner services that use this connection. If there are any, the DeleteConnection action fails.
DeleteService
Show Description Delete an App Runner service. This is an asynchronous operation. On a successful call, you can use the returned OperationId and the ListOperations call to track the operation's progress.
DescribeAutoScalingConfiguration
Show Description Return a full description of an App Runner automatic scaling configuration resource.
DescribeCustomDomains
Show Description Return a description of custom domain names that are associated with an App Runner service.
DescribeService
Show Description Return a full description of an App Runner service.
DisassociateCustomDomain
Show Description Disassociate a custom domain name from an App Runner service. Certificates tracking domain validity are associated with a custom domain and are stored in AWS Certificate Manager (ACM). These certificates aren't deleted as part of this action. App Runner delays certificate deletion for 30 days after a domain is disassociated from your service.
ListAutoScalingConfigurations
Show Description Returns a list of App Runner automatic scaling configurations in your Amazon Web Services account. You can query the revisions for a specific configuration name or the revisions for all configurations in your account. You can optionally query only the latest revision of each requested name.
ListConnections
Show Description Returns a list of App Runner connections that are associated with your Amazon Web Services account.
ListOperations
Show Description Return a list of operations that occurred on an App Runner service. The resulting list of OperationSummary objects is sorted in reverse chronological order. The first object on the list represents the last started operation.
ListServices
Show Description Returns a list of running App Runner services in your Amazon Web Services account.
ListTagsForResource
Show Description List tags that are associated with for an App Runner resource. The response contains a list of tag key-value pairs.
PauseService
Show Description Pause an active App Runner service. App Runner reduces compute capacity for the service to zero and loses state (for example, ephemeral storage is removed). This is an asynchronous operation. On a successful call, you can use the returned OperationId and the ListOperations call to track the operation's progress.
ResumeService
Show Description Resume an active App Runner service. App Runner provisions compute capacity for the service. This is an asynchronous operation. On a successful call, you can use the returned OperationId and the ListOperations call to track the operation's progress.
StartDeployment
Show Description Initiate a manual deployment of the latest commit in a source code repository or the latest image in a source image repository to an App Runner service. For a source code repository, App Runner retrieves the commit and builds a Docker image. For a source image repository, App Runner retrieves the latest Docker image. In both cases, App Runner then deploys the new image to your service and starts a new container instance. This is an asynchronous operation. On a successful call, you can use the returned OperationId and the ListOperations call to track the operation's progress.
TagResource
Show Description Add tags to, or update the tag values of, an App Runner resource. A tag is a key-value pair.
UntagResource
Show Description Remove tags from an App Runner resource.

Appstream Events

Service Event Name Description
appstream AssociateFleet
Show Description Associates the specified fleet with the specified stack.
BatchAssociateUserStack
Show Description Associates the specified users with the specified stacks. Users in a user pool cannot be assigned to stacks with fleets that are joined to an Active Directory domain.
BatchDisassociateUserStack
Show Description Disassociates the specified users from the specified stacks.
CopyImage
Show Description Copies the image within the same region or to a new region within the same AWS account. Note that any tags you added to the image will not be copied.
CreateDirectoryConfig
Show Description Creates a Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.
CreateFleet
Show Description Creates a fleet. A fleet consists of streaming instances that run a specified image.
CreateImageBuilder
Show Description Creates an image builder. An image builder is a virtual machine that is used to create an image. The initial state of the builder is PENDING. When it is ready, the state is RUNNING.
CreateImageBuilderStreamingURL
Show Description Creates a URL to start an image builder streaming session.
CreateStack
Show Description Creates a stack to start streaming applications to users. A stack consists of an associated fleet, user access policies, and storage configurations.
CreateStreamingURL
Show Description Creates a temporary URL to start an AppStream 2.0 streaming session for the specified user. A streaming URL enables application streaming to be tested without user setup.
CreateUpdatedImage
Show Description Creates a new image with the latest Windows operating system updates, driver updates, and AppStream 2.0 agent software. For more information, see the "Update an Image by Using Managed AppStream 2.0 Image Updates" section in Administer Your AppStream 2.0 Images, in the Amazon AppStream 2.0 Administration Guide.
CreateUsageReportSubscription
Show Description Creates a usage report subscription. Usage reports are generated daily.
CreateUser
Show Description Creates a new user in the user pool.
DeleteDirectoryConfig
Show Description Deletes the specified Directory Config object from AppStream 2.0. This object includes the information required to join streaming instances to an Active Directory domain.
DeleteFleet
Show Description Deletes the specified fleet.
DeleteImage
Show Description Deletes the specified image. You cannot delete an image when it is in use. After you delete an image, you cannot provision new capacity using the image.
DeleteImageBuilder
Show Description Deletes the specified image builder and releases the capacity.
DeleteImagePermissions
Show Description Deletes permissions for the specified private image. After you delete permissions for an image, AWS accounts to which you previously granted these permissions can no longer use the image.
DeleteStack
Show Description Deletes the specified stack. After the stack is deleted, the application streaming environment provided by the stack is no longer available to users. Also, any reservations made for application streaming sessions for the stack are released.
DeleteUsageReportSubscription
Show Description Disables usage report generation.
DeleteUser
Show Description Deletes a user from the user pool.
DescribeDirectoryConfigs
Show Description Retrieves a list that describes one or more specified Directory Config objects for AppStream 2.0, if the names for these objects are provided. Otherwise, all Directory Config objects in the account are described. These objects include the configuration information required to join fleets and image builders to Microsoft Active Directory domains. Although the response syntax in this topic includes the account password, this password is not returned in the actual response.
DescribeFleets
Show Description Retrieves a list that describes one or more specified fleets, if the fleet names are provided. Otherwise, all fleets in the account are described.
DescribeImageBuilders
Show Description Retrieves a list that describes one or more specified image builders, if the image builder names are provided. Otherwise, all image builders in the account are described.
DescribeImagePermissions
Show Description Retrieves a list that describes the permissions for shared AWS account IDs on a private image that you own.
DescribeImages
Show Description Retrieves a list that describes one or more specified images, if the image names or image ARNs are provided. Otherwise, all images in the account are described.
DescribeSessions
Show Description Retrieves a list that describes the streaming sessions for a specified stack and fleet. If a UserId is provided for the stack and fleet, only streaming sessions for that user are described. If an authentication type is not provided, the default is to authenticate users using a streaming URL.
DescribeStacks
Show Description Retrieves a list that describes one or more specified stacks, if the stack names are provided. Otherwise, all stacks in the account are described.
DescribeUsageReportSubscriptions
Show Description Retrieves a list that describes one or more usage report subscriptions.
DescribeUserStackAssociations
Show Description Retrieves a list that describes the UserStackAssociation objects. You must specify either or both of the following:
  • The stack name
  • The user name (email address of the user associated with the stack) and the authentication type for the user
DescribeUsers
Show Description Retrieves a list that describes one or more specified users in the user pool.
DisableUser
Show Description Disables the specified user in the user pool. Users can't sign in to AppStream 2.0 until they are re-enabled. This action does not delete the user.
DisassociateFleet
Show Description Disassociates the specified fleet from the specified stack.
EnableUser
Show Description Enables a user in the user pool. After being enabled, users can sign in to AppStream 2.0 and open applications from the stacks to which they are assigned.
ExpireSession
Show Description Immediately stops the specified streaming session.
ListAssociatedFleets
Show Description Retrieves the name of the fleet that is associated with the specified stack.
ListAssociatedStacks
Show Description Retrieves the name of the stack with which the specified fleet is associated.
ListTagsForResource
Show Description Retrieves a list of all tags for the specified AppStream 2.0 resource. You can tag AppStream 2.0 image builders, images, fleets, and stacks. For more information about tags, see Tagging Your Resources in the Amazon AppStream 2.0 Administration Guide.
StartFleet
Show Description Starts the specified fleet.
StartImageBuilder
Show Description Starts the specified image builder.
StopFleet
Show Description Stops the specified fleet.
StopImageBuilder
Show Description Stops the specified image builder.
TagResource
Show Description Adds or overwrites one or more tags for the specified AppStream 2.0 resource. You can tag AppStream 2.0 image builders, images, fleets, and stacks. Each tag consists of a key and an optional value. If a resource already has a tag with the same key, this operation updates its value. To list the current tags for your resources, use ListTagsForResource. To disassociate tags from your resources, use UntagResource. For more information about tags, see Tagging Your Resources in the Amazon AppStream 2.0 Administration Guide.
UntagResource
Show Description Disassociates one or more specified tags from the specified AppStream 2.0 resource. To list the current tags for your resources, use ListTagsForResource. For more information about tags, see Tagging Your Resources in the Amazon AppStream 2.0 Administration Guide.
UpdateDirectoryConfig
Show Description Updates the specified Directory Config object in AppStream 2.0. This object includes the configuration information required to join fleets and image builders to Microsoft Active Directory domains.
UpdateFleet
Show Description Updates the specified fleet. If the fleet is in the STOPPED state, you can update any attribute except the fleet name. If the fleet is in the RUNNING state, you can update the DisplayName, ComputeCapacity, ImageARN, ImageName, IdleDisconnectTimeoutInSeconds, and DisconnectTimeoutInSeconds attributes. If the fleet is in the STARTING or STOPPING state, you can't update it.
UpdateImagePermissions
Show Description Adds or updates permissions for the specified private image.

Appsync Events

Service Event Name Description
appsync CreateApiCache
Show Description Creates a cache for the GraphQL API.
CreateApiKey
Show Description Creates a unique key that you can distribute to clients who are executing your API.
CreateDataSource
Show Description Creates a DataSource object.
CreateFunction
Show Description Creates a Function object. A function is a reusable entity. Multiple functions can be used to compose the resolver logic.
CreateGraphqlApi
Show Description Creates a GraphqlApi object.
CreateResolver
Show Description Creates a Resolver object. A resolver converts incoming requests into a format that a data source can understand and converts the data source's responses into GraphQL.
CreateType
Show Description Creates a Type object.
DeleteApiCache
Show Description Deletes an ApiCache object.
DeleteApiKey
Show Description Deletes an API key.
DeleteDataSource
Show Description Deletes a DataSource object.
DeleteFunction
Show Description Deletes a Function.
DeleteGraphqlApi
Show Description Deletes a GraphqlApi object.
DeleteResolver
Show Description Deletes a Resolver object.
DeleteType
Show Description Deletes a Type object.
FlushApiCache
Show Description Flushes an ApiCache object.
GetApiCache
Show Description Retrieves an ApiCache object.
GetDataSource
Show Description Retrieves a DataSource object.
GetFunction
Show Description Get a Function.
GetGraphqlApi
Show Description Retrieves a GraphqlApi object.
GetIntrospectionSchema
Show Description Retrieves the introspection schema for a GraphQL API.
GetResolver
Show Description Retrieves a Resolver object.
GetSchemaCreationStatus
Show Description Retrieves the current status of a schema creation operation.
GetType
Show Description Retrieves a Type object.
ListApiKeys
Show Description Lists the API keys for a given API. API keys are deleted automatically 60 days after they expire. However, they may still be included in the response until they have actually been deleted. You can safely call DeleteApiKey to manually delete a key before it's automatically deleted.
ListDataSources
Show Description Lists the data sources for a given API.
ListFunctions
Show Description List multiple functions.
ListGraphqlApis
Show Description Lists your GraphQL APIs.
ListResolvers
Show Description Lists the resolvers for a given API and type.
ListResolversByFunction
Show Description List the resolvers that are associated with a specific function.
ListTagsForResource
Show Description Lists the tags for a resource.
ListTypes
Show Description Lists the types for a given API.
StartSchemaCreation
Show Description Adds a new schema to your GraphQL API. This operation is asynchronous. Use to determine when it has completed.
TagResource
Show Description Tags a resource with user-supplied tags.
UntagResource
Show Description Untags a resource.
UpdateApiCache
Show Description Updates the cache for the GraphQL API.
UpdateApiKey
Show Description Updates an API key. The key can be updated while it is not deleted.
UpdateDataSource
Show Description Updates a DataSource object.
UpdateFunction
Show Description Updates a Function object.
UpdateGraphqlApi
Show Description Updates a GraphqlApi object.
UpdateResolver
Show Description Updates a Resolver object.

Athena Events

Service Event Name Description
athena BatchGetNamedQuery
Show Description Returns the details of a single named query or a list of up to 50 queries, which you provide as an array of query ID strings. Requires you to have access to the workgroup in which the queries were saved. Use ListNamedQueriesInput to get the list of named query IDs in the specified workgroup. If information could not be retrieved for a submitted query ID, information about the query ID submitted is listed under UnprocessedNamedQueryId. Named queries differ from executed queries. Use BatchGetQueryExecutionInput to get details about each unique query execution, and ListQueryExecutionsInput to get a list of query execution IDs.
BatchGetQueryExecution
Show Description Returns the details of a single query execution or a list of up to 50 query executions, which you provide as an array of query execution ID strings. Requires you to have access to the workgroup in which the queries ran. To get a list of query execution IDs, use ListQueryExecutionsInput$WorkGroup. Query executions differ from named (saved) queries. Use BatchGetNamedQueryInput to get details about named queries.
CreateDataCatalog
Show Description Creates (registers) a data catalog with the specified name and properties. Catalogs created are visible to all users of the same Amazon Web Services account.
CreateNamedQuery
Show Description Creates a named query in the specified workgroup. Requires that you have access to the workgroup. For code samples using the Amazon Web Services SDK for Java, see Examples and Code Samples in the Amazon Athena User Guide.
CreatePreparedStatement
Show Description Creates a prepared statement for use with SQL queries in Athena.
CreateWorkGroup
Show Description Creates a workgroup with the specified name.
DeleteDataCatalog
Show Description Deletes a data catalog.
DeleteNamedQuery
Show Description Deletes the named query if you have access to the workgroup in which the query was saved. For code samples using the Amazon Web Services SDK for Java, see Examples and Code Samples in the Amazon Athena User Guide.
DeletePreparedStatement
Show Description Deletes the prepared statement with the specified name from the specified workgroup.
DeleteWorkGroup
Show Description Deletes the workgroup with the specified name. The primary workgroup cannot be deleted.
GetDataCatalog
Show Description Returns the specified data catalog.
GetDatabase
Show Description Returns a database object for the specified database and data catalog.
GetNamedQuery
Show Description Returns information about a single query. Requires that you have access to the workgroup in which the query was saved.
GetPreparedStatement
Show Description Retrieves the prepared statement with the specified name from the specified workgroup.
GetQueryExecution
Show Description Returns information about a single execution of a query if you have access to the workgroup in which the query ran. Each time a query executes, information about the query execution is saved with a unique ID.
GetQueryResults
Show Description Streams the results of a single query execution specified by QueryExecutionId from the Athena query results location in Amazon S3. For more information, see Query Results in the Amazon Athena User Guide. This request does not execute the query but returns results. Use StartQueryExecution to run a query. To stream query results successfully, the IAM principal with permission to call GetQueryResults also must have permissions to the Amazon S3 GetObject action for the Athena query results location. IAM principals with permission to the Amazon S3 GetObject action for the query results location are able to retrieve query results from Amazon S3 even if permission to the GetQueryResults action is denied. To restrict user or role access, ensure that Amazon S3 permissions to the Athena query location are denied.
GetTableMetadata
Show Description Returns table metadata for the specified catalog, database, and table.
GetWorkGroup
Show Description Returns information about the workgroup with the specified name.
ListDataCatalogs
Show Description Lists the data catalogs in the current Amazon Web Services account.
ListDatabases
Show Description Lists the databases in the specified data catalog.
ListEngineVersions
Show Description Returns a list of engine versions that are available to choose from, including the Auto option.
ListNamedQueries
Show Description Provides a list of available query IDs only for queries saved in the specified workgroup. Requires that you have access to the specified workgroup. If a workgroup is not specified, lists the saved queries for the primary workgroup. For code samples using the Amazon Web Services SDK for Java, see Examples and Code Samples in the Amazon Athena User Guide.
ListPreparedStatements
Show Description Lists the prepared statements in the specfied workgroup.
ListQueryExecutions
Show Description Provides a list of available query execution IDs for the queries in the specified workgroup. If a workgroup is not specified, returns a list of query execution IDs for the primary workgroup. Requires you to have access to the workgroup in which the queries ran. For code samples using the Amazon Web Services SDK for Java, see Examples and Code Samples in the Amazon Athena User Guide.
ListTableMetadata
Show Description Lists the metadata for the tables in the specified data catalog database.
ListTagsForResource
Show Description Lists the tags associated with an Athena workgroup or data catalog resource.
ListWorkGroups
Show Description Lists available workgroups for the account.
StartQueryExecution
Show Description Runs the SQL query statements contained in the Query. Requires you to have access to the workgroup in which the query ran. Running queries against an external catalog requires GetDataCatalog permission to the catalog. For code samples using the Amazon Web Services SDK for Java, see Examples and Code Samples in the Amazon Athena User Guide.
StopQueryExecution
Show Description Stops a query execution. Requires you to have access to the workgroup in which the query ran. For code samples using the Amazon Web Services SDK for Java, see Examples and Code Samples in the Amazon Athena User Guide.
TagResource
Show Description Adds one or more tags to an Athena resource. A tag is a label that you assign to a resource. In Athena, a resource can be a workgroup or data catalog. Each tag consists of a key and an optional value, both of which you define. For example, you can use tags to categorize Athena workgroups or data catalogs by purpose, owner, or environment. Use a consistent set of tag keys to make it easier to search and filter workgroups or data catalogs in your account. For best practices, see Tagging Best Practices. Tag keys can be from 1 to 128 UTF-8 Unicode characters, and tag values can be from 0 to 256 UTF-8 Unicode characters. Tags can use letters and numbers representable in UTF-8, and the following characters: + - = . _ : / @. Tag keys and values are case-sensitive. Tag keys must be unique per resource. If you specify more than one tag, separate them by commas.
UntagResource
Show Description Removes one or more tags from a data catalog or workgroup resource.
UpdateDataCatalog
Show Description Updates the data catalog that has the specified name.
UpdatePreparedStatement
Show Description Updates a prepared statement.

Auditmanager Events

Service Event Name Description
auditmanager AssociateAssessmentReportEvidenceFolder
Show Description Associates an evidence folder to an assessment report in a Audit Manager assessment.
BatchAssociateAssessmentReportEvidence
Show Description Associates a list of evidence to an assessment report in an Audit Manager assessment.
BatchCreateDelegationByAssessment
Show Description Creates a batch of delegations for an assessment in Audit Manager.
BatchDeleteDelegationByAssessment
Show Description Deletes a batch of delegations for an assessment in Audit Manager.
BatchDisassociateAssessmentReportEvidence
Show Description Disassociates a list of evidence from an assessment report in Audit Manager.
BatchImportEvidenceToAssessmentControl
Show Description Uploads one or more pieces of evidence to a control in an Audit Manager assessment.
CreateAssessment
Show Description Creates an assessment in Audit Manager.
CreateAssessmentFramework
Show Description Creates a custom framework in Audit Manager.
CreateAssessmentReport
Show Description Creates an assessment report for the specified assessment.
CreateControl
Show Description Creates a new custom control in Audit Manager.
DeleteAssessment
Show Description Deletes an assessment in Audit Manager.
DeleteAssessmentFramework
Show Description Deletes a custom framework in Audit Manager.
DeleteAssessmentFrameworkShare
Show Description Deletes a share request for a custom framework in Audit Manager.
DeleteAssessmentReport
Show Description Deletes an assessment report from an assessment in Audit Manager.
DeleteControl
Show Description Deletes a custom control in Audit Manager.
DeregisterAccount
Show Description Deregisters an account in Audit Manager.
DeregisterOrganizationAdminAccount
Show Description Removes the specified member Amazon Web Services account as a delegated administrator for Audit Manager. When you remove a delegated administrator from your Audit Manager settings, you continue to have access to the evidence that you previously collected under that account. This is also the case when you deregister a delegated administrator from Audit Manager. However, Audit Manager will stop collecting and attaching evidence to that delegated administrator account moving forward.
DisassociateAssessmentReportEvidenceFolder
Show Description Disassociates an evidence folder from the specified assessment report in Audit Manager.
GetAccountStatus
Show Description Returns the registration status of an account in Audit Manager.
GetAssessment
Show Description Returns an assessment from Audit Manager.
GetAssessmentFramework
Show Description Returns a framework from Audit Manager.
GetAssessmentReportUrl
Show Description Returns the URL of an assessment report in Audit Manager.
GetChangeLogs
Show Description Returns a list of changelogs from Audit Manager.
GetControl
Show Description Returns a control from Audit Manager.
GetDelegations
Show Description Returns a list of delegations from an audit owner to a delegate.
GetEvidence
Show Description Returns evidence from Audit Manager.
GetEvidenceByEvidenceFolder
Show Description Returns all evidence from a specified evidence folder in Audit Manager.
GetEvidenceFolder
Show Description Returns an evidence folder from the specified assessment in Audit Manager.
GetEvidenceFoldersByAssessment
Show Description Returns the evidence folders from a specified assessment in Audit Manager.
GetEvidenceFoldersByAssessmentControl
Show Description Returns a list of evidence folders that are associated with a specified control of an assessment in Audit Manager.
GetOrganizationAdminAccount
Show Description Returns the name of the delegated Amazon Web Services administrator account for the organization.
GetServicesInScope
Show Description Returns a list of the in-scope Amazon Web Services services for the specified assessment.
GetSettings
Show Description Returns the settings for the specified Amazon Web Services account.
ListAssessmentFrameworkShareRequests
Show Description Returns a list of sent or received share requests for custom frameworks in Audit Manager.
ListAssessmentFrameworks
Show Description Returns a list of the frameworks that are available in the Audit Manager framework library.
ListAssessmentReports
Show Description Returns a list of assessment reports created in Audit Manager.
ListAssessments
Show Description Returns a list of current and past assessments from Audit Manager.
ListControls
Show Description Returns a list of controls from Audit Manager.
ListKeywordsForDataSource
Show Description Returns a list of keywords that are pre-mapped to the specified control data source.
ListNotifications
Show Description Returns a list of all Audit Manager notifications.
ListTagsForResource
Show Description Returns a list of tags for the specified resource in Audit Manager.
RegisterAccount
Show Description Enables Audit Manager for the specified Amazon Web Services account.
RegisterOrganizationAdminAccount
Show Description Enables an Amazon Web Services account within the organization as the delegated administrator for Audit Manager.
StartAssessmentFrameworkShare
Show Description Creates a share request for a custom framework in Audit Manager. The share request specifies a recipient and notifies them that a custom framework is available. Recipients have 120 days to accept or decline the request. If no action is taken, the share request expires. When you invoke the StartAssessmentFrameworkShare API, you are about to share a custom framework with another Amazon Web Services account. You may not share a custom framework that is derived from a standard framework if the standard framework is designated as not eligible for sharing by Amazon Web Services, unless you have obtained permission to do so from the owner of the standard framework. To learn more about which standard frameworks are eligible for sharing, see Framework sharing eligibility in the Audit Manager User Guide.
TagResource
Show Description Tags the specified resource in Audit Manager.
UntagResource
Show Description Removes a tag from a resource in Audit Manager.
UpdateAssessment
Show Description Edits an Audit Manager assessment.
UpdateAssessmentControl
Show Description Updates a control within an assessment in Audit Manager.
UpdateAssessmentControlSetStatus
Show Description Updates the status of a control set in an Audit Manager assessment.
UpdateAssessmentFramework
Show Description Updates a custom framework in Audit Manager.
UpdateAssessmentFrameworkShare
Show Description Updates a share request for a custom framework in Audit Manager.
UpdateAssessmentStatus
Show Description Updates the status of an assessment in Audit Manager.
UpdateControl
Show Description Updates a custom control in Audit Manager.
UpdateSettings
Show Description Updates Audit Manager settings for the current user account.

Autoscaling-plans Events

Service Event Name Description
autoscaling-plans CreateScalingPlan
Show Description Creates a scaling plan.
DeleteScalingPlan
Show Description Deletes the specified scaling plan. Deleting a scaling plan deletes the underlying ScalingInstruction for all of the scalable resources that are covered by the plan. If the plan has launched resources or has scaling activities in progress, you must delete those resources separately.
DescribeScalingPlanResources
Show Description Describes the scalable resources in the specified scaling plan.
DescribeScalingPlans
Show Description Describes one or more of your scaling plans.
GetScalingPlanResourceForecastData
Show Description Retrieves the forecast data for a scalable resource. Capacity forecasts are represented as predicted values, or data points, that are calculated using historical data points from a specified CloudWatch load metric. Data points are available for up to 56 days.

Autoscaling Events

Service Event Name Description
autoscaling AttachInstances
AttachLoadBalancerTargetGroups
Show Description Attaches one or more target groups to the specified Auto Scaling group. This operation is used with the following load balancer types:
  • Application Load Balancer - Operates at the application layer (layer 7) and supports HTTP and HTTPS.
  • Network Load Balancer - Operates at the transport layer (layer 4) and supports TCP, TLS, and UDP.
  • Gateway Load Balancer - Operates at the network layer (layer 3).
To describe the target groups for an Auto Scaling group, call the DescribeLoadBalancerTargetGroups API. To detach the target group from the Auto Scaling group, call the DetachLoadBalancerTargetGroups API. For more information, see Elastic Load Balancing and Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
AttachLoadBalancers
Show Description To attach an Application Load Balancer, Network Load Balancer, or Gateway Load Balancer, use the AttachLoadBalancerTargetGroups API operation instead. Attaches one or more Classic Load Balancers to the specified Auto Scaling group. Amazon EC2 Auto Scaling registers the running instances with these Classic Load Balancers. To describe the load balancers for an Auto Scaling group, call the DescribeLoadBalancers API. To detach the load balancer from the Auto Scaling group, call the DetachLoadBalancers API. For more information, see Elastic Load Balancing and Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
BatchDeleteScheduledAction
Show Description Deletes one or more scheduled actions for the specified Auto Scaling group.
BatchPutScheduledUpdateGroupAction
Show Description Creates or updates one or more scheduled scaling actions for an Auto Scaling group.
CancelInstanceRefresh
Show Description Cancels an instance refresh operation in progress. Cancellation does not roll back any replacements that have already been completed, but it prevents new replacements from being started. This operation is part of the instance refresh feature in Amazon EC2 Auto Scaling, which helps you update instances in your Auto Scaling group after you make configuration changes.
CompleteLifecycleAction
Show Description Completes the lifecycle action for the specified token or instance with the specified result. This step is a part of the procedure for adding a lifecycle hook to an Auto Scaling group:
  1. (Optional) Create a Lambda function and a rule that allows CloudWatch Events to invoke your Lambda function when Amazon EC2 Auto Scaling launches or terminates instances.
  2. (Optional) Create a notification target and an IAM role. The target can be either an Amazon SQS queue or an Amazon SNS topic. The role allows Amazon EC2 Auto Scaling to publish lifecycle notifications to the target.
  3. Create the lifecycle hook. Specify whether the hook is used when the instances launch or terminate.
  4. If you need more time, record the lifecycle action heartbeat to keep the instance in a pending state.
  5. If you finish before the timeout period ends, complete the lifecycle action.
For more information, see Amazon EC2 Auto Scaling lifecycle hooks in the Amazon EC2 Auto Scaling User Guide.
CreateAutoScalingGroup
CreateLaunchConfiguration
CreateOrUpdateTags
DeleteAutoScalingGroup
DeleteLaunchConfiguration
DeleteLifecycleHook
Show Description Deletes the specified lifecycle hook. If there are any outstanding lifecycle actions, they are completed first (ABANDON for launching instances, CONTINUE for terminating instances).
DeleteNotificationConfiguration
DeletePolicy
DeleteScheduledAction
DeleteTags
DeleteWarmPool
Show Description Deletes the warm pool for the specified Auto Scaling group. For more information, see Warm pools for Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
DescribeAccountLimits
Show Description Describes the current Amazon EC2 Auto Scaling resource quotas for your account. When you establish an Amazon Web Services account, the account has initial quotas on the maximum number of Auto Scaling groups and launch configurations that you can create in a given Region. For more information, see Amazon EC2 Auto Scaling service quotas in the Amazon EC2 Auto Scaling User Guide.
DescribeAdjustmentTypes
Show Description Describes the available adjustment types for step scaling and simple scaling policies. The following adjustment types are supported:
  • ChangeInCapacity
  • ExactCapacity
  • PercentChangeInCapacity
DescribeAutoScalingGroups
Show Description Gets information about the Auto Scaling groups in the account and Region. If you specify Auto Scaling group names, the output includes information for only the specified Auto Scaling groups. If you specify filters, the output includes information for only those Auto Scaling groups that meet the filter criteria. If you do not specify group names or filters, the output includes information for all Auto Scaling groups. This operation also returns information about instances in Auto Scaling groups. To retrieve information about the instances in a warm pool, you must call the DescribeWarmPool API.
DescribeAutoScalingInstances
Show Description Gets information about the Auto Scaling instances in the account and Region.
DescribeAutoScalingNotificationTypes
Show Description Describes the notification types that are supported by Amazon EC2 Auto Scaling.
DescribeInstanceRefreshes
Show Description Gets information about the instance refreshes for the specified Auto Scaling group. This operation is part of the instance refresh feature in Amazon EC2 Auto Scaling, which helps you update instances in your Auto Scaling group after you make configuration changes. To help you determine the status of an instance refresh, this operation returns information about the instance refreshes you previously initiated, including their status, end time, the percentage of the instance refresh that is complete, and the number of instances remaining to update before the instance refresh is complete. The following are the possible statuses:
  • Pending - The request was created, but the operation has not started.
  • InProgress - The operation is in progress.
  • Successful - The operation completed successfully.
  • Failed - The operation failed to complete. You can troubleshoot using the status reason and the scaling activities.
  • Cancelling - An ongoing operation is being cancelled. Cancellation does not roll back any replacements that have already been completed, but it prevents new replacements from being started.
  • Cancelled - The operation is cancelled.
DescribeLaunchConfigurations
Show Description Gets information about the launch configurations in the account and Region.
DescribeLifecycleHookTypes
Show Description Describes the available types of lifecycle hooks. The following hook types are supported:
  • autoscaling:EC2_INSTANCE_LAUNCHING
  • autoscaling:EC2_INSTANCE_TERMINATING
DescribeLifecycleHooks
Show Description Gets information about the lifecycle hooks for the specified Auto Scaling group.
DescribeLoadBalancerTargetGroups
Show Description Gets information about the load balancer target groups for the specified Auto Scaling group. To determine the availability of registered instances, use the State element in the response. When you attach a target group to an Auto Scaling group, the initial State value is Adding. The state transitions to Added after all Auto Scaling instances are registered with the target group. If Elastic Load Balancing health checks are enabled for the Auto Scaling group, the state transitions to InService after at least one Auto Scaling instance passes the health check. When the target group is in the InService state, Amazon EC2 Auto Scaling can terminate and replace any instances that are reported as unhealthy. If no registered instances pass the health checks, the target group doesn't enter the InService state. Target groups also have an InService state if you attach them in the CreateAutoScalingGroup API call. If your target group state is InService, but it is not working properly, check the scaling activities by calling DescribeScalingActivities and take any corrective actions necessary. For help with failed health checks, see Troubleshooting Amazon EC2 Auto Scaling: Health checks in the Amazon EC2 Auto Scaling User Guide. For more information, see Elastic Load Balancing and Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
DescribeLoadBalancers
Show Description Gets information about the load balancers for the specified Auto Scaling group. This operation describes only Classic Load Balancers. If you have Application Load Balancers, Network Load Balancers, or Gateway Load Balancers, use the DescribeLoadBalancerTargetGroups API instead. To determine the availability of registered instances, use the State element in the response. When you attach a load balancer to an Auto Scaling group, the initial State value is Adding. The state transitions to Added after all Auto Scaling instances are registered with the load balancer. If Elastic Load Balancing health checks are enabled for the Auto Scaling group, the state transitions to InService after at least one Auto Scaling instance passes the health check. When the load balancer is in the InService state, Amazon EC2 Auto Scaling can terminate and replace any instances that are reported as unhealthy. If no registered instances pass the health checks, the load balancer doesn't enter the InService state. Load balancers also have an InService state if you attach them in the CreateAutoScalingGroup API call. If your load balancer state is InService, but it is not working properly, check the scaling activities by calling DescribeScalingActivities and take any corrective actions necessary. For help with failed health checks, see Troubleshooting Amazon EC2 Auto Scaling: Health checks in the Amazon EC2 Auto Scaling User Guide. For more information, see Elastic Load Balancing and Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
DescribeMetricCollectionTypes
Show Description Describes the available CloudWatch metrics for Amazon EC2 Auto Scaling. The GroupStandbyInstances metric is not returned by default. You must explicitly request this metric when calling the EnableMetricsCollection API.
DescribeNotificationConfigurations
Show Description Gets information about the Amazon SNS notifications that are configured for one or more Auto Scaling groups.
DescribePolicies
Show Description Gets information about the scaling policies in the account and Region.
DescribeScalingActivities
Show Description Gets information about the scaling activities in the account and Region. When scaling events occur, you see a record of the scaling activity in the scaling activities. For more information, see Verifying a scaling activity for an Auto Scaling group in the Amazon EC2 Auto Scaling User Guide. If the scaling event succeeds, the value of the StatusCode element in the response is Successful. If an attempt to launch instances failed, the StatusCode value is Failed or Cancelled and the StatusMessage element in the response indicates the cause of the failure. For help interpreting the StatusMessage, see Troubleshooting Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
DescribeScalingProcessTypes
Show Description Describes the scaling process types for use with the ResumeProcesses and SuspendProcesses APIs.
DescribeScheduledActions
Show Description Gets information about the scheduled actions that haven't run or that have not reached their end time. To describe the scaling activities for scheduled actions that have already run, call the DescribeScalingActivities API.
DescribeTags
Show Description Describes the specified tags. You can use filters to limit the results. For example, you can query for the tags for a specific Auto Scaling group. You can specify multiple values for a filter. A tag must match at least one of the specified values for it to be included in the results. You can also specify multiple filters. The result includes information for a particular tag only if it matches all the filters. If there's no match, no special message is returned. For more information, see Tagging Auto Scaling groups and instances in the Amazon EC2 Auto Scaling User Guide.
DescribeTerminationPolicyTypes
Show Description Describes the termination policies supported by Amazon EC2 Auto Scaling. For more information, see Controlling which Auto Scaling instances terminate during scale in in the Amazon EC2 Auto Scaling User Guide.
DescribeWarmPool
Show Description Gets information about a warm pool and its instances. For more information, see Warm pools for Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
DetachInstances
Show Description Removes one or more instances from the specified Auto Scaling group. After the instances are detached, you can manage them independent of the Auto Scaling group. If you do not specify the option to decrement the desired capacity, Amazon EC2 Auto Scaling launches instances to replace the ones that are detached. If there is a Classic Load Balancer attached to the Auto Scaling group, the instances are deregistered from the load balancer. If there are target groups attached to the Auto Scaling group, the instances are deregistered from the target groups. For more information, see Detach EC2 instances from your Auto Scaling group in the Amazon EC2 Auto Scaling User Guide.
DetachLoadBalancerTargetGroups
Show Description Detaches one or more target groups from the specified Auto Scaling group.
DetachLoadBalancers
Show Description Detaches one or more Classic Load Balancers from the specified Auto Scaling group. This operation detaches only Classic Load Balancers. If you have Application Load Balancers, Network Load Balancers, or Gateway Load Balancers, use the DetachLoadBalancerTargetGroups API instead. When you detach a load balancer, it enters the Removing state while deregistering the instances in the group. When all instances are deregistered, then you can no longer describe the load balancer using the DescribeLoadBalancers API call. The instances remain running.
DisableMetricsCollection
EnableMetricsCollection
EnterStandby
Show Description Moves the specified instances into the standby state. If you choose to decrement the desired capacity of the Auto Scaling group, the instances can enter standby as long as the desired capacity of the Auto Scaling group after the instances are placed into standby is equal to or greater than the minimum capacity of the group. If you choose not to decrement the desired capacity of the Auto Scaling group, the Auto Scaling group launches new instances to replace the instances on standby. For more information, see Temporarily removing instances from your Auto Scaling group in the Amazon EC2 Auto Scaling User Guide.
ExecutePolicy
ExitStandby
Show Description Moves the specified instances out of the standby state. After you put the instances back in service, the desired capacity is incremented. For more information, see Temporarily removing instances from your Auto Scaling group in the Amazon EC2 Auto Scaling User Guide.
GetPredictiveScalingForecast
Show Description Retrieves the forecast data for a predictive scaling policy. Load forecasts are predictions of the hourly load values using historical load data from CloudWatch and an analysis of historical trends. Capacity forecasts are represented as predicted values for the minimum capacity that is needed on an hourly basis, based on the hourly load forecast. A minimum of 24 hours of data is required to create the initial forecasts. However, having a full 14 days of historical data results in more accurate forecasts. For more information, see Predictive scaling for Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide.
PutLifecycleHook
Show Description Creates or updates a lifecycle hook for the specified Auto Scaling group. A lifecycle hook tells Amazon EC2 Auto Scaling to perform an action on an instance when the instance launches (before it is put into service) or as the instance terminates (before it is fully terminated). This step is a part of the procedure for adding a lifecycle hook to an Auto Scaling group:
  1. (Optional) Create a Lambda function and a rule that allows CloudWatch Events to invoke your Lambda function when Amazon EC2 Auto Scaling launches or terminates instances.
  2. (Optional) Create a notification target and an IAM role. The target can be either an Amazon SQS queue or an Amazon SNS topic. The role allows Amazon EC2 Auto Scaling to publish lifecycle notifications to the target.
  3. Create the lifecycle hook. Specify whether the hook is used when the instances launch or terminate.
  4. If you need more time, record the lifecycle action heartbeat to keep the instance in a pending state using the RecordLifecycleActionHeartbeat API call.
  5. If you finish before the timeout period ends, complete the lifecycle action using the CompleteLifecycleAction API call.
For more information, see Amazon EC2 Auto Scaling lifecycle hooks in the Amazon EC2 Auto Scaling User Guide. If you exceed your maximum limit of lifecycle hooks, which by default is 50 per Auto Scaling group, the call fails. You can view the lifecycle hooks for an Auto Scaling group using the DescribeLifecycleHooks API call. If you are no longer using a lifecycle hook, you can delete it by calling the DeleteLifecycleHook API.
PutNotificationConfiguration
PutScalingPolicy
Show Description Creates or updates a scaling policy for an Auto Scaling group. Scaling policies are used to scale an Auto Scaling group based on configurable metrics. If no policies are defined, the dynamic scaling and predictive scaling features are not used. For more information about using dynamic scaling, see Target tracking scaling policies and Step and simple scaling policies in the Amazon EC2 Auto Scaling User Guide. For more information about using predictive scaling, see Predictive scaling for Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide. You can view the scaling policies for an Auto Scaling group using the DescribePolicies API call. If you are no longer using a scaling policy, you can delete it by calling the DeletePolicy API.
PutScheduledUpdateGroupAction
PutWarmPool
Show Description Creates or updates a warm pool for the specified Auto Scaling group. A warm pool is a pool of pre-initialized EC2 instances that sits alongside the Auto Scaling group. Whenever your application needs to scale out, the Auto Scaling group can draw on the warm pool to meet its new desired capacity. For more information and example configurations, see Warm pools for Amazon EC2 Auto Scaling in the Amazon EC2 Auto Scaling User Guide. This operation must be called from the Region in which the Auto Scaling group was created. This operation cannot be called on an Auto Scaling group that has a mixed instances policy or a launch template or launch configuration that requests Spot Instances. You can view the instances in the warm pool using the DescribeWarmPool API call. If you are no longer using a warm pool, you can delete it by calling the DeleteWarmPool API.
RecordLifecycleActionHeartbeat
Show Description Records a heartbeat for the lifecycle action associated with the specified token or instance. This extends the timeout by the length of time defined using the PutLifecycleHook API call. This step is a part of the procedure for adding a lifecycle hook to an Auto Scaling group:
  1. (Optional) Create a Lambda function and a rule that allows CloudWatch Events to invoke your Lambda function when Amazon EC2 Auto Scaling launches or terminates instances.
  2. (Optional) Create a notification target and an IAM role. The target can be either an Amazon SQS queue or an Amazon SNS topic. The role allows Amazon EC2 Auto Scaling to publish lifecycle notifications to the target.
  3. Create the lifecycle hook. Specify whether the hook is used when the instances launch or terminate.
  4. If you need more time, record the lifecycle action heartbeat to keep the instance in a pending state.
  5. If you finish before the timeout period ends, complete the lifecycle action.
For more information, see Amazon EC2 Auto Scaling lifecycle hooks in the Amazon EC2 Auto Scaling User Guide.
ResumeProcesses
SetDesiredCapacity
SetInstanceHealth
SetInstanceProtection
Show Description Updates the instance protection settings of the specified instances. This operation cannot be called on instances in a warm pool. For more information about preventing instances that are part of an Auto Scaling group from terminating on scale in, see Instance scale-in protection in the Amazon EC2 Auto Scaling User Guide. If you exceed your maximum limit of instance IDs, which is 50 per Auto Scaling group, the call fails.
StartInstanceRefresh
Show Description Starts a new instance refresh operation. An instance refresh performs a rolling replacement of all or some instances in an Auto Scaling group. Each instance is terminated first and then replaced, which temporarily reduces the capacity available within your Auto Scaling group. This operation is part of the instance refresh feature in Amazon EC2 Auto Scaling, which helps you update instances in your Auto Scaling group. This feature is helpful, for example, when you have a new AMI or a new user data script. You just need to create a new launch template that specifies the new AMI or user data script. Then start an instance refresh to immediately begin the process of updating instances in the group. If the call succeeds, it creates a new instance refresh request with a unique ID that you can use to track its progress. To query its status, call the DescribeInstanceRefreshes API. To describe the instance refreshes that have already run, call the DescribeInstanceRefreshes API. To cancel an instance refresh operation in progress, use the CancelInstanceRefresh API.
SuspendProcesses
TerminateInstanceInAutoScalingGroup
Show Description Terminates the specified instance and optionally adjusts the desired group size. This operation cannot be called on instances in a warm pool. This call simply makes a termination request. The instance is not terminated immediately. When an instance is terminated, the instance status changes to terminated. You can't connect to or start an instance after you've terminated it. If you do not specify the option to decrement the desired capacity, Amazon EC2 Auto Scaling launches instances to replace the ones that are terminated. By default, Amazon EC2 Auto Scaling balances instances across all Availability Zones. If you decrement the desired capacity, your Auto Scaling group can become unbalanced between Availability Zones. Amazon EC2 Auto Scaling tries to rebalance the group, and rebalancing might terminate instances in other zones. For more information, see Rebalancing activities in the Amazon EC2 Auto Scaling User Guide.

Batch Events

Service Event Name Description
batch CancelJob
Show Description Cancels a job in an Batch job queue. Jobs that are in the SUBMITTED, PENDING, or RUNNABLE state are canceled. Jobs that have progressed to STARTING or RUNNING aren't canceled, but the API operation still succeeds, even if no job is canceled. These jobs must be terminated with the TerminateJob operation.
CreateComputeEnvironment
Show Description Creates an Batch compute environment. You can create MANAGED or UNMANAGED compute environments. MANAGED compute environments can use Amazon EC2 or Fargate resources. UNMANAGED compute environments can only use EC2 resources. In a managed compute environment, Batch manages the capacity and instance types of the compute resources within the environment. This is based on the compute resource specification that you define or the launch template that you specify when you create the compute environment. Either, you can choose to use EC2 On-Demand Instances and EC2 Spot Instances. Or, you can use Fargate and Fargate Spot capacity in your managed compute environment. You can optionally set a maximum price so that Spot Instances only launch when the Spot Instance price is less than a specified percentage of the On-Demand price. Multi-node parallel jobs aren't supported on Spot Instances. In an unmanaged compute environment, you can manage your own EC2 compute resources and have a lot of flexibility with how you configure your compute resources. For example, you can use custom AMIs. However, you must verify that each of your AMIs meet the Amazon ECS container instance AMI specification. For more information, see container instance AMIs in the Amazon Elastic Container Service Developer Guide. After you created your unmanaged compute environment, you can use the DescribeComputeEnvironments operation to find the Amazon ECS cluster that's associated with it. Then, launch your container instances into that Amazon ECS cluster. For more information, see Launching an Amazon ECS container instance in the Amazon Elastic Container Service Developer Guide. Batch doesn't upgrade the AMIs in a compute environment after the environment is created. For example, it doesn't update the AMIs when a newer version of the Amazon ECS optimized AMI is available. Therefore, you're responsible for managing the guest operating system (including its updates and security patches) and any additional application software or utilities that you install on the compute resources. To use a new AMI for your Batch jobs, complete these steps:
  1. Create a new compute environment with the new AMI.
  2. Add the compute environment to an existing job queue.
  3. Remove the earlier compute environment from your job queue.
  4. Delete the earlier compute environment.
CreateJobQueue
Show Description Creates an Batch job queue. When you create a job queue, you associate one or more compute environments to the queue and assign an order of preference for the compute environments. You also set a priority to the job queue that determines the order that the Batch scheduler places jobs onto its associated compute environments. For example, if a compute environment is associated with more than one job queue, the job queue with a higher priority is given preference for scheduling jobs to that compute environment.
DeleteComputeEnvironment
Show Description Deletes an Batch compute environment. Before you can delete a compute environment, you must set its state to DISABLED with the UpdateComputeEnvironment API operation and disassociate it from any job queues with the UpdateJobQueue API operation. Compute environments that use Fargate resources must terminate all active jobs on that compute environment before deleting the compute environment. If this isn't done, the compute environment enters an invalid state.
DeleteJobQueue
Show Description Deletes the specified job queue. You must first disable submissions for a queue with the UpdateJobQueue operation. All jobs in the queue are eventually terminated when you delete a job queue. The jobs are terminated at a rate of about 16 jobs each second. It's not necessary to disassociate compute environments from a queue before submitting a DeleteJobQueue request.
DeregisterJobDefinition
Show Description Deregisters an Batch job definition. Job definitions are permanently deleted after 180 days.
DescribeComputeEnvironments
Show Description Describes one or more of your compute environments. If you're using an unmanaged compute environment, you can use the DescribeComputeEnvironment operation to determine the ecsClusterArn that you should launch your Amazon ECS container instances into.
DescribeJobDefinitions
Show Description Describes a list of job definitions. You can specify a status (such as ACTIVE) to only return job definitions that match that status.
DescribeJobQueues
Show Description Describes one or more of your job queues.
DescribeJobs
Show Description Describes a list of Batch jobs.
ListJobs
Show Description Returns a list of Batch jobs. You must specify only one of the following items:
  • A job queue ID to return a list of jobs in that job queue
  • A multi-node parallel job ID to return a list of nodes for that job
  • An array job ID to return a list of the children for that job
You can filter the results by job status with the jobStatus parameter. If you don't specify a status, only RUNNING jobs are returned.
ListTagsForResource
Show Description Lists the tags for an Batch resource. Batch resources that support tags are compute environments, jobs, job definitions, and job queues. ARNs for child jobs of array and multi-node parallel (MNP) jobs are not supported.
RegisterJobDefinition
Show Description Registers an Batch job definition.
SubmitJob
Show Description Submits an Batch job from a job definition. Parameters that are specified during SubmitJob override parameters defined in the job definition. vCPU and memory requirements that are specified in the ResourceRequirements objects in the job definition are the exception. They can't be overridden this way using the memory and vcpus parameters. Rather, you must specify updates to job definition parameters in a ResourceRequirements object that's included in the containerOverrides parameter. Jobs that run on Fargate resources can't be guaranteed to run for more than 14 days. This is because, after 14 days, Fargate resources might become unavailable and job might be terminated.
TagResource
Show Description Associates the specified tags to a resource with the specified resourceArn. If existing tags on a resource aren't specified in the request parameters, they aren't changed. When a resource is deleted, the tags that are associated with that resource are deleted as well. Batch resources that support tags are compute environments, jobs, job definitions, and job queues. ARNs for child jobs of array and multi-node parallel (MNP) jobs are not supported.
TerminateJob
Show Description Terminates a job in a job queue. Jobs that are in the STARTING or RUNNING state are terminated, which causes them to transition to FAILED. Jobs that have not progressed to the STARTING state are cancelled.
UntagResource
Show Description Deletes specified tags from an Batch resource.
UpdateComputeEnvironment
Show Description Updates an Batch compute environment.

Braket Events

Service Event Name Description
braket CancelQuantumTask
Show Description Cancels the specified task.
CreateQuantumTask
Show Description Creates a quantum task.
GetDevice
Show Description Retrieves the devices available in Amazon Braket.
GetQuantumTask
Show Description Retrieves the specified quantum task.
ListTagsForResource
Show Description Shows the tags associated with this resource.
SearchDevices
Show Description Searches for devices using the specified filters.
SearchQuantumTasks
Show Description Searches for tasks that match the specified filter values.
TagResource
Show Description Add a tag to the specified resource.

Budgets Events

Service Event Name Description
budgets CreateBudget
Show Description Creates a budget and, if included, notifications and subscribers. Only one of BudgetLimit or PlannedBudgetLimits can be present in the syntax at one time. Use the syntax that matches your case. The Request Syntax section shows the BudgetLimit syntax. For PlannedBudgetLimits, see the Examples section.
CreateBudgetAction
Show Description Creates a budget action.
CreateNotification
Show Description Creates a notification. You must create the budget before you create the associated notification.
CreateSubscriber
Show Description Creates a subscriber. You must create the associated budget and notification before you create the subscriber.
DeleteBudget
Show Description Deletes a budget. You can delete your budget at any time. Deleting a budget also deletes the notifications and subscribers that are associated with that budget.
DeleteBudgetAction
Show Description Deletes a budget action.
DeleteNotification
Show Description Deletes a notification. Deleting a notification also deletes the subscribers that are associated with the notification.
DeleteSubscriber
Show Description Deletes a subscriber. Deleting the last subscriber to a notification also deletes the notification.
DescribeBudget
Show Description Describes a budget. The Request Syntax section shows the BudgetLimit syntax. For PlannedBudgetLimits, see the Examples section.
DescribeBudgetAction
Show Description Describes a budget action detail.
DescribeBudgetActionHistories
Show Description Describes a budget action history detail.
DescribeBudgetActionsForAccount
Show Description Describes all of the budget actions for an account.
DescribeBudgetActionsForBudget
Show Description Describes all of the budget actions for a budget.
DescribeBudgetPerformanceHistory
Show Description Describes the history for DAILY, MONTHLY, and QUARTERLY budgets. Budget history isn't available for ANNUAL budgets.
DescribeBudgets
Show Description Lists the budgets that are associated with an account. The Request Syntax section shows the BudgetLimit syntax. For PlannedBudgetLimits, see the Examples section.
DescribeNotificationsForBudget
Show Description Lists the notifications that are associated with a budget.
DescribeSubscribersForNotification
Show Description Lists the subscribers that are associated with a notification.
ExecuteBudgetAction
Show Description Executes a budget action.
UpdateBudget
Show Description Updates a budget. You can change every part of a budget except for the budgetName and the calculatedSpend. When you modify a budget, the calculatedSpend drops to zero until AWS has new usage data to use for forecasting. Only one of BudgetLimit or PlannedBudgetLimits can be present in the syntax at one time. Use the syntax that matches your case. The Request Syntax section shows the BudgetLimit syntax. For PlannedBudgetLimits, see the Examples section.
UpdateBudgetAction
Show Description Updates a budget action.
UpdateNotification
Show Description Updates a notification.

Cloudcontrol Events

Service Event Name Description
cloudcontrol CancelResourceRequest
Show Description Cancels the specified resource operation request. For more information, see Canceling resource operation requests in the Amazon Web Services Cloud Control API User Guide. Only resource operations requests with a status of PENDING or IN_PROGRESS can be cancelled.
CreateResource
Show Description Creates the specified resource. For more information, see Creating a resource in the Amazon Web Services Cloud Control API User Guide. After you have initiated a resource creation request, you can monitor the progress of your request by calling GetResourceRequestStatus using the RequestToken of the ProgressEvent type returned by CreateResource.
DeleteResource
Show Description Deletes the specified resource. For details, see Deleting a resource in the Amazon Web Services Cloud Control API User Guide. After you have initiated a resource deletion request, you can monitor the progress of your request by calling GetResourceRequestStatus using the RequestToken of the ProgressEvent returned by DeleteResource.
GetResource
Show Description Returns information about the current state of the specified resource. For details, see Reading a resource's current state. You can use this action to return information about an existing resource in your account and Amazon Web Services Region, whether or not those resources were provisioned using Cloud Control API.
GetResourceRequestStatus
Show Description Returns the current status of a resource operation request. For more information, see Tracking the progress of resource operation requests in the Amazon Web Services Cloud Control API User Guide.
ListResourceRequests
Show Description Returns existing resource operation requests. This includes requests of all status types. For more information, see Listing active resource operation requests in the Amazon Web Services Cloud Control API User Guide. Resource operation requests expire after seven days.
ListResources
Show Description Returns information about the specified resources. For more information, see Discovering resources in the Amazon Web Services Cloud Control API User Guide. You can use this action to return information about existing resources in your account and Amazon Web Services Region, whether or not those resources were provisioned using Cloud Control API.

Cloudformation Events

Service Event Name Description
cloudformation ActivateType
Show Description Activates a public third-party extension, making it available for use in stack templates. For more information, see Using public extensions in the CloudFormation User Guide. Once you have activated a public third-party extension in your account and region, use SetTypeConfiguration to specify configuration properties for the extension. For more information, see Configuring extensions at the account level in the CloudFormation User Guide.
BatchDescribeTypeConfigurations
Show Description Returns configuration data for the specified CloudFormation extensions, from the CloudFormation registry for the account and region. For more information, see Configuring extensions at the account level in the CloudFormation User Guide.
CancelUpdateStack
ContinueUpdateRollback
Show Description For a specified stack that is in the UPDATE_ROLLBACK_FAILED state, continues rolling it back to the UPDATE_ROLLBACK_COMPLETE state. Depending on the cause of the failure, you can manually fix the error and continue the rollback. By continuing the rollback, you can return your stack to a working state (the UPDATE_ROLLBACK_COMPLETE state), and then try to update the stack again. A stack goes into the UPDATE_ROLLBACK_FAILED state when CloudFormation cannot roll back all changes after a failed stack update. For example, you might have a stack that is rolling back to an old database instance that was deleted outside of CloudFormation. Because CloudFormation doesn't know the database was deleted, it assumes that the database instance still exists and attempts to roll back to it, causing the update rollback to fail.
CreateChangeSet
Show Description Creates a list of changes that will be applied to a stack so that you can review the changes before executing them. You can create a change set for a stack that doesn't exist or an existing stack. If you create a change set for a stack that doesn't exist, the change set shows all of the resources that CloudFormation will create. If you create a change set for an existing stack, CloudFormation compares the stack's information with the information that you submit in the change set and lists the differences. Use change sets to understand which resources CloudFormation will create or change, and how it will change resources in an existing stack, before you create or update a stack. To create a change set for a stack that doesn't exist, for the ChangeSetType parameter, specify CREATE. To create a change set for an existing stack, specify UPDATE for the ChangeSetType parameter. To create a change set for an import operation, specify IMPORT for the ChangeSetType parameter. After the CreateChangeSet call successfully completes, CloudFormation starts creating the change set. To check the status of the change set or to review it, use the DescribeChangeSet action. When you are satisfied with the changes the change set will make, execute the change set by using the ExecuteChangeSet action. CloudFormation doesn't make changes until you execute the change set. To create a change set for the entire stack hierachy, set IncludeNestedStacks to True.
CreateStack
Show Description Creates a stack as specified in the template. After the call completes successfully, the stack creation starts. You can check the status of the stack via the DescribeStacks API.
CreateStackInstances
Show Description Creates stack instances for the specified accounts, within the specified Regions. A stack instance refers to a stack in a specific account and Region. You must specify at least one value for either Accounts or DeploymentTargets, and you must specify at least one value for Regions.
CreateStackSet
Show Description Creates a stack set.
DeactivateType
Show Description Deactivates a public extension that was previously activated in this account and region. Once deactivated, an extension cannot be used in any CloudFormation operation. This includes stack update operations where the stack template includes the extension, even if no updates are being made to the extension. In addition, deactivated extensions are not automatically updated if a new version of the extension is released.
DeleteChangeSet
Show Description Deletes the specified change set. Deleting change sets ensures that no one executes the wrong change set. If the call successfully completes, CloudFormation successfully deleted the change set. If IncludeNestedStacks specifies True during the creation of the nested change set, then DeleteChangeSet will delete all change sets that belong to the stacks hierarchy and will also delete all change sets for nested stacks with the status of REVIEW_IN_PROGRESS.
DeleteStack
DeleteStackInstances
Show Description Deletes stack instances for the specified accounts, in the specified Regions.
DeleteStackSet
Show Description Deletes a stack set. Before you can delete a stack set, all of its member stack instances must be deleted. For more information about how to do this, see DeleteStackInstances.
DeregisterType
Show Description Marks an extension or extension version as DEPRECATED in the CloudFormation registry, removing it from active use. Deprecated extensions or extension versions cannot be used in CloudFormation operations. To deregister an entire extension, you must individually deregister all active versions of that extension. If an extension has only a single active version, deregistering that version results in the extension itself being deregistered and marked as deprecated in the registry. You cannot deregister the default version of an extension if there are other active version of that extension. If you do deregister the default version of an extension, the textensionype itself is deregistered as well and marked as deprecated. To view the deprecation status of an extension or extension version, use DescribeType.
DescribeAccountLimits
Show Description Retrieves your account's CloudFormation limits, such as the maximum number of stacks that you can create in your account. For more information about account limits, see CloudFormation Limits in the CloudFormation User Guide.
DescribeChangeSet
Show Description Returns the inputs for the change set and a list of changes that CloudFormation will make if you execute the change set. For more information, see Updating Stacks Using Change Sets in the CloudFormation User Guide.
DescribePublisher
Show Description Returns information about a CloudFormation extension publisher. If you do not supply a PublisherId, and you have registered as an extension publisher, DescribePublisher returns information about your own publisher account. For more information on registering as a publisher, see:
DescribeStackDriftDetectionStatus
Show Description Returns information about a stack drift detection operation. A stack drift detection operation detects whether a stack's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters. A stack is considered to have drifted if one or more of its resources have drifted. For more information on stack and resource drift, see Detecting Unregulated Configuration Changes to Stacks and Resources. Use DetectStackDrift to initiate a stack drift detection operation. DetectStackDrift returns a StackDriftDetectionId you can use to monitor the progress of the operation using DescribeStackDriftDetectionStatus. Once the drift detection operation has completed, use DescribeStackResourceDrifts to return drift information about the stack and its resources.
DescribeStackEvents
Show Description Returns all stack related events for a specified stack in reverse chronological order. For more information about a stack's event history, go to Stacks in the CloudFormation User Guide. You can list events for stacks that have failed to create or have been deleted by specifying the unique stack identifier (stack ID).
DescribeStackInstance
Show Description Returns the stack instance that's associated with the specified stack set, Amazon Web Services account, and Region. For a list of stack instances that are associated with a specific stack set, use ListStackInstances.
DescribeStackResource
Show Description Returns a description of the specified resource in the specified stack. For deleted stacks, DescribeStackResource returns resource information for up to 90 days after the stack has been deleted.
DescribeStackResourceDrifts
Show Description Returns drift information for the resources that have been checked for drift in the specified stack. This includes actual and expected configuration values for resources where CloudFormation detects configuration drift. For a given stack, there will be one StackResourceDrift for each stack resource that has been checked for drift. Resources that haven't yet been checked for drift are not included. Resources that do not currently support drift detection are not checked, and so not included. For a list of resources that support drift detection, see Resources that Support Drift Detection. Use DetectStackResourceDrift to detect drift on individual resources, or DetectStackDrift to detect drift on all supported resources for a given stack.
DescribeStackResources
Show Description Returns Amazon Web Services resource descriptions for running and deleted stacks. If StackName is specified, all the associated resources that are part of the stack are returned. If PhysicalResourceId is specified, the associated resources of the stack that the resource belongs to are returned. Only the first 100 resources will be returned. If your stack has more resources than this, you should use ListStackResources instead. For deleted stacks, DescribeStackResources returns resource information for up to 90 days after the stack has been deleted. You must specify either StackName or PhysicalResourceId, but not both. In addition, you can specify LogicalResourceId to filter the returned result. For more information about resources, the LogicalResourceId and PhysicalResourceId, go to the CloudFormation User Guide. A ValidationError is returned if you specify both StackName and PhysicalResourceId in the same request.
DescribeStackSet
Show Description Returns the description of the specified stack set.
DescribeStackSetOperation
Show Description Returns the description of the specified stack set operation.
DescribeStacks
Show Description Returns the description for the specified stack; if no stack name was specified, then it returns the description for all the stacks created. If the stack does not exist, an ValidationError is returned.
DescribeType
Show Description Returns detailed information about an extension that has been registered. If you specify a VersionId, DescribeType returns information about that specific extension version. Otherwise, it returns information about the default extension version.
DescribeTypeRegistration
Show Description Returns information about an extension's registration, including its current status and type and version identifiers. When you initiate a registration request using RegisterType , you can then use DescribeTypeRegistration to monitor the progress of that registration request. Once the registration request has completed, use DescribeType to return detailed information about an extension.
DetectStackDrift
Show Description Detects whether a stack's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters. For each resource in the stack that supports drift detection, CloudFormation compares the actual configuration of the resource with its expected template configuration. Only resource properties explicitly defined in the stack template are checked for drift. A stack is considered to have drifted if one or more of its resources differ from their expected template configurations. For more information, see Detecting Unregulated Configuration Changes to Stacks and Resources. Use DetectStackDrift to detect drift on all supported resources for a given stack, or DetectStackResourceDrift to detect drift on individual resources. For a list of stack resources that currently support drift detection, see Resources that Support Drift Detection. DetectStackDrift can take up to several minutes, depending on the number of resources contained within the stack. Use DescribeStackDriftDetectionStatus to monitor the progress of a detect stack drift operation. Once the drift detection operation has completed, use DescribeStackResourceDrifts to return drift information about the stack and its resources. When detecting drift on a stack, CloudFormation does not detect drift on any nested stacks belonging to that stack. Perform DetectStackDrift directly on the nested stack itself.
DetectStackResourceDrift
Show Description Returns information about whether a resource's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters. This information includes actual and expected property values for resources in which CloudFormation detects drift. Only resource properties explicitly defined in the stack template are checked for drift. For more information about stack and resource drift, see Detecting Unregulated Configuration Changes to Stacks and Resources. Use DetectStackResourceDrift to detect drift on individual resources, or DetectStackDrift to detect drift on all resources in a given stack that support drift detection. Resources that do not currently support drift detection cannot be checked. For a list of resources that support drift detection, see Resources that Support Drift Detection.
DetectStackSetDrift
Show Description Detect drift on a stack set. When CloudFormation performs drift detection on a stack set, it performs drift detection on the stack associated with each stack instance in the stack set. For more information, see How CloudFormation Performs Drift Detection on a Stack Set. DetectStackSetDrift returns the OperationId of the stack set drift detection operation. Use this operation id with DescribeStackSetOperation to monitor the progress of the drift detection operation. The drift detection operation may take some time, depending on the number of stack instances included in the stack set, as well as the number of resources included in each stack. Once the operation has completed, use the following actions to return drift information:
  • Use DescribeStackSet to return detailed information about the stack set, including detailed information about the last completed drift operation performed on the stack set. (Information about drift operations that are in progress is not included.)
  • Use ListStackInstances to return a list of stack instances belonging to the stack set, including the drift status and last drift time checked of each instance.
  • Use DescribeStackInstance to return detailed information about a specific stack instance, including its drift status and last drift time checked.
For more information on performing a drift detection operation on a stack set, see Detecting Unmanaged Changes in Stack Sets. You can only run a single drift detection operation on a given stack set at one time. To stop a drift detection stack set operation, use StopStackSetOperation .
EstimateTemplateCost
Show Description Returns the estimated monthly cost of a template. The return value is an Amazon Web Services Simple Monthly Calculator URL with a query string that describes the resources required to run the template.
ExecuteChangeSet
Show Description Updates a stack using the input information that was provided when the specified change set was created. After the call successfully completes, CloudFormation starts updating the stack. Use the DescribeStacks action to view the status of the update. When you execute a change set, CloudFormation deletes all other change sets associated with the stack because they aren't valid for the updated stack. If a stack policy is associated with the stack, CloudFormation enforces the policy during the update. You can't specify a temporary stack policy that overrides the current policy. To create a change set for the entire stack hierachy, IncludeNestedStacks must have been set to True.
GetStackPolicy
Show Description Returns the stack policy for a specified stack. If a stack doesn't have a policy, a null value is returned.
GetTemplate
Show Description Returns the template body for a specified stack. You can get the template for running or deleted stacks. For deleted stacks, GetTemplate returns the template for up to 90 days after the stack has been deleted. If the template does not exist, a ValidationError is returned.
GetTemplateSummary
Show Description Returns information about a new or existing template. The GetTemplateSummary action is useful for viewing parameter information, such as default parameter values and parameter types, before you create or update a stack or stack set. You can use the GetTemplateSummary action when you submit a template, or you can get template information for a stack set, or a running or deleted stack. For deleted stacks, GetTemplateSummary returns the template information for up to 90 days after the stack has been deleted. If the template does not exist, a ValidationError is returned.
ImportStacksToStackSet
Show Description Import existing stacks into a new stack sets. Use the stack import operation to import up to 10 stacks into a new stack set in the same account as the source stack or in a different administrator account and Region, by specifying the stack ID of the stack you intend to import. ImportStacksToStackSet is only supported by self-managed permissions.
ListChangeSets
Show Description Returns the ID and status of each active change set for a stack. For example, CloudFormation lists change sets that are in the CREATE_IN_PROGRESS or CREATE_PENDING state.
ListExports
Show Description Lists all exported output values in the account and Region in which you call this action. Use this action to see the exported output values that you can import into other stacks. To import values, use the Fn::ImportValue function. For more information, see CloudFormation Export Stack Output Values.
ListImports
Show Description Lists all stacks that are importing an exported output value. To modify or remove an exported output value, first use this action to see which stacks are using it. To see the exported output values in your account, see ListExports. For more information about importing an exported output value, see the Fn::ImportValue function.
ListStackInstances
Show Description Returns summary information about stack instances that are associated with the specified stack set. You can filter for stack instances that are associated with a specific Amazon Web Services account name or Region, or that have a specific status.
ListStackResources
Show Description Returns descriptions of all resources of the specified stack. For deleted stacks, ListStackResources returns resource information for up to 90 days after the stack has been deleted.
ListStackSetOperationResults
Show Description Returns summary information about the results of a stack set operation.
ListStackSetOperations
Show Description Returns summary information about operations performed on a stack set.
ListStackSets
Show Description Returns summary information about stack sets that are associated with the user.
  • [Self-managed permissions] If you set the CallAs parameter to SELF while signed in to your Amazon Web Services account, ListStackSets returns all self-managed stack sets in your Amazon Web Services account.
  • [Service-managed permissions] If you set the CallAs parameter to SELF while signed in to the organization's management account, ListStackSets returns all stack sets in the management account.
  • [Service-managed permissions] If you set the CallAs parameter to DELEGATED_ADMIN while signed in to your member account, ListStackSets returns all stack sets with service-managed permissions in the management account.
ListStacks
Show Description Returns the summary information for stacks whose status matches the specified StackStatusFilter. Summary information for stacks that have been deleted is kept for 90 days after the stack is deleted. If no StackStatusFilter is specified, summary information for all stacks is returned (including existing stacks and stacks that have been deleted).
ListTypeRegistrations
Show Description Returns a list of registration tokens for the specified extension(s).
ListTypeVersions
Show Description Returns summary information about the versions of an extension.
ListTypes
Show Description Returns summary information about extension that have been registered with CloudFormation.
PublishType
Show Description Publishes the specified extension to the CloudFormation registry as a public extension in this region. Public extensions are available for use by all CloudFormation users. For more information on publishing extensions, see Publishing extensions to make them available for public use in the CloudFormation CLI User Guide. To publish an extension, you must be registered as a publisher with CloudFormation. For more information, see RegisterPublisher.
RecordHandlerProgress
Show Description Reports progress of a resource handler to CloudFormation. Reserved for use by the CloudFormation CLI. Do not use this API in your code.
RegisterPublisher
Show Description Registers your account as a publisher of public extensions in the CloudFormation registry. Public extensions are available for use by all CloudFormation users. This publisher ID applies to your account in all Amazon Web Services Regions. For information on requirements for registering as a public extension publisher, see Registering your account to publish CloudFormation extensions in the CloudFormation CLI User Guide.

RegisterType
Show Description Registers an extension with the CloudFormation service. Registering an extension makes it available for use in CloudFormation templates in your Amazon Web Services account, and includes:
  • Validating the extension schema
  • Determining which handlers, if any, have been specified for the extension
  • Making the extension available for use in your account
For more information on how to develop extensions and ready them for registeration, see Creating Resource Providers in the CloudFormation CLI User Guide. You can have a maximum of 50 resource extension versions registered at a time. This maximum is per account and per region. Use DeregisterType to deregister specific extension versions if necessary. Once you have initiated a registration request using RegisterType , you can use DescribeTypeRegistration to monitor the progress of the registration request. Once you have registered a private extension in your account and region, use SetTypeConfiguration to specify configuration properties for the extension. For more information, see Configuring extensions at the account level in the CloudFormation User Guide.
RollbackStack
Show Description When specifying RollbackStack, you preserve the state of previously provisioned resources when an operation fails. You can check the status of the stack through the DescribeStacks API. Rolls back the specified stack to the last known stable state from CREATE_FAILED or UPDATE_FAILED stack statuses. This operation will delete a stack if it doesn't contain a last known stable state. A last known stable state includes any status in a *_COMPLETE. This includes the following stack statuses.
  • CREATE_COMPLETE
  • UPDATE_COMPLETE
  • UPDATE_ROLLBACK_COMPLETE
  • IMPORT_COMPLETE
  • IMPORT_ROLLBACK_COMPLETE
SetStackPolicy
SetTypeConfiguration
Show Description Specifies the configuration data for a registered CloudFormation extension, in the given account and region. To view the current configuration data for an extension, refer to the ConfigurationSchema element of DescribeType. For more information, see Configuring extensions at the account level in the CloudFormation User Guide. It is strongly recommended that you use dynamic references to restrict sensitive configuration definitions, such as third-party credentials. For more details on dynamic references, see Using dynamic references to specify template values in the CloudFormation User Guide.
SetTypeDefaultVersion
Show Description Specify the default version of an extension. The default version of an extension will be used in CloudFormation operations.
SignalResource
StopStackSetOperation
Show Description Stops an in-progress operation on a stack set and its associated stack instances.
TestType
Show Description Tests a registered extension to make sure it meets all necessary requirements for being published in the CloudFormation registry.
  • For resource types, this includes passing all contracts tests defined for the type.
  • For modules, this includes determining if the module's model meets all necessary requirements.
For more information, see Testing your public extension prior to publishing in the CloudFormation CLI User Guide. If you do not specify a version, CloudFormation uses the default version of the extension in your account and region for testing. To perform testing, CloudFormation assumes the execution role specified when the type was registered. For more information, see RegisterType. Once you've initiated testing on an extension using TestType, you can use DescribeType to monitor the current test status and test status description for the extension. An extension must have a test status of PASSED before it can be published. For more information, see Publishing extensions to make them available for public use in the CloudFormation CLI User Guide.
UpdateStack
Show Description Updates a stack as specified in the template. After the call completes successfully, the stack update starts. You can check the status of the stack via the DescribeStacks action. To get a copy of the template for an existing stack, you can use the GetTemplate action. For more information about creating an update template, updating a stack, and monitoring the progress of the update, see Updating a Stack.
UpdateStackInstances
Show Description Updates the parameter values for stack instances for the specified accounts, within the specified Regions. A stack instance refers to a stack in a specific account and Region. You can only update stack instances in Regions and accounts where they already exist; to create additional stack instances, use CreateStackInstances. During stack set updates, any parameters overridden for a stack instance are not updated, but retain their overridden value. You can only update the parameter values that are specified in the stack set; to add or delete a parameter itself, use UpdateStackSet to update the stack set template. If you add a parameter to a template, before you can override the parameter value specified in the stack set you must first use UpdateStackSet to update all stack instances with the updated template and parameter value specified in the stack set. Once a stack instance has been updated with the new parameter, you can then override the parameter value using UpdateStackInstances.
UpdateStackSet
Show Description Updates the stack set, and associated stack instances in the specified accounts and Regions. Even if the stack set operation created by updating the stack set fails (completely or partially, below or above a specified failure tolerance), the stack set is updated with your changes. Subsequent CreateStackInstances calls on the specified stack set use the updated stack set.
UpdateTerminationProtection
Show Description Updates termination protection for the specified stack. If a user attempts to delete a stack with termination protection enabled, the operation fails and the stack remains unchanged. For more information, see Protecting a Stack From Being Deleted in the CloudFormation User Guide. For nested stacks, termination protection is set on the root stack and cannot be changed directly on the nested stack.

Cloudfront Events

Service Event Name Description
cloudfront AssociateAlias
CreateCachePolicy
Show Description Creates a cache policy. After you create a cache policy, you can attach it to one or more cache behaviors. When it’s attached to a cache behavior, the cache policy determines the following:
  • The values that CloudFront includes in the cache key. These values can include HTTP headers, cookies, and URL query strings. CloudFront uses the cache key to find an object in its cache that it can return to the viewer.
  • The default, minimum, and maximum time to live (TTL) values that you want objects to stay in the CloudFront cache.
The headers, cookies, and query strings that are included in the cache key are automatically included in requests that CloudFront sends to the origin. CloudFront sends a request when it can’t find an object in its cache that matches the request’s cache key. If you want to send values to the origin but not include them in the cache key, use OriginRequestPolicy. For more information about cache policies, see Controlling the cache key in the Amazon CloudFront Developer Guide.
CreateCloudFrontOriginAccessIdentity
Show Description Creates a new origin access identity. If you're using Amazon S3 for your origin, you can use an origin access identity to require users to access your content using a CloudFront URL instead of the Amazon S3 URL. For more information about how to use origin access identities, see Serving Private Content through CloudFront in the Amazon CloudFront Developer Guide.
CreateDistribution
Show Description Creates a new web distribution. You create a CloudFront distribution to tell CloudFront where you want content to be delivered from, and the details about how to track and manage content delivery. Send a POST request to the /CloudFront API version/distribution/distribution ID resource. When you update a distribution, there are more required fields than when you create a distribution. When you update your distribution by using UpdateDistribution, follow the steps included in the documentation to get the current configuration and then make your updates. This helps to make sure that you include all of the required fields. To view a summary, see Required Fields for Create Distribution and Update Distribution in the Amazon CloudFront Developer Guide.
CreateDistributionWithTags
Show Description Create a new distribution with tags.
CreateFieldLevelEncryptionConfig
Show Description Create a new field-level encryption configuration.
CreateFieldLevelEncryptionProfile
Show Description Create a field-level encryption profile.
CreateFunction
Show Description Creates a CloudFront function. To create a function, you provide the function code and some configuration information about the function. The response contains an Amazon Resource Name (ARN) that uniquely identifies the function. When you create a function, it’s in the DEVELOPMENT stage. In this stage, you can test the function with TestFunction, and update it with UpdateFunction. When you’re ready to use your function with a CloudFront distribution, use PublishFunction to copy the function from the DEVELOPMENT stage to LIVE. When it’s live, you can attach the function to a distribution’s cache behavior, using the function’s ARN.
CreateInvalidation
Show Description Create a new invalidation.
CreateKeyGroup
Show Description Creates a key group that you can use with CloudFront signed URLs and signed cookies. To create a key group, you must specify at least one public key for the key group. After you create a key group, you can reference it from one or more cache behaviors. When you reference a key group in a cache behavior, CloudFront requires signed URLs or signed cookies for all requests that match the cache behavior. The URLs or cookies must be signed with a private key whose corresponding public key is in the key group. The signed URL or cookie contains information about which public key CloudFront should use to verify the signature. For more information, see Serving private content in the Amazon CloudFront Developer Guide.
CreateMonitoringSubscription
Show Description Enables additional CloudWatch metrics for the specified CloudFront distribution. The additional metrics incur an additional cost. For more information, see Viewing additional CloudFront distribution metrics in the Amazon CloudFront Developer Guide.
CreateOriginRequestPolicy
Show Description Creates an origin request policy. After you create an origin request policy, you can attach it to one or more cache behaviors. When it’s attached to a cache behavior, the origin request policy determines the values that CloudFront includes in requests that it sends to the origin. Each request that CloudFront sends to the origin includes the following:
  • The request body and the URL path (without the domain name) from the viewer request.
  • The headers that CloudFront automatically includes in every origin request, including Host, User-Agent, and X-Amz-Cf-Id.
  • All HTTP headers, cookies, and URL query strings that are specified in the cache policy or the origin request policy. These can include items from the viewer request and, in the case of headers, additional ones that are added by CloudFront.
CloudFront sends a request when it can’t find a valid object in its cache that matches the request. If you want to send values to the origin and also include them in the cache key, use CachePolicy. For more information about origin request policies, see Controlling origin requests in the Amazon CloudFront Developer Guide.
CreatePublicKey
Show Description Uploads a public key to CloudFront that you can use with signed URLs and signed cookies, or with field-level encryption.
CreateRealtimeLogConfig
Show Description Creates a real-time log configuration. After you create a real-time log configuration, you can attach it to one or more cache behaviors to send real-time log data to the specified Amazon Kinesis data stream. For more information about real-time log configurations, see Real-time logs in the Amazon CloudFront Developer Guide.
CreateResponseHeadersPolicy
Show Description Creates a response headers policy. A response headers policy contains information about a set of HTTP response headers and their values. To create a response headers policy, you provide some metadata about the policy, and a set of configurations that specify the response headers. After you create a response headers policy, you can use its ID to attach it to one or more cache behaviors in a CloudFront distribution. When it’s attached to a cache behavior, CloudFront adds the headers in the policy to HTTP responses that it sends for requests that match the cache behavior.
CreateStreamingDistribution
Show Description This API is deprecated. Amazon CloudFront is deprecating real-time messaging protocol (RTMP) distributions on December 31, 2020. For more information, read the announcement on the Amazon CloudFront discussion forum.
CreateStreamingDistributionWithTags
Show Description This API is deprecated. Amazon CloudFront is deprecating real-time messaging protocol (RTMP) distributions on December 31, 2020. For more information, read the announcement on the Amazon CloudFront discussion forum.
DeleteCachePolicy
DeleteCloudFrontOriginAccessIdentity
DeleteDistribution
DeleteFieldLevelEncryptionConfig
DeleteFieldLevelEncryptionProfile
DeleteFunction
DeleteKeyGroup
DeleteMonitoringSubscription
Show Description Disables additional CloudWatch metrics for the specified CloudFront distribution.
DeleteOriginRequestPolicy
DeletePublicKey
DeleteRealtimeLogConfig
DeleteResponseHeadersPolicy
DeleteStreamingDistribution
DescribeFunction
Show Description Gets configuration information and metadata about a CloudFront function, but not the function’s code. To get a function’s code, use GetFunction. To get configuration information and metadata about a function, you must provide the function’s name and stage. To get these values, you can use ListFunctions.
GetCachePolicy
Show Description Gets a cache policy, including the following metadata:
  • The policy’s identifier.
  • The date and time when the policy was last modified.
To get a cache policy, you must provide the policy’s identifier. If the cache policy is attached to a distribution’s cache behavior, you can get the policy’s identifier using ListDistributions or GetDistribution. If the cache policy is not attached to a cache behavior, you can get the identifier using ListCachePolicies.
GetCachePolicyConfig
Show Description Gets a cache policy configuration. To get a cache policy configuration, you must provide the policy’s identifier. If the cache policy is attached to a distribution’s cache behavior, you can get the policy’s identifier using ListDistributions or GetDistribution. If the cache policy is not attached to a cache behavior, you can get the identifier using ListCachePolicies.
GetCloudFrontOriginAccessIdentity
Show Description Get the information about an origin access identity.
GetCloudFrontOriginAccessIdentityConfig
Show Description Get the configuration information about an origin access identity.
GetDistribution
Show Description Get the information about a distribution.
GetDistributionConfig
Show Description Get the configuration information about a distribution.
GetFieldLevelEncryption
Show Description Get the field-level encryption configuration information.
GetFieldLevelEncryptionConfig
Show Description Get the field-level encryption configuration information.
GetFieldLevelEncryptionProfile
Show Description Get the field-level encryption profile information.
GetFieldLevelEncryptionProfileConfig
Show Description Get the field-level encryption profile configuration information.
GetFunction
Show Description Gets the code of a CloudFront function. To get configuration information and metadata about a function, use DescribeFunction. To get a function’s code, you must provide the function’s name and stage. To get these values, you can use ListFunctions.
GetInvalidation
Show Description Get the information about an invalidation.
GetKeyGroup
Show Description Gets a key group, including the date and time when the key group was last modified. To get a key group, you must provide the key group’s identifier. If the key group is referenced in a distribution’s cache behavior, you can get the key group’s identifier using ListDistributions or GetDistribution. If the key group is not referenced in a cache behavior, you can get the identifier using ListKeyGroups.
GetKeyGroupConfig
Show Description Gets a key group configuration. To get a key group configuration, you must provide the key group’s identifier. If the key group is referenced in a distribution’s cache behavior, you can get the key group’s identifier using ListDistributions or GetDistribution. If the key group is not referenced in a cache behavior, you can get the identifier using ListKeyGroups.
GetMonitoringSubscription
Show Description Gets information about whether additional CloudWatch metrics are enabled for the specified CloudFront distribution.
GetOriginRequestPolicy
Show Description Gets an origin request policy, including the following metadata:
  • The policy’s identifier.
  • The date and time when the policy was last modified.
To get an origin request policy, you must provide the policy’s identifier. If the origin request policy is attached to a distribution’s cache behavior, you can get the policy’s identifier using ListDistributions or GetDistribution. If the origin request policy is not attached to a cache behavior, you can get the identifier using ListOriginRequestPolicies.
GetOriginRequestPolicyConfig
Show Description Gets an origin request policy configuration. To get an origin request policy configuration, you must provide the policy’s identifier. If the origin request policy is attached to a distribution’s cache behavior, you can get the policy’s identifier using ListDistributions or GetDistribution. If the origin request policy is not attached to a cache behavior, you can get the identifier using ListOriginRequestPolicies.
GetPublicKey
Show Description Gets a public key.
GetPublicKeyConfig
Show Description Gets a public key configuration.
GetRealtimeLogConfig
Show Description Gets a real-time log configuration. To get a real-time log configuration, you can provide the configuration’s name or its Amazon Resource Name (ARN). You must provide at least one. If you provide both, CloudFront uses the name to identify the real-time log configuration to get.
GetResponseHeadersPolicy
Show Description Gets a response headers policy, including metadata (the policy’s identifier and the date and time when the policy was last modified). To get a response headers policy, you must provide the policy’s identifier. If the response headers policy is attached to a distribution’s cache behavior, you can get the policy’s identifier using ListDistributions or GetDistribution. If the response headers policy is not attached to a cache behavior, you can get the identifier using ListResponseHeadersPolicies.
GetResponseHeadersPolicyConfig
Show Description Gets a response headers policy configuration. To get a response headers policy configuration, you must provide the policy’s identifier. If the response headers policy is attached to a distribution’s cache behavior, you can get the policy’s identifier using ListDistributions or GetDistribution. If the response headers policy is not attached to a cache behavior, you can get the identifier using ListResponseHeadersPolicies.
GetStreamingDistribution
Show Description Gets information about a specified RTMP distribution, including the distribution configuration.
GetStreamingDistributionConfig
Show Description Get the configuration information about a streaming distribution.
ListCachePolicies
Show Description Gets a list of cache policies. You can optionally apply a filter to return only the managed policies created by Amazon Web Services, or only the custom policies created in your Amazon Web Services account. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListCloudFrontOriginAccessIdentities
Show Description Lists origin access identities.
ListConflictingAliases
Show Description Gets a list of aliases (also called CNAMEs or alternate domain names) that conflict or overlap with the provided alias, and the associated CloudFront distributions and Amazon Web Services accounts for each conflicting alias. In the returned list, the distribution and account IDs are partially hidden, which allows you to identify the distributions and accounts that you own, but helps to protect the information of ones that you don’t own. Use this operation to find aliases that are in use in CloudFront that conflict or overlap with the provided alias. For example, if you provide www.example.com as input, the returned list can include www.example.com and the overlapping wildcard alternate domain name (*.example.com), if they exist. If you provide *.example.com as input, the returned list can include *.example.com and any alternate domain names covered by that wildcard (for example, www.example.com, test.example.com, dev.example.com, and so on), if they exist. To list conflicting aliases, you provide the alias to search and the ID of a distribution in your account that has an attached SSL/TLS certificate that includes the provided alias. For more information, including how to set up the distribution and certificate, see Moving an alternate domain name to a different distribution in the Amazon CloudFront Developer Guide. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListDistributions
Show Description List CloudFront distributions.
ListDistributionsByCachePolicyId
Show Description Gets a list of distribution IDs for distributions that have a cache behavior that’s associated with the specified cache policy. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListDistributionsByKeyGroup
Show Description Gets a list of distribution IDs for distributions that have a cache behavior that references the specified key group. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListDistributionsByOriginRequestPolicyId
Show Description Gets a list of distribution IDs for distributions that have a cache behavior that’s associated with the specified origin request policy. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListDistributionsByRealtimeLogConfig
Show Description Gets a list of distributions that have a cache behavior that’s associated with the specified real-time log configuration. You can specify the real-time log configuration by its name or its Amazon Resource Name (ARN). You must provide at least one. If you provide both, CloudFront uses the name to identify the real-time log configuration to list distributions for. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListDistributionsByResponseHeadersPolicyId
Show Description Gets a list of distribution IDs for distributions that have a cache behavior that’s associated with the specified response headers policy. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListDistributionsByWebACLId
Show Description List the distributions that are associated with a specified WAF web ACL.
ListFieldLevelEncryptionConfigs
Show Description List all field-level encryption configurations that have been created in CloudFront for this account.
ListFieldLevelEncryptionProfiles
Show Description Request a list of field-level encryption profiles that have been created in CloudFront for this account.
ListFunctions
Show Description Gets a list of all CloudFront functions in your Amazon Web Services account. You can optionally apply a filter to return only the functions that are in the specified stage, either DEVELOPMENT or LIVE. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListInvalidations
Show Description Lists invalidation batches.
ListKeyGroups
Show Description Gets a list of key groups. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListOriginRequestPolicies
Show Description Gets a list of origin request policies. You can optionally apply a filter to return only the managed policies created by Amazon Web Services, or only the custom policies created in your Amazon Web Services account. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListPublicKeys
Show Description List all public keys that have been added to CloudFront for this account.
ListRealtimeLogConfigs
Show Description Gets a list of real-time log configurations. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListResponseHeadersPolicies
Show Description Gets a list of response headers policies. You can optionally apply a filter to get only the managed policies created by Amazon Web Services, or only the custom policies created in your Amazon Web Services account. You can optionally specify the maximum number of items to receive in the response. If the total number of items in the list exceeds the maximum that you specify, or the default maximum, the response is paginated. To get the next page of items, send a subsequent request that specifies the NextMarker value from the current response as the Marker value in the subsequent request.
ListStreamingDistributions
Show Description List streaming distributions.
ListTagsForResource
Show Description List tags for a CloudFront resource.
PublishFunction
Show Description Publishes a CloudFront function by copying the function code from the DEVELOPMENT stage to LIVE. This automatically updates all cache behaviors that are using this function to use the newly published copy in the LIVE stage. When a function is published to the LIVE stage, you can attach the function to a distribution’s cache behavior, using the function’s Amazon Resource Name (ARN). To publish a function, you must provide the function’s name and version (ETag value). To get these values, you can use ListFunctions and DescribeFunction.
TagResource
TestFunction
Show Description Tests a CloudFront function. To test a function, you provide an event object that represents an HTTP request or response that your CloudFront distribution could receive in production. CloudFront runs the function, passing it the event object that you provided, and returns the function’s result (the modified event object) in the response. The response also contains function logs and error messages, if any exist. For more information about testing functions, see Testing functions in the Amazon CloudFront Developer Guide. To test a function, you provide the function’s name and version (ETag value) along with the event object. To get the function’s name and version, you can use ListFunctions and DescribeFunction.
UntagResource
UpdateCachePolicy
Show Description Updates a cache policy configuration. When you update a cache policy configuration, all the fields are updated with the values provided in the request. You cannot update some fields independent of others. To update a cache policy configuration:
  1. Use GetCachePolicyConfig to get the current configuration.
  2. Locally modify the fields in the cache policy configuration that you want to update.
  3. Call UpdateCachePolicy by providing the entire cache policy configuration, including the fields that you modified and those that you didn’t.
UpdateCloudFrontOriginAccessIdentity
Show Description Update an origin access identity.
UpdateDistribution
Show Description Updates the configuration for a web distribution. When you update a distribution, there are more required fields than when you create a distribution. When you update your distribution by using this API action, follow the steps here to get the current configuration and then make your updates, to make sure that you include all of the required fields. To view a summary, see Required Fields for Create Distribution and Update Distribution in the Amazon CloudFront Developer Guide. The update process includes getting the current distribution configuration, updating the XML document that is returned to make your changes, and then submitting an UpdateDistribution request to make the updates. For information about updating a distribution using the CloudFront console instead, see Creating a Distribution in the Amazon CloudFront Developer Guide. To update a web distribution using the CloudFront API
  1. Submit a GetDistributionConfig request to get the current configuration and an Etag header for the distribution. If you update the distribution again, you must get a new Etag header.
  2. Update the XML document that was returned in the response to your GetDistributionConfig request to include your changes. When you edit the XML file, be aware of the following:
    • You must strip out the ETag parameter that is returned.
    • Additional fields are required when you update a distribution. There may be fields included in the XML file for features that you haven't configured for your distribution. This is expected and required to successfully update the distribution.
    • You can't change the value of CallerReference. If you try to change this value, CloudFront returns an IllegalUpdate error.
    • The new configuration replaces the existing configuration; the values that you specify in an UpdateDistribution request are not merged into your existing configuration. When you add, delete, or replace values in an element that allows multiple values (for example, CNAME), you must specify all of the values that you want to appear in the updated distribution. In addition, you must update the corresponding Quantity element.
  3. Submit an UpdateDistribution request to update the configuration for your distribution:
    • In the request body, include the XML document that you updated in Step 2. The request body must include an XML document with a DistributionConfig element.
    • Set the value of the HTTP If-Match header to the value of the ETag header that CloudFront returned when you submitted the GetDistributionConfig request in Step 1.
  4. Review the response to the UpdateDistribution request to confirm that the configuration was successfully updated.
  5. Optional: Submit a GetDistribution request to confirm that your changes have propagated. When propagation is complete, the value of Status is Deployed.
UpdateFieldLevelEncryptionConfig
Show Description Update a field-level encryption configuration.
UpdateFieldLevelEncryptionProfile
Show Description Update a field-level encryption profile.
UpdateFunction
Show Description Updates a CloudFront function. You can update a function’s code or the comment that describes the function. You cannot update a function’s name. To update a function, you provide the function’s name and version (ETag value) along with the updated function code. To get the name and version, you can use ListFunctions and DescribeFunction.
UpdateKeyGroup
Show Description Updates a key group. When you update a key group, all the fields are updated with the values provided in the request. You cannot update some fields independent of others. To update a key group:
  1. Get the current key group with GetKeyGroup or GetKeyGroupConfig.
  2. Locally modify the fields in the key group that you want to update. For example, add or remove public key IDs.
  3. Call UpdateKeyGroup with the entire key group object, including the fields that you modified and those that you didn’t.
UpdateOriginRequestPolicy
Show Description Updates an origin request policy configuration. When you update an origin request policy configuration, all the fields are updated with the values provided in the request. You cannot update some fields independent of others. To update an origin request policy configuration:
  1. Use GetOriginRequestPolicyConfig to get the current configuration.
  2. Locally modify the fields in the origin request policy configuration that you want to update.
  3. Call UpdateOriginRequestPolicy by providing the entire origin request policy configuration, including the fields that you modified and those that you didn’t.
UpdatePublicKey
Show Description Update public key information. Note that the only value you can change is the comment.
UpdateRealtimeLogConfig
Show Description Updates a real-time log configuration. When you update a real-time log configuration, all the parameters are updated with the values provided in the request. You cannot update some parameters independent of others. To update a real-time log configuration:
  1. Call GetRealtimeLogConfig to get the current real-time log configuration.
  2. Locally modify the parameters in the real-time log configuration that you want to update.
  3. Call this API (UpdateRealtimeLogConfig) by providing the entire real-time log configuration, including the parameters that you modified and those that you didn’t.
You cannot update a real-time log configuration’s Name or ARN.
UpdateResponseHeadersPolicy
Show Description Updates a response headers policy. When you update a response headers policy, the entire policy is replaced. You cannot update some policy fields independent of others. To update a response headers policy configuration:
  1. Use GetResponseHeadersPolicyConfig to get the current policy’s configuration.
  2. Modify the fields in the response headers policy configuration that you want to update.
  3. Call UpdateResponseHeadersPolicy, providing the entire response headers policy configuration, including the fields that you modified and those that you didn’t.

Cloudhsm Events

Service Event Name Description
cloudhsm AddTagsToResource
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Adds or overwrites one or more tags for the specified AWS CloudHSM resource. Each tag consists of a key and a value. Tag keys must be unique to each resource.
CreateHapg
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Creates a high-availability partition group. A high-availability partition group is a group of partitions that spans multiple physical HSMs.
CreateHsm
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Creates an uninitialized HSM instance. There is an upfront fee charged for each HSM instance that you create with the CreateHsm operation. If you accidentally provision an HSM and want to request a refund, delete the instance using the DeleteHsm operation, go to the AWS Support Center, create a new case, and select Account and Billing Support. It can take up to 20 minutes to create and provision an HSM. You can monitor the status of the HSM with the DescribeHsm operation. The HSM is ready to be initialized when the status changes to RUNNING.
CreateLunaClient
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Creates an HSM client.
DeleteHapg
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Deletes a high-availability partition group.
DeleteHsm
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Deletes an HSM. After completion, this operation cannot be undone and your key material cannot be recovered.
DeleteLunaClient
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Deletes a client.
DescribeHapg
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves information about a high-availability partition group.
DescribeHsm
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves information about an HSM. You can identify the HSM by its ARN or its serial number.
DescribeLunaClient
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves information about an HSM client.
GetConfig
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Gets the configuration files necessary to connect to all high availability partition groups the client is associated with.
ListAvailableZones
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Lists the Availability Zones that have available AWS CloudHSM capacity.
ListHapgs
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Lists the high-availability partition groups for the account. This operation supports pagination with the use of the NextToken member. If more results are available, the NextToken member of the response contains a token that you pass in the next call to ListHapgs to retrieve the next set of items.
ListHsms
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves the identifiers of all of the HSMs provisioned for the current customer. This operation supports pagination with the use of the NextToken member. If more results are available, the NextToken member of the response contains a token that you pass in the next call to ListHsms to retrieve the next set of items.
ListLunaClients
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Lists all of the clients. This operation supports pagination with the use of the NextToken member. If more results are available, the NextToken member of the response contains a token that you pass in the next call to ListLunaClients to retrieve the next set of items.
ListTagsForResource
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Returns a list of all tags for the specified AWS CloudHSM resource.
ModifyHapg
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Modifies an existing high-availability partition group.
ModifyHsm
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Modifies an HSM. This operation can result in the HSM being offline for up to 15 minutes while the AWS CloudHSM service is reconfigured. If you are modifying a production HSM, you should ensure that your AWS CloudHSM service is configured for high availability, and consider executing this operation during a maintenance window.
ModifyLunaClient
Show Description This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Modifies the certificate used by the client. This action can potentially start a workflow to install the new certificate on the client's HSMs.

Cloudhsmv2 Events

Service Event Name Description
cloudhsmv2 CopyBackupToRegion
Show Description Copy an AWS CloudHSM cluster backup to a different region.
CreateCluster
Show Description Creates a new AWS CloudHSM cluster.
CreateHsm
Show Description Creates a new hardware security module (HSM) in the specified AWS CloudHSM cluster.
DeleteBackup
Show Description Deletes a specified AWS CloudHSM backup. A backup can be restored up to 7 days after the DeleteBackup request is made. For more information on restoring a backup, see RestoreBackup.
DeleteCluster
Show Description Deletes the specified AWS CloudHSM cluster. Before you can delete a cluster, you must delete all HSMs in the cluster. To see if the cluster contains any HSMs, use DescribeClusters. To delete an HSM, use DeleteHsm.
DeleteHsm
Show Description Deletes the specified HSM. To specify an HSM, you can use its identifier (ID), the IP address of the HSM's elastic network interface (ENI), or the ID of the HSM's ENI. You need to specify only one of these values. To find these values, use DescribeClusters.
DescribeBackups
Show Description Gets information about backups of AWS CloudHSM clusters. This is a paginated operation, which means that each response might contain only a subset of all the backups. When the response contains only a subset of backups, it includes a NextToken value. Use this value in a subsequent DescribeBackups request to get more backups. When you receive a response with no NextToken (or an empty or null value), that means there are no more backups to get.
DescribeClusters
Show Description Gets information about AWS CloudHSM clusters. This is a paginated operation, which means that each response might contain only a subset of all the clusters. When the response contains only a subset of clusters, it includes a NextToken value. Use this value in a subsequent DescribeClusters request to get more clusters. When you receive a response with no NextToken (or an empty or null value), that means there are no more clusters to get.
InitializeCluster
Show Description Claims an AWS CloudHSM cluster by submitting the cluster certificate issued by your issuing certificate authority (CA) and the CA's root certificate. Before you can claim a cluster, you must sign the cluster's certificate signing request (CSR) with your issuing CA. To get the cluster's CSR, use DescribeClusters.
ListTags
Show Description Gets a list of tags for the specified AWS CloudHSM cluster. This is a paginated operation, which means that each response might contain only a subset of all the tags. When the response contains only a subset of tags, it includes a NextToken value. Use this value in a subsequent ListTags request to get more tags. When you receive a response with no NextToken (or an empty or null value), that means there are no more tags to get.
ModifyBackupAttributes
Show Description Modifies attributes for AWS CloudHSM backup.
ModifyCluster
Show Description Modifies AWS CloudHSM cluster.
RestoreBackup
Show Description Restores a specified AWS CloudHSM backup that is in the PENDING_DELETION state. For mor information on deleting a backup, see DeleteBackup.
TagResource
Show Description Adds or overwrites one or more tags for the specified AWS CloudHSM cluster.

Cloudsearch Events

Service Event Name Description
cloudsearch BuildSuggesters
Show Description Indexes the search suggestions. For more information, see Configuring Suggesters in the Amazon CloudSearch Developer Guide.
CreateDomain
Show Description Creates a new search domain. For more information, see Creating a Search Domain in the Amazon CloudSearch Developer Guide.
DefineAnalysisScheme
Show Description Configures an analysis scheme that can be applied to a text or text-array field to define language-specific text processing options. For more information, see Configuring Analysis Schemes in the Amazon CloudSearch Developer Guide.
DefineExpression
Show Description Configures an Expression for the search domain. Used to create new expressions and modify existing ones. If the expression exists, the new configuration replaces the old one. For more information, see Configuring Expressions in the Amazon CloudSearch Developer Guide.
DefineIndexField
Show Description Configures an IndexField for the search domain. Used to create new fields and modify existing ones. You must specify the name of the domain you are configuring and an index field configuration. The index field configuration specifies a unique name, the index field type, and the options you want to configure for the field. The options you can specify depend on the IndexFieldType. If the field exists, the new configuration replaces the old one. For more information, see Configuring Index Fields in the Amazon CloudSearch Developer Guide.
DefineSuggester
Show Description Configures a suggester for a domain. A suggester enables you to display possible matches before users finish typing their queries. When you configure a suggester, you must specify the name of the text field you want to search for possible matches and a unique name for the suggester. For more information, see Getting Search Suggestions in the Amazon CloudSearch Developer Guide.
DeleteAnalysisScheme
Show Description Deletes an analysis scheme. For more information, see Configuring Analysis Schemes in the Amazon CloudSearch Developer Guide.
DeleteDomain
Show Description Permanently deletes a search domain and all of its data. Once a domain has been deleted, it cannot be recovered. For more information, see Deleting a Search Domain in the Amazon CloudSearch Developer Guide.
DeleteExpression
Show Description Removes an Expression from the search domain. For more information, see Configuring Expressions in the Amazon CloudSearch Developer Guide.
DeleteIndexField
Show Description Removes an IndexField from the search domain. For more information, see Configuring Index Fields in the Amazon CloudSearch Developer Guide.
DeleteSuggester
Show Description Deletes a suggester. For more information, see Getting Search Suggestions in the Amazon CloudSearch Developer Guide.
DescribeAnalysisSchemes
Show Description Gets the analysis schemes configured for a domain. An analysis scheme defines language-specific text processing options for a text field. Can be limited to specific analysis schemes by name. By default, shows all analysis schemes and includes any pending changes to the configuration. Set the Deployed option to true to show the active configuration and exclude pending changes. For more information, see Configuring Analysis Schemes in the Amazon CloudSearch Developer Guide.
DescribeAvailabilityOptions
Show Description Gets the availability options configured for a domain. By default, shows the configuration with any pending changes. Set the Deployed option to true to show the active configuration and exclude pending changes. For more information, see Configuring Availability Options in the Amazon CloudSearch Developer Guide.
DescribeDomainEndpointOptions
Show Description Returns the domain's endpoint options, specifically whether all requests to the domain must arrive over HTTPS. For more information, see Configuring Domain Endpoint Options in the Amazon CloudSearch Developer Guide.
DescribeDomains
Show Description Gets information about the search domains owned by this account. Can be limited to specific domains. Shows all domains by default. To get the number of searchable documents in a domain, use the console or submit a matchall request to your domain's search endpoint: q=matchall&q.parser=structured&size=0. For more information, see Getting Information about a Search Domain in the Amazon CloudSearch Developer Guide.
DescribeExpressions
Show Description Gets the expressions configured for the search domain. Can be limited to specific expressions by name. By default, shows all expressions and includes any pending changes to the configuration. Set the Deployed option to true to show the active configuration and exclude pending changes. For more information, see Configuring Expressions in the Amazon CloudSearch Developer Guide.
DescribeIndexFields
Show Description Gets information about the index fields configured for the search domain. Can be limited to specific fields by name. By default, shows all fields and includes any pending changes to the configuration. Set the Deployed option to true to show the active configuration and exclude pending changes. For more information, see Getting Domain Information in the Amazon CloudSearch Developer Guide.
DescribeScalingParameters
Show Description Gets the scaling parameters configured for a domain. A domain's scaling parameters specify the desired search instance type and replication count. For more information, see Configuring Scaling Options in the Amazon CloudSearch Developer Guide.
DescribeServiceAccessPolicies
Show Description Gets information about the access policies that control access to the domain's document and search endpoints. By default, shows the configuration with any pending changes. Set the Deployed option to true to show the active configuration and exclude pending changes. For more information, see Configuring Access for a Search Domain in the Amazon CloudSearch Developer Guide.
DescribeSuggesters
Show Description Gets the suggesters configured for a domain. A suggester enables you to display possible matches before users finish typing their queries. Can be limited to specific suggesters by name. By default, shows all suggesters and includes any pending changes to the configuration. Set the Deployed option to true to show the active configuration and exclude pending changes. For more information, see Getting Search Suggestions in the Amazon CloudSearch Developer Guide.
IndexDocuments
Show Description Tells the search domain to start indexing its documents using the latest indexing options. This operation must be invoked to activate options whose OptionStatus is RequiresIndexDocuments.
ListDomainNames
Show Description Lists all search domains owned by an account.
UpdateAvailabilityOptions
Show Description Configures the availability options for a domain. Enabling the Multi-AZ option expands an Amazon CloudSearch domain to an additional Availability Zone in the same Region to increase fault tolerance in the event of a service disruption. Changes to the Multi-AZ option can take about half an hour to become active. For more information, see Configuring Availability Options in the Amazon CloudSearch Developer Guide.
UpdateDomainEndpointOptions
Show Description Updates the domain's endpoint options, specifically whether all requests to the domain must arrive over HTTPS. For more information, see Configuring Domain Endpoint Options in the Amazon CloudSearch Developer Guide.
UpdateScalingParameters
Show Description Configures scaling parameters for a domain. A domain's scaling parameters specify the desired search instance type and replication count. Amazon CloudSearch will still automatically scale your domain based on the volume of data and traffic, but not below the desired instance type and replication count. If the Multi-AZ option is enabled, these values control the resources used per Availability Zone. For more information, see Configuring Scaling Options in the Amazon CloudSearch Developer Guide.

Cloudsearchdomain Events

Service Event Name Description
cloudsearchdomain Search
Show Description Retrieves a list of documents that match the specified search criteria. How you specify the search criteria depends on which query parser you use. Amazon CloudSearch supports four query parsers:
  • simple: search all text and text-array fields for the specified string. Search for phrases, individual terms, and prefixes.
  • structured: search specific fields, construct compound queries using Boolean operators, and use advanced features such as term boosting and proximity searching.
  • lucene: specify search criteria using the Apache Lucene query parser syntax.
  • dismax: specify search criteria using the simplified subset of the Apache Lucene query parser syntax defined by the DisMax query parser.
For more information, see Searching Your Data in the Amazon CloudSearch Developer Guide. The endpoint for submitting Search requests is domain-specific. You submit search requests to a domain's search endpoint. To get the search endpoint for your domain, use the Amazon CloudSearch configuration service DescribeDomains action. A domain's endpoints are also displayed on the domain dashboard in the Amazon CloudSearch console.
Suggest
Show Description Retrieves autocomplete suggestions for a partial query string. You can use suggestions enable you to display likely matches before users finish typing. In Amazon CloudSearch, suggestions are based on the contents of a particular text field. When you request suggestions, Amazon CloudSearch finds all of the documents whose values in the suggester field start with the specified query string. The beginning of the field must match the query string to be considered a match. For more information about configuring suggesters and retrieving suggestions, see Getting Suggestions in the Amazon CloudSearch Developer Guide. The endpoint for submitting Suggest requests is domain-specific. You submit suggest requests to a domain's search endpoint. To get the search endpoint for your domain, use the Amazon CloudSearch configuration service DescribeDomains action. A domain's endpoints are also displayed on the domain dashboard in the Amazon CloudSearch console.

Cloudwatch Events

Service Event Name Description
cloudwatch DeleteAlarms
DeleteAnomalyDetector
Show Description Deletes the specified anomaly detection model from your account.
DeleteDashboards
Show Description Deletes all dashboards that you specify. You can specify up to 100 dashboards to delete. If there is an error during this call, no dashboards are deleted.
DeleteInsightRules
Show Description Permanently deletes the specified Contributor Insights rules. If you create a rule, delete it, and then re-create it with the same name, historical data from the first time the rule was created might not be available.
DeleteMetricStream
Show Description Permanently deletes the metric stream that you specify.
DescribeAlarmHistory
Show Description Retrieves the history for the specified alarm. You can filter the results by date range or item type. If an alarm name is not specified, the histories for either all metric alarms or all composite alarms are returned. CloudWatch retains the history of an alarm even if you delete the alarm.
DescribeAlarms
Show Description Retrieves the specified alarms. You can filter the results by specifying a prefix for the alarm name, the alarm state, or a prefix for any action.
DescribeAlarmsForMetric
Show Description Retrieves the alarms for the specified metric. To filter the results, specify a statistic, period, or unit. This operation retrieves only standard alarms that are based on the specified metric. It does not return alarms based on math expressions that use the specified metric, or composite alarms that use the specified metric.
DescribeAnomalyDetectors
Show Description Lists the anomaly detection models that you have created in your account. You can list all models in your account or filter the results to only the models that are related to a certain namespace, metric name, or metric dimension.
DescribeInsightRules
Show Description Returns a list of all the Contributor Insights rules in your account. For more information about Contributor Insights, see Using Contributor Insights to Analyze High-Cardinality Data.
DisableAlarmActions
DisableInsightRules
Show Description Disables the specified Contributor Insights rules. When rules are disabled, they do not analyze log groups and do not incur costs.
EnableAlarmActions
EnableInsightRules
Show Description Enables the specified Contributor Insights rules. When rules are enabled, they immediately begin analyzing log data.
GetDashboard
Show Description Displays the details of the dashboard that you specify. To copy an existing dashboard, use GetDashboard, and then use the data returned within DashboardBody as the template for the new dashboard when you call PutDashboard to create the copy.
GetInsightRuleReport
Show Description This operation returns the time series data collected by a Contributor Insights rule. The data includes the identity and number of contributors to the log group. You can also optionally return one or more statistics about each data point in the time series. These statistics can include the following:
  • UniqueContributors -- the number of unique contributors for each data point.
  • MaxContributorValue -- the value of the top contributor for each data point. The identity of the contributor might change for each data point in the graph. If this rule aggregates by COUNT, the top contributor for each data point is the contributor with the most occurrences in that period. If the rule aggregates by SUM, the top contributor is the contributor with the highest sum in the log field specified by the rule's Value, during that period.
  • SampleCount -- the number of data points matched by the rule.
  • Sum -- the sum of the values from all contributors during the time period represented by that data point.
  • Minimum -- the minimum value from a single observation during the time period represented by that data point.
  • Maximum -- the maximum value from a single observation during the time period represented by that data point.
  • Average -- the average value from all contributors during the time period represented by that data point.
GetMetricData
Show Description You can use the GetMetricData API to retrieve as many as 500 different metrics in a single request, with a total of as many as 100,800 data points. You can also optionally perform math expressions on the values of the returned statistics, to create new time series that represent new insights into your data. For example, using Lambda metrics, you could divide the Errors metric by the Invocations metric to get an error rate time series. For more information about metric math expressions, see Metric Math Syntax and Functions in the Amazon CloudWatch User Guide. Calls to the GetMetricData API have a different pricing structure than calls to GetMetricStatistics. For more information about pricing, see Amazon CloudWatch Pricing. Amazon CloudWatch retains metric data as follows:
  • Data points with a period of less than 60 seconds are available for 3 hours. These data points are high-resolution metrics and are available only for custom metrics that have been defined with a StorageResolution of 1.
  • Data points with a period of 60 seconds (1-minute) are available for 15 days.
  • Data points with a period of 300 seconds (5-minute) are available for 63 days.
  • Data points with a period of 3600 seconds (1 hour) are available for 455 days (15 months).
Data points that are initially published with a shorter period are aggregated together for long-term storage. For example, if you collect data using a period of 1 minute, the data remains available for 15 days with 1-minute resolution. After 15 days, this data is still available, but is aggregated and retrievable only with a resolution of 5 minutes. After 63 days, the data is further aggregated and is available with a resolution of 1 hour. If you omit Unit in your request, all data that was collected with any unit is returned, along with the corresponding units that were specified when the data was reported to CloudWatch. If you specify a unit, the operation returns only data that was collected with that unit specified. If you specify a unit that does not match the data collected, the results of the operation are null. CloudWatch does not perform unit conversions.
GetMetricStatistics
Show Description Gets statistics for the specified metric. The maximum number of data points returned from a single call is 1,440. If you request more than 1,440 data points, CloudWatch returns an error. To reduce the number of data points, you can narrow the specified time range and make multiple requests across adjacent time ranges, or you can increase the specified period. Data points are not returned in chronological order. CloudWatch aggregates data points based on the length of the period that you specify. For example, if you request statistics with a one-hour period, CloudWatch aggregates all data points with time stamps that fall within each one-hour period. Therefore, the number of values aggregated by CloudWatch is larger than the number of data points returned. CloudWatch needs raw data points to calculate percentile statistics. If you publish data using a statistic set instead, you can only retrieve percentile statistics for this data if one of the following conditions is true:
  • The SampleCount value of the statistic set is 1.
  • The Min and the Max values of the statistic set are equal.
Percentile statistics are not available for metrics when any of the metric values are negative numbers. Amazon CloudWatch retains metric data as follows:
  • Data points with a period of less than 60 seconds are available for 3 hours. These data points are high-resolution metrics and are available only for custom metrics that have been defined with a StorageResolution of 1.
  • Data points with a period of 60 seconds (1-minute) are available for 15 days.
  • Data points with a period of 300 seconds (5-minute) are available for 63 days.
  • Data points with a period of 3600 seconds (1 hour) are available for 455 days (15 months).
Data points that are initially published with a shorter period are aggregated together for long-term storage. For example, if you collect data using a period of 1 minute, the data remains available for 15 days with 1-minute resolution. After 15 days, this data is still available, but is aggregated and retrievable only with a resolution of 5 minutes. After 63 days, the data is further aggregated and is available with a resolution of 1 hour. CloudWatch started retaining 5-minute and 1-hour metric data as of July 9, 2016. For information about metrics and dimensions supported by Amazon Web Services services, see the Amazon CloudWatch Metrics and Dimensions Reference in the Amazon CloudWatch User Guide.
GetMetricStream
Show Description Returns information about the metric stream that you specify.
GetMetricWidgetImage
Show Description You can use the GetMetricWidgetImage API to retrieve a snapshot graph of one or more Amazon CloudWatch metrics as a bitmap image. You can then embed this image into your services and products, such as wiki pages, reports, and documents. You could also retrieve images regularly, such as every minute, and create your own custom live dashboard. The graph you retrieve can include all CloudWatch metric graph features, including metric math and horizontal and vertical annotations. There is a limit of 20 transactions per second for this API. Each GetMetricWidgetImage action has the following limits:
  • As many as 100 metrics in the graph.
  • Up to 100 KB uncompressed payload.
ListDashboards
Show Description Returns a list of the dashboards for your account. If you include DashboardNamePrefix, only those dashboards with names starting with the prefix are listed. Otherwise, all dashboards in your account are listed. ListDashboards returns up to 1000 results on one page. If there are more than 1000 dashboards, you can call ListDashboards again and include the value you received for NextToken in the first call, to receive the next 1000 results.
ListMetricStreams
Show Description Returns a list of metric streams in this account.
ListMetrics
Show Description List the specified metrics. You can use the returned metrics with GetMetricData or GetMetricStatistics to obtain statistical data. Up to 500 results are returned for any one call. To retrieve additional results, use the returned token with subsequent calls. After you create a metric, allow up to 15 minutes before the metric appears. You can see statistics about the metric sooner by using GetMetricData or GetMetricStatistics. ListMetrics doesn't return information about metrics if those metrics haven't reported data in the past two weeks. To retrieve those metrics, use GetMetricData or GetMetricStatistics.
ListTagsForResource
Show Description Displays the tags associated with a CloudWatch resource. Currently, alarms and Contributor Insights rules support tagging.
PutAnomalyDetector
Show Description Creates an anomaly detection model for a CloudWatch metric. You can use the model to display a band of expected normal values when the metric is graphed. For more information, see CloudWatch Anomaly Detection.
PutCompositeAlarm
PutDashboard
Show Description Creates a dashboard if it does not already exist, or updates an existing dashboard. If you update a dashboard, the entire contents are replaced with what you specify here. All dashboards in your account are global, not region-specific. A simple way to create a dashboard using PutDashboard is to copy an existing dashboard. To copy an existing dashboard using the console, you can load the dashboard and then use the View/edit source command in the Actions menu to display the JSON block for that dashboard. Another way to copy a dashboard is to use GetDashboard, and then use the data returned within DashboardBody as the template for the new dashboard when you call PutDashboard. When you create a dashboard with PutDashboard, a good practice is to add a text widget at the top of the dashboard with a message that the dashboard was created by script and should not be changed in the console. This message could also point console users to the location of the DashboardBody script or the CloudFormation template used to create the dashboard.
PutInsightRule
Show Description Creates a Contributor Insights rule. Rules evaluate log events in a CloudWatch Logs log group, enabling you to find contributor data for the log events in that log group. For more information, see Using Contributor Insights to Analyze High-Cardinality Data. If you create a rule, delete it, and then re-create it with the same name, historical data from the first time the rule was created might not be available.
PutMetricAlarm
PutMetricData
PutMetricStream
Show Description Creates or updates a metric stream. Metric streams can automatically stream CloudWatch metrics to Amazon Web Services destinations including Amazon S3 and to many third-party solutions. For more information, see Using Metric Streams. To create a metric stream, you must be logged on to an account that has the iam:PassRole permission and either the CloudWatchFullAccess policy or the cloudwatch:PutMetricStream permission. When you create or update a metric stream, you choose one of the following:
  • Stream metrics from all metric namespaces in the account.
  • Stream metrics from all metric namespaces in the account, except for the namespaces that you list in ExcludeFilters.
  • Stream metrics from only the metric namespaces that you list in IncludeFilters.
When you use PutMetricStream to create a new metric stream, the stream is created in the running state. If you use it to update an existing stream, the state of the stream is not changed.
SetAlarmState
StartMetricStreams
Show Description Starts the streaming of metrics for one or more of your metric streams.
StopMetricStreams
Show Description Stops the streaming of metrics for one or more of your metric streams.
TagResource
Show Description Assigns one or more tags (key-value pairs) to the specified CloudWatch resource. Currently, the only CloudWatch resources that can be tagged are alarms and Contributor Insights rules. Tags can help you organize and categorize your resources. You can also use them to scope user permissions by granting a user permission to access or change only resources with certain tag values. Tags don't have any semantic meaning to Amazon Web Services and are interpreted strictly as strings of characters. You can use the TagResource action with an alarm that already has tags. If you specify a new tag key for the alarm, this tag is appended to the list of tags associated with the alarm. If you specify a tag key that is already associated with the alarm, the new tag value that you specify replaces the previous value for that tag. You can associate as many as 50 tags with a CloudWatch resource.

Codeartifact Events

Service Event Name Description
codeartifact AssociateExternalConnection
Show Description Adds an existing external connection to a repository. One external connection is allowed per repository. A repository can have one or more upstream repositories, or an external connection.
CopyPackageVersions
Show Description Copies package versions from one repository to another repository in the same domain. You must specify versions or versionRevisions. You cannot specify both.
CreateDomain
Show Description Creates a domain. CodeArtifact domains make it easier to manage multiple repositories across an organization. You can use a domain to apply permissions across many repositories owned by different AWS accounts. An asset is stored only once in a domain, even if it's in multiple repositories. Although you can have multiple domains, we recommend a single production domain that contains all published artifacts so that your development teams can find and share packages. You can use a second pre-production domain to test changes to the production domain configuration.
CreateRepository
Show Description Creates a repository.
DeleteDomain
Show Description Deletes a domain. You cannot delete a domain that contains repositories. If you want to delete a domain with repositories, first delete its repositories.
DeleteDomainPermissionsPolicy
Show Description Deletes the resource policy set on a domain.
DeletePackageVersions
Show Description Deletes one or more versions of a package. A deleted package version cannot be restored in your repository. If you want to remove a package version from your repository and be able to restore it later, set its status to Archived. Archived packages cannot be downloaded from a repository and don't show up with list package APIs (for example, ListackageVersions), but you can restore them using UpdatePackageVersionsStatus.
DeleteRepository
Show Description Deletes a repository.
DeleteRepositoryPermissionsPolicy
Show Description Deletes the resource policy that is set on a repository. After a resource policy is deleted, the permissions allowed and denied by the deleted policy are removed. The effect of deleting a resource policy might not be immediate. Use DeleteRepositoryPermissionsPolicy with caution. After a policy is deleted, AWS users, roles, and accounts lose permissions to perform the repository actions granted by the deleted policy.
DescribeDomain
Show Description Returns a DomainDescription object that contains information about the requested domain.
DescribePackageVersion
Show Description Returns a PackageVersionDescription object that contains information about the requested package version.
DescribeRepository
Show Description Returns a RepositoryDescription object that contains detailed information about the requested repository.
DisassociateExternalConnection
Show Description Removes an existing external connection from a repository.
DisposePackageVersions
Show Description Deletes the assets in package versions and sets the package versions' status to Disposed. A disposed package version cannot be restored in your repository because its assets are deleted. To view all disposed package versions in a repository, use ListPackageVersions and set the status parameter to Disposed. To view information about a disposed package version, use DescribePackageVersion.
GetAuthorizationToken
Show Description Generates a temporary authorization token for accessing repositories in the domain. This API requires the codeartifact:GetAuthorizationToken and sts:GetServiceBearerToken permissions. For more information about authorization tokens, see AWS CodeArtifact authentication and tokens. CodeArtifact authorization tokens are valid for a period of 12 hours when created with the login command. You can call login periodically to refresh the token. When you create an authorization token with the GetAuthorizationToken API, you can set a custom authorization period, up to a maximum of 12 hours, with the durationSeconds parameter. The authorization period begins after login or GetAuthorizationToken is called. If login or GetAuthorizationToken is called while assuming a role, the token lifetime is independent of the maximum session duration of the role. For example, if you call sts assume-role and specify a session duration of 15 minutes, then generate a CodeArtifact authorization token, the token will be valid for the full authorization period even though this is longer than the 15-minute session duration. See Using IAM Roles for more information on controlling session duration.
GetDomainPermissionsPolicy
Show Description Returns the resource policy attached to the specified domain. The policy is a resource-based policy, not an identity-based policy. For more information, see Identity-based policies and resource-based policies in the AWS Identity and Access Management User Guide.
GetPackageVersionAsset
Show Description Returns an asset (or file) that is in a package. For example, for a Maven package version, use GetPackageVersionAsset to download a JAR file, a POM file, or any other assets in the package version.
GetPackageVersionReadme
Show Description Gets the readme file or descriptive text for a package version. For packages that do not contain a readme file, CodeArtifact extracts a description from a metadata file. For example, from the <description> element in the pom.xml file of a Maven package. The returned text might contain formatting. For example, it might contain formatting for Markdown or reStructuredText.
GetRepositoryEndpoint
Show Description Returns the endpoint of a repository for a specific package format. A repository has one endpoint for each package format:
  • npm
  • pypi
  • maven
GetRepositoryPermissionsPolicy
Show Description Returns the resource policy that is set on a repository.
ListDomains
Show Description Returns a list of DomainSummary objects for all domains owned by the AWS account that makes this call. Each returned DomainSummary object contains information about a domain.
ListPackageVersionAssets
Show Description Returns a list of AssetSummary objects for assets in a package version.
ListPackageVersionDependencies
Show Description Returns the direct dependencies for a package version. The dependencies are returned as PackageDependency objects. CodeArtifact extracts the dependencies for a package version from the metadata file for the package format (for example, the package.json file for npm packages and the pom.xml file for Maven). Any package version dependencies that are not listed in the configuration file are not returned.
ListPackageVersions
Show Description Returns a list of PackageVersionSummary objects for package versions in a repository that match the request parameters.
ListPackages
Show Description Returns a list of PackageSummary objects for packages in a repository that match the request parameters.
ListRepositories
Show Description Returns a list of RepositorySummary objects. Each RepositorySummary contains information about a repository in the specified AWS account and that matches the input parameters.
ListRepositoriesInDomain
Show Description Returns a list of RepositorySummary objects. Each RepositorySummary contains information about a repository in the specified domain and that matches the input parameters.
ListTagsForResource
Show Description Gets information about AWS tags for a specified Amazon Resource Name (ARN) in AWS CodeArtifact.
PutDomainPermissionsPolicy
Show Description Sets a resource policy on a domain that specifies permissions to access it. When you call PutDomainPermissionsPolicy, the resource policy on the domain is ignored when evaluting permissions. This ensures that the owner of a domain cannot lock themselves out of the domain, which would prevent them from being able to update the resource policy.
PutRepositoryPermissionsPolicy
Show Description Sets the resource policy on a repository that specifies permissions to access it. When you call PutRepositoryPermissionsPolicy, the resource policy on the repository is ignored when evaluting permissions. This ensures that the owner of a repository cannot lock themselves out of the repository, which would prevent them from being able to update the resource policy.
TagResource
Show Description Adds or updates tags for a resource in AWS CodeArtifact.
UntagResource
Show Description Removes tags from a resource in AWS CodeArtifact.
UpdatePackageVersionsStatus
Show Description Updates the status of one or more versions of a package.

Codebuild Events

Service Event Name Description
codebuild BatchDeleteBuilds
Show Description Deletes one or more builds.
BatchGetBuildBatches
Show Description Retrieves information about one or more batch builds.
BatchGetBuilds
Show Description Gets information about one or more builds.
BatchGetProjects
Show Description Gets information about one or more build projects.
BatchGetReportGroups
Show Description Returns an array of report groups.
BatchGetReports
Show Description Returns an array of reports.
CreateProject
Show Description Creates a build project.
CreateReportGroup
Show Description Creates a report group. A report group contains a collection of reports.
CreateWebhook
Show Description For an existing CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, enables CodeBuild to start rebuilding the source code every time a code change is pushed to the repository. If you enable webhooks for an CodeBuild project, and the project is used as a build step in CodePipeline, then two identical builds are created for each commit. One build is triggered through webhooks, and one through CodePipeline. Because billing is on a per-build basis, you are billed for both builds. Therefore, if you are using CodePipeline, we recommend that you disable webhooks in CodeBuild. In the CodeBuild console, clear the Webhook box. For more information, see step 5 in Change a Build Project's Settings.
DeleteBuildBatch
Show Description Deletes a batch build.
DeleteProject
Show Description Deletes a build project. When you delete a project, its builds are not deleted.
DeleteReport
Show Description Deletes a report.
DeleteReportGroup
Show Description Deletes a report group. Before you delete a report group, you must delete its reports.
DeleteResourcePolicy
Show Description Deletes a resource policy that is identified by its resource ARN.
DeleteSourceCredentials
Show Description Deletes a set of GitHub, GitHub Enterprise, or Bitbucket source credentials.
DeleteWebhook
Show Description For an existing CodeBuild build project that has its source code stored in a GitHub or Bitbucket repository, stops CodeBuild from rebuilding the source code every time a code change is pushed to the repository.
DescribeCodeCoverages
Show Description Retrieves one or more code coverage reports.
DescribeTestCases
Show Description Returns a list of details about test cases for a report.
GetReportGroupTrend
Show Description Analyzes and accumulates test report values for the specified test reports.
GetResourcePolicy
Show Description Gets a resource policy that is identified by its resource ARN.
ImportSourceCredentials
Show Description Imports the source repository credentials for an CodeBuild project that has its source code stored in a GitHub, GitHub Enterprise, or Bitbucket repository.
InvalidateProjectCache
Show Description Resets the cache for a project.
ListBuildBatches
Show Description Retrieves the identifiers of your build batches in the current region.
ListBuildBatchesForProject
Show Description Retrieves the identifiers of the build batches for a specific project.
ListBuilds
Show Description Gets a list of build IDs, with each build ID representing a single build.
ListBuildsForProject
Show Description Gets a list of build identifiers for the specified build project, with each build identifier representing a single build.
ListCuratedEnvironmentImages
Show Description Gets information about Docker images that are managed by CodeBuild.
ListProjects
Show Description Gets a list of build project names, with each build project name representing a single build project.
ListReportGroups
Show Description Gets a list ARNs for the report groups in the current Amazon Web Services account.
ListReports
Show Description Returns a list of ARNs for the reports in the current Amazon Web Services account.
ListReportsForReportGroup
Show Description Returns a list of ARNs for the reports that belong to a ReportGroup.
ListSharedProjects
Show Description Gets a list of projects that are shared with other Amazon Web Services accounts or users.
ListSharedReportGroups
Show Description Gets a list of report groups that are shared with other Amazon Web Services accounts or users.
ListSourceCredentials
Show Description Returns a list of SourceCredentialsInfo objects.
PutResourcePolicy
Show Description Stores a resource policy for the ARN of a Project or ReportGroup object.
RetryBuild
Show Description Restarts a build.
RetryBuildBatch
Show Description Restarts a failed batch build. Only batch builds that have failed can be retried.
StartBuild
Show Description Starts running a build.
StartBuildBatch
Show Description Starts a batch build for a project.
StopBuild
Show Description Attempts to stop running a build.
StopBuildBatch
Show Description Stops a running batch build.
UpdateProject
Show Description Changes the settings of a build project.
UpdateProjectVisibility
Show Description Changes the public visibility for a project. The project's build results, logs, and artifacts are available to the general public. For more information, see Public build projects in the CodeBuild User Guide. The following should be kept in mind when making your projects public:
  • All of a project's build results, logs, and artifacts, including builds that were run when the project was private, are available to the general public.
  • All build logs and artifacts are available to the public. Environment variables, source code, and other sensitive information may have been output to the build logs and artifacts. You must be careful about what information is output to the build logs. Some best practice are:
    • Do not store sensitive values, especially Amazon Web Services access key IDs and secret access keys, in environment variables. We recommend that you use an Amazon EC2 Systems Manager Parameter Store or Secrets Manager to store sensitive values.
    • Follow Best practices for using webhooks in the CodeBuild User Guide to limit which entities can trigger a build, and do not store the buildspec in the project itself, to ensure that your webhooks are as secure as possible.
  • A malicious user can use public builds to distribute malicious artifacts. We recommend that you review all pull requests to verify that the pull request is a legitimate change. We also recommend that you validate any artifacts with their checksums to make sure that the correct artifacts are being downloaded.
UpdateReportGroup
Show Description Updates a report group.

Codecommit Events

Service Event Name Description
codecommit AssociateApprovalRuleTemplateWithRepository
BatchAssociateApprovalRuleTemplateWithRepositories
Show Description Creates an association between an approval rule template and one or more specified repositories.
BatchDescribeMergeConflicts
Show Description Returns information about one or more merge conflicts in the attempted merge of two commit specifiers using the squash or three-way merge strategy.
BatchDisassociateApprovalRuleTemplateFromRepositories
Show Description Removes the association between an approval rule template and one or more specified repositories.
BatchGetCommits
Show Description Returns information about the contents of one or more commits in a repository.
BatchGetRepositories
Show Description Returns information about one or more repositories. The description field for a repository accepts all HTML characters and all valid Unicode characters. Applications that do not HTML-encode the description and display it in a webpage can expose users to potentially malicious code. Make sure that you HTML-encode the description field in any application that uses this API to display the repository description on a webpage.
CreateApprovalRuleTemplate
Show Description Creates a template for approval rules that can then be associated with one or more repositories in your AWS account. When you associate a template with a repository, AWS CodeCommit creates an approval rule that matches the conditions of the template for all pull requests that meet the conditions of the template. For more information, see AssociateApprovalRuleTemplateWithRepository.
CreateBranch
CreateCommit
Show Description Creates a commit for a repository on the tip of a specified branch.
CreatePullRequest
Show Description Creates a pull request in the specified repository.
CreatePullRequestApprovalRule
Show Description Creates an approval rule for a pull request.
CreateRepository
Show Description Creates a new, empty repository.
CreateUnreferencedMergeCommit
Show Description Creates an unreferenced commit that represents the result of merging two branches using a specified merge strategy. This can help you determine the outcome of a potential merge. This API cannot be used with the fast-forward merge strategy because that strategy does not create a merge commit. This unreferenced merge commit can only be accessed using the GetCommit API or through git commands such as git fetch. To retrieve this commit, you must specify its commit ID or otherwise reference it.
DeleteApprovalRuleTemplate
Show Description Deletes a specified approval rule template. Deleting a template does not remove approval rules on pull requests already created with the template.
DeleteBranch
Show Description Deletes a branch from a repository, unless that branch is the default branch for the repository.
DeleteCommentContent
Show Description Deletes the content of a comment made on a change, file, or commit in a repository.
DeleteFile
Show Description Deletes a specified file from a specified branch. A commit is created on the branch that contains the revision. The file still exists in the commits earlier to the commit that contains the deletion.
DeletePullRequestApprovalRule
Show Description Deletes an approval rule from a specified pull request. Approval rules can be deleted from a pull request only if the pull request is open, and if the approval rule was created specifically for a pull request and not generated from an approval rule template associated with the repository where the pull request was created. You cannot delete an approval rule from a merged or closed pull request.
DeleteRepository
Show Description Deletes a repository. If a specified repository was already deleted, a null repository ID is returned. Deleting a repository also deletes all associated objects and metadata. After a repository is deleted, all future push calls to the deleted repository fail.
DescribeMergeConflicts
Show Description Returns information about one or more merge conflicts in the attempted merge of two commit specifiers using the squash or three-way merge strategy. If the merge option for the attempted merge is specified as FAST_FORWARD_MERGE, an exception is thrown.
DescribePullRequestEvents
Show Description Returns information about one or more pull request events.
DisassociateApprovalRuleTemplateFromRepository
EvaluatePullRequestApprovalRules
Show Description Evaluates whether a pull request has met all the conditions specified in its associated approval rules.
GetApprovalRuleTemplate
Show Description Returns information about a specified approval rule template.
GetBlob
Show Description Returns the base-64 encoded content of an individual blob in a repository.
GetBranch
Show Description Returns information about a repository branch, including its name and the last commit ID.
GetComment
Show Description Returns the content of a comment made on a change, file, or commit in a repository. Reaction counts might include numbers from user identities who were deleted after the reaction was made. For a count of reactions from active identities, use GetCommentReactions.
GetCommentReactions
Show Description Returns information about reactions to a specified comment ID. Reactions from users who have been deleted will not be included in the count.
GetCommentsForComparedCommit
Show Description Returns information about comments made on the comparison between two commits. Reaction counts might include numbers from user identities who were deleted after the reaction was made. For a count of reactions from active identities, use GetCommentReactions.
GetCommentsForPullRequest
Show Description Returns comments made on a pull request. Reaction counts might include numbers from user identities who were deleted after the reaction was made. For a count of reactions from active identities, use GetCommentReactions.
GetCommit
Show Description Returns information about a commit, including commit message and committer information.
GetDifferences
Show Description Returns information about the differences in a valid commit specifier (such as a branch, tag, HEAD, commit ID, or other fully qualified reference). Results can be limited to a specified path.
GetFile
Show Description Returns the base-64 encoded contents of a specified file and its metadata.
GetFolder
Show Description Returns the contents of a specified folder in a repository.
GetMergeCommit
Show Description Returns information about a specified merge commit.
GetMergeConflicts
Show Description Returns information about merge conflicts between the before and after commit IDs for a pull request in a repository.
GetMergeOptions
Show Description Returns information about the merge options available for merging two specified branches. For details about why a merge option is not available, use GetMergeConflicts or DescribeMergeConflicts.
GetPullRequest
Show Description Gets information about a pull request in a specified repository.
GetPullRequestApprovalStates
Show Description Gets information about the approval states for a specified pull request. Approval states only apply to pull requests that have one or more approval rules applied to them.
GetPullRequestOverrideState
Show Description Returns information about whether approval rules have been set aside (overridden) for a pull request, and if so, the Amazon Resource Name (ARN) of the user or identity that overrode the rules and their requirements for the pull request.
GetRepository
Show Description Returns information about a repository. The description field for a repository accepts all HTML characters and all valid Unicode characters. Applications that do not HTML-encode the description and display it in a webpage can expose users to potentially malicious code. Make sure that you HTML-encode the description field in any application that uses this API to display the repository description on a webpage.
GetRepositoryTriggers
Show Description Gets information about triggers configured for a repository.
ListApprovalRuleTemplates
Show Description Lists all approval rule templates in the specified AWS Region in your AWS account. If an AWS Region is not specified, the AWS Region where you are signed in is used.
ListAssociatedApprovalRuleTemplatesForRepository
Show Description Lists all approval rule templates that are associated with a specified repository.
ListBranches
Show Description Gets information about one or more branches in a repository.
ListPullRequests
Show Description Returns a list of pull requests for a specified repository. The return list can be refined by pull request status or pull request author ARN.
ListRepositories
Show Description Gets information about one or more repositories.
ListRepositoriesForApprovalRuleTemplate
Show Description Lists all repositories associated with the specified approval rule template.
ListTagsForResource
Show Description Gets information about AWS tags for a specified Amazon Resource Name (ARN) in AWS CodeCommit. For a list of valid resources in AWS CodeCommit, see CodeCommit Resources and Operations in the AWS CodeCommit User Guide.
MergeBranchesByFastForward
Show Description Merges two branches using the fast-forward merge strategy.
MergeBranchesBySquash
Show Description Merges two branches using the squash merge strategy.
MergeBranchesByThreeWay
Show Description Merges two specified branches using the three-way merge strategy.
MergePullRequestByFastForward
Show Description Attempts to merge the source commit of a pull request into the specified destination branch for that pull request at the specified commit using the fast-forward merge strategy. If the merge is successful, it closes the pull request.
MergePullRequestBySquash
Show Description Attempts to merge the source commit of a pull request into the specified destination branch for that pull request at the specified commit using the squash merge strategy. If the merge is successful, it closes the pull request.
MergePullRequestByThreeWay
Show Description Attempts to merge the source commit of a pull request into the specified destination branch for that pull request at the specified commit using the three-way merge strategy. If the merge is successful, it closes the pull request.
OverridePullRequestApprovalRules
PostCommentForComparedCommit
Show Description Posts a comment on the comparison between two commits.
PostCommentForPullRequest
Show Description Posts a comment on a pull request.
PostCommentReply
Show Description Posts a comment in reply to an existing comment on a comparison between commits or a pull request.
PutCommentReaction
PutFile
Show Description Adds or updates a file in a branch in an AWS CodeCommit repository, and generates a commit for the addition in the specified branch.
PutRepositoryTriggers
Show Description Replaces all triggers for a repository. Used to create or delete triggers.
TagResource
TestRepositoryTriggers
Show Description Tests the functionality of repository triggers by sending information to the trigger target. If real data is available in the repository, the test sends data from the last commit. If no data is available, sample data is generated.
UntagResource
UpdateApprovalRuleTemplateContent
Show Description Updates the content of an approval rule template. You can change the number of required approvals, the membership of the approval rule, and whether an approval pool is defined.
UpdateApprovalRuleTemplateDescription
Show Description Updates the description for a specified approval rule template.
UpdateApprovalRuleTemplateName
Show Description Updates the name of a specified approval rule template.
UpdateComment
Show Description Replaces the contents of a comment.
UpdateDefaultBranch
UpdatePullRequestApprovalRuleContent
Show Description Updates the structure of an approval rule created specifically for a pull request. For example, you can change the number of required approvers and the approval pool for approvers.
UpdatePullRequestApprovalState
UpdatePullRequestDescription
Show Description Replaces the contents of the description of a pull request.
UpdatePullRequestStatus
Show Description Updates the status of a pull request.
UpdatePullRequestTitle
Show Description Replaces the title of a pull request.
UpdateRepositoryDescription

Codedeploy Events

Service Event Name Description
codedeploy AddTagsToOnPremisesInstances
BatchGetApplicationRevisions
Show Description Gets information about one or more application revisions. The maximum number of application revisions that can be returned is 25.
BatchGetApplications
Show Description Gets information about one or more applications. The maximum number of applications that can be returned is 100.
BatchGetDeploymentGroups
Show Description Gets information about one or more deployment groups.
BatchGetDeploymentInstances
Show Description This method works, but is deprecated. Use BatchGetDeploymentTargets instead. Returns an array of one or more instances associated with a deployment. This method works with EC2/On-premises and AWS Lambda compute platforms. The newer BatchGetDeploymentTargets works with all compute platforms. The maximum number of instances that can be returned is 25.
BatchGetDeploymentTargets
Show Description Returns an array of one or more targets associated with a deployment. This method works with all compute types and should be used instead of the deprecated BatchGetDeploymentInstances. The maximum number of targets that can be returned is 25. The type of targets returned depends on the deployment's compute platform or deployment method:
  • EC2/On-premises: Information about EC2 instance targets.
  • AWS Lambda: Information about Lambda functions targets.
  • Amazon ECS: Information about Amazon ECS service targets.
  • CloudFormation: Information about targets of blue/green deployments initiated by a CloudFormation stack update.
BatchGetDeployments
Show Description Gets information about one or more deployments. The maximum number of deployments that can be returned is 25.
BatchGetOnPremisesInstances
Show Description Gets information about one or more on-premises instances. The maximum number of on-premises instances that can be returned is 25.
ContinueDeployment
CreateApplication
Show Description Creates an application.
CreateDeployment
Show Description Deploys an application revision through the specified deployment group.
CreateDeploymentConfig
Show Description Creates a deployment configuration.
CreateDeploymentGroup
Show Description Creates a deployment group to which application revisions are deployed.
DeleteApplication
DeleteDeploymentConfig
DeleteDeploymentGroup
Show Description Deletes a deployment group.
DeleteGitHubAccountToken
Show Description Deletes a GitHub account connection.
DeleteResourcesByExternalId
Show Description Deletes resources linked to an external ID.
DeregisterOnPremisesInstance
GetApplication
Show Description Gets information about an application.
GetApplicationRevision
Show Description Gets information about an application revision.
GetDeployment
Show Description Gets information about a deployment. The content property of the appSpecContent object in the returned revision is always null. Use GetApplicationRevision and the sha256 property of the returned appSpecContent object to get the content of the deployment’s AppSpec file.
GetDeploymentConfig
Show Description Gets information about a deployment configuration.
GetDeploymentGroup
Show Description Gets information about a deployment group.
GetDeploymentInstance
Show Description Gets information about an instance as part of a deployment.
GetDeploymentTarget
Show Description Returns information about a deployment target.
GetOnPremisesInstance
Show Description Gets information about an on-premises instance.
ListApplicationRevisions
Show Description Lists information about revisions for an application.
ListApplications
Show Description Lists the applications registered with the IAM user or AWS account.
ListDeploymentConfigs
Show Description Lists the deployment configurations with the IAM user or AWS account.
ListDeploymentGroups
Show Description Lists the deployment groups for an application registered with the IAM user or AWS account.
ListDeploymentInstances
Show Description The newer BatchGetDeploymentTargets should be used instead because it works with all compute types. ListDeploymentInstances throws an exception if it is used with a compute platform other than EC2/On-premises or AWS Lambda. Lists the instance for a deployment associated with the IAM user or AWS account.
ListDeploymentTargets
Show Description Returns an array of target IDs that are associated a deployment.
ListDeployments
Show Description Lists the deployments in a deployment group for an application registered with the IAM user or AWS account.
ListGitHubAccountTokenNames
Show Description Lists the names of stored connections to GitHub accounts.
ListOnPremisesInstances
Show Description Gets a list of names for one or more on-premises instances. Unless otherwise specified, both registered and deregistered on-premises instance names are listed. To list only registered or deregistered on-premises instance names, use the registration status parameter.
ListTagsForResource
Show Description Returns a list of tags for the resource identified by a specified Amazon Resource Name (ARN). Tags are used to organize and categorize your CodeDeploy resources.
PutLifecycleEventHookExecutionStatus
Show Description Sets the result of a Lambda validation function. The function validates lifecycle hooks during a deployment that uses the AWS Lambda or Amazon ECS compute platform. For AWS Lambda deployments, the available lifecycle hooks are BeforeAllowTraffic and AfterAllowTraffic. For Amazon ECS deployments, the available lifecycle hooks are BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic. Lambda validation functions return Succeeded or Failed. For more information, see AppSpec 'hooks' Section for an AWS Lambda Deployment and AppSpec 'hooks' Section for an Amazon ECS Deployment.
RegisterApplicationRevision
RegisterOnPremisesInstance
RemoveTagsFromOnPremisesInstances
SkipWaitTimeForInstanceTermination
StopDeployment
Show Description Attempts to stop an ongoing deployment.
TagResource
Show Description Associates the list of tags in the input Tags parameter with the resource identified by the ResourceArn input parameter.
UntagResource
Show Description Disassociates a resource from a list of tags. The resource is identified by the ResourceArn input parameter. The tags are identified by the list of keys in the TagKeys input parameter.
UpdateApplication

Codeguru-reviewer Events

Service Event Name Description
codeguru-reviewer AssociateRepository
Show Description Use to associate an Amazon Web Services CodeCommit repository or a repostory managed by Amazon Web Services CodeStar Connections with Amazon CodeGuru Reviewer. When you associate a repository, CodeGuru Reviewer reviews source code changes in the repository's pull requests and provides automatic recommendations. You can view recommendations using the CodeGuru Reviewer console. For more information, see Recommendations in Amazon CodeGuru Reviewer in the Amazon CodeGuru Reviewer User Guide. If you associate a CodeCommit or S3 repository, it must be in the same Amazon Web Services Region and Amazon Web Services account where its CodeGuru Reviewer code reviews are configured. Bitbucket and GitHub Enterprise Server repositories are managed by Amazon Web Services CodeStar Connections to connect to CodeGuru Reviewer. For more information, see Associate a repository in the Amazon CodeGuru Reviewer User Guide. You cannot use the CodeGuru Reviewer SDK or the Amazon Web Services CLI to associate a GitHub repository with Amazon CodeGuru Reviewer. To associate a GitHub repository, use the console. For more information, see Getting started with CodeGuru Reviewer in the CodeGuru Reviewer User Guide.
CreateCodeReview
Show Description Use to create a code review with a CodeReviewType of RepositoryAnalysis. This type of code review analyzes all code under a specified branch in an associated repository. PullRequest code reviews are automatically triggered by a pull request.
DescribeCodeReview
Show Description Returns the metadata associated with the code review along with its status.
DescribeRecommendationFeedback
Show Description Describes the customer feedback for a CodeGuru Reviewer recommendation.
DescribeRepositoryAssociation
Show Description Returns a RepositoryAssociation object that contains information about the requested repository association.
DisassociateRepository
Show Description Removes the association between Amazon CodeGuru Reviewer and a repository.
ListCodeReviews
Show Description Lists all the code reviews that the customer has created in the past 90 days.
ListRecommendationFeedback
Show Description Returns a list of RecommendationFeedbackSummary objects that contain customer recommendation feedback for all CodeGuru Reviewer users.
ListRecommendations
Show Description Returns the list of all recommendations for a completed code review.
ListRepositoryAssociations
Show Description Returns a list of RepositoryAssociationSummary objects that contain summary information about a repository association. You can filter the returned list by ProviderType , Name , State , and Owner .
ListTagsForResource
Show Description Returns the list of tags associated with an associated repository resource.
PutRecommendationFeedback
Show Description Stores customer feedback for a CodeGuru Reviewer recommendation. When this API is called again with different reactions the previous feedback is overwritten.
TagResource
Show Description Adds one or more tags to an associated repository.

Codeguruprofiler Events

Service Event Name Description
codeguruprofiler AddNotificationChannels
Show Description Add up to 2 anomaly notifications channels for a profiling group.
BatchGetFrameMetricData
Show Description Returns the time series of values for a requested list of frame metrics from a time period.
ConfigureAgent
Show Description Used by profiler agents to report their current state and to receive remote configuration updates. For example, ConfigureAgent can be used to tell an agent whether to profile or not and for how long to return profiling data.
CreateProfilingGroup
Show Description Creates a profiling group.
DeleteProfilingGroup
Show Description Deletes a profiling group.
DescribeProfilingGroup
Show Description Returns a ProfilingGroupDescription object that contains information about the requested profiling group.
GetFindingsReportAccountSummary
Show Description Returns a list of FindingsReportSummary objects that contain analysis results for all profiling groups in your AWS account.
GetNotificationConfiguration
Show Description Get the current configuration for anomaly notifications for a profiling group.
GetPolicy
Show Description Returns the JSON-formatted resource-based policy on a profiling group.
GetProfile
Show Description Gets the aggregated profile of a profiling group for a specified time range. Amazon CodeGuru Profiler collects posted agent profiles for a profiling group into aggregated profiles. 
 <note> <p> Because aggregated profiles expire over time <code>GetProfile</code> is not idempotent. </p> </note> <p> Specify the time range for the requested aggregated profile using 1 or 2 of the following parameters: <code>startTime</code>, <code>endTime</code>, <code>period</code>. The maximum time range allowed is 7 days. If you specify all 3 parameters, an exception is thrown. If you specify only <code>period</code>, the latest aggregated profile is returned. </p> <p> Aggregated profiles are available with aggregation periods of 5 minutes, 1 hour, and 1 day, aligned to UTC. The aggregation period of an aggregated profile determines how long it is retained. For more information, see <a href="https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_AggregatedProfileTime.html"> <code>AggregatedProfileTime</code> </a>. The aggregated profile's aggregation period determines how long it is retained by CodeGuru Profiler. </p> <ul> <li> <p> If the aggregation period is 5 minutes, the aggregated profile is retained for 15 days. </p> </li> <li> <p> If the aggregation period is 1 hour, the aggregated profile is retained for 60 days. </p> </li> <li> <p> If the aggregation period is 1 day, the aggregated profile is retained for 3 years. </p> </li> </ul> <p>There are two use cases for calling <code>GetProfile</code>.</p> <ol> <li> <p> If you want to return an aggregated profile that already exists, use <a href="https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ListProfileTimes.html"> <code>ListProfileTimes</code> </a> to view the time ranges of existing aggregated profiles. Use them in a <code>GetProfile</code> request to return a specific, existing aggregated profile. </p> </li> <li> <p> If you want to return an aggregated profile for a time range that doesn't align with an existing aggregated profile, then CodeGuru Profiler makes a best effort to combine existing aggregated profiles from the requested time range and return them as one aggregated profile. </p> <p> If aggregated profiles do not exist for the full time range requested, then aggregated profiles for a smaller time range are returned. For example, if the requested time range is from 00:00 to 00:20, and the existing aggregated profiles are from 00:15 and 00:25, then the aggregated profiles from 00:15 to 00:20 are returned. </p> </li> </ol>
GetRecommendations
Show Description Returns a list of Recommendation objects that contain recommendations for a profiling group for a given time period. A list of Anomaly objects that contains details about anomalies detected in the profiling group for the same time period is also returned.
ListFindingsReports
Show Description List the available reports for a given profiling group and time range.
ListProfileTimes
Show Description Lists the start times of the available aggregated profiles of a profiling group for an aggregation period within the specified time range.
ListProfilingGroups
Show Description Returns a list of profiling groups. The profiling groups are returned as ProfilingGroupDescription objects.
ListTagsForResource
Show Description Returns a list of the tags that are assigned to a specified resource.
PostAgentProfile
Show Description Submits profiling data to an aggregated profile of a profiling group. To get an aggregated profile that is created with this profiling data, use GetProfile .
PutPermission
Show Description Adds permissions to a profiling group's resource-based policy that are provided using an action group. If a profiling group doesn't have a resource-based policy, one is created for it using the permissions in the action group and the roles and users in the principals parameter. 
 <p> The one supported action group that can be added is <code>agentPermission</code> which grants <code>ConfigureAgent</code> and <code>PostAgent</code> permissions. For more information, see <a href="https://docs.aws.amazon.com/codeguru/latest/profiler-ug/resource-based-policies.html">Resource-based policies in CodeGuru Profiler</a> in the <i>Amazon CodeGuru Profiler User Guide</i>, <a href="https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_ConfigureAgent.html"> <code>ConfigureAgent</code> </a>, and <a href="https://docs.aws.amazon.com/codeguru/latest/profiler-api/API_PostAgentProfile.html"> <code>PostAgentProfile</code> </a>. </p> <p> The first time you call <code>PutPermission</code> on a profiling group, do not specify a <code>revisionId</code> because it doesn't have a resource-based policy. Subsequent calls must provide a <code>revisionId</code> to specify which revision of the resource-based policy to add the permissions to. </p> <p> The response contains the profiling group's JSON-formatted resource policy. </p>
RemoveNotificationChannel
Show Description Remove one anomaly notifications channel for a profiling group.
RemovePermission
Show Description Removes permissions from a profiling group's resource-based policy that are provided using an action group. The one supported action group that can be removed is agentPermission which grants ConfigureAgent and PostAgent permissions. For more information, see Resource-based policies in CodeGuru Profiler in the Amazon CodeGuru Profiler User Guide, ConfigureAgent , and PostAgentProfile .
SubmitFeedback
Show Description Sends feedback to CodeGuru Profiler about whether the anomaly detected by the analysis is useful or not.
TagResource
Show Description Use to assign one or more tags to a resource.
UntagResource
Show Description Use to remove one or more tags from a resource.

Codepipeline Events

Service Event Name Description
codepipeline AcknowledgeJob
Show Description Returns information about a specified job and whether that job has been received by the job worker. Used for custom actions only.
AcknowledgeThirdPartyJob
Show Description Confirms a job worker has received the specified job. Used for partner actions only.
CreateCustomActionType
Show Description Creates a new custom action that can be used in all pipelines associated with the AWS account. Only used for custom actions.
CreatePipeline
Show Description Creates a pipeline. In the pipeline structure, you must include either artifactStore or artifactStores in your pipeline, but you cannot use both. If you create a cross-region action in your pipeline, you must use artifactStores.
DeleteCustomActionType
DeletePipeline
DeleteWebhook
Show Description Deletes a previously created webhook by name. Deleting the webhook stops AWS CodePipeline from starting a pipeline every time an external event occurs. The API returns successfully when trying to delete a webhook that is already deleted. If a deleted webhook is re-created by calling PutWebhook with the same name, it will have a different URL.
DeregisterWebhookWithThirdParty
Show Description Removes the connection between the webhook that was created by CodePipeline and the external tool with events to be detected. Currently supported only for webhooks that target an action type of GitHub.
DisableStageTransition
EnableStageTransition
GetActionType
Show Description Returns information about an action type created for an external provider, where the action is to be used by customers of the external provider. The action can be created with any supported integration model.
GetJobDetails
Show Description Returns information about a job. Used for custom actions only. When this API is called, AWS CodePipeline returns temporary credentials for the S3 bucket used to store artifacts for the pipeline, if the action requires access to that S3 bucket for input or output artifacts. This API also returns any secret values defined for the action.
GetPipeline
Show Description Returns the metadata, structure, stages, and actions of a pipeline. Can be used to return the entire structure of a pipeline in JSON format, which can then be modified and used to update the pipeline structure with UpdatePipeline.
GetPipelineExecution
Show Description Returns information about an execution of a pipeline, including details about artifacts, the pipeline execution ID, and the name, version, and status of the pipeline.
GetPipelineState
Show Description Returns information about the state of a pipeline, including the stages and actions. Values returned in the revisionId and revisionUrl fields indicate the source revision information, such as the commit ID, for the current state.
GetThirdPartyJobDetails
Show Description Requests the details of a job for a third party action. Used for partner actions only. When this API is called, AWS CodePipeline returns temporary credentials for the S3 bucket used to store artifacts for the pipeline, if the action requires access to that S3 bucket for input or output artifacts. This API also returns any secret values defined for the action.
ListActionExecutions
Show Description Lists the action executions that have occurred in a pipeline.
ListActionTypes
Show Description Gets a summary of all AWS CodePipeline action types associated with your account.
ListPipelineExecutions
Show Description Gets a summary of the most recent executions for a pipeline.
ListPipelines
Show Description Gets a summary of all of the pipelines associated with your account.
ListTagsForResource
Show Description Gets the set of key-value pairs (metadata) that are used to manage the resource.
ListWebhooks
Show Description Gets a listing of all the webhooks in this AWS Region for this account. The output lists all webhooks and includes the webhook URL and ARN and the configuration for each webhook.
PollForJobs
Show Description Returns information about any jobs for AWS CodePipeline to act on. PollForJobs is valid only for action types with "Custom" in the owner field. If the action type contains "AWS" or "ThirdParty" in the owner field, the PollForJobs action returns an error. When this API is called, AWS CodePipeline returns temporary credentials for the S3 bucket used to store artifacts for the pipeline, if the action requires access to that S3 bucket for input or output artifacts. This API also returns any secret values defined for the action.
PollForThirdPartyJobs
Show Description Determines whether there are any third party jobs for a job worker to act on. Used for partner actions only. When this API is called, AWS CodePipeline returns temporary credentials for the S3 bucket used to store artifacts for the pipeline, if the action requires access to that S3 bucket for input or output artifacts.
PutActionRevision
Show Description Provides information to AWS CodePipeline about new revisions to a source.
PutApprovalResult
Show Description Provides the response to a manual approval request to AWS CodePipeline. Valid responses include Approved and Rejected.
PutJobFailureResult
PutJobSuccessResult
PutThirdPartyJobFailureResult
PutThirdPartyJobSuccessResult
PutWebhook
Show Description Defines a webhook and returns a unique webhook URL generated by CodePipeline. This URL can be supplied to third party source hosting providers to call every time there's a code change. When CodePipeline receives a POST request on this URL, the pipeline defined in the webhook is started as long as the POST request satisfied the authentication and filtering requirements supplied when defining the webhook. RegisterWebhookWithThirdParty and DeregisterWebhookWithThirdParty APIs can be used to automatically configure supported third parties to call the generated webhook URL.
RegisterWebhookWithThirdParty
Show Description Configures a connection between the webhook that was created and the external tool with events to be detected.
RetryStageExecution
Show Description Resumes the pipeline execution by retrying the last failed actions in a stage. You can retry a stage immediately if any of the actions in the stage fail. When you retry, all actions that are still in progress continue working, and failed actions are triggered again.
StartPipelineExecution
Show Description Starts the specified pipeline. Specifically, it begins processing the latest commit to the source location specified as part of the pipeline.
StopPipelineExecution
Show Description Stops the specified pipeline execution. You choose to either stop the pipeline execution by completing in-progress actions without starting subsequent actions, or by abandoning in-progress actions. While completing or abandoning in-progress actions, the pipeline execution is in a Stopping state. After all in-progress actions are completed or abandoned, the pipeline execution is in a Stopped state.
TagResource
Show Description Adds to or modifies the tags of the given resource. Tags are metadata that can be used to manage a resource.
UntagResource
Show Description Removes tags from an AWS resource.
UpdateActionType

Codestar-connections Events

Service Event Name Description
codestar-connections CreateConnection
Show Description Creates a connection that can then be given to other AWS services like CodePipeline so that it can access third-party code repositories. The connection is in pending status until the third-party connection handshake is completed from the console.
CreateHost
Show Description Creates a resource that represents the infrastructure where a third-party provider is installed. The host is used when you create connections to an installed third-party provider type, such as GitHub Enterprise Server. You create one host for all connections to that provider. A host created through the CLI or the SDK is in `PENDING` status by default. You can make its status `AVAILABLE` by setting up the host in the console.
DeleteConnection
Show Description The connection to be deleted.
DeleteHost
Show Description The host to be deleted. Before you delete a host, all connections associated to the host must be deleted. A host cannot be deleted if it is in the VPC_CONFIG_INITIALIZING or VPC_CONFIG_DELETING state.
GetConnection
Show Description Returns the connection ARN and details such as status, owner, and provider type.
GetHost
Show Description Returns the host ARN and details such as status, provider type, endpoint, and, if applicable, the VPC configuration.
ListConnections
Show Description Lists the connections associated with your account.
ListHosts
Show Description Lists the hosts associated with your account.
ListTagsForResource
Show Description Gets the set of key-value pairs (metadata) that are used to manage the resource.
TagResource
Show Description Adds to or modifies the tags of the given resource. Tags are metadata that can be used to manage a resource.
UntagResource
Show Description Removes tags from an AWS resource.

Codestar-notifications Events

Service Event Name Description
codestar-notifications CreateNotificationRule
Show Description Creates a notification rule for a resource. The rule specifies the events you want notifications about and the targets (such as SNS topics) where you want to receive them.
DeleteNotificationRule
Show Description Deletes a notification rule for a resource.
DeleteTarget
Show Description Deletes a specified target for notifications.
DescribeNotificationRule
Show Description Returns information about a specified notification rule.
ListEventTypes
Show Description Returns information about the event types available for configuring notifications.
ListNotificationRules
Show Description Returns a list of the notification rules for an AWS account.
ListTagsForResource
Show Description Returns a list of the tags associated with a notification rule.
ListTargets
Show Description Returns a list of the notification rule targets for an AWS account.
Subscribe
Show Description Creates an association between a notification rule and an SNS topic so that the associated target can receive notifications when the events described in the rule are triggered.
TagResource
Show Description Associates a set of provided tags with a notification rule.
Unsubscribe
Show Description Removes an association between a notification rule and an Amazon SNS topic so that subscribers to that topic stop receiving notifications when the events described in the rule are triggered.
UntagResource
Show Description Removes the association between one or more provided tags and a notification rule.

Codestar Events

Service Event Name Description
codestar AssociateTeamMember
Show Description Adds an IAM user to the team for an AWS CodeStar project.
CreateProject
Show Description Creates a project, including project resources. This action creates a project based on a submitted project request. A set of source code files and a toolchain template file can be included with the project request. If these are not provided, an empty project is created.
CreateUserProfile
Show Description Creates a profile for a user that includes user preferences, such as the display name and email address assocciated with the user, in AWS CodeStar. The user profile is not project-specific. Information in the user profile is displayed wherever the user's information appears to other users in AWS CodeStar.
DeleteProject
Show Description Deletes a project, including project resources. Does not delete users associated with the project, but does delete the IAM roles that allowed access to the project.
DeleteUserProfile
Show Description Deletes a user profile in AWS CodeStar, including all personal preference data associated with that profile, such as display name and email address. It does not delete the history of that user, for example the history of commits made by that user.
DescribeProject
Show Description Describes a project and its resources.
DescribeUserProfile
Show Description Describes a user in AWS CodeStar and the user attributes across all projects.
DisassociateTeamMember
Show Description Removes a user from a project. Removing a user from a project also removes the IAM policies from that user that allowed access to the project and its resources. Disassociating a team member does not remove that user's profile from AWS CodeStar. It does not remove the user from IAM.
ListProjects
Show Description Lists all projects in AWS CodeStar associated with your AWS account.
ListResources
Show Description Lists resources associated with a project in AWS CodeStar.
ListTagsForProject
Show Description Gets the tags for a project.
ListTeamMembers
Show Description Lists all team members associated with a project.
ListUserProfiles
Show Description Lists all the user profiles configured for your AWS account in AWS CodeStar.
TagProject
Show Description Adds tags to a project.
UntagProject
Show Description Removes tags from a project.
UpdateProject
Show Description Updates a project in AWS CodeStar.
UpdateTeamMember
Show Description Updates a team member's attributes in an AWS CodeStar project. For example, you can change a team member's role in the project, or change whether they have remote access to project resources.

Cognito-identity Events

Service Event Name Description
cognito-identity CreateIdentityPool
Show Description Creates a new identity pool. The identity pool is a store of user identity information that is specific to your AWS account. The keys for SupportedLoginProviders are as follows:
  • Facebook: graph.facebook.com
  • Google: accounts.google.com
  • Amazon: www.amazon.com
  • Twitter: api.twitter.com
  • Digits: www.digits.com
You must use AWS Developer credentials to call this API.
DeleteIdentities
Show Description Deletes identities from an identity pool. You can specify a list of 1-60 identities that you want to delete. You must use AWS Developer credentials to call this API.
DeleteIdentityPool
DescribeIdentity
Show Description Returns metadata related to the given identity, including when the identity was created and any associated linked logins. You must use AWS Developer credentials to call this API.
DescribeIdentityPool
Show Description Gets details about a particular identity pool, including the pool name, ID description, creation date, and current number of users. You must use AWS Developer credentials to call this API.
GetCredentialsForIdentity
Show Description Returns credentials for the provided identity ID. Any provided logins will be validated against supported login providers. If the token is for cognito-identity.amazonaws.com, it will be passed through to AWS Security Token Service with the appropriate role for the token. This is a public API. You do not need any credentials to call this API.
GetId
Show Description Generates (or retrieves) a Cognito ID. Supplying multiple logins will create an implicit linked account. This is a public API. You do not need any credentials to call this API.
GetIdentityPoolRoles
Show Description Gets the roles for an identity pool. You must use AWS Developer credentials to call this API.
GetOpenIdToken
Show Description Gets an OpenID token, using a known Cognito ID. This known Cognito ID is returned by GetId. You can optionally add additional logins for the identity. Supplying multiple logins creates an implicit link. The OpenID token is valid for 10 minutes. This is a public API. You do not need any credentials to call this API.
GetOpenIdTokenForDeveloperIdentity
Show Description Registers (or retrieves) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process. Supplying multiple logins will create an implicit linked account. You can only specify one developer provider as part of the Logins map, which is linked to the identity pool. The developer provider is the "domain" by which Cognito will refer to your users. You can use GetOpenIdTokenForDeveloperIdentity to create a new identity and to link new logins (that is, user credentials issued by a public provider or developer provider) to an existing identity. When you want to create a new identity, the IdentityId should be null. When you want to associate a new login with an existing authenticated/unauthenticated identity, you can do so by providing the existing IdentityId. This API will create the identity in the specified IdentityPoolId. You must use AWS Developer credentials to call this API.
GetPrincipalTagAttributeMap
Show Description Use GetPrincipalTagAttributeMap to list all mappings between PrincipalTags and user attributes.
ListIdentities
Show Description Lists the identities in an identity pool. You must use AWS Developer credentials to call this API.
ListIdentityPools
Show Description Lists all of the Cognito identity pools registered for your account. You must use AWS Developer credentials to call this API.
ListTagsForResource
Show Description Lists the tags that are assigned to an Amazon Cognito identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria. You can use this action up to 10 times per second, per account.
LookupDeveloperIdentity
Show Description Retrieves the IdentityID associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifier values associated with an IdentityId for an existing identity. Either IdentityID or DeveloperUserIdentifier must not be null. If you supply only one of these values, the other value will be searched in the database and returned as a part of the response. If you supply both, DeveloperUserIdentifier will be matched against IdentityID. If the values are verified against the database, the response returns both values and is the same as the request. Otherwise a ResourceConflictException is thrown. LookupDeveloperIdentity is intended for low-throughput control plane operations: for example, to enable customer service to locate an identity ID by username. If you are using it for higher-volume operations such as user authentication, your requests are likely to be throttled. GetOpenIdTokenForDeveloperIdentity is a better option for higher-volume operations for user authentication. You must use AWS Developer credentials to call this API.
MergeDeveloperIdentities
Show Description Merges two users having different IdentityIds, existing in the same identity pool, and identified by the same developer provider. You can use this action to request that discrete users be merged and identified as a single user in the Cognito environment. Cognito associates the given source user (SourceUserIdentifier) with the IdentityId of the DestinationUserIdentifier. Only developer-authenticated users can be merged. If the users to be merged are associated with the same public provider, but as two different users, an exception will be thrown. The number of linked logins is limited to 20. So, the number of linked logins for the source user, SourceUserIdentifier, and the destination user, DestinationUserIdentifier, together should not be larger than 20. Otherwise, an exception will be thrown. You must use AWS Developer credentials to call this API.
SetIdentityPoolRoles
SetPrincipalTagAttributeMap
Show Description You can use this operation to use default (username and clientID) attribute or custom attribute mappings.
TagResource
Show Description Assigns a set of tags to the specified Amazon Cognito identity pool. A tag is a label that you can use to categorize and manage identity pools in different ways, such as by purpose, owner, environment, or other criteria. Each tag consists of a key and value, both of which you define. A key is a general category for more specific values. For example, if you have two versions of an identity pool, one for testing and another for production, you might assign an Environment tag key to both identity pools. The value of this key might be Test for one identity pool and Production for the other. Tags are useful for cost tracking and access control. You can activate your tags so that they appear on the Billing and Cost Management console, where you can track the costs associated with your identity pools. In an IAM policy, you can constrain permissions for identity pools based on specific tags or tag values. You can use this action up to 5 times per second, per account. An identity pool can have as many as 50 tags.
UnlinkDeveloperIdentity
UnlinkIdentity
UntagResource
Show Description Removes the specified tags from the specified Amazon Cognito identity pool. You can use this action up to 5 times per second, per account

Cognito-sync Events

Service Event Name Description
cognito-sync BulkPublish
Show Description Initiates a bulk publish of all existing datasets for an Identity Pool to the configured stream. Customers are limited to one successful bulk publish per 24 hours. Bulk publish is an asynchronous request, customers can see the status of the request via the GetBulkPublishDetails operation.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity.
DeleteDataset
Show Description Deletes the specific dataset. The dataset will be deleted permanently, and the action can't be undone. Datasets that this dataset was merged with will no longer report the merge. Any subsequent operation on this dataset will result in a ResourceNotFoundException. This API can be called with temporary user credentials provided by Cognito Identity or with developer credentials.
DescribeDataset
Show Description Gets meta data about a dataset by identity and dataset name. With Amazon Cognito Sync, each identity has access only to its own data. Thus, the credentials used to make this API call need to have access to the identity data. This API can be called with temporary user credentials provided by Cognito Identity or with developer credentials. You should use Cognito Identity credentials to make this API call.
DescribeIdentityPoolUsage
Show Description Gets usage details (for example, data storage) about a particular identity pool. This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity.
DescribeIdentityUsage
Show Description Gets usage information for an identity, including number of datasets and data usage. This API can be called with temporary user credentials provided by Cognito Identity or with developer credentials.
GetBulkPublishDetails
Show Description Get the status of the last BulkPublish operation for an identity pool.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity.
GetCognitoEvents
Show Description Gets the events and the corresponding Lambda functions associated with an identity pool.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity.
GetIdentityPoolConfiguration
Show Description Gets the configuration settings of an identity pool.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity.
ListDatasets
Show Description Lists datasets for an identity. With Amazon Cognito Sync, each identity has access only to its own data. Thus, the credentials used to make this API call need to have access to the identity data. ListDatasets can be called with temporary user credentials provided by Cognito Identity or with developer credentials. You should use the Cognito Identity credentials to make this API call.
ListIdentityPoolUsage
Show Description Gets a list of identity pools registered with Cognito. ListIdentityPoolUsage can only be called with developer credentials. You cannot make this API call with the temporary user credentials provided by Cognito Identity.
ListRecords
Show Description Gets paginated records, optionally changed after a particular sync count for a dataset and identity. With Amazon Cognito Sync, each identity has access only to its own data. Thus, the credentials used to make this API call need to have access to the identity data. ListRecords can be called with temporary user credentials provided by Cognito Identity or with developer credentials. You should use Cognito Identity credentials to make this API call.
RegisterDevice
Show Description Registers a device to receive push sync notifications.This API can only be called with temporary credentials provided by Cognito Identity. You cannot call this API with developer credentials.
SetCognitoEvents
SetIdentityPoolConfiguration
Show Description Sets the necessary configuration for push sync.This API can only be called with developer credentials. You cannot call this API with the temporary user credentials provided by Cognito Identity.
SubscribeToDataset
Show Description Subscribes to receive notifications when a dataset is modified by another device.This API can only be called with temporary credentials provided by Cognito Identity. You cannot call this API with developer credentials.
UnsubscribeFromDataset
Show Description Unsubscribes from receiving notifications when a dataset is modified by another device.This API can only be called with temporary credentials provided by Cognito Identity. You cannot call this API with developer credentials.

Comprehendmedical Events

Service Event Name Description
comprehendmedical DescribeEntitiesDetectionV2Job
Show Description Gets the properties associated with a medical entities detection job. Use this operation to get the status of a detection job.
DescribeICD10CMInferenceJob
Show Description Gets the properties associated with an InferICD10CM job. Use this operation to get the status of an inference job.
DescribePHIDetectionJob
Show Description Gets the properties associated with a protected health information (PHI) detection job. Use this operation to get the status of a detection job.
DescribeRxNormInferenceJob
Show Description Gets the properties associated with an InferRxNorm job. Use this operation to get the status of an inference job.
DetectEntities
Show Description The DetectEntities operation is deprecated. You should use the DetectEntitiesV2 operation instead. Inspects the clinical text for a variety of medical entities and returns specific information about them such as entity category, location, and confidence score on that information .
DetectEntitiesV2
Show Description Inspects the clinical text for a variety of medical entities and returns specific information about them such as entity category, location, and confidence score on that information. Amazon Comprehend Medical only detects medical entities in English language texts. The DetectEntitiesV2 operation replaces the DetectEntities operation. This new action uses a different model for determining the entities in your medical text and changes the way that some entities are returned in the output. You should use the DetectEntitiesV2 operation in all new applications. The DetectEntitiesV2 operation returns the Acuity and Direction entities as attributes instead of types.
DetectPHI
Show Description Inspects the clinical text for protected health information (PHI) entities and returns the entity category, location, and confidence score for each entity. Amazon Comprehend Medical only detects entities in English language texts.
InferICD10CM
Show Description InferICD10CM detects medical conditions as entities listed in a patient record and links those entities to normalized concept identifiers in the ICD-10-CM knowledge base from the Centers for Disease Control. Amazon Comprehend Medical only detects medical entities in English language texts.
InferRxNorm
Show Description InferRxNorm detects medications as entities listed in a patient record and links to the normalized concept identifiers in the RxNorm database from the National Library of Medicine. Amazon Comprehend Medical only detects medical entities in English language texts.
ListEntitiesDetectionV2Jobs
Show Description Gets a list of medical entity detection jobs that you have submitted.
ListICD10CMInferenceJobs
Show Description Gets a list of InferICD10CM jobs that you have submitted.
ListPHIDetectionJobs
Show Description Gets a list of protected health information (PHI) detection jobs that you have submitted.
ListRxNormInferenceJobs
Show Description Gets a list of InferRxNorm jobs that you have submitted.
StartEntitiesDetectionV2Job
Show Description Starts an asynchronous medical entity detection job for a collection of documents. Use the DescribeEntitiesDetectionV2Job operation to track the status of a job.
StartICD10CMInferenceJob
Show Description Starts an asynchronous job to detect medical conditions and link them to the ICD-10-CM ontology. Use the DescribeICD10CMInferenceJob operation to track the status of a job.
StartPHIDetectionJob
Show Description Starts an asynchronous job to detect protected health information (PHI). Use the DescribePHIDetectionJob operation to track the status of a job.
StartRxNormInferenceJob
Show Description Starts an asynchronous job to detect medication entities and link them to the RxNorm ontology. Use the DescribeRxNormInferenceJob operation to track the status of a job.
StopEntitiesDetectionV2Job
Show Description Stops a medical entities detection job in progress.
StopICD10CMInferenceJob
Show Description Stops an InferICD10CM inference job in progress.
StopPHIDetectionJob
Show Description Stops a protected health information (PHI) detection job in progress.

Compute-optimizer Events

Service Event Name Description
compute-optimizer DescribeRecommendationExportJobs
Show Description Describes recommendation export jobs created in the last seven days. Use the ExportAutoScalingGroupRecommendations or ExportEC2InstanceRecommendations actions to request an export of your recommendations. Then use the DescribeRecommendationExportJobs action to view your export jobs.
ExportAutoScalingGroupRecommendations
Show Description Exports optimization recommendations for Auto Scaling groups. Recommendations are exported in a comma-separated values (.csv) file, and its metadata in a JavaScript Object Notation (JSON) (.json) file, to an existing Amazon Simple Storage Service (Amazon S3) bucket that you specify. For more information, see Exporting Recommendations in the Compute Optimizer User Guide. You can have only one Auto Scaling group export job in progress per Amazon Web Services Region.
ExportEBSVolumeRecommendations
Show Description Exports optimization recommendations for Amazon EBS volumes. Recommendations are exported in a comma-separated values (.csv) file, and its metadata in a JavaScript Object Notation (JSON) (.json) file, to an existing Amazon Simple Storage Service (Amazon S3) bucket that you specify. For more information, see Exporting Recommendations in the Compute Optimizer User Guide. You can have only one Amazon EBS volume export job in progress per Amazon Web Services Region.
ExportEC2InstanceRecommendations
Show Description Exports optimization recommendations for Amazon EC2 instances. Recommendations are exported in a comma-separated values (.csv) file, and its metadata in a JavaScript Object Notation (JSON) (.json) file, to an existing Amazon Simple Storage Service (Amazon S3) bucket that you specify. For more information, see Exporting Recommendations in the Compute Optimizer User Guide. You can have only one Amazon EC2 instance export job in progress per Amazon Web Services Region.
ExportLambdaFunctionRecommendations
Show Description Exports optimization recommendations for Lambda functions. Recommendations are exported in a comma-separated values (.csv) file, and its metadata in a JavaScript Object Notation (JSON) (.json) file, to an existing Amazon Simple Storage Service (Amazon S3) bucket that you specify. For more information, see Exporting Recommendations in the Compute Optimizer User Guide. You can have only one Lambda function export job in progress per Amazon Web Services Region.
GetAutoScalingGroupRecommendations
Show Description Returns Auto Scaling group recommendations. Compute Optimizer generates recommendations for Amazon EC2 Auto Scaling groups that meet a specific set of requirements. For more information, see the Supported resources and requirements in the Compute Optimizer User Guide.
GetEBSVolumeRecommendations
Show Description Returns Amazon Elastic Block Store (Amazon EBS) volume recommendations. Compute Optimizer generates recommendations for Amazon EBS volumes that meet a specific set of requirements. For more information, see the Supported resources and requirements in the Compute Optimizer User Guide.
GetEC2InstanceRecommendations
Show Description Returns Amazon EC2 instance recommendations. Compute Optimizer generates recommendations for Amazon Elastic Compute Cloud (Amazon EC2) instances that meet a specific set of requirements. For more information, see the Supported resources and requirements in the Compute Optimizer User Guide.
GetEC2RecommendationProjectedMetrics
Show Description Returns the projected utilization metrics of Amazon EC2 instance recommendations. The Cpu and Memory metrics are the only projected utilization metrics returned when you run this action. Additionally, the Memory metric is returned only for resources that have the unified CloudWatch agent installed on them. For more information, see Enabling Memory Utilization with the CloudWatch Agent.
GetEnrollmentStatus
Show Description Returns the enrollment (opt in) status of an account to the Compute Optimizer service. If the account is the management account of an organization, this action also confirms the enrollment status of member accounts of the organization. Use the GetEnrollmentStatusesForOrganization action to get detailed information about the enrollment status of member accounts of an organization.
GetEnrollmentStatusesForOrganization
Show Description Returns the Compute Optimizer enrollment (opt-in) status of organization member accounts, if your account is an organization management account. To get the enrollment status of standalone accounts, use the GetEnrollmentStatus action.
GetLambdaFunctionRecommendations
Show Description Returns Lambda function recommendations. Compute Optimizer generates recommendations for functions that meet a specific set of requirements. For more information, see the Supported resources and requirements in the Compute Optimizer User Guide.
GetRecommendationSummaries
Show Description Returns the optimization findings for an account. It returns the number of:
  • Amazon EC2 instances in an account that are Underprovisioned, Overprovisioned, or Optimized.
  • Auto Scaling groups in an account that are NotOptimized, or Optimized.
  • Amazon EBS volumes in an account that are NotOptimized, or Optimized.
  • Lambda functions in an account that are NotOptimized, or Optimized.

Connect-contact-lens Events

Service Event Name Description
connect-contact-lens ListRealtimeContactAnalysisSegments
Show Description Provides a list of analysis segments for a real-time analysis session.

Connect Events

Service Event Name Description
connect AssociateApprovedOrigin
AssociateBot
AssociateInstanceStorageConfig
Show Description This API is in preview release for Amazon Connect and is subject to change. Associates a storage resource type for the first time. You can only associate one type of storage configuration in a single call. This means, for example, that you can't define an instance with multiple S3 buckets for storing chat transcripts. This API does not create a resource that doesn't exist. It only associates it to the instance. Ensure that the resource being specified in the storage configuration, like an S3 bucket, exists when being used for association.
AssociateLambdaFunction
AssociateLexBot
AssociateQueueQuickConnects
AssociateRoutingProfileQueues
AssociateSecurityKey
Show Description This API is in preview release for Amazon Connect and is subject to change. Associates a security key to the instance.
CreateAgentStatus
Show Description This API is in preview release for Amazon Connect and is subject to change. Creates an agent status for the specified Amazon Connect instance.
CreateContactFlow
Show Description Creates a contact flow for the specified Amazon Connect instance. You can also create and update contact flows using the Amazon Connect Flow language.
CreateHoursOfOperation
Show Description Creates hours of operation.
CreateInstance
Show Description This API is in preview release for Amazon Connect and is subject to change. Initiates an Amazon Connect instance with all the supported channels enabled. It does not attach any storage, such as Amazon Simple Storage Service (Amazon S3) or Amazon Kinesis. It also does not allow for any configurations on features, such as Contact Lens for Amazon Connect. Amazon Connect enforces a limit on the total number of instances that you can create or delete in 30 days. If you exceed this limit, you will get an error message indicating there has been an excessive number of attempts at creating or deleting instances. You must wait 30 days before you can restart creating and deleting instances in your account.
CreateIntegrationAssociation
Show Description Creates an Amazon Web Services resource association with an Amazon Connect instance.
CreateQueue
Show Description This API is in preview release for Amazon Connect and is subject to change. Creates a new queue for the specified Amazon Connect instance.
CreateQuickConnect
Show Description Creates a quick connect for the specified Amazon Connect instance.
CreateRoutingProfile
Show Description Creates a new routing profile.
CreateSecurityProfile
Show Description This API is in preview release for Amazon Connect and is subject to change. Creates a security profile.
CreateUseCase
Show Description Creates a use case for an integration association.
CreateUser
Show Description Creates a user account for the specified Amazon Connect instance. For information about how to create user accounts using the Amazon Connect console, see Add Users in the Amazon Connect Administrator Guide.
CreateUserHierarchyGroup
Show Description Creates a new user hierarchy group.
DeleteHoursOfOperation
DeleteInstance
DeleteIntegrationAssociation
DeleteQuickConnect
DeleteSecurityProfile
DeleteUseCase
DeleteUser
DeleteUserHierarchyGroup
DescribeAgentStatus
Show Description This API is in preview release for Amazon Connect and is subject to change. Describes an agent status.
DescribeContactFlow
Show Description Describes the specified contact flow. You can also create and update contact flows using the Amazon Connect Flow language.
DescribeHoursOfOperation
Show Description Describes the hours of operation.
DescribeInstance
Show Description This API is in preview release for Amazon Connect and is subject to change. Returns the current state of the specified instance identifier. It tracks the instance while it is being created and returns an error status, if applicable. If an instance is not created successfully, the instance status reason field returns details relevant to the reason. The instance in a failed state is returned only for 24 hours after the CreateInstance API was invoked.
DescribeInstanceAttribute
Show Description This API is in preview release for Amazon Connect and is subject to change. Describes the specified instance attribute.
DescribeInstanceStorageConfig
Show Description This API is in preview release for Amazon Connect and is subject to change. Retrieves the current storage configurations for the specified resource type, association ID, and instance ID.
DescribeQueue
Show Description This API is in preview release for Amazon Connect and is subject to change. Describes the specified queue.
DescribeQuickConnect
Show Description Describes the quick connect.
DescribeRoutingProfile
Show Description Describes the specified routing profile.
DescribeSecurityProfile
Show Description This API is in preview release for Amazon Connect and is subject to change. Gets basic information about the security profle.
DescribeUser
Show Description Describes the specified user account. You can find the instance ID in the console (it’s the final part of the ARN). The console does not display the user IDs. Instead, list the users and note the IDs provided in the output.
DescribeUserHierarchyGroup
Show Description Describes the specified hierarchy group.
DescribeUserHierarchyStructure
Show Description Describes the hierarchy structure of the specified Amazon Connect instance.
DisassociateApprovedOrigin
DisassociateBot
DisassociateInstanceStorageConfig
DisassociateLambdaFunction
DisassociateLexBot
DisassociateQueueQuickConnects
DisassociateRoutingProfileQueues
DisassociateSecurityKey
GetContactAttributes
Show Description Retrieves the contact attributes for the specified contact.
GetCurrentMetricData
Show Description Gets the real-time metric data from the specified Amazon Connect instance. For a description of each metric, see Real-time Metrics Definitions in the Amazon Connect Administrator Guide.
GetFederationToken
Show Description Retrieves a token for federation. This API doesn't support root users. If you try to invoke GetFederationToken with root credentials, an error message similar to the following one appears: Provided identity: Principal: .... User: .... cannot be used for federation with Amazon Connect
GetMetricData
Show Description Gets historical metric data from the specified Amazon Connect instance. For a description of each historical metric, see Historical Metrics Definitions in the Amazon Connect Administrator Guide.
ListAgentStatuses
Show Description This API is in preview release for Amazon Connect and is subject to change. Lists agent statuses.
ListApprovedOrigins
Show Description This API is in preview release for Amazon Connect and is subject to change. Returns a paginated list of all approved origins associated with the instance.
ListBots
Show Description This API is in preview release for Amazon Connect and is subject to change. For the specified version of Amazon Lex, returns a paginated list of all the Amazon Lex bots currently associated with the instance.
ListContactFlows
Show Description Provides information about the contact flows for the specified Amazon Connect instance. You can also create and update contact flows using the Amazon Connect Flow language. For more information about contact flows, see Contact Flows in the Amazon Connect Administrator Guide.
ListHoursOfOperations
Show Description Provides information about the hours of operation for the specified Amazon Connect instance. For more information about hours of operation, see Set the Hours of Operation for a Queue in the Amazon Connect Administrator Guide.
ListInstanceAttributes
Show Description This API is in preview release for Amazon Connect and is subject to change. Returns a paginated list of all attribute types for the given instance.
ListInstanceStorageConfigs
Show Description This API is in preview release for Amazon Connect and is subject to change. Returns a paginated list of storage configs for the identified instance and resource type.
ListInstances
Show Description This API is in preview release for Amazon Connect and is subject to change. Return a list of instances which are in active state, creation-in-progress state, and failed state. Instances that aren't successfully created (they are in a failed state) are returned only for 24 hours after the CreateInstance API was invoked.
ListIntegrationAssociations
Show Description Provides summary information about the Amazon Web Services resource associations for the specified Amazon Connect instance.
ListLambdaFunctions
Show Description This API is in preview release for Amazon Connect and is subject to change. Returns a paginated list of all Lambda functions that display in the dropdown options in the relevant contact flow blocks.
ListLexBots
Show Description This API is in preview release for Amazon Connect and is subject to change. Returns a paginated list of all the Amazon Lex bots currently associated with the instance.
ListPhoneNumbers
Show Description Provides information about the phone numbers for the specified Amazon Connect instance. For more information about phone numbers, see Set Up Phone Numbers for Your Contact Center in the Amazon Connect Administrator Guide.
ListPrompts
Show Description Provides information about the prompts for the specified Amazon Connect instance.
ListQueueQuickConnects
Show Description This API is in preview release for Amazon Connect and is subject to change. Lists the quick connects associated with a queue.
ListQueues
Show Description Provides information about the queues for the specified Amazon Connect instance. If you do not specify a QueueTypes parameter, both standard and agent queues are returned. This might cause an unexpected truncation of results if you have more than 1000 agents and you limit the number of results of the API call in code. For more information about queues, see Queues: Standard and Agent in the Amazon Connect Administrator Guide.
ListQuickConnects
Show Description Provides information about the quick connects for the specified Amazon Connect instance.
ListRoutingProfileQueues
Show Description Lists the queues associated with a routing profile.
ListRoutingProfiles
Show Description Provides summary information about the routing profiles for the specified Amazon Connect instance. For more information about routing profiles, see Routing Profiles and Create a Routing Profile in the Amazon Connect Administrator Guide.
ListSecurityKeys
Show Description This API is in preview release for Amazon Connect and is subject to change. Returns a paginated list of all security keys associated with the instance.
ListSecurityProfilePermissions
Show Description This API is in preview release for Amazon Connect and is subject to change. Lists the permissions granted to a security profile.
ListSecurityProfiles
Show Description This API is in preview release for Amazon Connect and is subject to change. Provides summary information about the security profiles for the specified Amazon Connect instance. For more information about security profiles, see Security Profiles in the Amazon Connect Administrator Guide.
ListTagsForResource
Show Description Lists the tags for the specified resource. For sample policies that use tags, see Amazon Connect Identity-Based Policy Examples in the Amazon Connect Administrator Guide.
ListUseCases
Show Description Lists the use cases for the integration association.
ListUserHierarchyGroups
Show Description Provides summary information about the hierarchy groups for the specified Amazon Connect instance. For more information about agent hierarchies, see Set Up Agent Hierarchies in the Amazon Connect Administrator Guide.
ListUsers
Show Description Provides summary information about the users for the specified Amazon Connect instance.
ResumeContactRecording
Show Description When a contact is being recorded, and the recording has been suspended using SuspendContactRecording, this API resumes recording the call. Only voice recordings are supported at this time.
StartChatContact
Show Description Initiates a contact flow to start a new chat for the customer. Response of this API provides a token required to obtain credentials from the CreateParticipantConnection API in the Amazon Connect Participant Service. When a new chat contact is successfully created, clients must subscribe to the participant’s connection for the created chat within 5 minutes. This is achieved by invoking CreateParticipantConnection with WEBSOCKET and CONNECTION_CREDENTIALS. A 429 error occurs in two situations:
  • API rate limit is exceeded. API TPS throttling returns a TooManyRequests exception.
  • The quota for concurrent active chats is exceeded. Active chat throttling returns a LimitExceededException.
For more information about chat, see Chat in the Amazon Connect Administrator Guide.
StartContactRecording
Show Description Starts recording the contact when the agent joins the call. StartContactRecording is a one-time action. For example, if you use StopContactRecording to stop recording an ongoing call, you can't use StartContactRecording to restart it. For scenarios where the recording has started and you want to suspend and resume it, such as when collecting sensitive information (for example, a credit card number), use SuspendContactRecording and ResumeContactRecording. You can use this API to override the recording behavior configured in the Set recording behavior block. Only voice recordings are supported at this time.
StartContactStreaming
Show Description Initiates real-time message streaming for a new chat contact. For more information about message streaming, see Enable real-time chat message streaming in the Amazon Connect Administrator Guide.
StartOutboundVoiceContact
Show Description Places an outbound call to a contact, and then initiates the contact flow. It performs the actions in the contact flow that's specified (in ContactFlowId). Agents do not initiate the outbound API, which means that they do not dial the contact. If the contact flow places an outbound call to a contact, and then puts the contact in queue, the call is then routed to the agent, like any other inbound case. There is a 60-second dialing timeout for this operation. If the call is not connected after 60 seconds, it fails. UK numbers with a 447 prefix are not allowed by default. Before you can dial these UK mobile numbers, you must submit a service quota increase request. For more information, see Amazon Connect Service Quotas in the Amazon Connect Administrator Guide. Campaign calls are not allowed by default. Before you can make a call with TrafficType = CAMPAIGN, you must submit a service quota increase request. For more information, see Amazon Connect Service Quotas in the Amazon Connect Administrator Guide.
StartTaskContact
Show Description Initiates a contact flow to start a new task.
StopContact
Show Description Ends the specified contact.
StopContactRecording
Show Description Stops recording a call when a contact is being recorded. StopContactRecording is a one-time action. If you use StopContactRecording to stop recording an ongoing call, you can't use StartContactRecording to restart it. For scenarios where the recording has started and you want to suspend it for sensitive information (for example, to collect a credit card number), and then restart it, use SuspendContactRecording and ResumeContactRecording. Only voice recordings are supported at this time.
StopContactStreaming
Show Description Ends message streaming on a specified contact. To restart message streaming on that contact, call the StartContactStreaming API.
SuspendContactRecording
Show Description When a contact is being recorded, this API suspends recording the call. For example, you might suspend the call recording while collecting sensitive information, such as a credit card number. Then use ResumeContactRecording to restart recording. The period of time that the recording is suspended is filled with silence in the final recording. Only voice recordings are supported at this time.
TagResource
UntagResource
UpdateAgentStatus
UpdateContactAttributes
Show Description Creates or updates user-defined contact attributes associated with the specified contact. You can create or update user-defined attributes for both ongoing and completed contacts. For example, while the call is active, you can update the customer's name or the reason the customer called. You can add notes about steps that the agent took during the call that display to the next agent that takes the call. You can also update attributes for a contact using data from your CRM application and save the data with the contact in Amazon Connect. You could also flag calls for additional analysis, such as legal review or to identify abusive callers. Contact attributes are available in Amazon Connect for 24 months, and are then deleted. For information about CTR retention and the maximum size of the CTR attributes section, see Feature specifications in the Amazon Connect Administrator Guide. Important: You cannot use the operation to update attributes for contacts that occurred prior to the release of the API, which was September 12, 2018. You can update attributes only for contacts that started after the release of the API. If you attempt to update attributes for a contact that occurred prior to the release of the API, a 400 error is returned. This applies also to queued callbacks that were initiated prior to the release of the API but are still active in your instance.
UpdateContactFlowContent
UpdateContactFlowName
UpdateHoursOfOperation
UpdateInstanceAttribute
UpdateInstanceStorageConfig
UpdateQueueHoursOfOperation
UpdateQueueMaxContacts
UpdateQueueName
UpdateQueueOutboundCallerConfig
UpdateQueueStatus
UpdateQuickConnectConfig
UpdateQuickConnectName
UpdateRoutingProfileConcurrency
UpdateRoutingProfileDefaultOutboundQueue
UpdateRoutingProfileName
UpdateRoutingProfileQueues
UpdateSecurityProfile
UpdateUserHierarchy
UpdateUserHierarchyGroupName
UpdateUserHierarchyStructure
UpdateUserIdentityInfo
UpdateUserPhoneConfig
UpdateUserRoutingProfile

Connectparticipant Events

Service Event Name Description
connectparticipant CompleteAttachmentUpload
Show Description Allows you to confirm that the attachment has been uploaded using the pre-signed URL provided in StartAttachmentUpload API. The Amazon Connect Participant Service APIs do not use Signature Version 4 authentication.
CreateParticipantConnection
Show Description Creates the participant's connection. Note that ParticipantToken is used for invoking this API instead of ConnectionToken. The participant token is valid for the lifetime of the participant – until they are part of a contact. The response URL for WEBSOCKET Type has a connect expiry timeout of 100s. Clients must manually connect to the returned websocket URL and subscribe to the desired topic. For chat, you need to publish the following on the established websocket connection: {"topic":"aws/subscribe","content":{"topics":["aws/chat"]}} Upon websocket URL expiry, as specified in the response ConnectionExpiry parameter, clients need to call this API again to obtain a new websocket URL and perform the same steps as before. Message streaming support: This API can also be used together with the StartContactStreaming API to create a participant connection for chat contacts that are not using a websocket. For more information about message streaming, Enable real-time chat message streaming in the Amazon Connect Administrator Guide. Feature specifications: For information about feature specifications, such as the allowed number of open websocket connections per participant, see Feature specifications in the Amazon Connect Administrator Guide. The Amazon Connect Participant Service APIs do not use Signature Version 4 authentication.
DisconnectParticipant
Show Description Disconnects a participant. Note that ConnectionToken is used for invoking this API instead of ParticipantToken. The Amazon Connect Participant Service APIs do not use Signature Version 4 authentication.
GetAttachment
Show Description Provides a pre-signed URL for download of a completed attachment. This is an asynchronous API for use with active contacts. The Amazon Connect Participant Service APIs do not use Signature Version 4 authentication.
GetTranscript
Show Description Retrieves a transcript of the session, including details about any attachments. Note that ConnectionToken is used for invoking this API instead of ParticipantToken. The Amazon Connect Participant Service APIs do not use Signature Version 4 authentication.
SendEvent
Show Description Sends an event. Note that ConnectionToken is used for invoking this API instead of ParticipantToken. The Amazon Connect Participant Service APIs do not use Signature Version 4 authentication.
SendMessage
Show Description Sends a message. Note that ConnectionToken is used for invoking this API instead of ParticipantToken. The Amazon Connect Participant Service APIs do not use Signature Version 4 authentication.

Cur Events

Service Event Name Description
cur DeleteReportDefinition
Show Description Deletes the specified report.
DescribeReportDefinitions
Show Description Lists the AWS Cost and Usage reports available to this account.
ModifyReportDefinition
Show Description Allows you to programatically update your report preferences.

Databrew Events

Service Event Name Description
databrew BatchDeleteRecipeVersion
Show Description Deletes one or more versions of a recipe at a time. The entire request will be rejected if:
  • The recipe does not exist.
  • There is an invalid version identifier in the list of versions.
  • The version list is empty.
  • The version list size exceeds 50.
  • The version list contains duplicate entries.
The request will complete successfully, but with partial failures, if:
  • A version does not exist.
  • A version is being used by a job.
  • You specify LATEST_WORKING, but it's being used by a project.
  • The version fails to be deleted.
The LATEST_WORKING version will only be deleted if the recipe has no other versions. If you try to delete LATEST_WORKING while other versions exist (or if they can't be deleted), then LATEST_WORKING will be listed as partial failure in the response.
CreateDataset
Show Description Creates a new DataBrew dataset.
CreateProfileJob
Show Description Creates a new job to analyze a dataset and create its data profile.
CreateProject
Show Description Creates a new DataBrew project.
CreateRecipe
Show Description Creates a new DataBrew recipe.
CreateRecipeJob
Show Description Creates a new job to transform input data, using steps defined in an existing Glue DataBrew recipe
CreateSchedule
Show Description Creates a new schedule for one or more DataBrew jobs. Jobs can be run at a specific date and time, or at regular intervals.
DeleteDataset
Show Description Deletes a dataset from DataBrew.
DeleteJob
Show Description Deletes the specified DataBrew job.
DeleteProject
Show Description Deletes an existing DataBrew project.
DeleteRecipeVersion
Show Description Deletes a single version of a DataBrew recipe.
DeleteSchedule
Show Description Deletes the specified DataBrew schedule.
DescribeDataset
Show Description Returns the definition of a specific DataBrew dataset.
DescribeJob
Show Description Returns the definition of a specific DataBrew job.
DescribeJobRun
Show Description Represents one run of a DataBrew job.
DescribeProject
Show Description Returns the definition of a specific DataBrew project.
DescribeRecipe
Show Description Returns the definition of a specific DataBrew recipe corresponding to a particular version.
DescribeSchedule
Show Description Returns the definition of a specific DataBrew schedule.
ListDatasets
Show Description Lists all of the DataBrew datasets.
ListJobRuns
Show Description Lists all of the previous runs of a particular DataBrew job.
ListJobs
Show Description Lists all of the DataBrew jobs that are defined.
ListProjects
Show Description Lists all of the DataBrew projects that are defined.
ListRecipeVersions
Show Description Lists the versions of a particular DataBrew recipe, except for LATEST_WORKING.
ListRecipes
Show Description Lists all of the DataBrew recipes that are defined.
ListSchedules
Show Description Lists the DataBrew schedules that are defined.
ListTagsForResource
Show Description Lists all the tags for a DataBrew resource.
PublishRecipe
Show Description Publishes a new version of a DataBrew recipe.
SendProjectSessionAction
Show Description Performs a recipe step within an interactive DataBrew session that's currently open.
StartJobRun
Show Description Runs a DataBrew job.
StartProjectSession
Show Description Creates an interactive session, enabling you to manipulate data in a DataBrew project.
StopJobRun
Show Description Stops a particular run of a job.
TagResource
Show Description Adds metadata tags to a DataBrew resource, such as a dataset, project, recipe, job, or schedule.
UntagResource
Show Description Removes metadata tags from a DataBrew resource.
UpdateDataset
Show Description Modifies the definition of an existing DataBrew dataset.
UpdateProfileJob
Show Description Modifies the definition of an existing profile job.
UpdateProject
Show Description Modifies the definition of an existing DataBrew project.
UpdateRecipe
Show Description Modifies the definition of the LATEST_WORKING version of a DataBrew recipe.
UpdateRecipeJob
Show Description Modifies the definition of an existing DataBrew recipe job.

Dataexchange Events

Service Event Name Description
dataexchange CancelJob
CreateDataSet
Show Description This operation creates a data set.
CreateEventAction
Show Description This operation creates an event action.
CreateJob
Show Description This operation creates a job.
CreateRevision
Show Description This operation creates a revision for a data set.
DeleteAsset
DeleteDataSet
DeleteEventAction
DeleteRevision
GetAsset
Show Description This operation returns information about an asset.
GetDataSet
Show Description This operation returns information about a data set.
GetEventAction
Show Description This operation retrieves information about an event action.
GetJob
Show Description This operation returns information about a job.
GetRevision
Show Description This operation returns information about a revision.
ListDataSetRevisions
Show Description This operation lists a data set's revisions sorted by CreatedAt in descending order.
ListDataSets
Show Description This operation lists your data sets. When listing by origin OWNED, results are sorted by CreatedAt in descending order. When listing by origin ENTITLED, there is no order and the maxResults parameter is ignored.
ListEventActions
Show Description This operation lists your event actions.
ListJobs
Show Description This operation lists your jobs sorted by CreatedAt in descending order.
ListRevisionAssets
Show Description This operation lists a revision's assets sorted alphabetically in descending order.
ListTagsForResource
Show Description This operation lists the tags on the resource.
StartJob
Show Description This operation starts a job.
TagResource
UntagResource
UpdateAsset
Show Description This operation updates an asset.
UpdateDataSet
Show Description This operation updates a data set.
UpdateEventAction
Show Description This operation updates the event action.

Datapipeline Events

Service Event Name Description
datapipeline ActivatePipeline
Show Description Validates the specified pipeline and starts processing pipeline tasks. If the pipeline does not pass validation, activation fails. If you need to pause the pipeline to investigate an issue with a component, such as a data source or script, call DeactivatePipeline. To activate a finished pipeline, modify the end date for the pipeline and then activate it.
AddTags
Show Description Adds or modifies tags for the specified pipeline.
CreatePipeline
Show Description Creates a new, empty pipeline. Use PutPipelineDefinition to populate the pipeline.
DeactivatePipeline
Show Description Deactivates the specified running pipeline. The pipeline is set to the DEACTIVATING state until the deactivation process completes. To resume a deactivated pipeline, use ActivatePipeline. By default, the pipeline resumes from the last completed execution. Optionally, you can specify the date and time to resume the pipeline.
DeletePipeline
DescribeObjects
Show Description Gets the object definitions for a set of objects associated with the pipeline. Object definitions are composed of a set of fields that define the properties of the object.
DescribePipelines
Show Description Retrieves metadata about one or more pipelines. The information retrieved includes the name of the pipeline, the pipeline identifier, its current state, and the user account that owns the pipeline. Using account credentials, you can retrieve metadata about pipelines that you or your IAM users have created. If you are using an IAM user account, you can retrieve metadata about only those pipelines for which you have read permissions. To retrieve the full pipeline definition instead of metadata about the pipeline, call GetPipelineDefinition.
EvaluateExpression
Show Description Task runners call EvaluateExpression to evaluate a string in the context of the specified object. For example, a task runner can evaluate SQL queries stored in Amazon S3.
GetPipelineDefinition
Show Description Gets the definition of the specified pipeline. You can call GetPipelineDefinition to retrieve the pipeline definition that you provided using PutPipelineDefinition.
ListPipelines
Show Description Lists the pipeline identifiers for all active pipelines that you have permission to access.
PollForTask
Show Description Task runners call PollForTask to receive a task to perform from AWS Data Pipeline. The task runner specifies which tasks it can perform by setting a value for the workerGroup parameter. The task returned can come from any of the pipelines that match the workerGroup value passed in by the task runner and that was launched using the IAM user credentials specified by the task runner. If tasks are ready in the work queue, PollForTask returns a response immediately. If no tasks are available in the queue, PollForTask uses long-polling and holds on to a poll connection for up to a 90 seconds, during which time the first newly scheduled task is handed to the task runner. To accomodate this, set the socket timeout in your task runner to 90 seconds. The task runner should not call PollForTask again on the same workerGroup until it receives a response, and this can take up to 90 seconds.
PutPipelineDefinition
Show Description Adds tasks, schedules, and preconditions to the specified pipeline. You can use PutPipelineDefinition to populate a new pipeline. PutPipelineDefinition also validates the configuration as it adds it to the pipeline. Changes to the pipeline are saved unless one of the following three validation errors exists in the pipeline.
  1. An object is missing a name or identifier field.
  2. A string or reference field is empty.
  3. The number of objects in the pipeline exceeds the maximum allowed objects.
  4. The pipeline is in a FINISHED state.
Pipeline object definitions are passed to the PutPipelineDefinition action and returned by the GetPipelineDefinition action.
QueryObjects
Show Description Queries the specified pipeline for the names of objects that match the specified set of conditions.
RemoveTags
Show Description Removes existing tags from the specified pipeline.
ReportTaskProgress
Show Description Task runners call ReportTaskProgress when assigned a task to acknowledge that it has the task. If the web service does not receive this acknowledgement within 2 minutes, it assigns the task in a subsequent PollForTask call. After this initial acknowledgement, the task runner only needs to report progress every 15 minutes to maintain its ownership of the task. You can change this reporting time from 15 minutes by specifying a reportProgressTimeout field in your pipeline. If a task runner does not report its status after 5 minutes, AWS Data Pipeline assumes that the task runner is unable to process the task and reassigns the task in a subsequent response to PollForTask. Task runners should call ReportTaskProgress every 60 seconds.
ReportTaskRunnerHeartbeat
Show Description Task runners call ReportTaskRunnerHeartbeat every 15 minutes to indicate that they are operational. If the AWS Data Pipeline Task Runner is launched on a resource managed by AWS Data Pipeline, the web service can use this call to detect when the task runner application has failed and restart a new instance.
SetStatus
SetTaskStatus
Show Description Task runners call SetTaskStatus to notify AWS Data Pipeline that a task is completed and provide information about the final status. A task runner makes this call regardless of whether the task was sucessful. A task runner does not need to call SetTaskStatus for tasks that are canceled by the web service during a call to ReportTaskProgress.

Datasync Events

Service Event Name Description
datasync CancelTaskExecution
Show Description Cancels execution of a task. When you cancel a task execution, the transfer of some files is abruptly interrupted. The contents of files that are transferred to the destination might be incomplete or inconsistent with the source files. However, if you start a new task execution on the same task and you allow the task execution to complete, file content on the destination is complete and consistent. This applies to other unexpected failures that interrupt a task execution. In all of these cases, DataSync successfully complete the transfer when you start the next task execution.
CreateAgent
Show Description Activates an DataSync agent that you have deployed on your host. The activation process associates your agent with your account. In the activation process, you specify information such as the Amazon Web Services Region that you want to activate the agent in. You activate the agent in the Amazon Web Services Region where your target locations (in Amazon S3 or Amazon EFS) reside. Your tasks are created in this Amazon Web Services Region. You can activate the agent in a VPC (virtual private cloud) or provide the agent access to a VPC endpoint so you can run tasks without going over the public internet. You can use an agent for more than one location. If a task uses multiple agents, all of them need to have status AVAILABLE for the task to run. If you use multiple agents for a source location, the status of all the agents must be AVAILABLE for the task to run. Agents are automatically updated by Amazon Web Services on a regular basis, using a mechanism that ensures minimal interruption to your tasks.

CreateLocationEfs
Show Description Creates an endpoint for an Amazon EFS file system.
CreateLocationFsxWindows
Show Description Creates an endpoint for an Amazon FSx for Windows File Server file system.
CreateLocationHdfs
Show Description Creates an endpoint for a Hadoop Distributed File System (HDFS).
CreateLocationNfs
Show Description Defines a file system on a Network File System (NFS) server that can be read from or written to.
CreateLocationObjectStorage
Show Description Creates an endpoint for a self-managed object storage bucket. For more information about self-managed object storage locations, see Creating a location for object storage.
CreateLocationS3
Show Description Creates an endpoint for an Amazon S3 bucket. For more information, see Create an Amazon S3 location in the DataSync User Guide.
CreateLocationSmb
Show Description Defines a file system on a Server Message Block (SMB) server that can be read from or written to.
CreateTask
Show Description Creates a task. A task includes a source location and a destination location, and a configuration that specifies how data is transferred. A task always transfers data from the source location to the destination location. The configuration specifies options such as task scheduling, bandwidth limits, etc. A task is the complete definition of a data transfer. When you create a task that transfers data between Amazon Web Services services in different Amazon Web Services Regions, one of the two locations that you specify must reside in the Region where DataSync is being used. The other location must be specified in a different Region. You can transfer data between commercial Amazon Web Services Regions except for China, or between Amazon Web Services GovCloud (US) Regions. When you use DataSync to copy files or objects between Amazon Web Services Regions, you pay for data transfer between Regions. This is billed as data transfer OUT from your source Region to your destination Region. For more information, see Data Transfer pricing.
DeleteAgent
Show Description Deletes an agent. To specify which agent to delete, use the Amazon Resource Name (ARN) of the agent in your request. The operation disassociates the agent from your Amazon Web Services account. However, it doesn't delete the agent virtual machine (VM) from your on-premises environment.
DeleteLocation
Show Description Deletes the configuration of a location used by DataSync.
DeleteTask
Show Description Deletes a task.
DescribeAgent
Show Description Returns metadata such as the name, the network interfaces, and the status (that is, whether the agent is running or not) for an agent. To specify which agent to describe, use the Amazon Resource Name (ARN) of the agent in your request.
DescribeLocationEfs
Show Description Returns metadata, such as the path information about an Amazon EFS location.
DescribeLocationFsxWindows
Show Description Returns metadata, such as the path information about an Amazon FSx for Windows File Server location.
DescribeLocationHdfs
Show Description Returns metadata, such as the authentication information about the Hadoop Distributed File System (HDFS) location.
DescribeLocationNfs
Show Description Returns metadata, such as the path information, about an NFS location.
DescribeLocationObjectStorage
Show Description Returns metadata about a self-managed object storage server location. For more information about self-managed object storage locations, see Creating a location for object storage.
DescribeLocationS3
Show Description Returns metadata, such as bucket name, about an Amazon S3 bucket location.
DescribeLocationSmb
Show Description Returns metadata, such as the path and user information about an SMB location.
DescribeTask
Show Description Returns metadata about a task.
DescribeTaskExecution
Show Description Returns detailed metadata about a task that is being executed.
ListAgents
Show Description Returns a list of agents owned by an Amazon Web Services account in the Amazon Web Services Region specified in the request. The returned list is ordered by agent Amazon Resource Name (ARN). By default, this operation returns a maximum of 100 agents. This operation supports pagination that enables you to optionally reduce the number of agents returned in a response. If you have more agents than are returned in a response (that is, the response returns only a truncated list of your agents), the response contains a marker that you can specify in your next request to fetch the next page of agents.
ListLocations
Show Description Returns a list of source and destination locations. If you have more locations than are returned in a response (that is, the response returns only a truncated list of your agents), the response contains a token that you can specify in your next request to fetch the next page of locations.
ListTagsForResource
Show Description Returns all the tags associated with a specified resource.
ListTaskExecutions
Show Description Returns a list of executed tasks.
ListTasks
Show Description Returns a list of all the tasks.
StartTaskExecution
Show Description Starts a specific invocation of a task. A TaskExecution value represents an individual run of a task. Each task can have at most one TaskExecution at a time. TaskExecution has the following transition phases: INITIALIZING
TagResource
Show Description Applies a key-value pair to an Amazon Web Services resource.
UntagResource
Show Description Removes a tag from an Amazon Web Services resource.
UpdateAgent
Show Description Updates the name of an agent.
UpdateLocationHdfs
Show Description Updates some parameters of a previously created location for a Hadoop Distributed File System cluster.
UpdateLocationNfs
Show Description Updates some of the parameters of a previously created location for Network File System (NFS) access. For information about creating an NFS location, see Creating a location for NFS.
UpdateLocationObjectStorage
Show Description Updates some of the parameters of a previously created location for self-managed object storage server access. For information about creating a self-managed object storage location, see Creating a location for object storage.
UpdateLocationSmb
Show Description Updates some of the parameters of a previously created location for Server Message Block (SMB) file system access. For information about creating an SMB location, see Creating a location for SMB.
UpdateTask
Show Description Updates the metadata associated with a task.

Detective Events

Service Event Name Description
detective AcceptInvitation
CreateGraph
Show Description Creates a new behavior graph for the calling account, and sets that account as the administrator account. This operation is called by the account that is enabling Detective. Before you try to enable Detective, make sure that your account has been enrolled in Amazon GuardDuty for at least 48 hours. If you do not meet this requirement, you cannot enable Detective. If you do meet the GuardDuty prerequisite, then when you make the request to enable Detective, it checks whether your data volume is within the Detective quota. If it exceeds the quota, then you cannot enable Detective. The operation also enables Detective for the calling account in the currently selected Region. It returns the ARN of the new behavior graph. CreateGraph triggers a process to create the corresponding data tables for the new behavior graph. An account can only be the administrator account for one behavior graph within a Region. If the same account calls CreateGraph with the same administrator account, it always returns the same behavior graph ARN. It does not create a new behavior graph.
CreateMembers
Show Description Sends a request to invite the specified AWS accounts to be member accounts in the behavior graph. This operation can only be called by the administrator account for a behavior graph. CreateMembers verifies the accounts and then invites the verified accounts. The administrator can optionally specify to not send invitation emails to the member accounts. This would be used when the administrator manages their member accounts centrally. The request provides the behavior graph ARN and the list of accounts to invite. The response separates the requested accounts into two lists:
  • The accounts that CreateMembers was able to start the verification for. This list includes member accounts that are being verified, that have passed verification and are to be invited, and that have failed verification.
  • The accounts that CreateMembers was unable to process. This list includes accounts that were already invited to be member accounts in the behavior graph.
DeleteGraph
DeleteMembers
Show Description Deletes one or more member accounts from the administrator account's behavior graph. This operation can only be called by a Detective administrator account. That account cannot use DeleteMembers to delete their own account from the behavior graph. To disable a behavior graph, the administrator account uses the DeleteGraph API method.
DisassociateMembership
GetMembers
Show Description Returns the membership details for specified member accounts for a behavior graph.
ListGraphs
Show Description Returns the list of behavior graphs that the calling account is an administrator account of. This operation can only be called by an administrator account. Because an account can currently only be the administrator of one behavior graph within a Region, the results always contain a single behavior graph.
ListInvitations
Show Description Retrieves the list of open and accepted behavior graph invitations for the member account. This operation can only be called by a member account. Open invitations are invitations that the member account has not responded to. The results do not include behavior graphs for which the member account declined the invitation. The results also do not include behavior graphs that the member account resigned from or was removed from.
ListMembers
Show Description Retrieves the list of member accounts for a behavior graph. Does not return member accounts that were removed from the behavior graph.
ListTagsForResource
Show Description Returns the tag values that are assigned to a behavior graph.
RejectInvitation
StartMonitoringMember
TagResource
Show Description Applies tag values to a behavior graph.

Devicefarm Events

Service Event Name Description
devicefarm CreateDevicePool
Show Description Creates a device pool.
CreateInstanceProfile
Show Description Creates a profile that can be applied to one or more private fleet device instances.
CreateNetworkProfile
Show Description Creates a network profile.
CreateProject
Show Description Creates a project.
CreateRemoteAccessSession
Show Description Specifies and starts a remote access session.
CreateTestGridProject
Show Description Creates a Selenium testing project. Projects are used to track TestGridSession instances.
CreateTestGridUrl
Show Description Creates a signed, short-term URL that can be passed to a Selenium RemoteWebDriver constructor.
CreateUpload
Show Description Uploads an app or test scripts.
CreateVPCEConfiguration
Show Description Creates a configuration record in Device Farm for your Amazon Virtual Private Cloud (VPC) endpoint.
DeleteDevicePool
Show Description Deletes a device pool given the pool ARN. Does not allow deletion of curated pools owned by the system.
DeleteInstanceProfile
Show Description Deletes a profile that can be applied to one or more private device instances.
DeleteNetworkProfile
Show Description Deletes a network profile.
DeleteProject
Show Description Deletes an AWS Device Farm project, given the project ARN. Deleting this resource does not stop an in-progress run.
DeleteRemoteAccessSession
Show Description Deletes a completed remote access session and its results.
DeleteRun
Show Description Deletes the run, given the run ARN. Deleting this resource does not stop an in-progress run.
DeleteTestGridProject
Show Description Deletes a Selenium testing project and all content generated under it. You cannot undo this operation. You cannot delete a project if it has active sessions.
DeleteUpload
Show Description Deletes an upload given the upload ARN.
DeleteVPCEConfiguration
Show Description Deletes a configuration for your Amazon Virtual Private Cloud (VPC) endpoint.
GetAccountSettings
Show Description Returns the number of unmetered iOS or unmetered Android devices that have been purchased by the account.
GetDevice
Show Description Gets information about a unique device type.
GetDeviceInstance
Show Description Returns information about a device instance that belongs to a private device fleet.
GetDevicePool
Show Description Gets information about a device pool.
GetDevicePoolCompatibility
Show Description Gets information about compatibility with a device pool.
GetInstanceProfile
Show Description Returns information about the specified instance profile.
GetJob
Show Description Gets information about a job.
GetNetworkProfile
Show Description Returns information about a network profile.
GetOfferingStatus
Show Description Gets the current status and future status of all offerings purchased by an AWS account. The response indicates how many offerings are currently available and the offerings that will be available in the next period. The API returns a NotEligible error if the user is not permitted to invoke the operation. If you must be able to invoke this operation, contact aws-devicefarm-support@amazon.com.
GetProject
Show Description Gets information about a project.
GetRemoteAccessSession
Show Description Returns a link to a currently running remote access session.
GetRun
Show Description Gets information about a run.
GetSuite
Show Description Gets information about a suite.
GetTest
Show Description Gets information about a test.
GetTestGridProject
Show Description Retrieves information about a Selenium testing project.
GetTestGridSession
Show Description A session is an instance of a browser created through a RemoteWebDriver with the URL from CreateTestGridUrlResult$url. You can use the following to look up sessions:

GetUpload
Show Description Gets information about an upload.
GetVPCEConfiguration
Show Description Returns information about the configuration settings for your Amazon Virtual Private Cloud (VPC) endpoint.
InstallToRemoteAccessSession
Show Description Installs an application to the device in a remote access session. For Android applications, the file must be in .apk format. For iOS applications, the file must be in .ipa format.
ListArtifacts
Show Description Gets information about artifacts.
ListDeviceInstances
Show Description Returns information about the private device instances associated with one or more AWS accounts.
ListDevicePools
Show Description Gets information about device pools.
ListDevices
Show Description Gets information about unique device types.
ListInstanceProfiles
Show Description Returns information about all the instance profiles in an AWS account.
ListJobs
Show Description Gets information about jobs for a given test run.
ListNetworkProfiles
Show Description Returns the list of available network profiles.
ListOfferingPromotions
Show Description Returns a list of offering promotions. Each offering promotion record contains the ID and description of the promotion. The API returns a NotEligible error if the caller is not permitted to invoke the operation. Contact aws-devicefarm-support@amazon.com if you must be able to invoke this operation.
ListOfferingTransactions
Show Description Returns a list of all historical purchases, renewals, and system renewal transactions for an AWS account. The list is paginated and ordered by a descending timestamp (most recent transactions are first). The API returns a NotEligible error if the user is not permitted to invoke the operation. If you must be able to invoke this operation, contact aws-devicefarm-support@amazon.com.
ListOfferings
Show Description Returns a list of products or offerings that the user can manage through the API. Each offering record indicates the recurring price per unit and the frequency for that offering. The API returns a NotEligible error if the user is not permitted to invoke the operation. If you must be able to invoke this operation, contact aws-devicefarm-support@amazon.com.
ListProjects
Show Description Gets information about projects.
ListRemoteAccessSessions
Show Description Returns a list of all currently running remote access sessions.
ListRuns
Show Description Gets information about runs, given an AWS Device Farm project ARN.
ListSamples
Show Description Gets information about samples, given an AWS Device Farm job ARN.
ListSuites
Show Description Gets information about test suites for a given job.
ListTagsForResource
Show Description List the tags for an AWS Device Farm resource.
ListTestGridProjects
Show Description Gets a list of all Selenium testing projects in your account.
ListTestGridSessionActions
Show Description Returns a list of the actions taken in a TestGridSession.
ListTestGridSessionArtifacts
Show Description Retrieves a list of artifacts created during the session.
ListTestGridSessions
Show Description Retrieves a list of sessions for a TestGridProject.
ListTests
Show Description Gets information about tests in a given test suite.
ListUniqueProblems
Show Description Gets information about unique problems, such as exceptions or crashes. Unique problems are defined as a single instance of an error across a run, job, or suite. For example, if a call in your application consistently raises an exception (OutOfBoundsException in MyActivity.java:386), ListUniqueProblems returns a single entry instead of many individual entries for that exception.
ListUploads
Show Description Gets information about uploads, given an AWS Device Farm project ARN.
ListVPCEConfigurations
Show Description Returns information about all Amazon Virtual Private Cloud (VPC) endpoint configurations in the AWS account.
PurchaseOffering
Show Description Immediately purchases offerings for an AWS account. Offerings renew with the latest total purchased quantity for an offering, unless the renewal was overridden. The API returns a NotEligible error if the user is not permitted to invoke the operation. If you must be able to invoke this operation, contact aws-devicefarm-support@amazon.com.
RenewOffering
Show Description Explicitly sets the quantity of devices to renew for an offering, starting from the effectiveDate of the next period. The API returns a NotEligible error if the user is not permitted to invoke the operation. If you must be able to invoke this operation, contact aws-devicefarm-support@amazon.com.
ScheduleRun
Show Description Schedules a run.
StopJob
Show Description Initiates a stop request for the current job. AWS Device Farm immediately stops the job on the device where tests have not started. You are not billed for this device. On the device where tests have started, setup suite and teardown suite tests run to completion on the device. You are billed for setup, teardown, and any tests that were in progress or already completed.
StopRemoteAccessSession
Show Description Ends a specified remote access session.
StopRun
Show Description Initiates a stop request for the current test run. AWS Device Farm immediately stops the run on devices where tests have not started. You are not billed for these devices. On devices where tests have started executing, setup suite and teardown suite tests run to completion on those devices. You are billed for setup, teardown, and any tests that were in progress or already completed.
TagResource
Show Description Associates the specified tags to a resource with the specified resourceArn. If existing tags on a resource are not specified in the request parameters, they are not changed. When a resource is deleted, the tags associated with that resource are also deleted.
UntagResource
Show Description Deletes the specified tags from a resource.
UpdateDeviceInstance
Show Description Updates information about a private device instance.
UpdateDevicePool
Show Description Modifies the name, description, and rules in a device pool given the attributes and the pool ARN. Rule updates are all-or-nothing, meaning they can only be updated as a whole (or not at all).
UpdateInstanceProfile
Show Description Updates information about an existing private device instance profile.
UpdateNetworkProfile
Show Description Updates the network profile.
UpdateProject
Show Description Modifies the specified project name, given the project ARN and a new name.
UpdateTestGridProject
Show Description Change details of a project.
UpdateUpload
Show Description Updates an uploaded test spec.

Devops-guru Events

Service Event Name Description
devops-guru AddNotificationChannel
Show Description Adds a notification channel to DevOps Guru. A notification channel is used to notify you about important DevOps Guru events, such as when an insight is generated. If you use an Amazon SNS topic in another account, you must attach a policy to it that grants DevOps Guru permission to it notifications. DevOps Guru adds the required policy on your behalf to send notifications using Amazon SNS in your account. For more information, see Permissions for cross account Amazon SNS topics. If you use an Amazon SNS topic that is encrypted by an AWS Key Management Service customer-managed key (CMK), then you must add permissions to the CMK. For more information, see Permissions for AWS KMS–encrypted Amazon SNS topics.
DescribeAccountHealth
Show Description Returns the number of open reactive insights, the number of open proactive insights, and the number of metrics analyzed in your AWS account. Use these numbers to gauge the health of operations in your AWS account.
DescribeAccountOverview
Show Description For the time range passed in, returns the number of open reactive insight that were created, the number of open proactive insights that were created, and the Mean Time to Recover (MTTR) for all closed reactive insights.
DescribeAnomaly
Show Description Returns details about an anomaly that you specify using its ID.
DescribeFeedback
Show Description Returns the most recent feedback submitted in the current AWS account and Region.
DescribeInsight
Show Description Returns details about an insight that you specify using its ID.
DescribeResourceCollectionHealth
Show Description Returns the number of open proactive insights, open reactive insights, and the Mean Time to Recover (MTTR) for all closed insights in resource collections in your account. You specify the type of AWS resources collection. The one type of AWS resource collection supported is AWS CloudFormation stacks. DevOps Guru can be configured to analyze only the AWS resources that are defined in the stacks. You can specify up to 500 AWS CloudFormation stacks.
DescribeServiceIntegration
Show Description Returns the integration status of services that are integrated with DevOps Guru. The one service that can be integrated with DevOps Guru is AWS Systems Manager, which can be used to create an OpsItem for each generated insight.
GetCostEstimation
Show Description Returns an estimate of the monthly cost for DevOps Guru to analyze your AWS resources. For more information, see Estimate your Amazon DevOps Guru costs and Amazon DevOps Guru pricing.
GetResourceCollection
Show Description Returns lists AWS resources that are of the specified resource collection type. The one type of AWS resource collection supported is AWS CloudFormation stacks. DevOps Guru can be configured to analyze only the AWS resources that are defined in the stacks. You can specify up to 500 AWS CloudFormation stacks.
ListAnomaliesForInsight
Show Description Returns a list of the anomalies that belong to an insight that you specify using its ID.
ListEvents
Show Description Returns a list of the events emitted by the resources that are evaluated by DevOps Guru. You can use filters to specify which events are returned.
ListInsights
Show Description Returns a list of insights in your AWS account. You can specify which insights are returned by their start time and status (ONGOING, CLOSED, or ANY).
ListNotificationChannels
Show Description Returns a list of notification channels configured for DevOps Guru. Each notification channel is used to notify you when DevOps Guru generates an insight that contains information about how to improve your operations. The one supported notification channel is Amazon Simple Notification Service (Amazon SNS).
ListRecommendations
Show Description Returns a list of a specified insight's recommendations. Each recommendation includes a list of related metrics and a list of related events.
PutFeedback
Show Description Collects customer feedback about the specified insight.
RemoveNotificationChannel
Show Description Removes a notification channel from DevOps Guru. A notification channel is used to notify you when DevOps Guru generates an insight that contains information about how to improve your operations.
SearchInsights
Show Description Returns a list of insights in your AWS account. You can specify which insights are returned by their start time, one or more statuses (ONGOING, CLOSED, and CLOSED), one or more severities (LOW, MEDIUM, and HIGH), and type (REACTIVE or PROACTIVE). Use the Filters parameter to specify status and severity search parameters. Use the Type parameter to specify REACTIVE or PROACTIVE in your search.
StartCostEstimation
Show Description Starts the creation of an estimate of the monthly cost to analyze your AWS resources.
UpdateResourceCollection
Show Description Updates the collection of resources that DevOps Guru analyzes. The one type of AWS resource collection supported is AWS CloudFormation stacks. DevOps Guru can be configured to analyze only the AWS resources that are defined in the stacks. You can specify up to 500 AWS CloudFormation stacks. This method also creates the IAM role required for you to use DevOps Guru.

Directconnect Events

Service Event Name Description
directconnect AcceptDirectConnectGatewayAssociationProposal
Show Description Accepts a proposal request to attach a virtual private gateway or transit gateway to a Direct Connect gateway.
AllocateConnectionOnInterconnect
Show Description Deprecated. Use AllocateHostedConnection instead. Creates a hosted connection on an interconnect. Allocates a VLAN number and a specified amount of bandwidth for use by a hosted connection on the specified interconnect. Intended for use by Direct Connect Partners only.
AllocateHostedConnection
Show Description Creates a hosted connection on the specified interconnect or a link aggregation group (LAG) of interconnects. Allocates a VLAN number and a specified amount of capacity (bandwidth) for use by a hosted connection on the specified interconnect or LAG of interconnects. Amazon Web Services polices the hosted connection for the specified capacity and the Direct Connect Partner must also police the hosted connection for the specified capacity. Intended for use by Direct Connect Partners only.
AllocatePrivateVirtualInterface
Show Description Provisions a private virtual interface to be owned by the specified Amazon Web Services account. Virtual interfaces created using this action must be confirmed by the owner using ConfirmPrivateVirtualInterface. Until then, the virtual interface is in the Confirming state and is not available to handle traffic.
AllocatePublicVirtualInterface
Show Description Provisions a public virtual interface to be owned by the specified Amazon Web Services account. The owner of a connection calls this function to provision a public virtual interface to be owned by the specified Amazon Web Services account. Virtual interfaces created using this function must be confirmed by the owner using ConfirmPublicVirtualInterface. Until this step has been completed, the virtual interface is in the confirming state and is not available to handle traffic. When creating an IPv6 public virtual interface, omit the Amazon address and customer address. IPv6 addresses are automatically assigned from the Amazon pool of IPv6 addresses; you cannot specify custom IPv6 addresses.
AllocateTransitVirtualInterface
Show Description Provisions a transit virtual interface to be owned by the specified Amazon Web Services account. Use this type of interface to connect a transit gateway to your Direct Connect gateway. The owner of a connection provisions a transit virtual interface to be owned by the specified Amazon Web Services account. After you create a transit virtual interface, it must be confirmed by the owner using ConfirmTransitVirtualInterface. Until this step has been completed, the transit virtual interface is in the requested state and is not available to handle traffic.
AssociateConnectionWithLag
Show Description Associates an existing connection with a link aggregation group (LAG). The connection is interrupted and re-established as a member of the LAG (connectivity to Amazon Web Services is interrupted). The connection must be hosted on the same Direct Connect endpoint as the LAG, and its bandwidth must match the bandwidth for the LAG. You can re-associate a connection that's currently associated with a different LAG; however, if removing the connection would cause the original LAG to fall below its setting for minimum number of operational connections, the request fails. Any virtual interfaces that are directly associated with the connection are automatically re-associated with the LAG. If the connection was originally associated with a different LAG, the virtual interfaces remain associated with the original LAG. For interconnects, any hosted connections are automatically re-associated with the LAG. If the interconnect was originally associated with a different LAG, the hosted connections remain associated with the original LAG.
AssociateHostedConnection
Show Description Associates a hosted connection and its virtual interfaces with a link aggregation group (LAG) or interconnect. If the target interconnect or LAG has an existing hosted connection with a conflicting VLAN number or IP address, the operation fails. This action temporarily interrupts the hosted connection's connectivity to Amazon Web Services as it is being migrated. Intended for use by Direct Connect Partners only.
AssociateMacSecKey
Show Description Associates a MAC Security (MACsec) Connection Key Name (CKN)/ Connectivity Association Key (CAK) pair with an Direct Connect dedicated connection. You must supply either the secretARN, or the CKN/CAK (ckn and cak) pair in the request. For information about MAC Security (MACsec) key considerations, see MACsec pre-shared CKN/CAK key considerations in the Direct Connect User Guide.
AssociateVirtualInterface
Show Description Associates a virtual interface with a specified link aggregation group (LAG) or connection. Connectivity to Amazon Web Services is temporarily interrupted as the virtual interface is being migrated. If the target connection or LAG has an associated virtual interface with a conflicting VLAN number or a conflicting IP address, the operation fails. Virtual interfaces associated with a hosted connection cannot be associated with a LAG; hosted connections must be migrated along with their virtual interfaces using AssociateHostedConnection. To reassociate a virtual interface to a new connection or LAG, the requester must own either the virtual interface itself or the connection to which the virtual interface is currently associated. Additionally, the requester must own the connection or LAG for the association.
ConfirmConnection
Show Description Confirms the creation of the specified hosted connection on an interconnect. Upon creation, the hosted connection is initially in the Ordering state, and remains in this state until the owner confirms creation of the hosted connection.
ConfirmCustomerAgreement
Show Description The confirmation of the terms of agreement when creating the connection/link aggregation group (LAG).
ConfirmPrivateVirtualInterface
Show Description Accepts ownership of a private virtual interface created by another Amazon Web Services account. After the virtual interface owner makes this call, the virtual interface is created and attached to the specified virtual private gateway or Direct Connect gateway, and is made available to handle traffic.
ConfirmPublicVirtualInterface
Show Description Accepts ownership of a public virtual interface created by another Amazon Web Services account. After the virtual interface owner makes this call, the specified virtual interface is created and made available to handle traffic.
ConfirmTransitVirtualInterface
Show Description Accepts ownership of a transit virtual interface created by another Amazon Web Services account. After the owner of the transit virtual interface makes this call, the specified transit virtual interface is created and made available to handle traffic.
CreateBGPPeer
Show Description Creates a BGP peer on the specified virtual interface. You must create a BGP peer for the corresponding address family (IPv4/IPv6) in order to access Amazon Web Services resources that also use that address family. If logical redundancy is not supported by the connection, interconnect, or LAG, the BGP peer cannot be in the same address family as an existing BGP peer on the virtual interface. When creating a IPv6 BGP peer, omit the Amazon address and customer address. IPv6 addresses are automatically assigned from the Amazon pool of IPv6 addresses; you cannot specify custom IPv6 addresses. For a public virtual interface, the Autonomous System Number (ASN) must be private or already on the allow list for the virtual interface.
CreateConnection
Show Description Creates a connection between a customer network and a specific Direct Connect location. A connection links your internal network to an Direct Connect location over a standard Ethernet fiber-optic cable. One end of the cable is connected to your router, the other to an Direct Connect router. To find the locations for your Region, use DescribeLocations. You can automatically add the new connection to a link aggregation group (LAG) by specifying a LAG ID in the request. This ensures that the new connection is allocated on the same Direct Connect endpoint that hosts the specified LAG. If there are no available ports on the endpoint, the request fails and no connection is created.
CreateDirectConnectGateway
Show Description Creates a Direct Connect gateway, which is an intermediate object that enables you to connect a set of virtual interfaces and virtual private gateways. A Direct Connect gateway is global and visible in any Amazon Web Services Region after it is created. The virtual interfaces and virtual private gateways that are connected through a Direct Connect gateway can be in different Amazon Web Services Regions. This enables you to connect to a VPC in any Region, regardless of the Region in which the virtual interfaces are located, and pass traffic between them.
CreateDirectConnectGatewayAssociation
Show Description Creates an association between a Direct Connect gateway and a virtual private gateway. The virtual private gateway must be attached to a VPC and must not be associated with another Direct Connect gateway.
CreateDirectConnectGatewayAssociationProposal
Show Description Creates a proposal to associate the specified virtual private gateway or transit gateway with the specified Direct Connect gateway. You can associate a Direct Connect gateway and virtual private gateway or transit gateway that is owned by any Amazon Web Services account.
CreateInterconnect
Show Description Creates an interconnect between an Direct Connect Partner's network and a specific Direct Connect location. An interconnect is a connection that is capable of hosting other connections. The Direct Connect Partner can use an interconnect to provide Direct Connect hosted connections to customers through their own network services. Like a standard connection, an interconnect links the partner's network to an Direct Connect location over a standard Ethernet fiber-optic cable. One end is connected to the partner's router, the other to an Direct Connect router. You can automatically add the new interconnect to a link aggregation group (LAG) by specifying a LAG ID in the request. This ensures that the new interconnect is allocated on the same Direct Connect endpoint that hosts the specified LAG. If there are no available ports on the endpoint, the request fails and no interconnect is created. For each end customer, the Direct Connect Partner provisions a connection on their interconnect by calling AllocateHostedConnection. The end customer can then connect to Amazon Web Services resources by creating a virtual interface on their connection, using the VLAN assigned to them by the Direct Connect Partner. Intended for use by Direct Connect Partners only.
CreateLag
Show Description Creates a link aggregation group (LAG) with the specified number of bundled physical dedicated connections between the customer network and a specific Direct Connect location. A LAG is a logical interface that uses the Link Aggregation Control Protocol (LACP) to aggregate multiple interfaces, enabling you to treat them as a single interface. All connections in a LAG must use the same bandwidth (either 1Gbps or 10Gbps) and must terminate at the same Direct Connect endpoint. You can have up to 10 dedicated connections per LAG. Regardless of this limit, if you request more connections for the LAG than Direct Connect can allocate on a single endpoint, no LAG is created. You can specify an existing physical dedicated connection or interconnect to include in the LAG (which counts towards the total number of connections). Doing so interrupts the current physical dedicated connection, and re-establishes them as a member of the LAG. The LAG will be created on the same Direct Connect endpoint to which the dedicated connection terminates. Any virtual interfaces associated with the dedicated connection are automatically disassociated and re-associated with the LAG. The connection ID does not change. If the Amazon Web Services account used to create a LAG is a registered Direct Connect Partner, the LAG is automatically enabled to host sub-connections. For a LAG owned by a partner, any associated virtual interfaces cannot be directly configured.
CreatePrivateVirtualInterface
Show Description Creates a private virtual interface. A virtual interface is the VLAN that transports Direct Connect traffic. A private virtual interface can be connected to either a Direct Connect gateway or a Virtual Private Gateway (VGW). Connecting the private virtual interface to a Direct Connect gateway enables the possibility for connecting to multiple VPCs, including VPCs in different Amazon Web Services Regions. Connecting the private virtual interface to a VGW only provides access to a single VPC within the same Region. Setting the MTU of a virtual interface to 9001 (jumbo frames) can cause an update to the underlying physical connection if it wasn't updated to support jumbo frames. Updating the connection disrupts network connectivity for all virtual interfaces associated with the connection for up to 30 seconds. To check whether your connection supports jumbo frames, call DescribeConnections. To check whether your virtual interface supports jumbo frames, call DescribeVirtualInterfaces.
CreatePublicVirtualInterface
Show Description Creates a public virtual interface. A virtual interface is the VLAN that transports Direct Connect traffic. A public virtual interface supports sending traffic to public services of Amazon Web Services such as Amazon S3. When creating an IPv6 public virtual interface (addressFamily is ipv6), leave the customer and amazon address fields blank to use auto-assigned IPv6 space. Custom IPv6 addresses are not supported.
CreateTransitVirtualInterface
Show Description Creates a transit virtual interface. A transit virtual interface should be used to access one or more transit gateways associated with Direct Connect gateways. A transit virtual interface enables the connection of multiple VPCs attached to a transit gateway to a Direct Connect gateway. If you associate your transit gateway with one or more Direct Connect gateways, the Autonomous System Number (ASN) used by the transit gateway and the Direct Connect gateway must be different. For example, if you use the default ASN 64512 for both your the transit gateway and Direct Connect gateway, the association request fails. Setting the MTU of a virtual interface to 8500 (jumbo frames) can cause an update to the underlying physical connection if it wasn't updated to support jumbo frames. Updating the connection disrupts network connectivity for all virtual interfaces associated with the connection for up to 30 seconds. To check whether your connection supports jumbo frames, call DescribeConnections. To check whether your virtual interface supports jumbo frames, call DescribeVirtualInterfaces.
DeleteBGPPeer
Show Description Deletes the specified BGP peer on the specified virtual interface with the specified customer address and ASN. You cannot delete the last BGP peer from a virtual interface.
DeleteConnection
Show Description Deletes the specified connection. Deleting a connection only stops the Direct Connect port hour and data transfer charges. If you are partnering with any third parties to connect with the Direct Connect location, you must cancel your service with them separately.
DeleteDirectConnectGateway
Show Description Deletes the specified Direct Connect gateway. You must first delete all virtual interfaces that are attached to the Direct Connect gateway and disassociate all virtual private gateways associated with the Direct Connect gateway.
DeleteDirectConnectGatewayAssociation
Show Description Deletes the association between the specified Direct Connect gateway and virtual private gateway. We recommend that you specify the associationID to delete the association. Alternatively, if you own virtual gateway and a Direct Connect gateway association, you can specify the virtualGatewayId and directConnectGatewayId to delete an association.
DeleteDirectConnectGatewayAssociationProposal
Show Description Deletes the association proposal request between the specified Direct Connect gateway and virtual private gateway or transit gateway.
DeleteInterconnect
Show Description Deletes the specified interconnect. Intended for use by Direct Connect Partners only.
DeleteLag
Show Description Deletes the specified link aggregation group (LAG). You cannot delete a LAG if it has active virtual interfaces or hosted connections.
DeleteVirtualInterface
Show Description Deletes a virtual interface.
DescribeConnectionLoa
Show Description Deprecated. Use DescribeLoa instead. Gets the LOA-CFA for a connection. The Letter of Authorization - Connecting Facility Assignment (LOA-CFA) is a document that your APN partner or service provider uses when establishing your cross connect to Amazon Web Services at the colocation facility. For more information, see Requesting Cross Connects at Direct Connect Locations in the Direct Connect User Guide.
DescribeConnections
Show Description Displays the specified connection or all connections in this Region.
DescribeConnectionsOnInterconnect
Show Description Deprecated. Use DescribeHostedConnections instead. Lists the connections that have been provisioned on the specified interconnect. Intended for use by Direct Connect Partners only.
DescribeCustomerMetadata
Show Description Get and view a list of customer agreements, along with their signed status and whether the customer is an NNIPartner, NNIPartnerV2, or a nonPartner.
DescribeDirectConnectGatewayAssociationProposals
Show Description Describes one or more association proposals for connection between a virtual private gateway or transit gateway and a Direct Connect gateway.
DescribeDirectConnectGatewayAssociations
Show Description Lists the associations between your Direct Connect gateways and virtual private gateways and transit gateways. You must specify one of the following:
  • A Direct Connect gateway The response contains all virtual private gateways and transit gateways associated with the Direct Connect gateway.
  • A virtual private gateway The response contains the Direct Connect gateway.
  • A transit gateway The response contains the Direct Connect gateway.
  • A Direct Connect gateway and a virtual private gateway The response contains the association between the Direct Connect gateway and virtual private gateway.
  • A Direct Connect gateway and a transit gateway The response contains the association between the Direct Connect gateway and transit gateway.
DescribeDirectConnectGatewayAttachments
Show Description Lists the attachments between your Direct Connect gateways and virtual interfaces. You must specify a Direct Connect gateway, a virtual interface, or both. If you specify a Direct Connect gateway, the response contains all virtual interfaces attached to the Direct Connect gateway. If you specify a virtual interface, the response contains all Direct Connect gateways attached to the virtual interface. If you specify both, the response contains the attachment between the Direct Connect gateway and the virtual interface.
DescribeDirectConnectGateways
Show Description Lists all your Direct Connect gateways or only the specified Direct Connect gateway. Deleted Direct Connect gateways are not returned.
DescribeHostedConnections
Show Description Lists the hosted connections that have been provisioned on the specified interconnect or link aggregation group (LAG). Intended for use by Direct Connect Partners only.
DescribeInterconnectLoa
Show Description Deprecated. Use DescribeLoa instead. Gets the LOA-CFA for the specified interconnect. The Letter of Authorization - Connecting Facility Assignment (LOA-CFA) is a document that is used when establishing your cross connect to Amazon Web Services at the colocation facility. For more information, see Requesting Cross Connects at Direct Connect Locations in the Direct Connect User Guide.
DescribeInterconnects
Show Description Lists the interconnects owned by the Amazon Web Services account or only the specified interconnect.
DescribeLags
Show Description Describes all your link aggregation groups (LAG) or the specified LAG.
DescribeLoa
Show Description Gets the LOA-CFA for a connection, interconnect, or link aggregation group (LAG). The Letter of Authorization - Connecting Facility Assignment (LOA-CFA) is a document that is used when establishing your cross connect to Amazon Web Services at the colocation facility. For more information, see Requesting Cross Connects at Direct Connect Locations in the Direct Connect User Guide.
DescribeLocations
Show Description Lists the Direct Connect locations in the current Amazon Web Services Region. These are the locations that can be selected when calling CreateConnection or CreateInterconnect.
DescribeRouterConfiguration
Show Description Details about the router.
DescribeTags
Show Description Describes the tags associated with the specified Direct Connect resources.
DescribeVirtualGateways
Show Description Lists the virtual private gateways owned by the Amazon Web Services account. You can create one or more Direct Connect private virtual interfaces linked to a virtual private gateway.
DescribeVirtualInterfaces
Show Description Displays all virtual interfaces for an Amazon Web Services account. Virtual interfaces deleted fewer than 15 minutes before you make the request are also returned. If you specify a connection ID, only the virtual interfaces associated with the connection are returned. If you specify a virtual interface ID, then only a single virtual interface is returned. A virtual interface (VLAN) transmits the traffic between the Direct Connect location and the customer network.
DisassociateConnectionFromLag
Show Description Disassociates a connection from a link aggregation group (LAG). The connection is interrupted and re-established as a standalone connection (the connection is not deleted; to delete the connection, use the DeleteConnection request). If the LAG has associated virtual interfaces or hosted connections, they remain associated with the LAG. A disassociated connection owned by an Direct Connect Partner is automatically converted to an interconnect. If disassociating the connection would cause the LAG to fall below its setting for minimum number of operational connections, the request fails, except when it's the last member of the LAG. If all connections are disassociated, the LAG continues to exist as an empty LAG with no physical connections.
DisassociateMacSecKey
Show Description Removes the association between a MAC Security (MACsec) security key and an Direct Connect dedicated connection.
ListVirtualInterfaceTestHistory
Show Description Lists the virtual interface failover test history.
StartBgpFailoverTest
Show Description Starts the virtual interface failover test that verifies your configuration meets your resiliency requirements by placing the BGP peering session in the DOWN state. You can then send traffic to verify that there are no outages. You can run the test on public, private, transit, and hosted virtual interfaces. You can use ListVirtualInterfaceTestHistory to view the virtual interface test history. If you need to stop the test before the test interval completes, use StopBgpFailoverTest.
StopBgpFailoverTest
Show Description Stops the virtual interface failover test.
TagResource
Show Description Adds the specified tags to the specified Direct Connect resource. Each resource can have a maximum of 50 tags. Each tag consists of a key and an optional value. If a tag with the same key is already associated with the resource, this action updates its value.
UntagResource
Show Description Removes one or more tags from the specified Direct Connect resource.
UpdateConnection
Show Description Updates the Direct Connect dedicated connection configuration. You can update the following parameters for a connection:
  • The connection name
  • The connection's MAC Security (MACsec) encryption mode.
UpdateDirectConnectGateway
Show Description Updates the name of a current Direct Connect gateway.
UpdateDirectConnectGatewayAssociation
Show Description Updates the specified attributes of the Direct Connect gateway association. Add or remove prefixes from the association.
UpdateLag
Show Description Updates the attributes of the specified link aggregation group (LAG). You can update the following LAG attributes:
  • The name of the LAG.
  • The value for the minimum number of connections that must be operational for the LAG itself to be operational.
  • The LAG's MACsec encryption mode. Amazon Web Services assigns this value to each connection which is part of the LAG.
  • The tags
If you adjust the threshold value for the minimum number of operational connections, ensure that the new value does not cause the LAG to fall below the threshold and become non-operational.

Discovery Events

Service Event Name Description
discovery AssociateConfigurationItemsToApplication
Show Description Associates one or more configuration items with an application.
BatchDeleteImportData
Show Description Deletes one or more import tasks, each identified by their import ID. Each import task has a number of records that can identify servers or applications. AWS Application Discovery Service has built-in matching logic that will identify when discovered servers match existing entries that you've previously discovered, the information for the already-existing discovered server is updated. When you delete an import task that contains records that were used to match, the information in those matched records that comes from the deleted records will also be deleted.
CreateApplication
Show Description Creates an application with the given name and description.
CreateTags
Show Description Creates one or more tags for configuration items. Tags are metadata that help you categorize IT assets. This API accepts a list of multiple configuration items.
DeleteApplications
Show Description Deletes a list of applications and their associations with configuration items.
DeleteTags
Show Description Deletes the association between configuration items and one or more tags. This API accepts a list of multiple configuration items.
DescribeAgents
Show Description Lists agents or connectors as specified by ID or other filters. All agents/connectors associated with your user account can be listed if you call DescribeAgents as is without passing any parameters.
DescribeConfigurations
Show Description Retrieves attributes for a list of configuration item IDs. All of the supplied IDs must be for the same asset type from one of the following:
  • server
  • application
  • process
  • connection
Output fields are specific to the asset type specified. For example, the output for a server configuration item includes a list of attributes about the server, such as host name, operating system, number of network cards, etc. For a complete list of outputs for each asset type, see Using the DescribeConfigurations Action in the AWS Application Discovery Service User Guide.
DescribeContinuousExports
Show Description Lists exports as specified by ID. All continuous exports associated with your user account can be listed if you call DescribeContinuousExports as is without passing any parameters.
DescribeExportConfigurations
Show Description DescribeExportConfigurations is deprecated. Use DescribeImportTasks, instead.
DescribeExportTasks
Show Description Retrieve status of one or more export tasks. You can retrieve the status of up to 100 export tasks.
DescribeImportTasks
Show Description Returns an array of import tasks for your account, including status information, times, IDs, the Amazon S3 Object URL for the import file, and more.
DescribeTags
Show Description Retrieves a list of configuration items that have tags as specified by the key-value pairs, name and value, passed to the optional parameter filters. There are three valid tag filter names:
  • tagKey
  • tagValue
  • configurationId
Also, all configuration items associated with your user account that have tags can be listed if you call DescribeTags as is without passing any parameters.
DisassociateConfigurationItemsFromApplication
Show Description Disassociates one or more configuration items from an application.
ExportConfigurations
Show Description Deprecated. Use StartExportTask instead. Exports all discovered configuration data to an Amazon S3 bucket or an application that enables you to view and evaluate the data. Data includes tags and tag associations, processes, connections, servers, and system performance. This API returns an export ID that you can query using the DescribeExportConfigurations API. The system imposes a limit of two configuration exports in six hours.
GetDiscoverySummary
Show Description Retrieves a short summary of discovered assets. This API operation takes no request parameters and is called as is at the command prompt as shown in the example.
ListConfigurations
Show Description Retrieves a list of configuration items as specified by the value passed to the required parameter configurationType. Optional filtering may be applied to refine search results.
ListServerNeighbors
Show Description Retrieves a list of servers that are one network hop away from a specified server.
StartContinuousExport
Show Description Start the continuous flow of agent's discovered data into Amazon Athena.
StartDataCollectionByAgentIds
Show Description Instructs the specified agents or connectors to start collecting data.
StartExportTask
Show Description Begins the export of discovered data to an S3 bucket. If you specify agentIds in a filter, the task exports up to 72 hours of detailed data collected by the identified Application Discovery Agent, including network, process, and performance details. A time range for exported agent data may be set by using startTime and endTime. Export of detailed agent data is limited to five concurrently running exports. If you do not include an agentIds filter, summary data is exported that includes both AWS Agentless Discovery Connector data and summary data from AWS Discovery Agents. Export of summary data is limited to two exports per day.
StartImportTask
Show Description Starts an import task, which allows you to import details of your on-premises environment directly into AWS Migration Hub without having to use the Application Discovery Service (ADS) tools such as the Discovery Connector or Discovery Agent. This gives you the option to perform migration assessment and planning directly from your imported data, including the ability to group your devices as applications and track their migration status. To start an import request, do this:
  1. Download the specially formatted comma separated value (CSV) import template, which you can find here: https://s3-us-west-2.amazonaws.com/templates-7cffcf56-bd96-4b1c-b45b-a5b42f282e46/import_template.csv.
  2. Fill out the template with your server and application data.
  3. Upload your import file to an Amazon S3 bucket, and make a note of it's Object URL. Your import file must be in the CSV format.
  4. Use the console or the StartImportTask command with the AWS CLI or one of the AWS SDKs to import the records from your file.
For more information, including step-by-step procedures, see Migration Hub Import in the AWS Application Discovery Service User Guide. There are limits to the number of import tasks you can create (and delete) in an AWS account. For more information, see AWS Application Discovery Service Limits in the AWS Application Discovery Service User Guide.
StopContinuousExport
Show Description Stop the continuous flow of agent's discovered data into Amazon Athena.
StopDataCollectionByAgentIds
Show Description Instructs the specified agents or connectors to stop collecting data.

Dlm Events

Service Event Name Description
dlm CreateLifecyclePolicy
Show Description Creates a policy to manage the lifecycle of the specified Amazon Web Services resources. You can create up to 100 lifecycle policies.
DeleteLifecyclePolicy
Show Description Deletes the specified lifecycle policy and halts the automated operations that the policy specified.
GetLifecyclePolicies
Show Description Gets summary information about all or the specified data lifecycle policies. To get complete information about a policy, use GetLifecyclePolicy.
GetLifecyclePolicy
Show Description Gets detailed information about the specified lifecycle policy.
ListTagsForResource
Show Description Lists the tags for the specified resource.
TagResource
Show Description Adds the specified tags to the specified resource.
UntagResource
Show Description Removes the specified tags from the specified resource.

Docdb Events

Service Event Name Description
docdb AddSourceIdentifierToSubscription
Show Description Adds a source identifier to an existing event notification subscription.
AddTagsToResource
ApplyPendingMaintenanceAction
Show Description Applies a pending maintenance action to a resource (for example, to an Amazon DocumentDB instance).
CopyDBClusterParameterGroup
Show Description Copies the specified cluster parameter group.
CopyDBClusterSnapshot
Show Description Copies a snapshot of a cluster. To copy a cluster snapshot from a shared manual cluster snapshot, SourceDBClusterSnapshotIdentifier must be the Amazon Resource Name (ARN) of the shared cluster snapshot. You can only copy a shared DB cluster snapshot, whether encrypted or not, in the same Region. To cancel the copy operation after it is in progress, delete the target cluster snapshot identified by TargetDBClusterSnapshotIdentifier while that cluster snapshot is in the copying status.
CreateDBCluster
Show Description Creates a new Amazon DocumentDB cluster.
CreateDBClusterParameterGroup
Show Description Creates a new cluster parameter group. Parameters in a cluster parameter group apply to all of the instances in a cluster. A cluster parameter group is initially created with the default parameters for the database engine used by instances in the cluster. In Amazon DocumentDB, you cannot make modifications directly to the default.docdb3.6 cluster parameter group. If your Amazon DocumentDB cluster is using the default cluster parameter group and you want to modify a value in it, you must first create a new parameter group or copy an existing parameter group, modify it, and then apply the modified parameter group to your cluster. For the new cluster parameter group and associated settings to take effect, you must then reboot the instances in the cluster without failover. For more information, see Modifying Amazon DocumentDB Cluster Parameter Groups.
CreateDBClusterSnapshot
Show Description Creates a snapshot of a cluster.
CreateDBInstance
Show Description Creates a new instance.
CreateDBSubnetGroup
Show Description Creates a new subnet group. subnet groups must contain at least one subnet in at least two Availability Zones in the Region.
CreateEventSubscription
Show Description Creates an Amazon DocumentDB event notification subscription. This action requires a topic Amazon Resource Name (ARN) created by using the Amazon DocumentDB console, the Amazon SNS console, or the Amazon SNS API. To obtain an ARN with Amazon SNS, you must create a topic in Amazon SNS and subscribe to the topic. The ARN is displayed in the Amazon SNS console. You can specify the type of source (SourceType) that you want to be notified of. You can also provide a list of Amazon DocumentDB sources (SourceIds) that trigger the events, and you can provide a list of event categories (EventCategories) for events that you want to be notified of. For example, you can specify SourceType = db-instance, SourceIds = mydbinstance1, mydbinstance2 and EventCategories = Availability, Backup. If you specify both the SourceType and SourceIds (such as SourceType = db-instance and SourceIdentifier = myDBInstance1), you are notified of all the db-instance events for the specified source. If you specify a SourceType but do not specify a SourceIdentifier, you receive notice of the events for that source type for all your Amazon DocumentDB sources. If you do not specify either the SourceType or the SourceIdentifier, you are notified of events generated from all Amazon DocumentDB sources belonging to your customer account.
CreateGlobalCluster
Show Description Creates an Amazon DocumentDB global cluster that can span multiple multiple Regions. The global cluster contains one primary cluster with read-write capability, and up-to give read-only secondary clusters. Global clusters uses storage-based fast replication across regions with latencies less than one second, using dedicated infrastructure with no impact to your workload’s performance.

You can create a global cluster that is initially empty, and then add a primary and a secondary to it. Or you can specify an existing cluster during the create operation, and this cluster becomes the primary of the global cluster. This action only applies to Amazon DocumentDB clusters.

DeleteDBCluster
Show Description Deletes a previously provisioned cluster. When you delete a cluster, all automated backups for that cluster are deleted and can't be recovered. Manual DB cluster snapshots of the specified cluster are not deleted.

DeleteDBClusterParameterGroup
DeleteDBClusterSnapshot
Show Description Deletes a cluster snapshot. If the snapshot is being copied, the copy operation is terminated. The cluster snapshot must be in the available state to be deleted.
DeleteDBInstance
Show Description Deletes a previously provisioned instance.
DeleteDBSubnetGroup
DeleteEventSubscription
Show Description Deletes an Amazon DocumentDB event notification subscription.
DeleteGlobalCluster
Show Description Deletes a global cluster. The primary and secondary clusters must already be detached or deleted before attempting to delete a global cluster. This action only applies to Amazon DocumentDB clusters.
DescribeCertificates
Show Description Returns a list of certificate authority (CA) certificates provided by Amazon DocumentDB for this account.
DescribeDBClusterParameterGroups
Show Description Returns a list of DBClusterParameterGroup descriptions. If a DBClusterParameterGroupName parameter is specified, the list contains only the description of the specified cluster parameter group.
DescribeDBClusterParameters
Show Description Returns the detailed parameter list for a particular cluster parameter group.
DescribeDBClusterSnapshotAttributes
Show Description Returns a list of cluster snapshot attribute names and values for a manual DB cluster snapshot. When you share snapshots with other accounts, DescribeDBClusterSnapshotAttributes returns the restore attribute and a list of IDs for the accounts that are authorized to copy or restore the manual cluster snapshot. If all is included in the list of values for the restore attribute, then the manual cluster snapshot is public and can be copied or restored by all accounts.
DescribeDBClusterSnapshots
Show Description Returns information about cluster snapshots. This API operation supports pagination.
DescribeDBClusters
Show Description Returns information about provisioned Amazon DocumentDB clusters. This API operation supports pagination. For certain management features such as cluster and instance lifecycle management, Amazon DocumentDB leverages operational technology that is shared with Amazon RDS and Amazon Neptune. Use the filterName=engine,Values=docdb filter parameter to return only Amazon DocumentDB clusters.
DescribeDBEngineVersions
Show Description Returns a list of the available engines.
DescribeDBInstances
Show Description Returns information about provisioned Amazon DocumentDB instances. This API supports pagination.
DescribeDBSubnetGroups
Show Description Returns a list of DBSubnetGroup descriptions. If a DBSubnetGroupName is specified, the list will contain only the descriptions of the specified DBSubnetGroup.
DescribeEngineDefaultClusterParameters
Show Description Returns the default engine and system parameter information for the cluster database engine.
DescribeEventCategories
Show Description Displays a list of categories for all event source types, or, if specified, for a specified source type.
DescribeEventSubscriptions
Show Description Lists all the subscription descriptions for a customer account. The description for a subscription includes SubscriptionName, SNSTopicARN, CustomerID, SourceType, SourceID, CreationTime, and Status. If you specify a SubscriptionName, lists the description for that subscription.
DescribeEvents
Show Description Returns events related to instances, security groups, snapshots, and DB parameter groups for the past 14 days. You can obtain events specific to a particular DB instance, security group, snapshot, or parameter group by providing the name as a parameter. By default, the events of the past hour are returned.
DescribeGlobalClusters
Show Description Returns information about Amazon DocumentDB global clusters. This API supports pagination. This action only applies to Amazon DocumentDB clusters.
DescribeOrderableDBInstanceOptions
Show Description Returns a list of orderable instance options for the specified engine.
DescribePendingMaintenanceActions
Show Description Returns a list of resources (for example, instances) that have at least one pending maintenance action.
FailoverDBCluster
Show Description Forces a failover for a cluster. A failover for a cluster promotes one of the Amazon DocumentDB replicas (read-only instances) in the cluster to be the primary instance (the cluster writer). If the primary instance fails, Amazon DocumentDB automatically fails over to an Amazon DocumentDB replica, if one exists. You can force a failover when you want to simulate a failure of a primary instance for testing.
ListTagsForResource
Show Description Lists all tags on an Amazon DocumentDB resource.
ModifyDBCluster
Show Description Modifies a setting for an Amazon DocumentDB cluster. You can change one or more database configuration parameters by specifying these parameters and the new values in the request.
ModifyDBClusterParameterGroup
Show Description Modifies the parameters of a cluster parameter group. To modify more than one parameter, submit a list of the following: ParameterName, ParameterValue, and ApplyMethod. A maximum of 20 parameters can be modified in a single request. Changes to dynamic parameters are applied immediately. Changes to static parameters require a reboot or maintenance window before the change can take effect. After you create a cluster parameter group, you should wait at least 5 minutes before creating your first cluster that uses that cluster parameter group as the default parameter group. This allows Amazon DocumentDB to fully complete the create action before the parameter group is used as the default for a new cluster. This step is especially important for parameters that are critical when creating the default database for a cluster, such as the character set for the default database defined by the character_set_database parameter.
ModifyDBClusterSnapshotAttribute
Show Description Adds an attribute and values to, or removes an attribute and values from, a manual cluster snapshot. To share a manual cluster snapshot with other accounts, specify restore as the AttributeName, and use the ValuesToAdd parameter to add a list of IDs of the accounts that are authorized to restore the manual cluster snapshot. Use the value all to make the manual cluster snapshot public, which means that it can be copied or restored by all accounts. Do not add the all value for any manual cluster snapshots that contain private information that you don't want available to all accounts. If a manual cluster snapshot is encrypted, it can be shared, but only by specifying a list of authorized account IDs for the ValuesToAdd parameter. You can't use all as a value for that parameter in this case.
ModifyDBInstance
Show Description Modifies settings for an instance. You can change one or more database configuration parameters by specifying these parameters and the new values in the request.
ModifyDBSubnetGroup
Show Description Modifies an existing subnet group. subnet groups must contain at least one subnet in at least two Availability Zones in the Region.
ModifyEventSubscription
Show Description Modifies an existing Amazon DocumentDB event notification subscription.
ModifyGlobalCluster
Show Description Modify a setting for an Amazon DocumentDB global cluster. You can change one or more configuration parameters (for example: deletion protection), or the global cluster identifier by specifying these parameters and the new values in the request. This action only applies to Amazon DocumentDB clusters.
RebootDBInstance
Show Description You might need to reboot your instance, usually for maintenance reasons. For example, if you make certain changes, or if you change the cluster parameter group that is associated with the instance, you must reboot the instance for the changes to take effect. Rebooting an instance restarts the database engine service. Rebooting an instance results in a momentary outage, during which the instance status is set to rebooting.
RemoveFromGlobalCluster
Show Description Detaches an Amazon DocumentDB secondary cluster from a global cluster. The cluster becomes a standalone cluster with read-write capability instead of being read-only and receiving data from a primary in a different region. This action only applies to Amazon DocumentDB clusters.
RemoveSourceIdentifierFromSubscription
Show Description Removes a source identifier from an existing Amazon DocumentDB event notification subscription.
RemoveTagsFromResource
ResetDBClusterParameterGroup
Show Description Modifies the parameters of a cluster parameter group to the default value. To reset specific parameters, submit a list of the following: ParameterName and ApplyMethod. To reset the entire cluster parameter group, specify the DBClusterParameterGroupName and ResetAllParameters parameters. When you reset the entire group, dynamic parameters are updated immediately and static parameters are set to pending-reboot to take effect on the next DB instance reboot.
RestoreDBClusterFromSnapshot
Show Description Creates a new cluster from a snapshot or cluster snapshot. If a snapshot is specified, the target cluster is created from the source DB snapshot with a default configuration and default security group. If a cluster snapshot is specified, the target cluster is created from the source cluster restore point with the same configuration as the original source DB cluster, except that the new cluster is created with the default security group.
RestoreDBClusterToPointInTime
Show Description Restores a cluster to an arbitrary point in time. Users can restore to any point in time before LatestRestorableTime for up to BackupRetentionPeriod days. The target cluster is created from the source cluster with the same configuration as the original cluster, except that the new cluster is created with the default security group.
StartDBCluster
Show Description Restarts the stopped cluster that is specified by DBClusterIdentifier. For more information, see Stopping and Starting an Amazon DocumentDB Cluster.

Ds Events

Service Event Name Description
ds AcceptSharedDirectory
Show Description Accepts a directory sharing request that was sent from the directory owner account.
AddIpRoutes
Show Description If the DNS server for your self-managed domain uses a publicly addressable IP address, you must add a CIDR address block to correctly route traffic to and from your Microsoft AD on Amazon Web Services. AddIpRoutes adds this address block. You can also use AddIpRoutes to facilitate routing traffic that uses public IP ranges from your Microsoft AD on Amazon Web Services to a peer VPC. Before you call AddIpRoutes, ensure that all of the required permissions have been explicitly granted through a policy. For details about what permissions are required to run the AddIpRoutes operation, see Directory Service API Permissions: Actions, Resources, and Conditions Reference.
AddRegion
Show Description Adds two domain controllers in the specified Region for the specified directory.
AddTagsToResource
Show Description Adds or overwrites one or more tags for the specified directory. Each directory can have a maximum of 50 tags. Each tag consists of a key and optional value. Tag keys must be unique to each resource.
CancelSchemaExtension
Show Description Cancels an in-progress schema extension to a Microsoft AD directory. Once a schema extension has started replicating to all domain controllers, the task can no longer be canceled. A schema extension can be canceled during any of the following states; Initializing, CreatingSnapshot, and UpdatingSchema.
ConnectDirectory
Show Description Creates an AD Connector to connect to a self-managed directory. Before you call ConnectDirectory, ensure that all of the required permissions have been explicitly granted through a policy. For details about what permissions are required to run the ConnectDirectory operation, see Directory Service API Permissions: Actions, Resources, and Conditions Reference.
CreateAlias
Show Description Creates an alias for a directory and assigns the alias to the directory. The alias is used to construct the access URL for the directory, such as http://<alias>.awsapps.com. After an alias has been created, it cannot be deleted or reused, so this operation should only be used when absolutely necessary.
CreateComputer
Show Description Creates an Active Directory computer object in the specified directory.
CreateConditionalForwarder
Show Description Creates a conditional forwarder associated with your Amazon Web Services directory. Conditional forwarders are required in order to set up a trust relationship with another domain. The conditional forwarder points to the trusted domain.
CreateDirectory
Show Description Creates a Simple AD directory. For more information, see Simple Active Directory in the Directory Service Admin Guide. Before you call CreateDirectory, ensure that all of the required permissions have been explicitly granted through a policy. For details about what permissions are required to run the CreateDirectory operation, see Directory Service API Permissions: Actions, Resources, and Conditions Reference.
CreateLogSubscription
Show Description Creates a subscription to forward real-time Directory Service domain controller security logs to the specified Amazon CloudWatch log group in your Amazon Web Services account.
CreateMicrosoftAD
Show Description Creates a Microsoft AD directory in the Amazon Web Services Cloud. For more information, see Managed Microsoft AD in the Directory Service Admin Guide. Before you call CreateMicrosoftAD, ensure that all of the required permissions have been explicitly granted through a policy. For details about what permissions are required to run the CreateMicrosoftAD operation, see Directory Service API Permissions: Actions, Resources, and Conditions Reference.
CreateSnapshot
Show Description Creates a snapshot of a Simple AD or Microsoft AD directory in the Amazon Web Services cloud. You cannot take snapshots of AD Connector directories.
CreateTrust
Show Description Directory Service for Microsoft Active Directory allows you to configure trust relationships. For example, you can establish a trust between your Managed Microsoft AD directory, and your existing self-managed Microsoft Active Directory. This would allow you to provide users and groups access to resources in either domain, with a single set of credentials. This action initiates the creation of the Amazon Web Services side of a trust relationship between an Managed Microsoft AD directory and an external domain. You can create either a forest trust or an external trust.
DeleteConditionalForwarder
Show Description Deletes a conditional forwarder that has been set up for your Amazon Web Services directory.
DeleteDirectory
Show Description Deletes an Directory Service directory. Before you call DeleteDirectory, ensure that all of the required permissions have been explicitly granted through a policy. For details about what permissions are required to run the DeleteDirectory operation, see Directory Service API Permissions: Actions, Resources, and Conditions Reference.
DeleteLogSubscription
Show Description Deletes the specified log subscription.
DeleteSnapshot
Show Description Deletes a directory snapshot.
DeleteTrust
Show Description Deletes an existing trust relationship between your Managed Microsoft AD directory and an external domain.
DeregisterCertificate
Show Description Deletes from the system the certificate that was registered for secure LDAP or client certificate authentication.
DeregisterEventTopic
Show Description Removes the specified directory as a publisher to the specified Amazon SNS topic.
DescribeCertificate
Show Description Displays information about the certificate registered for secure LDAP or client certificate authentication.
DescribeClientAuthenticationSettings
Show Description Retrieves information about the type of client authentication for the specified directory, if the type is specified. If no type is specified, information about all client authentication types that are supported for the specified directory is retrieved. Currently, only SmartCard is supported.
DescribeConditionalForwarders
Show Description Obtains information about the conditional forwarders for this account. If no input parameters are provided for RemoteDomainNames, this request describes all conditional forwarders for the specified directory ID.
DescribeDirectories
Show Description Obtains information about the directories that belong to this account. You can retrieve information about specific directories by passing the directory identifiers in the DirectoryIds parameter. Otherwise, all directories that belong to the current account are returned. This operation supports pagination with the use of the NextToken request and response parameters. If more results are available, the DescribeDirectoriesResult.NextToken member contains a token that you pass in the next call to DescribeDirectories to retrieve the next set of items. You can also specify a maximum number of return results with the Limit parameter.
DescribeDomainControllers
Show Description Provides information about any domain controllers in your directory.
DescribeEventTopics
Show Description Obtains information about which Amazon SNS topics receive status messages from the specified directory. If no input parameters are provided, such as DirectoryId or TopicName, this request describes all of the associations in the account.
DescribeLDAPSSettings
Show Description Describes the status of LDAP security for the specified directory.
DescribeRegions
Show Description Provides information about the Regions that are configured for multi-Region replication.
DescribeSharedDirectories
Show Description Returns the shared directories in your account.
DescribeSnapshots
Show Description Obtains information about the directory snapshots that belong to this account. This operation supports pagination with the use of the NextToken request and response parameters. If more results are available, the DescribeSnapshots.NextToken member contains a token that you pass in the next call to DescribeSnapshots to retrieve the next set of items. You can also specify a maximum number of return results with the Limit parameter.
DescribeTrusts
Show Description Obtains information about the trust relationships for this account. If no input parameters are provided, such as DirectoryId or TrustIds, this request describes all the trust relationships belonging to the account.
DisableClientAuthentication
Show Description Disables alternative client authentication methods for the specified directory.
DisableLDAPS
Show Description Deactivates LDAP secure calls for the specified directory.
DisableRadius
Show Description Disables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector or Microsoft AD directory.
DisableSso
Show Description Disables single-sign on for a directory.
EnableClientAuthentication
Show Description Enables alternative client authentication methods for the specified directory.
EnableLDAPS
Show Description Activates the switch for the specific directory to always use LDAP secure calls.
EnableRadius
Show Description Enables multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector or Microsoft AD directory.
EnableSso
Show Description Enables single sign-on for a directory. Single sign-on allows users in your directory to access certain Amazon Web Services services from a computer joined to the directory without having to enter their credentials separately.
GetDirectoryLimits
Show Description Obtains directory limit information for the current Region.
GetSnapshotLimits
Show Description Obtains the manual snapshot limits for a directory.
ListCertificates
Show Description For the specified directory, lists all the certificates registered for a secure LDAP or client certificate authentication.
ListIpRoutes
Show Description Lists the address blocks that you have added to a directory.
ListLogSubscriptions
Show Description Lists the active log subscriptions for the Amazon Web Services account.
ListSchemaExtensions
Show Description Lists all schema extensions applied to a Microsoft AD Directory.
ListTagsForResource
Show Description Lists all tags on a directory.
RegisterCertificate
Show Description Registers a certificate for a secure LDAP or client certificate authentication.
RegisterEventTopic
Show Description Associates a directory with an Amazon SNS topic. This establishes the directory as a publisher to the specified Amazon SNS topic. You can then receive email or text (SMS) messages when the status of your directory changes. You get notified if your directory goes from an Active status to an Impaired or Inoperable status. You also receive a notification when the directory returns to an Active status.
RejectSharedDirectory
Show Description Rejects a directory sharing request that was sent from the directory owner account.
RemoveIpRoutes
Show Description Removes IP address blocks from a directory.
RemoveRegion
Show Description Stops all replication and removes the domain controllers from the specified Region. You cannot remove the primary Region with this operation. Instead, use the DeleteDirectory API.
RemoveTagsFromResource
Show Description Removes tags from a directory.
ResetUserPassword
Show Description Resets the password for any user in your Managed Microsoft AD or Simple AD directory. You can reset the password for any user in your directory with the following exceptions:
  • For Simple AD, you cannot reset the password for any user that is a member of either the Domain Admins or Enterprise Admins group except for the administrator user.
  • For Managed Microsoft AD, you can only reset the password for a user that is in an OU based off of the NetBIOS name that you typed when you created your directory. For example, you cannot reset the password for a user in the Amazon Web Services Reserved OU. For more information about the OU structure for an Managed Microsoft AD directory, see What Gets Created in the Directory Service Administration Guide.
RestoreFromSnapshot
Show Description Restores a directory using an existing directory snapshot. When you restore a directory from a snapshot, any changes made to the directory after the snapshot date are overwritten. This action returns as soon as the restore operation is initiated. You can monitor the progress of the restore operation by calling the DescribeDirectories operation with the directory identifier. When the DirectoryDescription.Stage value changes to Active, the restore operation is complete.
ShareDirectory
Show Description Shares a specified directory (DirectoryId) in your Amazon Web Services account (directory owner) with another Amazon Web Services account (directory consumer). With this operation you can use your directory from any Amazon Web Services account and from any Amazon VPC within an Amazon Web Services Region. When you share your Managed Microsoft AD directory, Directory Service creates a shared directory in the directory consumer account. This shared directory contains the metadata to provide access to the directory within the directory owner account. The shared directory is visible in all VPCs in the directory consumer account. The ShareMethod parameter determines whether the specified directory can be shared between Amazon Web Services accounts inside the same Amazon Web Services organization (ORGANIZATIONS). It also determines whether you can share the directory with any other Amazon Web Services account either inside or outside of the organization (HANDSHAKE). The ShareNotes parameter is only used when HANDSHAKE is called, which sends a directory sharing request to the directory consumer.
StartSchemaExtension
Show Description Applies a schema extension to a Microsoft AD directory.
UnshareDirectory
Show Description Stops the directory sharing between the directory owner and consumer accounts.
UpdateConditionalForwarder
Show Description Updates a conditional forwarder that has been set up for your Amazon Web Services directory.
UpdateNumberOfDomainControllers
Show Description Adds or removes domain controllers to or from the directory. Based on the difference between current value and new value (provided through this API call), domain controllers will be added or removed. It may take up to 45 minutes for any new domain controllers to become fully active once the requested number of domain controllers is updated. During this time, you cannot make another update request.
UpdateRadius
Show Description Updates the Remote Authentication Dial In User Service (RADIUS) server information for an AD Connector or Microsoft AD directory.
UpdateTrust
Show Description Updates the trust that has been set up between your Managed Microsoft AD directory and an self-managed Active Directory.

Dynamodb Events

Service Event Name Description
dynamodb BatchExecuteStatement
Show Description This operation allows you to perform batch reads and writes on data stored in DynamoDB, using PartiQL.
BatchGetItem
Show Description The BatchGetItem operation returns the attributes of one or more items from one or more tables. You identify requested items by primary key. A single operation can retrieve up to 16 MB of data, which can contain as many as 100 items. BatchGetItem returns a partial result if the response size limit is exceeded, the table's provisioned throughput is exceeded, or an internal processing failure occurs. If a partial result is returned, the operation returns a value for UnprocessedKeys. You can use this value to retry the operation starting with the next item to get. If you request more than 100 items, BatchGetItem returns a ValidationException with the message "Too many items requested for the BatchGetItem call." For example, if you ask to retrieve 100 items, but each individual item is 300 KB in size, the system returns 52 items (so as not to exceed the 16 MB limit). It also returns an appropriate UnprocessedKeys value so you can get the next page of results. If desired, your application can include its own logic to assemble the pages of results into one dataset. If none of the items can be processed due to insufficient provisioned throughput on all of the tables in the request, then BatchGetItem returns a ProvisionedThroughputExceededException. If at least one of the items is successfully processed, then BatchGetItem completes successfully, while returning the keys of the unread items in UnprocessedKeys. If DynamoDB returns any unprocessed items, you should retry the batch operation on those items. However, we strongly recommend that you use an exponential backoff algorithm. If you retry the batch operation immediately, the underlying read or write requests can still fail due to throttling on the individual tables. If you delay the batch operation using exponential backoff, the individual requests in the batch are much more likely to succeed. For more information, see Batch Operations and Error Handling in the Amazon DynamoDB Developer Guide. By default, BatchGetItem performs eventually consistent reads on every table in the request. If you want strongly consistent reads instead, you can set ConsistentRead to true for any or all tables. In order to minimize response latency, BatchGetItem retrieves items in parallel. When designing your application, keep in mind that DynamoDB does not return items in any particular order. To help parse the response by item, include the primary key values for the items in your request in the ProjectionExpression parameter. If a requested item does not exist, it is not returned in the result. Requests for nonexistent items consume the minimum read capacity units according to the type of read. For more information, see Working with Tables in the Amazon DynamoDB Developer Guide.
BatchWriteItem
Show Description The BatchWriteItem operation puts or deletes multiple items in one or more tables. A single call to BatchWriteItem can write up to 16 MB of data, which can comprise as many as 25 put or delete requests. Individual items to be written can be as large as 400 KB. BatchWriteItem cannot update items. To update items, use the UpdateItem action. The individual PutItem and DeleteItem operations specified in BatchWriteItem are atomic; however BatchWriteItem as a whole is not. If any requested operations fail because the table's provisioned throughput is exceeded or an internal processing failure occurs, the failed operations are returned in the UnprocessedItems response parameter. You can investigate and optionally resend the requests. Typically, you would call BatchWriteItem in a loop. Each iteration would check for unprocessed items and submit a new BatchWriteItem request with those unprocessed items until all items have been processed. If none of the items can be processed due to insufficient provisioned throughput on all of the tables in the request, then BatchWriteItem returns a ProvisionedThroughputExceededException. If DynamoDB returns any unprocessed items, you should retry the batch operation on those items. However, we strongly recommend that you use an exponential backoff algorithm. If you retry the batch operation immediately, the underlying read or write requests can still fail due to throttling on the individual tables. If you delay the batch operation using exponential backoff, the individual requests in the batch are much more likely to succeed. For more information, see Batch Operations and Error Handling in the Amazon DynamoDB Developer Guide. With BatchWriteItem, you can efficiently write or delete large amounts of data, such as from Amazon EMR, or copy data from another database into DynamoDB. In order to improve performance with these large-scale operations, BatchWriteItem does not behave in the same way as individual PutItem and DeleteItem calls would. For example, you cannot specify conditions on individual put and delete requests, and BatchWriteItem does not return deleted items in the response. If you use a programming language that supports concurrency, you can use threads to write items in parallel. Your application must include the necessary logic to manage the threads. With languages that don't support threading, you must update or delete the specified items one at a time. In both situations, BatchWriteItem performs the specified put and delete operations in parallel, giving you the power of the thread pool approach without having to introduce complexity into your application. Parallel processing reduces latency, but each specified put and delete request consumes the same number of write capacity units whether it is processed in parallel or not. Delete operations on nonexistent items consume one write capacity unit. If one or more of the following is true, DynamoDB rejects the entire batch write operation:
  • One or more tables specified in the BatchWriteItem request does not exist.
  • Primary key attributes specified on an item in the request do not match those in the corresponding table's primary key schema.
  • You try to perform multiple operations on the same item in the same BatchWriteItem request. For example, you cannot put and delete the same item in the same BatchWriteItem request.
  • Your request contains at least two items with identical hash and range keys (which essentially is two put operations).
  • There are more than 25 requests in the batch.
  • Any individual item in a batch exceeds 400 KB.
  • The total request size exceeds 16 MB.
CreateBackup
Show Description Creates a backup for an existing table. Each time you create an on-demand backup, the entire table data is backed up. There is no limit to the number of on-demand backups that can be taken. When you create an on-demand backup, a time marker of the request is cataloged, and the backup is created asynchronously, by applying all changes until the time of the request to the last full table snapshot. Backup requests are processed instantaneously and become available for restore within minutes. You can call CreateBackup at a maximum rate of 50 times per second. All backups in DynamoDB work without consuming any provisioned throughput on the table. If you submit a backup request on 2018-12-14 at 14:25:00, the backup is guaranteed to contain all data committed to the table up to 14:24:00, and data committed after 14:26:00 will not be. The backup might contain data modifications made between 14:24:00 and 14:26:00. On-demand backup does not support causal consistency. Along with data, the following are also included on the backups:
  • Global secondary indexes (GSIs)
  • Local secondary indexes (LSIs)
  • Streams
  • Provisioned read and write capacity
CreateGlobalTable
Show Description Creates a global table from an existing table. A global table creates a replication relationship between two or more DynamoDB tables with the same table name in the provided Regions. This operation only applies to Version 2017.11.29 of global tables. If you want to add a new replica table to a global table, each of the following conditions must be true:
  • The table must have the same primary key as all of the other replicas.
  • The table must have the same name as all of the other replicas.
  • The table must have DynamoDB Streams enabled, with the stream containing both the new and the old images of the item.
  • None of the replica tables in the global table can contain any data.
If global secondary indexes are specified, then the following conditions must also be met:
  • The global secondary indexes must have the same name.
  • The global secondary indexes must have the same hash key and sort key (if present).
If local secondary indexes are specified, then the following conditions must also be met:
  • The local secondary indexes must have the same name.
  • The local secondary indexes must have the same hash key and sort key (if present).
Write capacity settings should be set consistently across your replica tables and secondary indexes. DynamoDB strongly recommends enabling auto scaling to manage the write capacity settings for all of your global tables replicas and indexes. If you prefer to manage write capacity settings manually, you should provision equal replicated write capacity units to your replica tables. You should also provision equal replicated write capacity units to matching secondary indexes across your global table.
CreateTable
Show Description The CreateTable operation adds a new table to your account. In an AWS account, table names must be unique within each Region. That is, you can have two tables with same name if you create the tables in different Regions. CreateTable is an asynchronous operation. Upon receiving a CreateTable request, DynamoDB immediately returns a response with a TableStatus of CREATING. After the table is created, DynamoDB sets the TableStatus to ACTIVE. You can perform read and write operations only on an ACTIVE table. You can optionally define secondary indexes on the new table, as part of the CreateTable operation. If you want to create multiple tables with secondary indexes on them, you must create the tables sequentially. Only one table with secondary indexes can be in the CREATING state at any given time. You can use the DescribeTable action to check the table status.
DeleteBackup
Show Description Deletes an existing backup of a table. You can call DeleteBackup at a maximum rate of 10 times per second.
DeleteItem
Show Description Deletes a single item in a table by primary key. You can perform a conditional delete operation that deletes the item if it exists, or if it has an expected attribute value. In addition to deleting an item, you can also return the item's attribute values in the same operation, using the ReturnValues parameter. Unless you specify conditions, the DeleteItem is an idempotent operation; running it multiple times on the same item or attribute does not result in an error response. Conditional deletes are useful for deleting items only if specific conditions are met. If those conditions are met, DynamoDB performs the delete. Otherwise, the item is not deleted.
DeleteTable
Show Description The DeleteTable operation deletes a table and all of its items. After a DeleteTable request, the specified table is in the DELETING state until DynamoDB completes the deletion. If the table is in the ACTIVE state, you can delete it. If a table is in CREATING or UPDATING states, then DynamoDB returns a ResourceInUseException. If the specified table does not exist, DynamoDB returns a ResourceNotFoundException. If table is already in the DELETING state, no error is returned. DynamoDB might continue to accept data read and write operations, such as GetItem and PutItem, on a table in the DELETING state until the table deletion is complete. When you delete a table, any indexes on that table are also deleted. If you have DynamoDB Streams enabled on the table, then the corresponding stream on that table goes into the DISABLED state, and the stream is automatically deleted after 24 hours. Use the DescribeTable action to check the status of the table.
DescribeBackup
Show Description Describes an existing backup of a table. You can call DescribeBackup at a maximum rate of 10 times per second.
DescribeContinuousBackups
Show Description Checks the status of continuous backups and point in time recovery on the specified table. Continuous backups are ENABLED on all tables at table creation. If point in time recovery is enabled, PointInTimeRecoveryStatus will be set to ENABLED. After continuous backups and point in time recovery are enabled, you can restore to any point in time within EarliestRestorableDateTime and LatestRestorableDateTime. LatestRestorableDateTime is typically 5 minutes before the current time. You can restore your table to any point in time during the last 35 days. You can call DescribeContinuousBackups at a maximum rate of 10 times per second.
DescribeContributorInsights
Show Description Returns information about contributor insights, for a given table or global secondary index.
DescribeEndpoints
Show Description Returns the regional endpoint information.
DescribeExport
Show Description Describes an existing table export.
DescribeGlobalTable
Show Description Returns information about the specified global table. This operation only applies to Version 2017.11.29 of global tables. If you are using global tables Version 2019.11.21 you can use DescribeTable instead.
DescribeGlobalTableSettings
Show Description Describes Region-specific settings for a global table. This operation only applies to Version 2017.11.29 of global tables.
DescribeKinesisStreamingDestination
Show Description Returns information about the status of Kinesis streaming.
DescribeLimits
Show Description Returns the current provisioned-capacity quotas for your AWS account in a Region, both for the Region as a whole and for any one DynamoDB table that you create there. When you establish an AWS account, the account has initial quotas on the maximum read capacity units and write capacity units that you can provision across all of your DynamoDB tables in a given Region. Also, there are per-table quotas that apply when you create a table there. For more information, see Service, Account, and Table Quotas page in the Amazon DynamoDB Developer Guide. Although you can increase these quotas by filing a case at AWS Support Center, obtaining the increase is not instantaneous. The DescribeLimits action lets you write code to compare the capacity you are currently using to those quotas imposed by your account so that you have enough time to apply for an increase before you hit a quota. For example, you could use one of the AWS SDKs to do the following:
  1. Call DescribeLimits for a particular Region to obtain your current account quotas on provisioned capacity there.
  2. Create a variable to hold the aggregate read capacity units provisioned for all your tables in that Region, and one to hold the aggregate write capacity units. Zero them both.
  3. Call ListTables to obtain a list of all your DynamoDB tables.
  4. For each table name listed by ListTables, do the following:
    • Call DescribeTable with the table name.
    • Use the data returned by DescribeTable to add the read capacity units and write capacity units provisioned for the table itself to your variables.
    • If the table has one or more global secondary indexes (GSIs), loop over these GSIs and add their provisioned capacity values to your variables as well.
  5. Report the account quotas for that Region returned by DescribeLimits, along with the total current provisioned capacity levels you have calculated.
This will let you see whether you are getting close to your account-level quotas. The per-table quotas apply only when you are creating a new table. They restrict the sum of the provisioned capacity of the new table itself and all its global secondary indexes. For existing tables and their GSIs, DynamoDB doesn't let you increase provisioned capacity extremely rapidly, but the only quota that applies is that the aggregate provisioned capacity over all your tables and GSIs cannot exceed either of the per-account quotas. DescribeLimits should only be called periodically. You can expect throttling errors if you call it more than once in a minute. The DescribeLimits Request element has no content.
DescribeTable
Show Description Returns information about the table, including the current status of the table, when it was created, the primary key schema, and any indexes on the table. If you issue a DescribeTable request immediately after a CreateTable request, DynamoDB might return a ResourceNotFoundException. This is because DescribeTable uses an eventually consistent query, and the metadata for your table might not be available at that moment. Wait for a few seconds, and then try the DescribeTable request again.
DescribeTableReplicaAutoScaling
Show Description Describes auto scaling settings across replicas of the global table at once. This operation only applies to Version 2019.11.21 of global tables.
DescribeTimeToLive
Show Description Gives a description of the Time to Live (TTL) status on the specified table.
DisableKinesisStreamingDestination
Show Description Stops replication from the DynamoDB table to the Kinesis data stream. This is done without deleting either of the resources.
EnableKinesisStreamingDestination
Show Description Starts table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow. If this operation doesn't return results immediately, use DescribeKinesisStreamingDestination to check if streaming to the Kinesis data stream is ACTIVE.
ExecuteStatement
Show Description This operation allows you to perform reads and singleton writes on data stored in DynamoDB, using PartiQL.
ExecuteTransaction
Show Description This operation allows you to perform transactional reads or writes on data stored in DynamoDB, using PartiQL.
ExportTableToPointInTime
Show Description Exports table data to an S3 bucket. The table must have point in time recovery enabled, and you can export data from any time within the point in time recovery window.
GetItem
Show Description The GetItem operation returns a set of attributes for the item with the given primary key. If there is no matching item, GetItem does not return any data and there will be no Item element in the response. GetItem provides an eventually consistent read by default. If your application requires a strongly consistent read, set ConsistentRead to true. Although a strongly consistent read might take more time than an eventually consistent read, it always returns the last updated value.
ListBackups
Show Description List backups associated with an AWS account. To list backups for a given table, specify TableName. ListBackups returns a paginated list of results with at most 1 MB worth of items in a page. You can also specify a maximum number of entries to be returned in a page. In the request, start time is inclusive, but end time is exclusive. Note that these boundaries are for the time at which the original backup was requested. You can call ListBackups a maximum of five times per second.
ListContributorInsights
Show Description Returns a list of ContributorInsightsSummary for a table and all its global secondary indexes.
ListExports
Show Description Lists completed exports within the past 90 days.
ListGlobalTables
Show Description Lists all global tables that have a replica in the specified Region. This operation only applies to Version 2017.11.29 of global tables.
ListTables
Show Description Returns an array of table names associated with the current account and endpoint. The output from ListTables is paginated, with each page returning a maximum of 100 table names.
ListTagsOfResource
Show Description List all tags on an Amazon DynamoDB resource. You can call ListTagsOfResource up to 10 times per second, per account. For an overview on tagging DynamoDB resources, see Tagging for DynamoDB in the Amazon DynamoDB Developer Guide.
PutItem
Show Description Creates a new item, or replaces an old item with a new item. If an item that has the same primary key as the new item already exists in the specified table, the new item completely replaces the existing item. You can perform a conditional put operation (add a new item if one with the specified primary key doesn't exist), or replace an existing item if it has certain attribute values. You can return the item's attribute values in the same operation, using the ReturnValues parameter. This topic provides general information about the PutItem API. For information on how to call the PutItem API using the AWS SDK in specific languages, see the following: When you add an item, the primary key attributes are the only required attributes. Attribute values cannot be null. Empty String and Binary attribute values are allowed. Attribute values of type String and Binary must have a length greater than zero if the attribute is used as a key attribute for a table or index. Set type attributes cannot be empty. Invalid Requests with empty values will be rejected with a ValidationException exception. To prevent a new item from replacing an existing item, use a conditional expression that contains the attribute_not_exists function with the name of the attribute being used as the partition key for the table. Since every record must contain that attribute, the attribute_not_exists function will only succeed if no matching item exists. For more information about PutItem, see Working with Items in the Amazon DynamoDB Developer Guide.
Query
Show Description The Query operation finds items based on primary key values. You can query any table or secondary index that has a composite primary key (a partition key and a sort key). Use the KeyConditionExpression parameter to provide a specific value for the partition key. The Query operation will return all of the items from the table or index with that partition key value. You can optionally narrow the scope of the Query operation by specifying a sort key value and a comparison operator in KeyConditionExpression. To further refine the Query results, you can optionally provide a FilterExpression. A FilterExpression determines which items within the results should be returned to you. All of the other results are discarded. A Query operation always returns a result set. If no matching items are found, the result set will be empty. Queries that do not return results consume the minimum number of read capacity units for that type of read operation. DynamoDB calculates the number of read capacity units consumed based on item size, not on the amount of data that is returned to an application. The number of capacity units consumed will be the same whether you request all of the attributes (the default behavior) or just some of them (using a projection expression). The number will also be the same whether or not you use a FilterExpression. Query results are always sorted by the sort key value. If the data type of the sort key is Number, the results are returned in numeric order; otherwise, the results are returned in order of UTF-8 bytes. By default, the sort order is ascending. To reverse the order, set the ScanIndexForward parameter to false. A single Query operation will read up to the maximum number of items set (if using the Limit parameter) or a maximum of 1 MB of data and then apply any filtering to the results using FilterExpression. If LastEvaluatedKey is present in the response, you will need to paginate the result set. For more information, see Paginating the Results in the Amazon DynamoDB Developer Guide. FilterExpression is applied after a Query finishes, but before the results are returned. A FilterExpression cannot contain partition key or sort key attributes. You need to specify those attributes in the KeyConditionExpression. A Query operation can return an empty result set and a LastEvaluatedKey if all the items read for the page of results are filtered out. You can query a table, a local secondary index, or a global secondary index. For a query on a table or on a local secondary index, you can set the ConsistentRead parameter to true and obtain a strongly consistent result. Global secondary indexes support eventually consistent reads only, so do not specify ConsistentRead when querying a global secondary index.
RestoreTableFromBackup
Show Description Creates a new table from an existing backup. Any number of users can execute up to 4 concurrent restores (any type of restore) in a given account. You can call RestoreTableFromBackup at a maximum rate of 10 times per second. You must manually set up the following on the restored table:
  • Auto scaling policies
  • IAM policies
  • Amazon CloudWatch metrics and alarms
  • Tags
  • Stream settings
  • Time to Live (TTL) settings
RestoreTableToPointInTime
Show Description Restores the specified table to the specified point in time within EarliestRestorableDateTime and LatestRestorableDateTime. You can restore your table to any point in time during the last 35 days. Any number of users can execute up to 4 concurrent restores (any type of restore) in a given account. When you restore using point in time recovery, DynamoDB restores your table data to the state based on the selected date and time (day:hour:minute:second) to a new table. Along with data, the following are also included on the new restored table using point in time recovery:
  • Global secondary indexes (GSIs)
  • Local secondary indexes (LSIs)
  • Provisioned read and write capacity
  • Encryption settings All these settings come from the current settings of the source table at the time of restore.
You must manually set up the following on the restored table:
  • Auto scaling policies
  • IAM policies
  • Amazon CloudWatch metrics and alarms
  • Tags
  • Stream settings
  • Time to Live (TTL) settings
  • Point in time recovery settings
Scan
Show Description The Scan operation returns one or more items and item attributes by accessing every item in a table or a secondary index. To have DynamoDB return fewer items, you can provide a FilterExpression operation. If the total number of scanned items exceeds the maximum dataset size limit of 1 MB, the scan stops and results are returned to the user as a LastEvaluatedKey value to continue the scan in a subsequent operation. The results also include the number of items exceeding the limit. A scan can result in no table data meeting the filter criteria. A single Scan operation reads up to the maximum number of items set (if using the Limit parameter) or a maximum of 1 MB of data and then apply any filtering to the results using FilterExpression. If LastEvaluatedKey is present in the response, you need to paginate the result set. For more information, see Paginating the Results in the Amazon DynamoDB Developer Guide. Scan operations proceed sequentially; however, for faster performance on a large table or secondary index, applications can request a parallel Scan operation by providing the Segment and TotalSegments parameters. For more information, see Parallel Scan in the Amazon DynamoDB Developer Guide. Scan uses eventually consistent reads when accessing the data in a table; therefore, the result set might not include the changes to data in the table immediately before the operation began. If you need a consistent copy of the data, as of the time that the Scan begins, you can set the ConsistentRead parameter to true.
TagResource
TransactGetItems
Show Description TransactGetItems is a synchronous operation that atomically retrieves multiple items from one or more tables (but not from indexes) in a single account and Region. A TransactGetItems call can contain up to 25 TransactGetItem objects, each of which contains a Get structure that specifies an item to retrieve from a table in the account and Region. A call to TransactGetItems cannot retrieve items from tables in more than one AWS account or Region. The aggregate size of the items in the transaction cannot exceed 4 MB. DynamoDB rejects the entire TransactGetItems request if any of the following is true:
  • A conflicting operation is in the process of updating an item to be read.
  • There is insufficient provisioned capacity for the transaction to be completed.
  • There is a user error, such as an invalid data format.
  • The aggregate size of the items in the transaction cannot exceed 4 MB.
TransactWriteItems
Show Description TransactWriteItems is a synchronous write operation that groups up to 25 action requests. These actions can target items in different tables, but not in different AWS accounts or Regions, and no two actions can target the same item. For example, you cannot both ConditionCheck and Update the same item. The aggregate size of the items in the transaction cannot exceed 4 MB. The actions are completed atomically so that either all of them succeed, or all of them fail. They are defined by the following objects:
  • Put  —   Initiates a PutItem operation to write a new item. This structure specifies the primary key of the item to be written, the name of the table to write it in, an optional condition expression that must be satisfied for the write to succeed, a list of the item's attributes, and a field indicating whether to retrieve the item's attributes if the condition is not met.
  • Update  —   Initiates an UpdateItem operation to update an existing item. This structure specifies the primary key of the item to be updated, the name of the table where it resides, an optional condition expression that must be satisfied for the update to succeed, an expression that defines one or more attributes to be updated, and a field indicating whether to retrieve the item's attributes if the condition is not met.
  • Delete  —   Initiates a DeleteItem operation to delete an existing item. This structure specifies the primary key of the item to be deleted, the name of the table where it resides, an optional condition expression that must be satisfied for the deletion to succeed, and a field indicating whether to retrieve the item's attributes if the condition is not met.
  • ConditionCheck  —   Applies a condition to an item that is not being modified by the transaction. This structure specifies the primary key of the item to be checked, the name of the table where it resides, a condition expression that must be satisfied for the transaction to succeed, and a field indicating whether to retrieve the item's attributes if the condition is not met.
DynamoDB rejects the entire TransactWriteItems request if any of the following is true:
  • A condition in one of the condition expressions is not met.
  • An ongoing operation is in the process of updating the same item.
  • There is insufficient provisioned capacity for the transaction to be completed.
  • An item size becomes too large (bigger than 400 KB), a local secondary index (LSI) becomes too large, or a similar validation error occurs because of changes made by the transaction.
  • The aggregate size of the items in the transaction exceeds 4 MB.
  • There is a user error, such as an invalid data format.
UntagResource
UpdateContinuousBackups
Show Description UpdateContinuousBackups enables or disables point in time recovery for the specified table. A successful UpdateContinuousBackups call returns the current ContinuousBackupsDescription. Continuous backups are ENABLED on all tables at table creation. If point in time recovery is enabled, PointInTimeRecoveryStatus will be set to ENABLED. Once continuous backups and point in time recovery are enabled, you can restore to any point in time within EarliestRestorableDateTime and LatestRestorableDateTime. LatestRestorableDateTime is typically 5 minutes before the current time. You can restore your table to any point in time during the last 35 days.
UpdateContributorInsights
Show Description Updates the status for contributor insights for a specific table or index.
UpdateGlobalTable
Show Description Adds or removes replicas in the specified global table. The global table must already exist to be able to use this operation. Any replica to be added must be empty, have the same name as the global table, have the same key schema, have DynamoDB Streams enabled, and have the same provisioned and maximum write capacity units. Although you can use UpdateGlobalTable to add replicas and remove replicas in a single request, for simplicity we recommend that you issue separate requests for adding or removing replicas. If global secondary indexes are specified, then the following conditions must also be met:
  • The global secondary indexes must have the same name.
  • The global secondary indexes must have the same hash key and sort key (if present).
  • The global secondary indexes must have the same provisioned and maximum write capacity units.
UpdateGlobalTableSettings
Show Description Updates settings for a global table.
UpdateItem
Show Description Edits an existing item's attributes, or adds a new item to the table if it does not already exist. You can put, delete, or add attribute values. You can also perform a conditional update on an existing item (insert a new attribute name-value pair if it doesn't exist, or replace an existing name-value pair if it has certain expected attribute values). You can also return the item's attribute values in the same UpdateItem operation using the ReturnValues parameter.
UpdateTable
Show Description Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table. You can only perform one of the following operations at once:
  • Modify the provisioned throughput settings of the table.
  • Enable or disable DynamoDB Streams on the table.
  • Remove a global secondary index from the table.
  • Create a new global secondary index on the table. After the index begins backfilling, you can use UpdateTable to perform other operations.
UpdateTable is an asynchronous operation; while it is executing, the table status changes from ACTIVE to UPDATING. While it is UPDATING, you cannot issue another UpdateTable request. When the table returns to the ACTIVE state, the UpdateTable operation is complete.
UpdateTableReplicaAutoScaling
Show Description Updates auto scaling settings on your global tables at once. This operation only applies to Version 2019.11.21 of global tables.

Dynamodbstreams Events

Service Event Name Description
dynamodbstreams DescribeStream
Show Description Returns information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table. You can call DescribeStream at a maximum rate of 10 times per second. Each shard in the stream has a SequenceNumberRange associated with it. If the SequenceNumberRange has a StartingSequenceNumber but no EndingSequenceNumber, then the shard is still open (able to receive more stream records). If both StartingSequenceNumber and EndingSequenceNumber are present, then that shard is closed and can no longer receive more data.
GetRecords
Show Description Retrieves the stream records from a given shard. Specify a shard iterator using the ShardIterator parameter. The shard iterator specifies the position in the shard from which you want to start reading stream records sequentially. If there are no stream records available in the portion of the shard that the iterator points to, GetRecords returns an empty list. Note that it might take multiple calls to get to a portion of the shard that contains stream records. GetRecords can retrieve a maximum of 1 MB of data or 1000 stream records, whichever comes first.
GetShardIterator
Show Description Returns a shard iterator. A shard iterator provides information about how to retrieve the stream records from within a shard. Use the shard iterator in a subsequent GetRecords request to read the stream records from the shard. A shard iterator expires 15 minutes after it is returned to the requester.

Ebs Events

Service Event Name Description
ebs CompleteSnapshot
Show Description Seals and completes the snapshot after all of the required blocks of data have been written to it. Completing the snapshot changes the status to completed. You cannot write new blocks to a snapshot after it has been completed.
GetSnapshotBlock
Show Description Returns the data in a block in an Amazon Elastic Block Store snapshot.
ListChangedBlocks
Show Description Returns information about the blocks that are different between two Amazon Elastic Block Store snapshots of the same volume/snapshot lineage.
ListSnapshotBlocks
Show Description Returns information about the blocks in an Amazon Elastic Block Store snapshot.
PutSnapshotBlock
Show Description Writes a block of data to a snapshot. If the specified block contains data, the existing data is overwritten. The target snapshot must be in the pending state. Data written to a snapshot must be aligned with 512-KiB sectors.

Ec2-instance-connect Events

Service Event Name Description
ec2-instance-connect SendSSHPublicKey
Show Description Pushes an SSH public key to the specified EC2 instance for use by the specified user. The key remains for 60 seconds. For more information, see Connect to your Linux instance using EC2 Instance Connect in the Amazon EC2 User Guide.

Ecr-public Events

Service Event Name Description
ecr-public BatchCheckLayerAvailability
Show Description Checks the availability of one or more image layers within a repository in a public registry. When an image is pushed to a repository, each image layer is checked to verify if it has been uploaded before. If it has been uploaded, then the image layer is skipped. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
BatchDeleteImage
Show Description Deletes a list of specified images within a repository in a public registry. Images are specified with either an imageTag or imageDigest. You can remove a tag from an image by specifying the image's tag in your request. When you remove the last tag from an image, the image is deleted from your repository. You can completely delete an image (and all of its tags) by specifying the image's digest in your request.
CompleteLayerUpload
Show Description Informs Amazon ECR that the image layer upload has completed for a specified public registry, repository name, and upload ID. You can optionally provide a sha256 digest of the image layer for data validation purposes. When an image is pushed, the CompleteLayerUpload API is called once per each new image layer to verify that the upload has completed. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
CreateRepository
Show Description Creates a repository in a public registry. For more information, see Amazon ECR repositories in the Amazon Elastic Container Registry User Guide.
DeleteRepository
Show Description Deletes a repository in a public registry. If the repository contains images, you must either delete all images in the repository or use the force option which deletes all images on your behalf before deleting the repository.
DeleteRepositoryPolicy
Show Description Deletes the repository policy associated with the specified repository.
DescribeImageTags
Show Description Returns the image tag details for a repository in a public registry.
DescribeImages
Show Description Returns metadata about the images in a repository in a public registry. Beginning with Docker version 1.9, the Docker client compresses image layers before pushing them to a V2 Docker registry. The output of the docker images command shows the uncompressed image size, so it may return a larger image size than the image sizes returned by DescribeImages.
DescribeRegistries
Show Description Returns details for a public registry.
DescribeRepositories
Show Description Describes repositories in a public registry.
GetAuthorizationToken
Show Description Retrieves an authorization token. An authorization token represents your IAM authentication credentials and can be used to access any Amazon ECR registry that your IAM principal has access to. The authorization token is valid for 12 hours. This API requires the ecr-public:GetAuthorizationToken and sts:GetServiceBearerToken permissions.
GetRegistryCatalogData
Show Description Retrieves catalog metadata for a public registry.
GetRepositoryCatalogData
Show Description Retrieve catalog metadata for a repository in a public registry. This metadata is displayed publicly in the Amazon ECR Public Gallery.
GetRepositoryPolicy
Show Description Retrieves the repository policy for the specified repository.
InitiateLayerUpload
Show Description Notifies Amazon ECR that you intend to upload an image layer. When an image is pushed, the InitiateLayerUpload API is called once per image layer that has not already been uploaded. Whether or not an image layer has been uploaded is determined by the BatchCheckLayerAvailability API action. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
ListTagsForResource
Show Description List the tags for an Amazon ECR Public resource.
PutImage
Show Description Creates or updates the image manifest and tags associated with an image. When an image is pushed and all new image layers have been uploaded, the PutImage API is called once to create or update the image manifest and the tags associated with the image. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
PutRegistryCatalogData
Show Description Create or updates the catalog data for a public registry.
PutRepositoryCatalogData
Show Description Creates or updates the catalog data for a repository in a public registry.
SetRepositoryPolicy
Show Description Applies a repository policy to the specified public repository to control access permissions. For more information, see Amazon ECR Repository Policies in the Amazon Elastic Container Registry User Guide.
TagResource
Show Description Associates the specified tags to a resource with the specified resourceArn. If existing tags on a resource are not specified in the request parameters, they are not changed. When a resource is deleted, the tags associated with that resource are deleted as well.
UntagResource
Show Description Deletes specified tags from a resource.

Ecr Events

Service Event Name Description
ecr BatchCheckLayerAvailability
Show Description Checks the availability of one or more image layers in a repository. When an image is pushed to a repository, each image layer is checked to verify if it has been uploaded before. If it has been uploaded, then the image layer is skipped. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
BatchDeleteImage
Show Description Deletes a list of specified images within a repository. Images are specified with either an imageTag or imageDigest. You can remove a tag from an image by specifying the image's tag in your request. When you remove the last tag from an image, the image is deleted from your repository. You can completely delete an image (and all of its tags) by specifying the image's digest in your request.
BatchGetImage
Show Description Gets detailed information for an image. Images are specified with either an imageTag or imageDigest. When an image is pulled, the BatchGetImage API is called once to retrieve the image manifest.
CompleteLayerUpload
Show Description Informs Amazon ECR that the image layer upload has completed for a specified registry, repository name, and upload ID. You can optionally provide a sha256 digest of the image layer for data validation purposes. When an image is pushed, the CompleteLayerUpload API is called once per each new image layer to verify that the upload has completed. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
CreateRepository
Show Description Creates a repository. For more information, see Amazon ECR repositories in the Amazon Elastic Container Registry User Guide.
DeleteLifecyclePolicy
Show Description Deletes the lifecycle policy associated with the specified repository.
DeleteRegistryPolicy
Show Description Deletes the registry permissions policy.
DeleteRepository
Show Description Deletes a repository. If the repository contains images, you must either delete all images in the repository or use the force option to delete the repository.
DeleteRepositoryPolicy
Show Description Deletes the repository policy associated with the specified repository.
DescribeImageReplicationStatus
Show Description Returns the replication status for a specified image.
DescribeImageScanFindings
Show Description Returns the scan findings for the specified image.
DescribeImages
Show Description Returns metadata about the images in a repository. Beginning with Docker version 1.9, the Docker client compresses image layers before pushing them to a V2 Docker registry. The output of the docker images command shows the uncompressed image size, so it may return a larger image size than the image sizes returned by DescribeImages.
DescribeRegistry
Show Description Describes the settings for a registry. The replication configuration for a repository can be created or updated with the PutReplicationConfiguration API action.
DescribeRepositories
Show Description Describes image repositories in a registry.
GetAuthorizationToken
Show Description Retrieves an authorization token. An authorization token represents your IAM authentication credentials and can be used to access any Amazon ECR registry that your IAM principal has access to. The authorization token is valid for 12 hours. The authorizationToken returned is a base64 encoded string that can be decoded and used in a docker login command to authenticate to a registry. The CLI offers an get-login-password command that simplifies the login process. For more information, see Registry authentication in the Amazon Elastic Container Registry User Guide.
GetDownloadUrlForLayer
Show Description Retrieves the pre-signed Amazon S3 download URL corresponding to an image layer. You can only get URLs for image layers that are referenced in an image. When an image is pulled, the GetDownloadUrlForLayer API is called once per image layer that is not already cached. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
GetLifecyclePolicy
Show Description Retrieves the lifecycle policy for the specified repository.
GetLifecyclePolicyPreview
Show Description Retrieves the results of the lifecycle policy preview request for the specified repository.
GetRegistryPolicy
Show Description Retrieves the permissions policy for a registry.
GetRepositoryPolicy
Show Description Retrieves the repository policy for the specified repository.
InitiateLayerUpload
Show Description Notifies Amazon ECR that you intend to upload an image layer. When an image is pushed, the InitiateLayerUpload API is called once per image layer that has not already been uploaded. Whether or not an image layer has been uploaded is determined by the BatchCheckLayerAvailability API action. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
ListImages
Show Description Lists all the image IDs for the specified repository. You can filter images based on whether or not they are tagged by using the tagStatus filter and specifying either TAGGED, UNTAGGED or ANY. For example, you can filter your results to return only UNTAGGED images and then pipe that result to a BatchDeleteImage operation to delete them. Or, you can filter your results to return only TAGGED images to list all of the tags in your repository.
ListTagsForResource
Show Description List the tags for an Amazon ECR resource.
PutImage
Show Description Creates or updates the image manifest and tags associated with an image. When an image is pushed and all new image layers have been uploaded, the PutImage API is called once to create or update the image manifest and the tags associated with the image. This operation is used by the Amazon ECR proxy and is not generally used by customers for pulling and pushing images. In most cases, you should use the docker CLI to pull, tag, and push images.
PutImageScanningConfiguration
Show Description Updates the image scanning configuration for the specified repository.
PutImageTagMutability
Show Description Updates the image tag mutability settings for the specified repository. For more information, see Image tag mutability in the Amazon Elastic Container Registry User Guide.
PutLifecyclePolicy
Show Description Creates or updates the lifecycle policy for the specified repository. For more information, see Lifecycle policy template.
PutRegistryPolicy
Show Description Creates or updates the permissions policy for your registry. A registry policy is used to specify permissions for another Amazon Web Services account and is used when configuring cross-account replication. For more information, see Registry permissions in the Amazon Elastic Container Registry User Guide.
PutReplicationConfiguration
Show Description Creates or updates the replication configuration for a registry. The existing replication configuration for a repository can be retrieved with the DescribeRegistry API action. The first time the PutReplicationConfiguration API is called, a service-linked IAM role is created in your account for the replication process. For more information, see Using service-linked roles for Amazon ECR in the Amazon Elastic Container Registry User Guide. When configuring cross-account replication, the destination account must grant the source account permission to replicate. This permission is controlled using a registry permissions policy. For more information, see PutRegistryPolicy.
SetRepositoryPolicy
Show Description Applies a repository policy to the specified repository to control access permissions. For more information, see Amazon ECR Repository policies in the Amazon Elastic Container Registry User Guide.
StartImageScan
Show Description Starts an image vulnerability scan. An image scan can only be started once per 24 hours on an individual image. This limit includes if an image was scanned on initial push. For more information, see Image scanning in the Amazon Elastic Container Registry User Guide.
StartLifecyclePolicyPreview
Show Description Starts a preview of a lifecycle policy for the specified repository. This allows you to see the results before associating the lifecycle policy with the repository.
TagResource
Show Description Adds specified tags to a resource with the specified ARN. Existing tags on a resource are not changed if they are not specified in the request parameters.
UntagResource
Show Description Deletes specified tags from a resource.

Ecs Events

Service Event Name Description
ecs CreateCapacityProvider
Show Description Creates a new capacity provider. Capacity providers are associated with an Amazon ECS cluster and are used in capacity provider strategies to facilitate cluster auto scaling. Only capacity providers using an Auto Scaling group can be created. Amazon ECS tasks on Fargate use the FARGATE and FARGATE_SPOT capacity providers which are already created and available to all accounts in Regions supported by Fargate.
CreateCluster
Show Description Creates a new Amazon ECS cluster. By default, your account receives a default cluster when you launch your first container instance. However, you can create your own cluster with a unique name with the CreateCluster action. When you call the CreateCluster API operation, Amazon ECS attempts to create the Amazon ECS service-linked role for your account so that required resources in other Amazon Web Services services can be managed on your behalf. However, if the IAM user that makes the call does not have permissions to create the service-linked role, it is not created. For more information, see Using Service-Linked Roles for Amazon ECS in the Amazon Elastic Container Service Developer Guide.
CreateService
Show Description Runs and maintains a desired number of tasks from a specified task definition. If the number of tasks running in a service drops below the desiredCount, Amazon ECS runs another copy of the task in the specified cluster. To update an existing service, see the UpdateService action. In addition to maintaining the desired count of tasks in your service, you can optionally run your service behind one or more load balancers. The load balancers distribute traffic across the tasks that are associated with the service. For more information, see Service Load Balancing in the Amazon Elastic Container Service Developer Guide. Tasks for services that do not use a load balancer are considered healthy if they're in the RUNNING state. Tasks for services that do use a load balancer are considered healthy if they're in the RUNNING state and the container instance that they're hosted on is reported as healthy by the load balancer. There are two service scheduler strategies available:
  • REPLICA - The replica scheduling strategy places and maintains the desired number of tasks across your cluster. By default, the service scheduler spreads tasks across Availability Zones. You can use task placement strategies and constraints to customize task placement decisions. For more information, see Service Scheduler Concepts in the Amazon Elastic Container Service Developer Guide.
  • DAEMON - The daemon scheduling strategy deploys exactly one task on each active container instance that meets all of the task placement constraints that you specify in your cluster. The service scheduler also evaluates the task placement constraints for running tasks and will stop tasks that do not meet the placement constraints. When using this strategy, you don't need to specify a desired number of tasks, a task placement strategy, or use Service Auto Scaling policies. For more information, see Service Scheduler Concepts in the Amazon Elastic Container Service Developer Guide.
You can optionally specify a deployment configuration for your service. The deployment is triggered by changing properties, such as the task definition or the desired count of a service, with an UpdateService operation. The default value for a replica service for minimumHealthyPercent is 100%. The default value for a daemon service for minimumHealthyPercent is 0%. If a service is using the ECS deployment controller, the minimum healthy percent represents a lower limit on the number of tasks in a service that must remain in the RUNNING state during a deployment, as a percentage of the desired number of tasks (rounded up to the nearest integer), and while any container instances are in the DRAINING state if the service contains tasks using the EC2 launch type. This parameter enables you to deploy without using additional cluster capacity. For example, if your service has a desired number of four tasks and a minimum healthy percent of 50%, the scheduler might stop two existing tasks to free up cluster capacity before starting two new tasks. Tasks for services that do not use a load balancer are considered healthy if they're in the RUNNING state. Tasks for services that do use a load balancer are considered healthy if they're in the RUNNING state and they're reported as healthy by the load balancer. The default value for minimum healthy percent is 100%. If a service is using the ECS deployment controller, the maximum percent parameter represents an upper limit on the number of tasks in a service that are allowed in the RUNNING or PENDING state during a deployment, as a percentage of the desired number of tasks (rounded down to the nearest integer), and while any container instances are in the DRAINING state if the service contains tasks using the EC2 launch type. This parameter enables you to define the deployment batch size. For example, if your service has a desired number of four tasks and a maximum percent value of 200%, the scheduler may start four new tasks before stopping the four older tasks (provided that the cluster resources required to do this are available). The default value for maximum percent is 200%. If a service is using either the CODE_DEPLOY or EXTERNAL deployment controller types and tasks that use the EC2 launch type, the minimum healthy percent and maximum percent values are used only to define the lower and upper limit on the number of the tasks in the service that remain in the RUNNING state while the container instances are in the DRAINING state. If the tasks in the service use the Fargate launch type, the minimum healthy percent and maximum percent values aren't used, although they're currently visible when describing your service. When creating a service that uses the EXTERNAL deployment controller, you can specify only parameters that aren't controlled at the task set level. The only required parameter is the service name. You control your services using the CreateTaskSet operation. For more information, see Amazon ECS Deployment Types in the Amazon Elastic Container Service Developer Guide. When the service scheduler launches new tasks, it determines task placement in your cluster using the following logic:
  • Determine which of the container instances in your cluster can support your service's task definition (for example, they have the required CPU, memory, ports, and container instance attributes).
  • By default, the service scheduler attempts to balance tasks across Availability Zones in this manner (although you can choose a different placement strategy) with the placementStrategy parameter):
    • Sort the valid container instances, giving priority to instances that have the fewest number of running tasks for this service in their respective Availability Zone. For example, if zone A has one running service task and zones B and C each have zero, valid container instances in either zone B or C are considered optimal for placement.
    • Place the new service task on a valid container instance in an optimal Availability Zone (based on the previous steps), favoring container instances with the fewest number of running tasks for this service.
CreateTaskSet
Show Description Create a task set in the specified cluster and service. This is used when a service uses the EXTERNAL deployment controller type. For more information, see Amazon ECS Deployment Types in the Amazon Elastic Container Service Developer Guide.
DeleteAccountSetting
Show Description Disables an account setting for a specified IAM user, IAM role, or the root user for an account.
DeleteAttributes
Show Description Deletes one or more custom attributes from an Amazon ECS resource.
DeleteCapacityProvider
Show Description Deletes the specified capacity provider. The FARGATE and FARGATE_SPOT capacity providers are reserved and cannot be deleted. You can disassociate them from a cluster using either the PutClusterCapacityProviders API or by deleting the cluster. Prior to a capacity provider being deleted, the capacity provider must be removed from the capacity provider strategy from all services. The UpdateService API can be used to remove a capacity provider from a service's capacity provider strategy. When updating a service, the forceNewDeployment option can be used to ensure that any tasks using the Amazon EC2 instance capacity provided by the capacity provider are transitioned to use the capacity from the remaining capacity providers. Only capacity providers that are not associated with a cluster can be deleted. To remove a capacity provider from a cluster, you can either use PutClusterCapacityProviders or delete the cluster.
DeleteCluster
Show Description Deletes the specified cluster. The cluster will transition to the INACTIVE state. Clusters with an INACTIVE status may remain discoverable in your account for a period of time. However, this behavior is subject to change in the future, so you should not rely on INACTIVE clusters persisting. You must deregister all container instances from this cluster before you may delete it. You can list the container instances in a cluster with ListContainerInstances and deregister them with DeregisterContainerInstance.
DeleteService
Show Description Deletes a specified service within a cluster. You can delete a service if you have no running tasks in it and the desired task count is zero. If the service is actively maintaining tasks, you cannot delete it, and you must update the service to a desired task count of zero. For more information, see UpdateService. When you delete a service, if there are still running tasks that require cleanup, the service status moves from ACTIVE to DRAINING, and the service is no longer visible in the console or in the ListServices API operation. After all tasks have transitioned to either STOPPING or STOPPED status, the service status moves from DRAINING to INACTIVE. Services in the DRAINING or INACTIVE status can still be viewed with the DescribeServices API operation. However, in the future, INACTIVE services may be cleaned up and purged from Amazon ECS record keeping, and DescribeServices calls on those services return a ServiceNotFoundException error. If you attempt to create a new service with the same name as an existing service in either ACTIVE or DRAINING status, you receive an error.
DeleteTaskSet
Show Description Deletes a specified task set within a service. This is used when a service uses the EXTERNAL deployment controller type. For more information, see Amazon ECS Deployment Types in the Amazon Elastic Container Service Developer Guide.
DeregisterContainerInstance
Show Description Deregisters an Amazon ECS container instance from the specified cluster. This instance is no longer available to run tasks. If you intend to use the container instance for some other purpose after deregistration, you should stop all of the tasks running on the container instance before deregistration. That prevents any orphaned tasks from consuming resources. Deregistering a container instance removes the instance from a cluster, but it does not terminate the EC2 instance. If you are finished using the instance, be sure to terminate it in the Amazon EC2 console to stop billing. If you terminate a running container instance, Amazon ECS automatically deregisters the instance from your cluster (stopped container instances or instances with disconnected agents are not automatically deregistered when terminated).
DeregisterTaskDefinition
Show Description Deregisters the specified task definition by family and revision. Upon deregistration, the task definition is marked as INACTIVE. Existing tasks and services that reference an INACTIVE task definition continue to run without disruption. Existing services that reference an INACTIVE task definition can still scale up or down by modifying the service's desired count. You cannot use an INACTIVE task definition to run new tasks or create new services, and you cannot update an existing service to reference an INACTIVE task definition. However, there may be up to a 10-minute window following deregistration where these restrictions have not yet taken effect. At this time, INACTIVE task definitions remain discoverable in your account indefinitely. However, this behavior is subject to change in the future, so you should not rely on INACTIVE task definitions persisting beyond the lifecycle of any associated tasks and services.
DescribeCapacityProviders
Show Description Describes one or more of your capacity providers.
DescribeClusters
Show Description Describes one or more of your clusters.
DescribeContainerInstances
Show Description Describes one or more container instances. Returns metadata about each container instance requested.
DescribeServices
Show Description Describes the specified services running in your cluster.
DescribeTaskDefinition
Show Description Describes a task definition. You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family. You can only describe INACTIVE task definitions while an active task or service references them.
DescribeTaskSets
Show Description Describes the task sets in the specified cluster and service. This is used when a service uses the EXTERNAL deployment controller type. For more information, see Amazon ECS Deployment Types in the Amazon Elastic Container Service Developer Guide.
DescribeTasks
Show Description Describes a specified task or tasks.
DiscoverPollEndpoint
Show Description This action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent. Returns an endpoint for the Amazon ECS agent to poll for updates.
ExecuteCommand
Show Description Runs a command remotely on a container within a task.
ListAccountSettings
Show Description Lists the account settings for a specified principal.
ListAttributes
Show Description Lists the attributes for Amazon ECS resources within a specified target type and cluster. When you specify a target type and cluster, ListAttributes returns a list of attribute objects, one for each attribute on each resource. You can filter the list of results to a single attribute name to only return results that have that name. You can also filter the results by attribute name and value, for example, to see which container instances in a cluster are running a Linux AMI (ecs.os-type=linux).
ListClusters
Show Description Returns a list of existing clusters.
ListContainerInstances
Show Description Returns a list of container instances in a specified cluster. You can filter the results of a ListContainerInstances operation with cluster query language statements inside the filter parameter. For more information, see Cluster Query Language in the Amazon Elastic Container Service Developer Guide.
ListServices
Show Description Returns a list of services. You can filter the results by cluster, launch type, and scheduling strategy.
ListTagsForResource
Show Description List the tags for an Amazon ECS resource.
ListTaskDefinitionFamilies
Show Description Returns a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definition revisions). You can filter out task definition families that do not contain any ACTIVE task definition revisions by setting the status parameter to ACTIVE. You can also filter the results with the familyPrefix parameter.
ListTaskDefinitions
Show Description Returns a list of task definitions that are registered to your account. You can filter the results by family name with the familyPrefix parameter or by status with the status parameter.
ListTasks
Show Description Returns a list of tasks. You can filter the results by cluster, task definition family, container instance, launch type, what IAM principal started the task, or by the desired status of the task. Recently stopped tasks might appear in the returned results. Currently, stopped tasks appear in the returned results for at least one hour.
PutAccountSetting
Show Description Modifies an account setting. Account settings are set on a per-Region basis. If you change the account setting for the root user, the default settings for all of the IAM users and roles for which no individual account setting has been specified are reset. For more information, see Account Settings in the Amazon Elastic Container Service Developer Guide. When serviceLongArnFormat, taskLongArnFormat, or containerInstanceLongArnFormat are specified, the Amazon Resource Name (ARN) and resource ID format of the resource type for a specified IAM user, IAM role, or the root user for an account is affected. The opt-in and opt-out account setting must be set for each Amazon ECS resource separately. The ARN and resource ID format of a resource will be defined by the opt-in status of the IAM user or role that created the resource. You must enable this setting to use Amazon ECS features such as resource tagging. When awsvpcTrunking is specified, the elastic network interface (ENI) limit for any new container instances that support the feature is changed. If awsvpcTrunking is enabled, any new container instances that support the feature are launched have the increased ENI limits available to them. For more information, see Elastic Network Interface Trunking in the Amazon Elastic Container Service Developer Guide. When containerInsights is specified, the default setting indicating whether CloudWatch Container Insights is enabled for your clusters is changed. If containerInsights is enabled, any new clusters that are created will have Container Insights enabled unless you disable it during cluster creation. For more information, see CloudWatch Container Insights in the Amazon Elastic Container Service Developer Guide.
PutAccountSettingDefault
Show Description Modifies an account setting for all IAM users on an account for whom no individual account setting has been specified. Account settings are set on a per-Region basis.
PutAttributes
Show Description Create or update an attribute on an Amazon ECS resource. If the attribute does not exist, it is created. If the attribute exists, its value is replaced with the specified value. To delete an attribute, use DeleteAttributes. For more information, see Attributes in the Amazon Elastic Container Service Developer Guide.
PutClusterCapacityProviders
Show Description Modifies the available capacity providers and the default capacity provider strategy for a cluster. You must specify both the available capacity providers and a default capacity provider strategy for the cluster. If the specified cluster has existing capacity providers associated with it, you must specify all existing capacity providers in addition to any new ones you want to add. Any existing capacity providers associated with a cluster that are omitted from a PutClusterCapacityProviders API call will be disassociated with the cluster. You can only disassociate an existing capacity provider from a cluster if it's not being used by any existing tasks. When creating a service or running a task on a cluster, if no capacity provider or launch type is specified, then the cluster's default capacity provider strategy is used. It is recommended to define a default capacity provider strategy for your cluster, however you may specify an empty array ([]) to bypass defining a default strategy.
RegisterContainerInstance
Show Description This action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent. Registers an EC2 instance into the specified cluster. This instance becomes available to place containers on.
RegisterTaskDefinition
Show Description Registers a new task definition from the supplied family and containerDefinitions. Optionally, you can add data volumes to your containers with the volumes parameter. For more information about task definition parameters and defaults, see Amazon ECS Task Definitions in the Amazon Elastic Container Service Developer Guide. You can specify an IAM role for your task with the taskRoleArn parameter. When you specify an IAM role for a task, its containers can then use the latest versions of the CLI or SDKs to make API requests to the Amazon Web Services services that are specified in the IAM policy associated with the role. For more information, see IAM Roles for Tasks in the Amazon Elastic Container Service Developer Guide. You can specify a Docker networking mode for the containers in your task definition with the networkMode parameter. The available network modes correspond to those described in Network settings in the Docker run reference. If you specify the awsvpc network mode, the task is allocated an elastic network interface, and you must specify a NetworkConfiguration when you create a service or run a task with the task definition. For more information, see Task Networking in the Amazon Elastic Container Service Developer Guide.
RunTask
Show Description Starts a new task using the specified task definition. You can allow Amazon ECS to place tasks for you, or you can customize how Amazon ECS places tasks using placement constraints and placement strategies. For more information, see Scheduling Tasks in the Amazon Elastic Container Service Developer Guide. Alternatively, you can use StartTask to use your own scheduler or place tasks manually on specific container instances. The Amazon ECS API follows an eventual consistency model, due to the distributed nature of the system supporting the API. This means that the result of an API command you run that affects your Amazon ECS resources might not be immediately visible to all subsequent commands you run. Keep this in mind when you carry out an API command that immediately follows a previous API command. To manage eventual consistency, you can do the following:
  • Confirm the state of the resource before you run a command to modify it. Run the DescribeTasks command using an exponential backoff algorithm to ensure that you allow enough time for the previous command to propagate through the system. To do this, run the DescribeTasks command repeatedly, starting with a couple of seconds of wait time and increasing gradually up to five minutes of wait time.
  • Add wait time between subsequent commands, even if the DescribeTasks command returns an accurate response. Apply an exponential backoff algorithm starting with a couple of seconds of wait time, and increase gradually up to about five minutes of wait time.
StartTask
Show Description Starts a new task from the specified task definition on the specified container instance or instances. Alternatively, you can use RunTask to place tasks for you. For more information, see Scheduling Tasks in the Amazon Elastic Container Service Developer Guide.
StopTask
Show Description Stops a running task. Any tags associated with the task will be deleted. When StopTask is called on a task, the equivalent of docker stop is issued to the containers running in the task. This results in a SIGTERM value and a default 30-second timeout, after which the SIGKILL value is sent and the containers are forcibly stopped. If the container handles the SIGTERM value gracefully and exits within 30 seconds from receiving it, no SIGKILL value is sent. The default 30-second timeout can be configured on the Amazon ECS container agent with the ECS_CONTAINER_STOP_TIMEOUT variable. For more information, see Amazon ECS Container Agent Configuration in the Amazon Elastic Container Service Developer Guide.
SubmitAttachmentStateChanges
Show Description This action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent. Sent to acknowledge that an attachment changed states.
SubmitContainerStateChange
Show Description This action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent. Sent to acknowledge that a container changed states.
SubmitTaskStateChange
Show Description This action is only used by the Amazon ECS agent, and it is not intended for use outside of the agent. Sent to acknowledge that a task changed states.
TagResource
Show Description Associates the specified tags to a resource with the specified resourceArn. If existing tags on a resource are not specified in the request parameters, they are not changed. When a resource is deleted, the tags associated with that resource are deleted as well.
UntagResource
Show Description Deletes specified tags from a resource.
UpdateCapacityProvider
Show Description Modifies the parameters for a capacity provider.
UpdateCluster
Show Description Updates the cluster.
UpdateClusterSettings
Show Description Modifies the settings to use for a cluster.
UpdateContainerAgent
Show Description Updates the Amazon ECS container agent on a specified container instance. Updating the Amazon ECS container agent does not interrupt running tasks or services on the container instance. The process for updating the agent differs depending on whether your container instance was launched with the Amazon ECS-optimized AMI or another operating system. The UpdateContainerAgent API isn't supported for container instances using the Amazon ECS-optimized Amazon Linux 2 (arm64) AMI. To update the container agent, you can update the ecs-init package which will update the agent. For more information, see Updating the Amazon ECS container agent in the Amazon Elastic Container Service Developer Guide. The UpdateContainerAgent API requires an Amazon ECS-optimized AMI or Amazon Linux AMI with the ecs-init service installed and running. For help updating the Amazon ECS container agent on other operating systems, see Manually updating the Amazon ECS container agent in the Amazon Elastic Container Service Developer Guide.
UpdateContainerInstancesState
Show Description Modifies the status of an Amazon ECS container instance. Once a container instance has reached an ACTIVE state, you can change the status of a container instance to DRAINING to manually remove an instance from a cluster, for example to perform system updates, update the Docker daemon, or scale down the cluster size. A container instance cannot be changed to DRAINING until it has reached an ACTIVE status. If the instance is in any other status, an error will be received. When you set a container instance to DRAINING, Amazon ECS prevents new tasks from being scheduled for placement on the container instance and replacement service tasks are started on other container instances in the cluster if the resources are available. Service tasks on the container instance that are in the PENDING state are stopped immediately. Service tasks on the container instance that are in the RUNNING state are stopped and replaced according to the service's deployment configuration parameters, minimumHealthyPercent and maximumPercent. You can change the deployment configuration of your service using UpdateService.
  • If minimumHealthyPercent is below 100%, the scheduler can ignore desiredCount temporarily during task replacement. For example, desiredCount is four tasks, a minimum of 50% allows the scheduler to stop two existing tasks before starting two new tasks. If the minimum is 100%, the service scheduler can't remove existing tasks until the replacement tasks are considered healthy. Tasks for services that do not use a load balancer are considered healthy if they are in the RUNNING state. Tasks for services that use a load balancer are considered healthy if they are in the RUNNING state and the container instance they are hosted on is reported as healthy by the load balancer.
  • The maximumPercent parameter represents an upper limit on the number of running tasks during task replacement, which enables you to define the replacement batch size. For example, if desiredCount is four tasks, a maximum of 200% starts four new tasks before stopping the four tasks to be drained, provided that the cluster resources required to do this are available. If the maximum is 100%, then replacement tasks can't start until the draining tasks have stopped.
Any PENDING or RUNNING tasks that do not belong to a service are not affected. You must wait for them to finish or stop them manually. A container instance has completed draining when it has no more RUNNING tasks. You can verify this using ListTasks. When a container instance has been drained, you can set a container instance to ACTIVE status and once it has reached that status the Amazon ECS scheduler can begin scheduling tasks on the instance again.
UpdateService
Show Description Updating the task placement strategies and constraints on an Amazon ECS service remains in preview and is a Beta Service as defined by and subject to the Beta Service Participation Service Terms located at https://aws.amazon.com/service-terms ("Beta Terms"). These Beta Terms apply to your participation in this preview. Modifies the parameters of a service. For services using the rolling update (ECS) deployment controller, the desired count, deployment configuration, network configuration, task placement constraints and strategies, or task definition used can be updated. For services using the blue/green (CODE_DEPLOY) deployment controller, only the desired count, deployment configuration, task placement constraints and strategies, and health check grace period can be updated using this API. If the network configuration, platform version, or task definition need to be updated, a new CodeDeploy deployment should be created. For more information, see CreateDeployment in the CodeDeploy API Reference. For services using an external deployment controller, you can update only the desired count, task placement constraints and strategies, and health check grace period using this API. If the launch type, load balancer, network configuration, platform version, or task definition need to be updated, you should create a new task set. For more information, see CreateTaskSet. You can add to or subtract from the number of instantiations of a task definition in a service by specifying the cluster that the service is running in and a new desiredCount parameter. If you have updated the Docker image of your application, you can create a new task definition with that image and deploy it to your service. The service scheduler uses the minimum healthy percent and maximum percent parameters (in the service's deployment configuration) to determine the deployment strategy. If your updated Docker image uses the same tag as what is in the existing task definition for your service (for example, my_image:latest), you do not need to create a new revision of your task definition. You can update the service using the forceNewDeployment option. The new tasks launched by the deployment pull the current image/tag combination from your repository when they start. You can also update the deployment configuration of a service. When a deployment is triggered by updating the task definition of a service, the service scheduler uses the deployment configuration parameters, minimumHealthyPercent and maximumPercent, to determine the deployment strategy.
  • If minimumHealthyPercent is below 100%, the scheduler can ignore desiredCount temporarily during a deployment. For example, if desiredCount is four tasks, a minimum of 50% allows the scheduler to stop two existing tasks before starting two new tasks. Tasks for services that do not use a load balancer are considered healthy if they are in the RUNNING state. Tasks for services that use a load balancer are considered healthy if they are in the RUNNING state and the container instance they are hosted on is reported as healthy by the load balancer.
  • The maximumPercent parameter represents an upper limit on the number of running tasks during a deployment, which enables you to define the deployment batch size. For example, if desiredCount is four tasks, a maximum of 200% starts four new tasks before stopping the four older tasks (provided that the cluster resources required to do this are available).
When UpdateService stops a task during a deployment, the equivalent of docker stop is issued to the containers running in the task. This results in a SIGTERM and a 30-second timeout, after which SIGKILL is sent and the containers are forcibly stopped. If the container handles the SIGTERM gracefully and exits within 30 seconds from receiving it, no SIGKILL is sent. When the service scheduler launches new tasks, it determines task placement in your cluster with the following logic:
  • Determine which of the container instances in your cluster can support your service's task definition (for example, they have the required CPU, memory, ports, and container instance attributes).
  • By default, the service scheduler attempts to balance tasks across Availability Zones in this manner (although you can choose a different placement strategy):
    • Sort the valid container instances by the fewest number of running tasks for this service in the same Availability Zone as the instance. For example, if zone A has one running service task and zones B and C each have zero, valid container instances in either zone B or C are considered optimal for placement.
    • Place the new service task on a valid container instance in an optimal Availability Zone (based on the previous steps), favoring container instances with the fewest number of running tasks for this service.
When the service scheduler stops running tasks, it attempts to maintain balance across the Availability Zones in your cluster using the following logic:
  • Sort the container instances by the largest number of running tasks for this service in the same Availability Zone as the instance. For example, if zone A has one running service task and zones B and C each have two, container instances in either zone B or C are considered optimal for termination.
  • Stop the task on a container instance in an optimal Availability Zone (based on the previous steps), favoring container instances with the largest number of running tasks for this service.
UpdateServicePrimaryTaskSet
Show Description Modifies which task set in a service is the primary task set. Any parameters that are updated on the primary task set in a service will transition to the service. This is used when a service uses the EXTERNAL deployment controller type. For more information, see Amazon ECS Deployment Types in the Amazon Elastic Container Service Developer Guide.

Eks Events

Service Event Name Description
eks AssociateEncryptionConfig
Show Description Associate encryption configuration to an existing cluster. You can use this API to enable encryption on existing clusters which do not have encryption already enabled. This allows you to implement a defense-in-depth security strategy without migrating applications to new Amazon EKS clusters.
AssociateIdentityProviderConfig
Show Description Associate an identity provider configuration to a cluster. If you want to authenticate identities using an identity provider, you can create an identity provider configuration and associate it to your cluster. After configuring authentication to your cluster you can create Kubernetes roles and clusterroles to assign permissions to the roles, and then bind the roles to the identities using Kubernetes rolebindings and clusterrolebindings. For more information see Using RBAC Authorization in the Kubernetes documentation.
CreateAddon
Show Description Creates an Amazon EKS add-on. Amazon EKS add-ons help to automate the provisioning and lifecycle management of common operational software for Amazon EKS clusters. Amazon EKS add-ons can only be used with Amazon EKS clusters running version 1.18 with platform version eks.3 or later because add-ons rely on the Server-side Apply Kubernetes feature, which is only available in Kubernetes 1.18 and later.
CreateCluster
Show Description Creates an Amazon EKS control plane. The Amazon EKS control plane consists of control plane instances that run the Kubernetes software, such as etcd and the API server. The control plane runs in an account managed by Amazon Web Services, and the Kubernetes API is exposed via the Amazon EKS API server endpoint. Each Amazon EKS cluster control plane is single-tenant and unique and runs on its own set of Amazon EC2 instances. The cluster control plane is provisioned across multiple Availability Zones and fronted by an Elastic Load Balancing Network Load Balancer. Amazon EKS also provisions elastic network interfaces in your VPC subnets to provide connectivity from the control plane instances to the nodes (for example, to support kubectl exec, logs, and proxy data flows). Amazon EKS nodes run in your Amazon Web Services account and connect to your cluster's control plane via the Kubernetes API server endpoint and a certificate file that is created for your cluster. Cluster creation typically takes several minutes. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch nodes into your cluster. For more information, see Managing Cluster Authentication and Launching Amazon EKS nodes in the Amazon EKS User Guide.
CreateFargateProfile
Show Description Creates an Fargate profile for your Amazon EKS cluster. You must have at least one Fargate profile in a cluster to be able to run pods on Fargate. The Fargate profile allows an administrator to declare which pods run on Fargate and specify which pods run on which Fargate profile. This declaration is done through the profile’s selectors. Each profile can have up to five selectors that contain a namespace and labels. A namespace is required for every selector. The label field consists of multiple optional key-value pairs. Pods that match the selectors are scheduled on Fargate. If a to-be-scheduled pod matches any of the selectors in the Fargate profile, then that pod is run on Fargate. When you create a Fargate profile, you must specify a pod execution role to use with the pods that are scheduled with the profile. This role is added to the cluster's Kubernetes Role Based Access Control (RBAC) for authorization so that the kubelet that is running on the Fargate infrastructure can register with your Amazon EKS cluster so that it can appear in your cluster as a node. The pod execution role also provides IAM permissions to the Fargate infrastructure to allow read access to Amazon ECR image repositories. For more information, see Pod Execution Role in the Amazon EKS User Guide. Fargate profiles are immutable. However, you can create a new updated profile to replace an existing profile and then delete the original after the updated profile has finished creating. If any Fargate profiles in a cluster are in the DELETING status, you must wait for that Fargate profile to finish deleting before you can create any other profiles in that cluster. For more information, see Fargate Profile in the Amazon EKS User Guide.
CreateNodegroup
Show Description Creates a managed node group for an Amazon EKS cluster. You can only create a node group for your cluster that is equal to the current Kubernetes version for the cluster. All node groups are created with the latest AMI release version for the respective minor Kubernetes version of the cluster, unless you deploy a custom AMI using a launch template. For more information about using launch templates, see Launch template support. An Amazon EKS managed node group is an Amazon EC2 Auto Scaling group and associated Amazon EC2 instances that are managed by Amazon Web Services for an Amazon EKS cluster. Each node group uses a version of the Amazon EKS optimized Amazon Linux 2 AMI. For more information, see Managed Node Groups in the Amazon EKS User Guide.
DeleteAddon
Show Description Delete an Amazon EKS add-on. When you remove the add-on, it will also be deleted from the cluster. You can always manually start an add-on on the cluster using the Kubernetes API.
DeleteCluster
Show Description Deletes the Amazon EKS cluster control plane. If you have active services in your cluster that are associated with a load balancer, you must delete those services before deleting the cluster so that the load balancers are deleted properly. Otherwise, you can have orphaned resources in your VPC that prevent you from being able to delete the VPC. For more information, see Deleting a Cluster in the Amazon EKS User Guide. If you have managed node groups or Fargate profiles attached to the cluster, you must delete them first. For more information, see DeleteNodegroup and DeleteFargateProfile.
DeleteFargateProfile
Show Description Deletes an Fargate profile. When you delete a Fargate profile, any pods running on Fargate that were created with the profile are deleted. If those pods match another Fargate profile, then they are scheduled on Fargate with that profile. If they no longer match any Fargate profiles, then they are not scheduled on Fargate and they may remain in a pending state. Only one Fargate profile in a cluster can be in the DELETING status at a time. You must wait for a Fargate profile to finish deleting before you can delete any other profiles in that cluster.
DeleteNodegroup
Show Description Deletes an Amazon EKS node group for a cluster.
DeregisterCluster
Show Description Deregisters a connected cluster to remove it from the Amazon EKS control plane.
DescribeAddon
Show Description Describes an Amazon EKS add-on.
DescribeAddonVersions
Show Description Describes the Kubernetes versions that the add-on can be used with.
DescribeCluster
Show Description Returns descriptive information about an Amazon EKS cluster. The API server endpoint and certificate authority data returned by this operation are required for kubelet and kubectl to communicate with your Kubernetes API server. For more information, see Create a kubeconfig for Amazon EKS. The API server endpoint and certificate authority data aren't available until the cluster reaches the ACTIVE state.
DescribeFargateProfile
Show Description Returns descriptive information about an Fargate profile.
DescribeIdentityProviderConfig
Show Description Returns descriptive information about an identity provider configuration.
DescribeNodegroup
Show Description Returns descriptive information about an Amazon EKS node group.
DescribeUpdate
Show Description Returns descriptive information about an update against your Amazon EKS cluster or associated managed node group. When the status of the update is Succeeded, the update is complete. If an update fails, the status is Failed, and an error detail explains the reason for the failure.
DisassociateIdentityProviderConfig
Show Description Disassociates an identity provider configuration from a cluster. If you disassociate an identity provider from your cluster, users included in the provider can no longer access the cluster. However, you can still access the cluster with Amazon Web Services IAM users.
ListAddons
Show Description Lists the available add-ons.
ListClusters
Show Description Lists the Amazon EKS clusters in your Amazon Web Services account in the specified Region.
ListFargateProfiles
Show Description Lists the Fargate profiles associated with the specified cluster in your Amazon Web Services account in the specified Region.
ListIdentityProviderConfigs
Show Description A list of identity provider configurations.
ListNodegroups
Show Description Lists the Amazon EKS managed node groups associated with the specified cluster in your Amazon Web Services account in the specified Region. Self-managed node groups are not listed.
ListTagsForResource
Show Description List the tags for an Amazon EKS resource.
ListUpdates
Show Description Lists the updates associated with an Amazon EKS cluster or managed node group in your Amazon Web Services account, in the specified Region.
RegisterCluster
Show Description Connects a Kubernetes cluster to the Amazon EKS control plane. Any Kubernetes cluster can be connected to the Amazon EKS control plane to view current information about the cluster and its nodes. Cluster connection requires two steps. First, send a RegisterClusterRequest to add it to the Amazon EKS control plane. Second, a Manifest containing the activationID and activationCode must be applied to the Kubernetes cluster through it's native provider to provide visibility. After the Manifest is updated and applied, then the connected cluster is visible to the Amazon EKS control plane. If the Manifest is not applied within a set amount of time, then the connected cluster will no longer be visible and must be deregistered. See DeregisterCluster.
TagResource
Show Description Associates the specified tags to a resource with the specified resourceArn. If existing tags on a resource are not specified in the request parameters, they are not changed. When a resource is deleted, the tags associated with that resource are deleted as well. Tags that you create for Amazon EKS resources do not propagate to any other resources associated with the cluster. For example, if you tag a cluster with this operation, that tag does not automatically propagate to the subnets and nodes associated with the cluster.
UntagResource
Show Description Deletes specified tags from a resource.
UpdateAddon
Show Description Updates an Amazon EKS add-on.
UpdateClusterConfig
Show Description Updates an Amazon EKS cluster configuration. Your cluster continues to function during the update. The response output includes an update ID that you can use to track the status of your cluster update with the DescribeUpdate API operation. You can use this API operation to enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren't exported to CloudWatch Logs. For more information, see Amazon EKS Cluster Control Plane Logs in the Amazon EKS User Guide . CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see CloudWatch Pricing. You can also use this API operation to enable or disable public and private access to your cluster's Kubernetes API server endpoint. By default, public access is enabled, and private access is disabled. For more information, see Amazon EKS cluster endpoint access control in the Amazon EKS User Guide . You can't update the subnets or security group IDs for an existing cluster. Cluster updates are asynchronous, and they should finish within a few minutes. During an update, the cluster status moves to UPDATING (this status transition is eventually consistent). When the update is complete (either Failed or Successful), the cluster status moves to Active.
UpdateClusterVersion
Show Description Updates an Amazon EKS cluster to the specified Kubernetes version. Your cluster continues to function during the update. The response output includes an update ID that you can use to track the status of your cluster update with the DescribeUpdate API operation. Cluster updates are asynchronous, and they should finish within a few minutes. During an update, the cluster status moves to UPDATING (this status transition is eventually consistent). When the update is complete (either Failed or Successful), the cluster status moves to Active. If your cluster has managed node groups attached to it, all of your node groups’ Kubernetes versions must match the cluster’s Kubernetes version in order to update the cluster to a new Kubernetes version.
UpdateNodegroupConfig
Show Description Updates an Amazon EKS managed node group configuration. Your node group continues to function during the update. The response output includes an update ID that you can use to track the status of your node group update with the DescribeUpdate API operation. Currently you can update the Kubernetes labels for a node group or the scaling configuration.

Elastic-inference Events

Service Event Name Description
elastic-inference DescribeAcceleratorOfferings
Show Description Describes the locations in which a given accelerator type or set of types is present in a given region.
DescribeAcceleratorTypes
Show Description Describes the accelerator types available in a given region, as well as their characteristics, such as memory and throughput.
DescribeAccelerators
Show Description Describes information over a provided set of accelerators belonging to an account.
ListTagsForResource
Show Description Returns all tags of an Elastic Inference Accelerator.
TagResource
Show Description Adds the specified tags to an Elastic Inference Accelerator.

Elasticbeanstalk Events

Service Event Name Description
elasticbeanstalk AbortEnvironmentUpdate
ApplyEnvironmentManagedAction
Show Description Applies a scheduled managed action immediately. A managed action can be applied only if its status is Scheduled. Get the status and action ID of a managed action with DescribeEnvironmentManagedActions.
AssociateEnvironmentOperationsRole
CheckDNSAvailability
Show Description Checks if the specified CNAME is available.
ComposeEnvironments
Show Description Create or update a group of environments that each run a separate component of a single application. Takes a list of version labels that specify application source bundles for each of the environments to create or update. The name of each environment and other required information must be included in the source bundles in an environment manifest named env.yaml. See Compose Environments for details.
CreateApplication
Show Description Creates an application that has one configuration template named default and no application versions.
CreateApplicationVersion
Show Description Creates an application version for the specified application. You can create an application version from a source bundle in Amazon S3, a commit in AWS CodeCommit, or the output of an AWS CodeBuild build as follows: Specify a commit in an AWS CodeCommit repository with SourceBuildInformation. Specify a build in an AWS CodeBuild with SourceBuildInformation and BuildConfiguration. Specify a source bundle in S3 with SourceBundle Omit both SourceBuildInformation and SourceBundle to use the default sample application. After you create an application version with a specified Amazon S3 bucket and key location, you can't change that Amazon S3 location. If you change the Amazon S3 location, you receive an exception when you attempt to launch an environment from the application version.
CreateConfigurationTemplate
Show Description Creates an AWS Elastic Beanstalk configuration template, associated with a specific Elastic Beanstalk application. You define application configuration settings in a configuration template. You can then use the configuration template to deploy different versions of the application with the same configuration settings. Templates aren't associated with any environment. The EnvironmentName response element is always null. Related Topics
CreateEnvironment
Show Description Launches an AWS Elastic Beanstalk environment for the specified application using the specified configuration.
CreatePlatformVersion
Show Description Create a new version of your custom platform.
CreateStorageLocation
Show Description Creates a bucket in Amazon S3 to store application versions, logs, and other files used by Elastic Beanstalk environments. The Elastic Beanstalk console and EB CLI call this API the first time you create an environment in a region. If the storage location already exists, CreateStorageLocation still returns the bucket name but does not create a new bucket.
DeleteApplication
DeleteApplicationVersion
DeleteConfigurationTemplate
DeleteEnvironmentConfiguration
DeletePlatformVersion
Show Description Deletes the specified version of a custom platform.
DescribeAccountAttributes
Show Description Returns attributes related to AWS Elastic Beanstalk that are associated with the calling AWS account. The result currently has one set of attributes—resource quotas.
DescribeApplicationVersions
Show Description Retrieve a list of application versions.
DescribeApplications
Show Description Returns the descriptions of existing applications.
DescribeConfigurationOptions
Show Description Describes the configuration options that are used in a particular configuration template or environment, or that a specified solution stack defines. The description includes the values the options, their default values, and an indication of the required action on a running environment if an option value is changed.
DescribeConfigurationSettings
Show Description Returns a description of the settings for the specified configuration set, that is, either a configuration template or the configuration set associated with a running environment. When describing the settings for the configuration set associated with a running environment, it is possible to receive two sets of setting descriptions. One is the deployed configuration set, and the other is a draft configuration of an environment that is either in the process of deployment or that failed to deploy. Related Topics
DescribeEnvironmentHealth
Show Description Returns information about the overall health of the specified environment. The DescribeEnvironmentHealth operation is only available with AWS Elastic Beanstalk Enhanced Health.
DescribeEnvironmentManagedActionHistory
Show Description Lists an environment's completed and failed managed actions.
DescribeEnvironmentManagedActions
Show Description Lists an environment's upcoming and in-progress managed actions.
DescribeEnvironmentResources
Show Description Returns AWS resources for this environment.
DescribeEnvironments
Show Description Returns descriptions for existing environments.
DescribeEvents
Show Description Returns list of event descriptions matching criteria up to the last 6 weeks. This action returns the most recent 1,000 events from the specified NextToken.
DescribeInstancesHealth
Show Description Retrieves detailed information about the health of instances in your AWS Elastic Beanstalk. This operation requires enhanced health reporting.
DescribePlatformVersion
Show Description Describes a platform version. Provides full details. Compare to ListPlatformVersions, which provides summary information about a list of platform versions. For definitions of platform version and other platform-related terms, see AWS Elastic Beanstalk Platforms Glossary.
DisassociateEnvironmentOperationsRole
ListAvailableSolutionStacks
Show Description Returns a list of the available solution stack names, with the public version first and then in reverse chronological order.
ListPlatformBranches
Show Description Lists the platform branches available for your account in an AWS Region. Provides summary information about each platform branch. For definitions of platform branch and other platform-related terms, see AWS Elastic Beanstalk Platforms Glossary.
ListPlatformVersions
Show Description Lists the platform versions available for your account in an AWS Region. Provides summary information about each platform version. Compare to DescribePlatformVersion, which provides full details about a single platform version. For definitions of platform version and other platform-related terms, see AWS Elastic Beanstalk Platforms Glossary.
ListTagsForResource
Show Description Return the tags applied to an AWS Elastic Beanstalk resource. The response contains a list of tag key-value pairs. Elastic Beanstalk supports tagging of all of its resources. For details about resource tagging, see Tagging Application Resources.
RebuildEnvironment
RequestEnvironmentInfo
RestartAppServer
RetrieveEnvironmentInfo
Show Description Retrieves the compiled information from a RequestEnvironmentInfo request. Related Topics
SwapEnvironmentCNAMEs
TerminateEnvironment
Show Description Terminates the specified environment.
UpdateApplication
Show Description Updates the specified application to have the specified properties. If a property (for example, description) is not provided, the value remains unchanged. To clear these properties, specify an empty string.
UpdateApplicationResourceLifecycle
Show Description Modifies lifecycle settings for an application.
UpdateApplicationVersion
Show Description Updates the specified application version to have the specified properties. If a property (for example, description) is not provided, the value remains unchanged. To clear properties, specify an empty string.
UpdateConfigurationTemplate
Show Description Updates the specified configuration template to have the specified properties or configuration option values. If a property (for example, ApplicationName) is not provided, its value remains unchanged. To clear such properties, specify an empty string. Related Topics
UpdateEnvironment
Show Description Updates the environment description, deploys a new application version, updates the configuration settings to an entirely new configuration template, or updates select configuration option values in the running environment. Attempting to update both the release and configuration is not allowed and AWS Elastic Beanstalk returns an InvalidParameterCombination error. When updating the configuration settings to a new template or individual settings, a draft configuration is created and DescribeConfigurationSettings for this environment returns two setting descriptions with different DeploymentStatus values.
UpdateTagsForResource

Elastictranscoder Events

Service Event Name Description
elastictranscoder CancelJob
Show Description The CancelJob operation cancels an unfinished job. You can only cancel a job that has a status of Submitted. To prevent a pipeline from starting to process a job while you're getting the job identifier, use UpdatePipelineStatus to temporarily pause the pipeline.
CreateJob
Show Description When you create a job, Elastic Transcoder returns JSON data that includes the values that you specified plus information about the job that is created. If you have specified more than one output for your jobs (for example, one output for the Kindle Fire and another output for the Apple iPhone 4s), you currently must use the Elastic Transcoder API to list the jobs (as opposed to the AWS Console).
CreatePipeline
Show Description The CreatePipeline operation creates a pipeline with settings that you specify.
CreatePreset
Show Description The CreatePreset operation creates a preset with settings that you specify. Elastic Transcoder checks the CreatePreset settings to ensure that they meet Elastic Transcoder requirements and to determine whether they comply with H.264 standards. If your settings are not valid for Elastic Transcoder, Elastic Transcoder returns an HTTP 400 response (ValidationException) and does not create the preset. If the settings are valid for Elastic Transcoder but aren't strictly compliant with the H.264 standard, Elastic Transcoder creates the preset and returns a warning message in the response. This helps you determine whether your settings comply with the H.264 standard while giving you greater flexibility with respect to the video that Elastic Transcoder produces. Elastic Transcoder uses the H.264 video-compression format. For more information, see the International Telecommunication Union publication Recommendation ITU-T H.264: Advanced video coding for generic audiovisual services.
DeletePipeline
Show Description The DeletePipeline operation removes a pipeline. You can only delete a pipeline that has never been used or that is not currently in use (doesn't contain any active jobs). If the pipeline is currently in use, DeletePipeline returns an error.
DeletePreset
Show Description The DeletePreset operation removes a preset that you've added in an AWS region. You can't delete the default presets that are included with Elastic Transcoder.
ListJobsByPipeline
Show Description The ListJobsByPipeline operation gets a list of the jobs currently in a pipeline. Elastic Transcoder returns all of the jobs currently in the specified pipeline. The response body contains one element for each job that satisfies the search criteria.
ListJobsByStatus
Show Description The ListJobsByStatus operation gets a list of jobs that have a specified status. The response body contains one element for each job that satisfies the search criteria.
ListPipelines
Show Description The ListPipelines operation gets a list of the pipelines associated with the current AWS account.
ListPresets
Show Description The ListPresets operation gets a list of the default presets included with Elastic Transcoder and the presets that you've added in an AWS region.
ReadJob
Show Description The ReadJob operation returns detailed information about a job.
ReadPipeline
Show Description The ReadPipeline operation gets detailed information about a pipeline.
ReadPreset
Show Description The ReadPreset operation gets detailed information about a preset.
TestRole
Show Description The TestRole operation tests the IAM role used to create the pipeline. The TestRole action lets you determine whether the IAM role you are using has sufficient permissions to let Elastic Transcoder perform tasks associated with the transcoding process. The action attempts to assume the specified IAM role, checks read access to the input and output buckets, and tries to send a test notification to Amazon SNS topics that you specify.
UpdatePipeline
Show Description Use the UpdatePipeline operation to update settings for a pipeline. When you change pipeline settings, your changes take effect immediately. Jobs that you have already submitted and that Elastic Transcoder has not started to process are affected in addition to jobs that you submit after you change settings.
UpdatePipelineNotifications
Show Description With the UpdatePipelineNotifications operation, you can update Amazon Simple Notification Service (Amazon SNS) notifications for a pipeline. When you update notifications for a pipeline, Elastic Transcoder returns the values that you specified in the request.

Elb Events

Service Event Name Description
elb AddTags
Show Description Adds the specified tags to the specified load balancer. Each load balancer can have a maximum of 10 tags. Each tag consists of a key and an optional value. If a tag with the same key is already associated with the load balancer, AddTags updates its value. For more information, see Tag Your Classic Load Balancer in the Classic Load Balancers Guide.
ApplySecurityGroupsToLoadBalancer
Show Description Associates one or more security groups with your load balancer in a virtual private cloud (VPC). The specified security groups override the previously associated security groups. For more information, see Security Groups for Load Balancers in a VPC in the Classic Load Balancers Guide.
AttachLoadBalancerToSubnets
Show Description Adds one or more subnets to the set of configured subnets for the specified load balancer. The load balancer evenly distributes requests across all registered subnets. For more information, see Add or Remove Subnets for Your Load Balancer in a VPC in the Classic Load Balancers Guide.
ConfigureHealthCheck
Show Description Specifies the health check settings to use when evaluating the health state of your EC2 instances. For more information, see Configure Health Checks for Your Load Balancer in the Classic Load Balancers Guide.
CreateAppCookieStickinessPolicy
Show Description Generates a stickiness policy with sticky session lifetimes that follow that of an application-generated cookie. This policy can be associated only with HTTP/HTTPS listeners. This policy is similar to the policy created by CreateLBCookieStickinessPolicy, except that the lifetime of the special Elastic Load Balancing cookie, AWSELB, follows the lifetime of the application-generated cookie specified in the policy configuration. The load balancer only inserts a new stickiness cookie when the application response includes a new application cookie. If the application cookie is explicitly removed or expires, the session stops being sticky until a new application cookie is issued. For more information, see Application-Controlled Session Stickiness in the Classic Load Balancers Guide.
CreateLBCookieStickinessPolicy
Show Description Generates a stickiness policy with sticky session lifetimes controlled by the lifetime of the browser (user-agent) or a specified expiration period. This policy can be associated only with HTTP/HTTPS listeners. When a load balancer implements this policy, the load balancer uses a special cookie to track the instance for each request. When the load balancer receives a request, it first checks to see if this cookie is present in the request. If so, the load balancer sends the request to the application server specified in the cookie. If not, the load balancer sends the request to a server that is chosen based on the existing load-balancing algorithm. A cookie is inserted into the response for binding subsequent requests from the same user to that server. The validity of the cookie is based on the cookie expiration time, which is specified in the policy configuration. For more information, see Duration-Based Session Stickiness in the Classic Load Balancers Guide.
CreateLoadBalancer
Show Description Creates a Classic Load Balancer. You can add listeners, security groups, subnets, and tags when you create your load balancer, or you can add them later using CreateLoadBalancerListeners, ApplySecurityGroupsToLoadBalancer, AttachLoadBalancerToSubnets, and AddTags. To describe your current load balancers, see DescribeLoadBalancers. When you are finished with a load balancer, you can delete it using DeleteLoadBalancer. You can create up to 20 load balancers per region per account. You can request an increase for the number of load balancers for your account. For more information, see Limits for Your Classic Load Balancer in the Classic Load Balancers Guide.
CreateLoadBalancerListeners
Show Description Creates one or more listeners for the specified load balancer. If a listener with the specified port does not already exist, it is created; otherwise, the properties of the new listener must match the properties of the existing listener. For more information, see Listeners for Your Classic Load Balancer in the Classic Load Balancers Guide.
CreateLoadBalancerPolicy
Show Description Creates a policy with the specified attributes for the specified load balancer. Policies are settings that are saved for your load balancer and that can be applied to the listener or the application server, depending on the policy type.
DeleteLoadBalancer
Show Description Deletes the specified load balancer. If you are attempting to recreate a load balancer, you must reconfigure all settings. The DNS name associated with a deleted load balancer are no longer usable. The name and associated DNS record of the deleted load balancer no longer exist and traffic sent to any of its IP addresses is no longer delivered to your instances. If the load balancer does not exist or has already been deleted, the call to DeleteLoadBalancer still succeeds.
DeleteLoadBalancerListeners
Show Description Deletes the specified listeners from the specified load balancer.
DeleteLoadBalancerPolicy
Show Description Deletes the specified policy from the specified load balancer. This policy must not be enabled for any listeners.
DeregisterInstancesFromLoadBalancer
Show Description Deregisters the specified instances from the specified load balancer. After the instance is deregistered, it no longer receives traffic from the load balancer. You can use DescribeLoadBalancers to verify that the instance is deregistered from the load balancer. For more information, see Register or De-Register EC2 Instances in the Classic Load Balancers Guide.
DescribeAccountLimits
Show Description Describes the current Elastic Load Balancing resource limits for your AWS account. For more information, see Limits for Your Classic Load Balancer in the Classic Load Balancers Guide.
DescribeInstanceHealth
Show Description Describes the state of the specified instances with respect to the specified load balancer. If no instances are specified, the call describes the state of all instances that are currently registered with the load balancer. If instances are specified, their state is returned even if they are no longer registered with the load balancer. The state of terminated instances is not returned.
DescribeLoadBalancerAttributes
Show Description Describes the attributes for the specified load balancer.
DescribeLoadBalancerPolicies
Show Description Describes the specified policies. If you specify a load balancer name, the action returns the descriptions of all policies created for the load balancer. If you specify a policy name associated with your load balancer, the action returns the description of that policy. If you don't specify a load balancer name, the action returns descriptions of the specified sample policies, or descriptions of all sample policies. The names of the sample policies have the ELBSample- prefix.
DescribeLoadBalancerPolicyTypes
Show Description Describes the specified load balancer policy types or all load balancer policy types. The description of each type indicates how it can be used. For example, some policies can be used only with layer 7 listeners, some policies can be used only with layer 4 listeners, and some policies can be used only with your EC2 instances. You can use CreateLoadBalancerPolicy to create a policy configuration for any of these policy types. Then, depending on the policy type, use either SetLoadBalancerPoliciesOfListener or SetLoadBalancerPoliciesForBackendServer to set the policy.
DescribeLoadBalancers
Show Description Describes the specified the load balancers. If no load balancers are specified, the call describes all of your load balancers.
DescribeTags
Show Description Describes the tags associated with the specified load balancers.
DetachLoadBalancerFromSubnets
Show Description Removes the specified subnets from the set of configured subnets for the load balancer. After a subnet is removed, all EC2 instances registered with the load balancer in the removed subnet go into the OutOfService state. Then, the load balancer balances the traffic among the remaining routable subnets.
DisableAvailabilityZonesForLoadBalancer
Show Description Removes the specified Availability Zones from the set of Availability Zones for the specified load balancer in EC2-Classic or a default VPC. For load balancers in a non-default VPC, use DetachLoadBalancerFromSubnets. There must be at least one Availability Zone registered with a load balancer at all times. After an Availability Zone is removed, all instances registered with the load balancer that are in the removed Availability Zone go into the OutOfService state. Then, the load balancer attempts to equally balance the traffic among its remaining Availability Zones. For more information, see Add or Remove Availability Zones in the Classic Load Balancers Guide.
EnableAvailabilityZonesForLoadBalancer
Show Description Adds the specified Availability Zones to the set of Availability Zones for the specified load balancer in EC2-Classic or a default VPC. For load balancers in a non-default VPC, use AttachLoadBalancerToSubnets. The load balancer evenly distributes requests across all its registered Availability Zones that contain instances. For more information, see Add or Remove Availability Zones in the Classic Load Balancers Guide.
ModifyLoadBalancerAttributes
Show Description Modifies the attributes of the specified load balancer. You can modify the load balancer attributes, such as AccessLogs, ConnectionDraining, and CrossZoneLoadBalancing by either enabling or disabling them. Or, you can modify the load balancer attribute ConnectionSettings by specifying an idle connection timeout value for your load balancer. For more information, see the following in the Classic Load Balancers Guide:
RegisterInstancesWithLoadBalancer
Show Description Adds the specified instances to the specified load balancer. The instance must be a running instance in the same network as the load balancer (EC2-Classic or the same VPC). If you have EC2-Classic instances and a load balancer in a VPC with ClassicLink enabled, you can link the EC2-Classic instances to that VPC and then register the linked EC2-Classic instances with the load balancer in the VPC. Note that RegisterInstanceWithLoadBalancer completes when the request has been registered. Instance registration takes a little time to complete. To check the state of the registered instances, use DescribeLoadBalancers or DescribeInstanceHealth. After the instance is registered, it starts receiving traffic and requests from the load balancer. Any instance that is not in one of the Availability Zones registered for the load balancer is moved to the OutOfService state. If an Availability Zone is added to the load balancer later, any instances registered with the load balancer move to the InService state. To deregister instances from a load balancer, use DeregisterInstancesFromLoadBalancer. For more information, see Register or De-Register EC2 Instances in the Classic Load Balancers Guide.
RemoveTags
Show Description Removes one or more tags from the specified load balancer.
SetLoadBalancerListenerSSLCertificate
Show Description Sets the certificate that terminates the specified listener's SSL connections. The specified certificate replaces any prior certificate that was used on the same load balancer and port. For more information about updating your SSL certificate, see Replace the SSL Certificate for Your Load Balancer in the Classic Load Balancers Guide.
SetLoadBalancerPoliciesForBackendServer
Show Description Replaces the set of policies associated with the specified port on which the EC2 instance is listening with a new set of policies. At this time, only the back-end server authentication policy type can be applied to the instance ports; this policy type is composed of multiple public key policies. Each time you use SetLoadBalancerPoliciesForBackendServer to enable the policies, use the PolicyNames parameter to list the policies that you want to enable. You can use DescribeLoadBalancers or DescribeLoadBalancerPolicies to verify that the policy is associated with the EC2 instance. For more information about enabling back-end instance authentication, see Configure Back-end Instance Authentication in the Classic Load Balancers Guide. For more information about Proxy Protocol, see Configure Proxy Protocol Support in the Classic Load Balancers Guide.

Elbv2 Events

Service Event Name Description
elbv2 AddListenerCertificates
Show Description Adds the specified SSL server certificate to the certificate list for the specified HTTPS or TLS listener. If the certificate in already in the certificate list, the call is successful but the certificate is not added again. For more information, see HTTPS listeners in the Application Load Balancers Guide or TLS listeners in the Network Load Balancers Guide.
AddTags
Show Description Adds the specified tags to the specified Elastic Load Balancing resource. You can tag your Application Load Balancers, Network Load Balancers, Gateway Load Balancers, target groups, listeners, and rules. Each tag consists of a key and an optional value. If a resource already has a tag with the same key, AddTags updates its value.
CreateListener
Show Description Creates a listener for the specified Application Load Balancer, Network Load Balancer, or Gateway Load Balancer. For more information, see the following: This operation is idempotent, which means that it completes at most one time. If you attempt to create multiple listeners with the same settings, each call succeeds.
CreateLoadBalancer
Show Description Creates an Application Load Balancer, Network Load Balancer, or Gateway Load Balancer. For more information, see the following: This operation is idempotent, which means that it completes at most one time. If you attempt to create multiple load balancers with the same settings, each call succeeds.
CreateRule
Show Description Creates a rule for the specified listener. The listener must be associated with an Application Load Balancer. Each rule consists of a priority, one or more actions, and one or more conditions. Rules are evaluated in priority order, from the lowest value to the highest value. When the conditions for a rule are met, its actions are performed. If the conditions for no rules are met, the actions for the default rule are performed. For more information, see Listener rules in the Application Load Balancers Guide.
CreateTargetGroup
Show Description Creates a target group. For more information, see the following: This operation is idempotent, which means that it completes at most one time. If you attempt to create multiple target groups with the same settings, each call succeeds.
DeleteListener
Show Description Deletes the specified listener. Alternatively, your listener is deleted when you delete the load balancer to which it is attached.
DeleteLoadBalancer
Show Description Deletes the specified Application Load Balancer, Network Load Balancer, or Gateway Load Balancer. Deleting a load balancer also deletes its listeners. You can't delete a load balancer if deletion protection is enabled. If the load balancer does not exist or has already been deleted, the call succeeds. Deleting a load balancer does not affect its registered targets. For example, your EC2 instances continue to run and are still registered to their target groups. If you no longer need these EC2 instances, you can stop or terminate them.
DeleteRule
Show Description Deletes the specified rule. You can't delete the default rule.
DeleteTargetGroup
Show Description Deletes the specified target group. You can delete a target group if it is not referenced by any actions. Deleting a target group also deletes any associated health checks. Deleting a target group does not affect its registered targets. For example, any EC2 instances continue to run until you stop or terminate them.
DeregisterTargets
Show Description Deregisters the specified targets from the specified target group. After the targets are deregistered, they no longer receive traffic from the load balancer.
DescribeAccountLimits
Show Description Describes the current Elastic Load Balancing resource limits for your Amazon Web Services account. For more information, see the following:
DescribeListenerCertificates
Show Description Describes the default certificate and the certificate list for the specified HTTPS or TLS listener. If the default certificate is also in the certificate list, it appears twice in the results (once with IsDefault set to true and once with IsDefault set to false). For more information, see SSL certificates in the Application Load Balancers Guide or Server certificates in the Network Load Balancers Guide.
DescribeListeners
Show Description Describes the specified listeners or the listeners for the specified Application Load Balancer, Network Load Balancer, or Gateway Load Balancer. You must specify either a load balancer or one or more listeners.
DescribeLoadBalancerAttributes
Show Description Describes the attributes for the specified Application Load Balancer, Network Load Balancer, or Gateway Load Balancer. For more information, see the following:
DescribeLoadBalancers
Show Description Describes the specified load balancers or all of your load balancers.
DescribeRules
Show Description Describes the specified rules or the rules for the specified listener. You must specify either a listener or one or more rules.
DescribeSSLPolicies
Show Description Describes the specified policies or all policies used for SSL negotiation. For more information, see Security policies in the Application Load Balancers Guide or Security policies in the Network Load Balancers Guide.
DescribeTags
Show Description Describes the tags for the specified Elastic Load Balancing resources. You can describe the tags for one or more Application Load Balancers, Network Load Balancers, Gateway Load Balancers, target groups, listeners, or rules.
DescribeTargetGroupAttributes
Show Description Describes the attributes for the specified target group. For more information, see the following:
DescribeTargetGroups
Show Description Describes the specified target groups or all of your target groups. By default, all target groups are described. Alternatively, you can specify one of the following to filter the results: the ARN of the load balancer, the names of one or more target groups, or the ARNs of one or more target groups.
DescribeTargetHealth
Show Description Describes the health of the specified targets or all of your targets.
ModifyListener
Show Description Replaces the specified properties of the specified listener. Any properties that you do not specify remain unchanged. Changing the protocol from HTTPS to HTTP, or from TLS to TCP, removes the security policy and default certificate properties. If you change the protocol from HTTP to HTTPS, or from TCP to TLS, you must add the security policy and default certificate properties. To add an item to a list, remove an item from a list, or update an item in a list, you must provide the entire list. For example, to add an action, specify a list with the current actions plus the new action.
ModifyLoadBalancerAttributes
Show Description Modifies the specified attributes of the specified Application Load Balancer, Network Load Balancer, or Gateway Load Balancer. If any of the specified attributes can't be modified as requested, the call fails. Any existing attributes that you do not modify retain their current values.
ModifyRule
Show Description Replaces the specified properties of the specified rule. Any properties that you do not specify are unchanged. To add an item to a list, remove an item from a list, or update an item in a list, you must provide the entire list. For example, to add an action, specify a list with the current actions plus the new action.
ModifyTargetGroup
Show Description Modifies the health checks used when evaluating the health state of the targets in the specified target group.
ModifyTargetGroupAttributes
Show Description Modifies the specified attributes of the specified target group.
RegisterTargets
Show Description Registers the specified targets with the specified target group. If the target is an EC2 instance, it must be in the running state when you register it. By default, the load balancer routes requests to registered targets using the protocol and port for the target group. Alternatively, you can override the port for a target when you register it. You can register each EC2 instance or IP address with the same target group multiple times using different ports. With a Network Load Balancer, you cannot register instances by instance ID if they have the following instance types: C1, CC1, CC2, CG1, CG2, CR1, CS1, G1, G2, HI1, HS1, M1, M2, M3, and T1. You can register instances of these types by IP address.
RemoveListenerCertificates
Show Description Removes the specified certificate from the certificate list for the specified HTTPS or TLS listener.
RemoveTags
Show Description Removes the specified tags from the specified Elastic Load Balancing resources. You can remove the tags for one or more Application Load Balancers, Network Load Balancers, Gateway Load Balancers, target groups, listeners, or rules.
SetIpAddressType
Show Description Sets the type of IP addresses used by the subnets of the specified Application Load Balancer or Network Load Balancer.
SetRulePriorities
Show Description Sets the priorities of the specified rules. You can reorder the rules as long as there are no priority conflicts in the new order. Any existing rules that you do not specify retain their current priority.
SetSecurityGroups
Show Description Associates the specified security groups with the specified Application Load Balancer. The specified security groups override the previously associated security groups. You can't specify a security group for a Network Load Balancer or Gateway Load Balancer.

Emr-containers Events

Service Event Name Description
emr-containers CancelJobRun
Show Description Cancels a job run. A job run is a unit of work, such as a Spark jar, PySpark script, or SparkSQL query, that you submit to Amazon EMR on EKS.
CreateManagedEndpoint
Show Description Creates a managed endpoint. A managed endpoint is a gateway that connects EMR Studio to Amazon EMR on EKS so that EMR Studio can communicate with your virtual cluster.
CreateVirtualCluster
Show Description Creates a virtual cluster. Virtual cluster is a managed entity on Amazon EMR on EKS. You can create, describe, list and delete virtual clusters. They do not consume any additional resource in your system. A single virtual cluster maps to a single Kubernetes namespace. Given this relationship, you can model virtual clusters the same way you model Kubernetes namespaces to meet your requirements.
DeleteManagedEndpoint
Show Description Deletes a managed endpoint. A managed endpoint is a gateway that connects EMR Studio to Amazon EMR on EKS so that EMR Studio can communicate with your virtual cluster.
DeleteVirtualCluster
Show Description Deletes a virtual cluster. Virtual cluster is a managed entity on Amazon EMR on EKS. You can create, describe, list and delete virtual clusters. They do not consume any additional resource in your system. A single virtual cluster maps to a single Kubernetes namespace. Given this relationship, you can model virtual clusters the same way you model Kubernetes namespaces to meet your requirements.
DescribeJobRun
Show Description Displays detailed information about a job run. A job run is a unit of work, such as a Spark jar, PySpark script, or SparkSQL query, that you submit to Amazon EMR on EKS.
DescribeManagedEndpoint
Show Description Displays detailed information about a managed endpoint. A managed endpoint is a gateway that connects EMR Studio to Amazon EMR on EKS so that EMR Studio can communicate with your virtual cluster.
DescribeVirtualCluster
Show Description Displays detailed information about a specified virtual cluster. Virtual cluster is a managed entity on Amazon EMR on EKS. You can create, describe, list and delete virtual clusters. They do not consume any additional resource in your system. A single virtual cluster maps to a single Kubernetes namespace. Given this relationship, you can model virtual clusters the same way you model Kubernetes namespaces to meet your requirements.
ListJobRuns
Show Description Lists job runs based on a set of parameters. A job run is a unit of work, such as a Spark jar, PySpark script, or SparkSQL query, that you submit to Amazon EMR on EKS.
ListManagedEndpoints
Show Description Lists managed endpoints based on a set of parameters. A managed endpoint is a gateway that connects EMR Studio to Amazon EMR on EKS so that EMR Studio can communicate with your virtual cluster.
ListTagsForResource
Show Description Lists the tags assigned to the resources.
ListVirtualClusters
Show Description Lists information about the specified virtual cluster. Virtual cluster is a managed entity on Amazon EMR on EKS. You can create, describe, list and delete virtual clusters. They do not consume any additional resource in your system. A single virtual cluster maps to a single Kubernetes namespace. Given this relationship, you can model virtual clusters the same way you model Kubernetes namespaces to meet your requirements.
StartJobRun
Show Description Starts a job run. A job run is a unit of work, such as a Spark jar, PySpark script, or SparkSQL query, that you submit to Amazon EMR on EKS.
TagResource
Show Description Assigns tags to resources. A tag is a label that you assign to an AWS resource. Each tag consists of a key and an optional value, both of which you define. Tags enable you to categorize your AWS resources by attributes such as purpose, owner, or environment. When you have many resources of the same type, you can quickly identify a specific resource based on the tags you've assigned to it. For example, you can define a set of tags for your Amazon EMR on EKS clusters to help you track each cluster's owner and stack level. We recommend that you devise a consistent set of tag keys for each resource type. You can then search and filter the resources based on the tags that you add.

Emr Events

Service Event Name Description
emr AddInstanceFleet
Show Description Adds an instance fleet to a running cluster. The instance fleet configuration is available only in Amazon EMR versions 4.8.0 and later, excluding 5.0.x.
AddInstanceGroups
Show Description Adds one or more instance groups to a running cluster.
AddJobFlowSteps
Show Description AddJobFlowSteps adds new steps to a running cluster. A maximum of 256 steps are allowed in each job flow. If your cluster is long-running (such as a Hive data warehouse) or complex, you may require more than 256 steps to process your data. You can bypass the 256-step limitation in various ways, including using SSH to connect to the master node and submitting queries directly to the software running on the master node, such as Hive and Hadoop. For more information on how to do this, see Add More than 256 Steps to a Cluster in the Amazon EMR Management Guide. A step specifies the location of a JAR file stored either on the master node of the cluster or in Amazon S3. Each step is performed by the main function of the main class of the JAR file. The main class can be specified either in the manifest of the JAR or by using the MainFunction parameter of the step. Amazon EMR executes each step in the order listed. For a step to be considered complete, the main function must exit with a zero exit code and all Hadoop jobs started while the step was running must have completed and run successfully. You can only add steps to a cluster that is in one of the following states: STARTING, BOOTSTRAPPING, RUNNING, or WAITING.
AddTags
Show Description Adds tags to an Amazon EMR resource, such as a cluster or an Amazon EMR Studio. Tags make it easier to associate resources in various ways, such as grouping clusters to track your Amazon EMR resource allocation costs. For more information, see Tag Clusters.
CancelSteps
Show Description Cancels a pending step or steps in a running cluster. Available only in Amazon EMR versions 4.8.0 and later, excluding version 5.0.0. A maximum of 256 steps are allowed in each CancelSteps request. CancelSteps is idempotent but asynchronous; it does not guarantee that a step will be canceled, even if the request is successfully submitted. When you use Amazon EMR versions 5.28.0 and later, you can cancel steps that are in a PENDING or RUNNING state. In earlier versions of Amazon EMR, you can only cancel steps that are in a PENDING state.
CreateSecurityConfiguration
Show Description Creates a security configuration, which is stored in the service and can be specified when a cluster is created.
CreateStudio
Show Description Creates a new Amazon EMR Studio.
CreateStudioSessionMapping
DeleteSecurityConfiguration
Show Description Deletes a security configuration.
DeleteStudio
DeleteStudioSessionMapping
DescribeCluster
Show Description Provides cluster-level details including status, hardware and software configuration, VPC settings, and so on.
DescribeJobFlows
Show Description This API is no longer supported and will eventually be removed. We recommend you use ListClusters, DescribeCluster, ListSteps, ListInstanceGroups and ListBootstrapActions instead. DescribeJobFlows returns a list of job flows that match all of the supplied parameters. The parameters can include a list of job flow IDs, job flow states, and restrictions on job flow creation date and time. Regardless of supplied parameters, only job flows created within the last two months are returned. If no parameters are supplied, then job flows matching either of the following criteria are returned:
  • Job flows created and completed in the last two weeks
  • Job flows created within the last two months that are in one of the following states: RUNNING, WAITING, SHUTTING_DOWN, STARTING
Amazon EMR can return a maximum of 512 job flow descriptions.
DescribeNotebookExecution
Show Description Provides details of a notebook execution.
DescribeReleaseLabel
Show Description Provides EMR release label details, such as releases available the region where the API request is run, and the available applications for a specific EMR release label. Can also list EMR release versions that support a specified version of Spark.
DescribeSecurityConfiguration
Show Description Provides the details of a security configuration by returning the configuration JSON.
DescribeStep
Show Description Provides more detail about the cluster step.
DescribeStudio
Show Description Returns details for the specified Amazon EMR Studio including ID, Name, VPC, Studio access URL, and so on.
GetAutoTerminationPolicy
Show Description Returns the auto-termination policy for an Amazon EMR cluster.
GetBlockPublicAccessConfiguration
Show Description Returns the Amazon EMR block public access configuration for your Amazon Web Services account in the current Region. For more information see Configure Block Public Access for Amazon EMR in the Amazon EMR Management Guide.
GetManagedScalingPolicy
Show Description Fetches the attached managed scaling policy for an Amazon EMR cluster.
GetStudioSessionMapping
Show Description Fetches mapping details for the specified Amazon EMR Studio and identity (user or group).
ListBootstrapActions
Show Description Provides information about the bootstrap actions associated with a cluster.
ListClusters
Show Description Provides the status of all clusters visible to this Amazon Web Services account. Allows you to filter the list of clusters based on certain criteria; for example, filtering by cluster creation date and time or by status. This call returns a maximum of 50 clusters in unsorted order per call, but returns a marker to track the paging of the cluster list across multiple ListClusters calls.
ListInstanceFleets
Show Description Lists all available details about the instance fleets in a cluster. The instance fleet configuration is available only in Amazon EMR versions 4.8.0 and later, excluding 5.0.x versions.
ListInstanceGroups
Show Description Provides all available details about the instance groups in a cluster.
ListInstances
Show Description Provides information for all active EC2 instances and EC2 instances terminated in the last 30 days, up to a maximum of 2,000. EC2 instances in any of the following states are considered active: AWAITING_FULFILLMENT, PROVISIONING, BOOTSTRAPPING, RUNNING.
ListNotebookExecutions
Show Description Provides summaries of all notebook executions. You can filter the list based on multiple criteria such as status, time range, and editor id. Returns a maximum of 50 notebook executions and a marker to track the paging of a longer notebook execution list across multiple ListNotebookExecution calls.
ListReleaseLabels
Show Description Retrieves release labels of EMR services in the region where the API is called.
ListSecurityConfigurations
Show Description Lists all the security configurations visible to this account, providing their creation dates and times, and their names. This call returns a maximum of 50 clusters per call, but returns a marker to track the paging of the cluster list across multiple ListSecurityConfigurations calls.
ListSteps
Show Description Provides a list of steps for the cluster in reverse order unless you specify stepIds with the request or filter by StepStates. You can specify a maximum of 10 stepIDs. The CLI automatically paginates results to return a list greater than 50 steps. To return more than 50 steps using the CLI, specify a Marker, which is a pagination token that indicates the next set of steps to retrieve.
ListStudioSessionMappings
Show Description Returns a list of all user or group session mappings for the Amazon EMR Studio specified by StudioId.
ListStudios
Show Description Returns a list of all Amazon EMR Studios associated with the Amazon Web Services account. The list includes details such as ID, Studio Access URL, and creation time for each Studio.
ModifyCluster
Show Description Modifies the number of steps that can be executed concurrently for the cluster specified using ClusterID.
ModifyInstanceFleet
ModifyInstanceGroups
PutAutoScalingPolicy
Show Description Creates or updates an automatic scaling policy for a core instance group or task instance group in an Amazon EMR cluster. The automatic scaling policy defines how an instance group dynamically adds and terminates EC2 instances in response to the value of a CloudWatch metric.
PutAutoTerminationPolicy
Show Description Creates or updates an auto-termination policy for an Amazon EMR cluster. An auto-termination policy defines the amount of idle time in seconds after which a cluster automatically terminates. For alternative cluster termination options, see Control cluster termination.
PutBlockPublicAccessConfiguration
Show Description Creates or updates an Amazon EMR block public access configuration for your Amazon Web Services account in the current Region. For more information see Configure Block Public Access for Amazon EMR in the Amazon EMR Management Guide.
PutManagedScalingPolicy
Show Description Creates or updates a managed scaling policy for an Amazon EMR cluster. The managed scaling policy defines the limits for resources, such as EC2 instances that can be added or terminated from a cluster. The policy only applies to the core and task nodes. The master node cannot be scaled after initial configuration.
RemoveAutoScalingPolicy
Show Description Removes an automatic scaling policy from a specified instance group within an EMR cluster.
RemoveAutoTerminationPolicy
Show Description Removes an auto-termination policy from an Amazon EMR cluster.
RemoveManagedScalingPolicy
Show Description Removes a managed scaling policy from a specified EMR cluster.
RemoveTags
Show Description Removes tags from an Amazon EMR resource, such as a cluster or Amazon EMR Studio. Tags make it easier to associate resources in various ways, such as grouping clusters to track your Amazon EMR resource allocation costs. For more information, see Tag Clusters. The following example removes the stack tag with value Prod from a cluster:
RunJobFlow
Show Description RunJobFlow creates and starts running a new cluster (job flow). The cluster runs the steps specified. After the steps complete, the cluster stops and the HDFS partition is lost. To prevent loss of data, configure the last step of the job flow to store results in Amazon S3. If the JobFlowInstancesConfig KeepJobFlowAliveWhenNoSteps parameter is set to TRUE, the cluster transitions to the WAITING state rather than shutting down after the steps have completed. For additional protection, you can set the JobFlowInstancesConfig TerminationProtected parameter to TRUE to lock the cluster and prevent it from being terminated by API call, user intervention, or in the event of a job flow error. A maximum of 256 steps are allowed in each job flow. If your cluster is long-running (such as a Hive data warehouse) or complex, you may require more than 256 steps to process your data. You can bypass the 256-step limitation in various ways, including using the SSH shell to connect to the master node and submitting queries directly to the software running on the master node, such as Hive and Hadoop. For more information on how to do this, see Add More than 256 Steps to a Cluster in the Amazon EMR Management Guide. For long running clusters, we recommend that you periodically store your results. The instance fleets configuration is available only in Amazon EMR versions 4.8.0 and later, excluding 5.0.x versions. The RunJobFlow request can contain InstanceFleets parameters or InstanceGroups parameters, but not both.
SetTerminationProtection
SetVisibleToAllUsers
StartNotebookExecution
Show Description Starts a notebook execution.
StopNotebookExecution
TerminateJobFlows
UpdateStudio

Es Events

Service Event Name Description
es AcceptInboundCrossClusterSearchConnection
Show Description Allows the destination domain owner to accept an inbound cross-cluster search connection request.
AddTags
AssociatePackage
Show Description Associates a package with an Amazon ES domain.
CancelElasticsearchServiceSoftwareUpdate
Show Description Cancels a scheduled service software update for an Amazon ES domain. You can only perform this operation before the AutomatedUpdateDate and when the UpdateStatus is in the PENDING_UPDATE state.
CreateElasticsearchDomain
Show Description Creates a new Elasticsearch domain. For more information, see Creating Elasticsearch Domains in the Amazon Elasticsearch Service Developer Guide.
CreateOutboundCrossClusterSearchConnection
Show Description Creates a new cross-cluster search connection from a source domain to a destination domain.
CreatePackage
Show Description Create a package for use with Amazon ES domains.
DeleteElasticsearchDomain
Show Description Permanently deletes the specified Elasticsearch domain and all of its data. Once a domain is deleted, it cannot be recovered.
DeleteElasticsearchServiceRole
DeleteInboundCrossClusterSearchConnection
Show Description Allows the destination domain owner to delete an existing inbound cross-cluster search connection.
DeleteOutboundCrossClusterSearchConnection
Show Description Allows the source domain owner to delete an existing outbound cross-cluster search connection.
DeletePackage
Show Description Delete the package.
DescribeDomainAutoTunes
Show Description Provides scheduled Auto-Tune action details for the Elasticsearch domain, such as Auto-Tune action type, description, severity, and scheduled date.
DescribeElasticsearchDomain
Show Description Returns domain configuration information about the specified Elasticsearch domain, including the domain ID, domain endpoint, and domain ARN.
DescribeElasticsearchDomainConfig
Show Description Provides cluster configuration information about the specified Elasticsearch domain, such as the state, creation date, update version, and update date for cluster options.
DescribeElasticsearchDomains
Show Description Returns domain configuration information about the specified Elasticsearch domains, including the domain ID, domain endpoint, and domain ARN.
DescribeElasticsearchInstanceTypeLimits
Show Description Describe Elasticsearch Limits for a given InstanceType and ElasticsearchVersion. When modifying existing Domain, specify the DomainName to know what Limits are supported for modifying.
DescribeInboundCrossClusterSearchConnections
Show Description Lists all the inbound cross-cluster search connections for a destination domain.
DescribeOutboundCrossClusterSearchConnections
Show Description Lists all the outbound cross-cluster search connections for a source domain.
DescribePackages
Show Description Describes all packages available to Amazon ES. Includes options for filtering, limiting the number of results, and pagination.
DescribeReservedElasticsearchInstanceOfferings
Show Description Lists available reserved Elasticsearch instance offerings.
DescribeReservedElasticsearchInstances
Show Description Returns information about reserved Elasticsearch instances for this account.
DissociatePackage
Show Description Dissociates a package from the Amazon ES domain.
GetCompatibleElasticsearchVersions
Show Description Returns a list of upgrade compatible Elastisearch versions. You can optionally pass a DomainName to get all upgrade compatible Elasticsearch versions for that specific domain.
GetPackageVersionHistory
Show Description Returns a list of versions of the package, along with their creation time and commit message.
GetUpgradeHistory
Show Description Retrieves the complete history of the last 10 upgrades that were performed on the domain.
GetUpgradeStatus
Show Description Retrieves the latest status of the last upgrade or upgrade eligibility check that was performed on the domain.
ListDomainNames
Show Description Returns the name of all Elasticsearch domains owned by the current user's account.
ListDomainsForPackage
Show Description Lists all Amazon ES domains associated with the package.
ListElasticsearchInstanceTypes
Show Description List all Elasticsearch instance types that are supported for given ElasticsearchVersion
ListElasticsearchVersions
Show Description List all supported Elasticsearch versions
ListPackagesForDomain
Show Description Lists all packages associated with the Amazon ES domain.
ListTags
Show Description Returns all tags for the given Elasticsearch domain.
PurchaseReservedElasticsearchInstanceOffering
Show Description Allows you to purchase reserved Elasticsearch instances.
RejectInboundCrossClusterSearchConnection
Show Description Allows the destination domain owner to reject an inbound cross-cluster search connection request.
RemoveTags
StartElasticsearchServiceSoftwareUpdate
Show Description Schedules a service software update for an Amazon ES domain.
UpdateElasticsearchDomainConfig
Show Description Modifies the cluster configuration of the specified Elasticsearch domain, setting as setting the instance type and the number of instances.
UpdatePackage
Show Description Updates a package for use with Amazon ES domains.

Events Events

Service Event Name Description
events ActivateEventSource
CancelReplay
Show Description Cancels the specified replay.
CreateApiDestination
Show Description Creates an API destination, which is an HTTP invocation endpoint configured as a target for events.
CreateArchive
Show Description Creates an archive of events with the specified settings. When you create an archive, incoming events might not immediately start being sent to the archive. Allow a short period of time for changes to take effect. If you do not specify a pattern to filter events sent to the archive, all events are sent to the archive except replayed events. Replayed events are not sent to an archive.
CreateConnection
Show Description Creates a connection. A connection defines the authorization type and credentials to use for authorization with an API destination HTTP endpoint.
CreateEventBus
Show Description Creates a new event bus within your account. This can be a custom event bus which you can use to receive events from your custom applications and services, or it can be a partner event bus which can be matched to a partner event source.
CreatePartnerEventSource
Show Description Called by an SaaS partner to create a partner event source. This operation is not used by Amazon Web Services customers. Each partner event source can be used by one Amazon Web Services account to create a matching partner event bus in that Amazon Web Services account. A SaaS partner must create one partner event source for each Amazon Web Services account that wants to receive those event types. A partner event source creates events based on resources within the SaaS partner's service or application. An Amazon Web Services account that creates a partner event bus that matches the partner event source can use that event bus to receive events from the partner, and then process them using Amazon Web Services Events rules and targets. Partner event source names follow this format: partner_name/event_namespace/event_name partner_name is determined during partner registration and identifies the partner to Amazon Web Services customers. event_namespace is determined by the partner and is a way for the partner to categorize their events. event_name is determined by the partner, and should uniquely identify an event-generating resource within the partner system. The combination of event_namespace and event_name should help Amazon Web Services customers decide whether to create an event bus to receive these events.
DeactivateEventSource
DeauthorizeConnection
Show Description Removes all authorization parameters from the connection. This lets you remove the secret from the connection so you can reuse it without having to create a new connection.
DeleteApiDestination
Show Description Deletes the specified API destination.
DeleteArchive
Show Description Deletes the specified archive.
DeleteConnection
Show Description Deletes a connection.
DeleteEventBus
DeletePartnerEventSource
DeleteRule
DescribeApiDestination
Show Description Retrieves details about an API destination.
DescribeArchive
Show Description Retrieves details about an archive.
DescribeConnection
Show Description Retrieves details about a connection.
DescribeEventBus
Show Description Displays details about an event bus in your account. This can include the external Amazon Web Services accounts that are permitted to write events to your default event bus, and the associated policy. For custom event buses and partner event buses, it displays the name, ARN, policy, state, and creation time. To enable your account to receive events from other accounts on its default event bus, use PutPermission. For more information about partner event buses, see CreateEventBus.
DescribeEventSource
Show Description This operation lists details about a partner event source that is shared with your account.
DescribePartnerEventSource
Show Description An SaaS partner can use this operation to list details about a partner event source that they have created. Amazon Web Services customers do not use this operation. Instead, Amazon Web Services customers can use DescribeEventSource to see details about a partner event source that is shared with them.
DescribeReplay
Show Description Retrieves details about a replay. Use DescribeReplay to determine the progress of a running replay. A replay processes events to replay based on the time in the event, and replays them using 1 minute intervals. If you use StartReplay and specify an EventStartTime and an EventEndTime that covers a 20 minute time range, the events are replayed from the first minute of that 20 minute range first. Then the events from the second minute are replayed. You can use DescribeReplay to determine the progress of a replay. The value returned for EventLastReplayedTime indicates the time within the specified time range associated with the last event replayed.
DescribeRule
Show Description Describes the specified rule. DescribeRule does not list the targets of a rule. To see the targets associated with a rule, use ListTargetsByRule.
DisableRule
EnableRule
ListApiDestinations
Show Description Retrieves a list of API destination in the account in the current Region.
ListArchives
Show Description Lists your archives. You can either list all the archives or you can provide a prefix to match to the archive names. Filter parameters are exclusive.
ListConnections
Show Description Retrieves a list of connections from the account.
ListEventBuses
Show Description Lists all the event buses in your account, including the default event bus, custom event buses, and partner event buses.
ListEventSources
Show Description You can use this to see all the partner event sources that have been shared with your Amazon Web Services account. For more information about partner event sources, see CreateEventBus.
ListPartnerEventSourceAccounts
Show Description An SaaS partner can use this operation to display the Amazon Web Services account ID that a particular partner event source name is associated with. This operation is not used by Amazon Web Services customers.
ListPartnerEventSources
Show Description An SaaS partner can use this operation to list all the partner event source names that they have created. This operation is not used by Amazon Web Services customers.
ListReplays
Show Description Lists your replays. You can either list all the replays or you can provide a prefix to match to the replay names. Filter parameters are exclusive.
ListRuleNamesByTarget
Show Description Lists the rules for the specified target. You can see which of the rules in Amazon EventBridge can invoke a specific target in your account.
ListRules
Show Description Lists your Amazon EventBridge rules. You can either list all the rules or you can provide a prefix to match to the rule names. ListRules does not list the targets of a rule. To see the targets associated with a rule, use ListTargetsByRule.
ListTagsForResource
Show Description Displays the tags associated with an EventBridge resource. In EventBridge, rules and event buses can be tagged.
ListTargetsByRule
Show Description Lists the targets assigned to the specified rule.
PutEvents
Show Description Sends custom events to Amazon EventBridge so that they can be matched to rules.
PutPartnerEvents
Show Description This is used by SaaS partners to write events to a customer's partner event bus. Amazon Web Services customers do not use this operation.
PutPermission
PutRule
Show Description Creates or updates the specified rule. Rules are enabled by default, or based on value of the state. You can disable a rule using DisableRule. A single rule watches for events from a single event bus. Events generated by Amazon Web Services services go to your account's default event bus. Events generated by SaaS partner services or applications go to the matching partner event bus. If you have custom applications or services, you can specify whether their events go to your default event bus or a custom event bus that you have created. For more information, see CreateEventBus. If you are updating an existing rule, the rule is replaced with what you specify in this PutRule command. If you omit arguments in PutRule, the old values for those arguments are not kept. Instead, they are replaced with null values. When you create or update a rule, incoming events might not immediately start matching to new or updated rules. Allow a short period of time for changes to take effect. A rule must contain at least an EventPattern or ScheduleExpression. Rules with EventPatterns are triggered when a matching event is observed. Rules with ScheduleExpressions self-trigger based on the given schedule. A rule can have both an EventPattern and a ScheduleExpression, in which case the rule triggers on matching events as well as on a schedule. When you initially create a rule, you can optionally assign one or more tags to the rule. Tags can help you organize and categorize your resources. You can also use them to scope user permissions, by granting a user permission to access or change only rules with certain tag values. To use the PutRule operation and assign tags, you must have both the events:PutRule and events:TagResource permissions. If you are updating an existing rule, any tags you specify in the PutRule operation are ignored. To update the tags of an existing rule, use TagResource and UntagResource. Most services in Amazon Web Services treat : or / as the same character in Amazon Resource Names (ARNs). However, EventBridge uses an exact match in event patterns and rules. Be sure to use the correct ARN characters when creating event patterns so that they match the ARN syntax in the event you want to match. In EventBridge, it is possible to create rules that lead to infinite loops, where a rule is fired repeatedly. For example, a rule might detect that ACLs have changed on an S3 bucket, and trigger software to change them to the desired state. If the rule is not written carefully, the subsequent change to the ACLs fires the rule again, creating an infinite loop. To prevent this, write the rules so that the triggered actions do not re-fire the same rule. For example, your rule could fire only if ACLs are found to be in a bad state, instead of after any change. An infinite loop can quickly cause higher than expected charges. We recommend that you use budgeting, which alerts you when charges exceed your specified limit. For more information, see Managing Your Costs with Budgets.
PutTargets
Show Description Adds the specified targets to the specified rule, or updates the targets if they are already associated with the rule. Targets are the resources that are invoked when a rule is triggered. You can configure the following as targets for Events:
  • API destination
  • Amazon API Gateway REST API endpoints
  • API Gateway
  • Batch job queue
  • CloudWatch Logs group
  • CodeBuild project
  • CodePipeline
  • Amazon EC2 CreateSnapshot API call
  • Amazon EC2 RebootInstances API call
  • Amazon EC2 StopInstances API call
  • Amazon EC2 TerminateInstances API call
  • Amazon ECS tasks
  • Event bus in a different Amazon Web Services account or Region. You can use an event bus in the US East (N. Virginia) us-east-1, US West (Oregon) us-west-2, or Europe (Ireland) eu-west-1 Regions as a target for a rule.
  • Firehose delivery stream (Kinesis Data Firehose)
  • Inspector assessment template (Amazon Inspector)
  • Kinesis stream (Kinesis Data Stream)
  • Lambda function
  • Redshift clusters (Data API statement execution)
  • Amazon SNS topic
  • Amazon SQS queues (includes FIFO queues
  • SSM Automation
  • SSM OpsItem
  • SSM Run Command
  • Step Functions state machines
Creating rules with built-in targets is supported only in the Amazon Web Services Management Console. The built-in targets are EC2 CreateSnapshot API call, EC2 RebootInstances API call, EC2 StopInstances API call, and EC2 TerminateInstances API call. For some target types, PutTargets provides target-specific parameters. If the target is a Kinesis data stream, you can optionally specify which shard the event goes to by using the KinesisParameters argument. To invoke a command on multiple EC2 instances with one rule, you can use the RunCommandParameters field. To be able to make API calls against the resources that you own, Amazon EventBridge needs the appropriate permissions. For Lambda and Amazon SNS resources, EventBridge relies on resource-based policies. For EC2 instances, Kinesis Data Streams, Step Functions state machines and API Gateway REST APIs, EventBridge relies on IAM roles that you specify in the RoleARN argument in PutTargets. For more information, see Authentication and Access Control in the Amazon EventBridge User Guide. If another Amazon Web Services account is in the same region and has granted you permission (using PutPermission), you can send events to that account. Set that account's event bus as a target of the rules in your account. To send the matched events to the other account, specify that account's event bus as the Arn value when you run PutTargets. If your account sends events to another account, your account is charged for each sent event. Each event sent to another account is charged as a custom event. The account receiving the event is not charged. For more information, see Amazon EventBridge Pricing. Input, InputPath, and InputTransformer are not available with PutTarget if the target is an event bus of a different Amazon Web Services account. If you are setting the event bus of another account as the target, and that account granted permission to your account through an organization instead of directly by the account ID, then you must specify a RoleArn with proper permissions in the Target structure. For more information, see Sending and Receiving Events Between Amazon Web Services Accounts in the Amazon EventBridge User Guide. For more information about enabling cross-account events, see PutPermission. Input, InputPath, and InputTransformer are mutually exclusive and optional parameters of a target. When a rule is triggered due to a matched event:
  • If none of the following arguments are specified for a target, then the entire event is passed to the target in JSON format (unless the target is Amazon EC2 Run Command or Amazon ECS task, in which case nothing from the event is passed to the target).
  • If Input is specified in the form of valid JSON, then the matched event is overridden with this constant.
  • If InputPath is specified in the form of JSONPath (for example, $.detail), then only the part of the event specified in the path is passed to the target (for example, only the detail part of the event is passed).
  • If InputTransformer is specified, then one or more specified JSONPaths are extracted from the event and used as values in a template that you specify as the input to the target.
When you specify InputPath or InputTransformer, you must use JSON dot notation, not bracket notation. When you add targets to a rule and the associated rule triggers soon after, new or updated targets might not be immediately invoked. Allow a short period of time for changes to take effect. This action can partially fail if too many requests are made at the same time. If that happens, FailedEntryCount is non-zero in the response and each entry in FailedEntries provides the ID of the failed target and the error code.
RemovePermission
RemoveTargets
Show Description Removes the specified targets from the specified rule. When the rule is triggered, those targets are no longer be invoked. When you remove a target, when the associated rule triggers, removed targets might continue to be invoked. Allow a short period of time for changes to take effect. This action can partially fail if too many requests are made at the same time. If that happens, FailedEntryCount is non-zero in the response and each entry in FailedEntries provides the ID of the failed target and the error code.
StartReplay
Show Description Starts the specified replay. Events are not necessarily replayed in the exact same order that they were added to the archive. A replay processes events to replay based on the time in the event, and replays them using 1 minute intervals. If you specify an EventStartTime and an EventEndTime that covers a 20 minute time range, the events are replayed from the first minute of that 20 minute range first. Then the events from the second minute are replayed. You can use DescribeReplay to determine the progress of a replay. The value returned for EventLastReplayedTime indicates the time within the specified time range associated with the last event replayed.
TagResource
Show Description Assigns one or more tags (key-value pairs) to the specified EventBridge resource. Tags can help you organize and categorize your resources. You can also use them to scope user permissions by granting a user permission to access or change only resources with certain tag values. In EventBridge, rules and event buses can be tagged. Tags don't have any semantic meaning to Amazon Web Services and are interpreted strictly as strings of characters. You can use the TagResource action with a resource that already has tags. If you specify a new tag key, this tag is appended to the list of tags associated with the resource. If you specify a tag key that is already associated with the resource, the new tag value that you specify replaces the previous value for that tag. You can associate as many as 50 tags with a resource.
TestEventPattern
Show Description Tests whether the specified event pattern matches the provided event. Most services in Amazon Web Services treat : or / as the same character in Amazon Resource Names (ARNs). However, EventBridge uses an exact match in event patterns and rules. Be sure to use the correct ARN characters when creating event patterns so that they match the ARN syntax in the event you want to match.
UntagResource
Show Description Removes one or more tags from the specified EventBridge resource. In Amazon EventBridge (CloudWatch Events), rules and event buses can be tagged.
UpdateApiDestination
Show Description Updates an API destination.
UpdateArchive
Show Description Updates the specified archive.

Finspace-data Events

Service Event Name Description
finspace-data CreateChangeset
Show Description Creates a new changeset in a FinSpace dataset.
GetProgrammaticAccessCredentials
Show Description Request programmatic credentials to use with Habanero SDK.

Finspace Events

Service Event Name Description
finspace CreateEnvironment
Show Description Create a new FinSpace environment.
DeleteEnvironment
Show Description Delete an FinSpace environment.
GetEnvironment
Show Description Returns the FinSpace environment object.
ListEnvironments
Show Description A list of all of your FinSpace environments.
ListTagsForResource
Show Description A list of all tags for a resource.
TagResource
Show Description Adds metadata tags to a FinSpace resource.
UntagResource
Show Description Removes metadata tags from a FinSpace resource.

Firehose Events

Service Event Name Description
firehose CreateDeliveryStream
Show Description Creates a Kinesis Data Firehose delivery stream. By default, you can create up to 50 delivery streams per AWS Region. This is an asynchronous operation that immediately returns. The initial status of the delivery stream is CREATING. After the delivery stream is created, its status is ACTIVE and it now accepts data. If the delivery stream creation fails, the status transitions to CREATING_FAILED. Attempts to send data to a delivery stream that is not in the ACTIVE state cause an exception. To check the state of a delivery stream, use DescribeDeliveryStream. If the status of a delivery stream is CREATING_FAILED, this status doesn't change, and you can't invoke CreateDeliveryStream again on it. However, you can invoke the DeleteDeliveryStream operation to delete it. A Kinesis Data Firehose delivery stream can be configured to receive records directly from providers using PutRecord or PutRecordBatch, or it can be configured to use an existing Kinesis stream as its source. To specify a Kinesis data stream as input, set the DeliveryStreamType parameter to KinesisStreamAsSource, and provide the Kinesis stream Amazon Resource Name (ARN) and role ARN in the KinesisStreamSourceConfiguration parameter. To create a delivery stream with server-side encryption (SSE) enabled, include DeliveryStreamEncryptionConfigurationInput in your request. This is optional. You can also invoke StartDeliveryStreamEncryption to turn on SSE for an existing delivery stream that doesn't have SSE enabled. A delivery stream is configured with a single destination: Amazon S3, Amazon ES, Amazon Redshift, or Splunk. You must specify only one of the following destination configuration parameters: ExtendedS3DestinationConfiguration, S3DestinationConfiguration, ElasticsearchDestinationConfiguration, RedshiftDestinationConfiguration, or SplunkDestinationConfiguration. When you specify S3DestinationConfiguration, you can also provide the following optional values: BufferingHints, EncryptionConfiguration, and CompressionFormat. By default, if no BufferingHints value is provided, Kinesis Data Firehose buffers data up to 5 MB or for 5 minutes, whichever condition is satisfied first. BufferingHints is a hint, so there are some cases where the service cannot adhere to these conditions strictly. For example, record boundaries might be such that the size is a little over or under the configured buffering size. By default, no encryption is performed. We strongly recommend that you enable encryption to ensure secure data storage in Amazon S3. A few notes about Amazon Redshift as a destination:
  • An Amazon Redshift destination requires an S3 bucket as intermediate location. Kinesis Data Firehose first delivers data to Amazon S3 and then uses COPY syntax to load data into an Amazon Redshift table. This is specified in the RedshiftDestinationConfiguration.S3Configuration parameter.
  • The compression formats SNAPPY or ZIP cannot be specified in RedshiftDestinationConfiguration.S3Configuration because the Amazon Redshift COPY operation that reads from the S3 bucket doesn't support these compression formats.
  • We strongly recommend that you use the user name and password you provide exclusively with Kinesis Data Firehose, and that the permissions for the account are restricted for Amazon Redshift INSERT permissions.
Kinesis Data Firehose assumes the IAM role that is configured as part of the destination. The role should allow the Kinesis Data Firehose principal to assume the role, and the role should have permissions that allow the service to deliver the data. For more information, see Grant Kinesis Data Firehose Access to an Amazon S3 Destination in the Amazon Kinesis Data Firehose Developer Guide.
DeleteDeliveryStream
Show Description Deletes a delivery stream and its data. To check the state of a delivery stream, use DescribeDeliveryStream. You can delete a delivery stream only if it is in one of the following states: ACTIVE, DELETING, CREATING_FAILED, or DELETING_FAILED. You can't delete a delivery stream that is in the CREATING state. While the deletion request is in process, the delivery stream is in the DELETING state. While the delivery stream is in the DELETING state, the service might continue to accept records, but it doesn't make any guarantees with respect to delivering the data. Therefore, as a best practice, first stop any applications that are sending records before you delete a delivery stream.
DescribeDeliveryStream
Show Description Describes the specified delivery stream and its status. For example, after your delivery stream is created, call DescribeDeliveryStream to see whether the delivery stream is ACTIVE and therefore ready for data to be sent to it. If the status of a delivery stream is CREATING_FAILED, this status doesn't change, and you can't invoke CreateDeliveryStream again on it. However, you can invoke the DeleteDeliveryStream operation to delete it. If the status is DELETING_FAILED, you can force deletion by invoking DeleteDeliveryStream again but with DeleteDeliveryStreamInput$AllowForceDelete set to true.
ListDeliveryStreams
Show Description Lists your delivery streams in alphabetical order of their names. The number of delivery streams might be too large to return using a single call to ListDeliveryStreams. You can limit the number of delivery streams returned, using the Limit parameter. To determine whether there are more delivery streams to list, check the value of HasMoreDeliveryStreams in the output. If there are more delivery streams to list, you can request them by calling this operation again and setting the ExclusiveStartDeliveryStreamName parameter to the name of the last delivery stream returned in the last call.
ListTagsForDeliveryStream
Show Description Lists the tags for the specified delivery stream. This operation has a limit of five transactions per second per account.
PutRecord
Show Description Writes a single data record into an Amazon Kinesis Data Firehose delivery stream. To write multiple data records into a delivery stream, use PutRecordBatch. Applications using these operations are referred to as producers. By default, each delivery stream can take in up to 2,000 transactions per second, 5,000 records per second, or 5 MB per second. If you use PutRecord and PutRecordBatch, the limits are an aggregate across these two operations for each delivery stream. For more information about limits and how to request an increase, see Amazon Kinesis Data Firehose Limits. You must specify the name of the delivery stream and the data record when using PutRecord. The data record consists of a data blob that can be up to 1,000 KiB in size, and any kind of data. For example, it can be a segment from a log file, geographic location data, website clickstream data, and so on. Kinesis Data Firehose buffers records before delivering them to the destination. To disambiguate the data blobs at the destination, a common solution is to use delimiters in the data, such as a newline (\n) or some other character unique within the data. This allows the consumer application to parse individual data items when reading the data from the destination. The PutRecord operation returns a RecordId, which is a unique string assigned to each record. Producer applications can use this ID for purposes such as auditability and investigation. If the PutRecord operation throws a ServiceUnavailableException, back off and retry. If the exception persists, it is possible that the throughput limits have been exceeded for the delivery stream. Data records sent to Kinesis Data Firehose are stored for 24 hours from the time they are added to a delivery stream as it tries to send the records to the destination. If the destination is unreachable for more than 24 hours, the data is no longer available. Don't concatenate two or more base64 strings to form the data fields of your records. Instead, concatenate the raw data, then perform base64 encoding.
PutRecordBatch
Show Description Writes multiple data records into a delivery stream in a single call, which can achieve higher throughput per producer than when writing single records. To write single data records into a delivery stream, use PutRecord. Applications using these operations are referred to as producers. For information about service quota, see Amazon Kinesis Data Firehose Quota. Each PutRecordBatch request supports up to 500 records. Each record in the request can be as large as 1,000 KB (before base64 encoding), up to a limit of 4 MB for the entire request. These limits cannot be changed. You must specify the name of the delivery stream and the data record when using PutRecord. The data record consists of a data blob that can be up to 1,000 KB in size, and any kind of data. For example, it could be a segment from a log file, geographic location data, website clickstream data, and so on. Kinesis Data Firehose buffers records before delivering them to the destination. To disambiguate the data blobs at the destination, a common solution is to use delimiters in the data, such as a newline (\n) or some other character unique within the data. This allows the consumer application to parse individual data items when reading the data from the destination. The PutRecordBatch response includes a count of failed records, FailedPutCount, and an array of responses, RequestResponses. Even if the PutRecordBatch call succeeds, the value of FailedPutCount may be greater than 0, indicating that there are records for which the operation didn't succeed. Each entry in the RequestResponses array provides additional information about the processed record. It directly correlates with a record in the request array using the same ordering, from the top to the bottom. The response array always includes the same number of records as the request array. RequestResponses includes both successfully and unsuccessfully processed records. Kinesis Data Firehose tries to process all records in each PutRecordBatch request. A single record failure does not stop the processing of subsequent records. A successfully processed record includes a RecordId value, which is unique for the record. An unsuccessfully processed record includes ErrorCode and ErrorMessage values. ErrorCode reflects the type of error, and is one of the following values: ServiceUnavailableException or InternalFailure. ErrorMessage provides more detailed information about the error. If there is an internal server error or a timeout, the write might have completed or it might have failed. If FailedPutCount is greater than 0, retry the request, resending only those records that might have failed processing. This minimizes the possible duplicate records and also reduces the total bytes sent (and corresponding charges). We recommend that you handle any duplicates at the destination. If PutRecordBatch throws ServiceUnavailableException, back off and retry. If the exception persists, it is possible that the throughput limits have been exceeded for the delivery stream. Data records sent to Kinesis Data Firehose are stored for 24 hours from the time they are added to a delivery stream as it attempts to send the records to the destination. If the destination is unreachable for more than 24 hours, the data is no longer available. Don't concatenate two or more base64 strings to form the data fields of your records. Instead, concatenate the raw data, then perform base64 encoding.
StartDeliveryStreamEncryption
Show Description Enables server-side encryption (SSE) for the delivery stream. This operation is asynchronous. It returns immediately. When you invoke it, Kinesis Data Firehose first sets the encryption status of the stream to ENABLING, and then to ENABLED. The encryption status of a delivery stream is the Status property in DeliveryStreamEncryptionConfiguration. If the operation fails, the encryption status changes to ENABLING_FAILED. You can continue to read and write data to your delivery stream while the encryption status is ENABLING, but the data is not encrypted. It can take up to 5 seconds after the encryption status changes to ENABLED before all records written to the delivery stream are encrypted. To find out whether a record or a batch of records was encrypted, check the response elements PutRecordOutput$Encrypted and PutRecordBatchOutput$Encrypted, respectively. To check the encryption status of a delivery stream, use DescribeDeliveryStream. Even if encryption is currently enabled for a delivery stream, you can still invoke this operation on it to change the ARN of the CMK or both its type and ARN. If you invoke this method to change the CMK, and the old CMK is of type CUSTOMER_MANAGED_CMK, Kinesis Data Firehose schedules the grant it had on the old CMK for retirement. If the new CMK is of type CUSTOMER_MANAGED_CMK, Kinesis Data Firehose creates a grant that enables it to use the new CMK to encrypt and decrypt data and to manage the grant. If a delivery stream already has encryption enabled and then you invoke this operation to change the ARN of the CMK or both its type and ARN and you get ENABLING_FAILED, this only means that the attempt to change the CMK failed. In this case, encryption remains enabled with the old CMK. If the encryption status of your delivery stream is ENABLING_FAILED, you can invoke this operation again with a valid CMK. The CMK must be enabled and the key policy mustn't explicitly deny the permission for Kinesis Data Firehose to invoke KMS encrypt and decrypt operations. You can enable SSE for a delivery stream only if it's a delivery stream that uses DirectPut as its source. The StartDeliveryStreamEncryption and StopDeliveryStreamEncryption operations have a combined limit of 25 calls per delivery stream per 24 hours. For example, you reach the limit if you call StartDeliveryStreamEncryption 13 times and StopDeliveryStreamEncryption 12 times for the same delivery stream in a 24-hour period.
StopDeliveryStreamEncryption
Show Description Disables server-side encryption (SSE) for the delivery stream. This operation is asynchronous. It returns immediately. When you invoke it, Kinesis Data Firehose first sets the encryption status of the stream to DISABLING, and then to DISABLED. You can continue to read and write data to your stream while its status is DISABLING. It can take up to 5 seconds after the encryption status changes to DISABLED before all records written to the delivery stream are no longer subject to encryption. To find out whether a record or a batch of records was encrypted, check the response elements PutRecordOutput$Encrypted and PutRecordBatchOutput$Encrypted, respectively. To check the encryption state of a delivery stream, use DescribeDeliveryStream. If SSE is enabled using a customer managed CMK and then you invoke StopDeliveryStreamEncryption, Kinesis Data Firehose schedules the related KMS grant for retirement and then retires it after it ensures that it is finished delivering records to the destination. The StartDeliveryStreamEncryption and StopDeliveryStreamEncryption operations have a combined limit of 25 calls per delivery stream per 24 hours. For example, you reach the limit if you call StartDeliveryStreamEncryption 13 times and StopDeliveryStreamEncryption 12 times for the same delivery stream in a 24-hour period.
TagDeliveryStream
Show Description Adds or updates tags for the specified delivery stream. A tag is a key-value pair that you can define and assign to AWS resources. If you specify a tag that already exists, the tag value is replaced with the value that you specify in the request. Tags are metadata. For example, you can add friendly names and descriptions or other types of information that can help you distinguish the delivery stream. For more information about tags, see Using Cost Allocation Tags in the AWS Billing and Cost Management User Guide. Each delivery stream can have up to 50 tags. This operation has a limit of five transactions per second per account.
UntagDeliveryStream
Show Description Removes tags from the specified delivery stream. Removed tags are deleted, and you can't recover them after this operation successfully completes. If you specify a tag that doesn't exist, the operation ignores it. This operation has a limit of five transactions per second per account.

Fis Events

Service Event Name Description
fis CreateExperimentTemplate
Show Description Creates an experiment template. To create a template, specify the following information:
  • Targets: A target can be a specific resource in your AWS environment, or one or more resources that match criteria that you specify, for example, resources that have specific tags.
  • Actions: The actions to carry out on the target. You can specify multiple actions, the duration of each action, and when to start each action during an experiment.
  • Stop conditions: If a stop condition is triggered while an experiment is running, the experiment is automatically stopped. You can define a stop condition as a CloudWatch alarm.
For more information, see the AWS Fault Injection Simulator User Guide.
DeleteExperimentTemplate
Show Description Deletes the specified experiment template.
GetAction
Show Description Gets information about the specified AWS FIS action.
GetExperiment
Show Description Gets information about the specified experiment.
GetExperimentTemplate
Show Description Gets information about the specified experiment template.
ListActions
Show Description Lists the available AWS FIS actions.
ListExperimentTemplates
Show Description Lists your experiment templates.
ListExperiments
Show Description Lists your experiments.
ListTagsForResource
Show Description Lists the tags for the specified resource.
StartExperiment
Show Description Starts running an experiment from the specified experiment template.
StopExperiment
Show Description Stops the specified experiment.
TagResource
Show Description Applies the specified tags to the specified resource.
UntagResource
Show Description Removes the specified tags from the specified resource.

Forecast Events

Service Event Name Description
forecast CreateDataset
Show Description Creates an Amazon Forecast dataset. The information about the dataset that you provide helps Forecast understand how to consume the data for model training. This includes the following:
  • DataFrequency - How frequently your historical time-series data is collected.
  • Domain and DatasetType - Each dataset has an associated dataset domain and a type within the domain. Amazon Forecast provides a list of predefined domains and types within each domain. For each unique dataset domain and type within the domain, Amazon Forecast requires your data to include a minimum set of predefined fields.
  • Schema - A schema specifies the fields in the dataset, including the field name and data type.
After creating a dataset, you import your training data into it and add the dataset to a dataset group. You use the dataset group to create a predictor. For more information, see howitworks-datasets-groups. To get a list of all your datasets, use the ListDatasets operation. For example Forecast datasets, see the Amazon Forecast Sample GitHub repository. The Status of a dataset must be ACTIVE before you can import training data. Use the DescribeDataset operation to get the status.
CreateDatasetGroup
Show Description Creates a dataset group, which holds a collection of related datasets. You can add datasets to the dataset group when you create the dataset group, or later by using the UpdateDatasetGroup operation. After creating a dataset group and adding datasets, you use the dataset group when you create a predictor. For more information, see howitworks-datasets-groups. To get a list of all your datasets groups, use the ListDatasetGroups operation. The Status of a dataset group must be ACTIVE before you can use the dataset group to create a predictor. To get the status, use the DescribeDatasetGroup operation.
CreateDatasetImportJob
Show Description Imports your training data to an Amazon Forecast dataset. You provide the location of your training data in an Amazon Simple Storage Service (Amazon S3) bucket and the Amazon Resource Name (ARN) of the dataset that you want to import the data to. You must specify a DataSource object that includes an AWS Identity and Access Management (IAM) role that Amazon Forecast can assume to access the data, as Amazon Forecast makes a copy of your data and processes it in an internal AWS system. For more information, see aws-forecast-iam-roles. The training data must be in CSV format. The delimiter must be a comma (,). You can specify the path to a specific CSV file, the S3 bucket, or to a folder in the S3 bucket. For the latter two cases, Amazon Forecast imports all files up to the limit of 10,000 files. Because dataset imports are not aggregated, your most recent dataset import is the one that is used when training a predictor or generating a forecast. Make sure that your most recent dataset import contains all of the data you want to model off of, and not just the new data collected since the previous import. To get a list of all your dataset import jobs, filtered by specified criteria, use the ListDatasetImportJobs operation.
CreateForecast
Show Description Creates a forecast for each item in the TARGET_TIME_SERIES dataset that was used to train the predictor. This is known as inference. To retrieve the forecast for a single item at low latency, use the operation. To export the complete forecast into your Amazon Simple Storage Service (Amazon S3) bucket, use the CreateForecastExportJob operation. The range of the forecast is determined by the ForecastHorizon value, which you specify in the CreatePredictor request. When you query a forecast, you can request a specific date range within the forecast. To get a list of all your forecasts, use the ListForecasts operation. The forecasts generated by Amazon Forecast are in the same time zone as the dataset that was used to create the predictor. For more information, see howitworks-forecast. The Status of the forecast must be ACTIVE before you can query or export the forecast. Use the DescribeForecast operation to get the status.
CreateForecastExportJob
Show Description Exports a forecast created by the CreateForecast operation to your Amazon Simple Storage Service (Amazon S3) bucket. The forecast file name will match the following conventions: <ForecastExportJobName>_<ExportTimestamp>_<PartNumber> where the <ExportTimestamp> component is in Java SimpleDateFormat (yyyy-MM-ddTHH-mm-ssZ). You must specify a DataDestination object that includes an AWS Identity and Access Management (IAM) role that Amazon Forecast can assume to access the Amazon S3 bucket. For more information, see aws-forecast-iam-roles. For more information, see howitworks-forecast. To get a list of all your forecast export jobs, use the ListForecastExportJobs operation. The Status of the forecast export job must be ACTIVE before you can access the forecast in your Amazon S3 bucket. To get the status, use the DescribeForecastExportJob operation.
CreatePredictor
Show Description Creates an Amazon Forecast predictor. In the request, provide a dataset group and either specify an algorithm or let Amazon Forecast choose an algorithm for you using AutoML. If you specify an algorithm, you also can override algorithm-specific hyperparameters. Amazon Forecast uses the algorithm to train a predictor using the latest version of the datasets in the specified dataset group. You can then generate a forecast using the CreateForecast operation. To see the evaluation metrics, use the GetAccuracyMetrics operation. You can specify a featurization configuration to fill and aggregate the data fields in the TARGET_TIME_SERIES dataset to improve model training. For more information, see FeaturizationConfig. For RELATED_TIME_SERIES datasets, CreatePredictor verifies that the DataFrequency specified when the dataset was created matches the ForecastFrequency. TARGET_TIME_SERIES datasets don't have this restriction. Amazon Forecast also verifies the delimiter and timestamp format. For more information, see howitworks-datasets-groups. By default, predictors are trained and evaluated at the 0.1 (P10), 0.5 (P50), and 0.9 (P90) quantiles. You can choose custom forecast types to train and evaluate your predictor by setting the ForecastTypes. AutoML If you want Amazon Forecast to evaluate each algorithm and choose the one that minimizes the objective function, set PerformAutoML to true. The objective function is defined as the mean of the weighted losses over the forecast types. By default, these are the p10, p50, and p90 quantile losses. For more information, see EvaluationResult. When AutoML is enabled, the following properties are disallowed:
  • AlgorithmArn
  • HPOConfig
  • PerformHPO
  • TrainingParameters
To get a list of all of your predictors, use the ListPredictors operation. Before you can use the predictor to create a forecast, the Status of the predictor must be ACTIVE, signifying that training has completed. To get the status, use the DescribePredictor operation.
CreatePredictorBacktestExportJob
Show Description Exports backtest forecasts and accuracy metrics generated by the CreatePredictor operation. Two folders containing CSV files are exported to your specified S3 bucket. The export file names will match the following conventions: <ExportJobName>_<ExportTimestamp>_<PartNumber>.csv The <ExportTimestamp> component is in Java SimpleDate format (yyyy-MM-ddTHH-mm-ssZ). You must specify a DataDestination object that includes an Amazon S3 bucket and an AWS Identity and Access Management (IAM) role that Amazon Forecast can assume to access the Amazon S3 bucket. For more information, see aws-forecast-iam-roles. The Status of the export job must be ACTIVE before you can access the export in your Amazon S3 bucket. To get the status, use the DescribePredictorBacktestExportJob operation.
DeleteDataset
DeleteDatasetGroup
DeleteDatasetImportJob
DeleteForecast
DeleteForecastExportJob
DeletePredictor
DeletePredictorBacktestExportJob
DeleteResourceTree
DescribeDataset
Show Description Describes an Amazon Forecast dataset created using the CreateDataset operation. In addition to listing the parameters specified in the CreateDataset request, this operation includes the following dataset properties:
  • CreationTime
  • LastModificationTime
  • Status
DescribeDatasetGroup
Show Description Describes a dataset group created using the CreateDatasetGroup operation. In addition to listing the parameters provided in the CreateDatasetGroup request, this operation includes the following properties:
  • DatasetArns - The datasets belonging to the group.
  • CreationTime
  • LastModificationTime
  • Status
DescribeDatasetImportJob
Show Description Describes a dataset import job created using the CreateDatasetImportJob operation. In addition to listing the parameters provided in the CreateDatasetImportJob request, this operation includes the following properties:
  • CreationTime
  • LastModificationTime
  • DataSize
  • FieldStatistics
  • Status
  • Message - If an error occurred, information about the error.
DescribeForecast
Show Description Describes a forecast created using the CreateForecast operation. In addition to listing the properties provided in the CreateForecast request, this operation lists the following properties:
  • DatasetGroupArn - The dataset group that provided the training data.
  • CreationTime
  • LastModificationTime
  • Status
  • Message - If an error occurred, information about the error.
DescribeForecastExportJob
Show Description Describes a forecast export job created using the CreateForecastExportJob operation. In addition to listing the properties provided by the user in the CreateForecastExportJob request, this operation lists the following properties:
  • CreationTime
  • LastModificationTime
  • Status
  • Message - If an error occurred, information about the error.
DescribePredictor
Show Description Describes a predictor created using the CreatePredictor operation. In addition to listing the properties provided in the CreatePredictor request, this operation lists the following properties:
  • DatasetImportJobArns - The dataset import jobs used to import training data.
  • AutoMLAlgorithmArns - If AutoML is performed, the algorithms that were evaluated.
  • CreationTime
  • LastModificationTime
  • Status
  • Message - If an error occurred, information about the error.
DescribePredictorBacktestExportJob
Show Description Describes a predictor backtest export job created using the CreatePredictorBacktestExportJob operation. In addition to listing the properties provided by the user in the CreatePredictorBacktestExportJob request, this operation lists the following properties:
  • CreationTime
  • LastModificationTime
  • Status
  • Message (if an error occurred)
GetAccuracyMetrics
Show Description Provides metrics on the accuracy of the models that were trained by the CreatePredictor operation. Use metrics to see how well the model performed and to decide whether to use the predictor to generate a forecast. For more information, see Predictor Metrics. This operation generates metrics for each backtest window that was evaluated. The number of backtest windows (NumberOfBacktestWindows) is specified using the EvaluationParameters object, which is optionally included in the CreatePredictor request. If NumberOfBacktestWindows isn't specified, the number defaults to one. The parameters of the filling method determine which items contribute to the metrics. If you want all items to contribute, specify zero. If you want only those items that have complete data in the range being evaluated to contribute, specify nan. For more information, see FeaturizationMethod. Before you can get accuracy metrics, the Status of the predictor must be ACTIVE, signifying that training has completed. To get the status, use the DescribePredictor operation.
ListDatasetGroups
Show Description Returns a list of dataset groups created using the CreateDatasetGroup operation. For each dataset group, this operation returns a summary of its properties, including its Amazon Resource Name (ARN). You can retrieve the complete set of properties by using the dataset group ARN with the DescribeDatasetGroup operation.
ListDatasetImportJobs
Show Description Returns a list of dataset import jobs created using the CreateDatasetImportJob operation. For each import job, this operation returns a summary of its properties, including its Amazon Resource Name (ARN). You can retrieve the complete set of properties by using the ARN with the DescribeDatasetImportJob operation. You can filter the list by providing an array of Filter objects.
ListDatasets
Show Description Returns a list of datasets created using the CreateDataset operation. For each dataset, a summary of its properties, including its Amazon Resource Name (ARN), is returned. To retrieve the complete set of properties, use the ARN with the DescribeDataset operation.
ListForecastExportJobs
Show Description Returns a list of forecast export jobs created using the CreateForecastExportJob operation. For each forecast export job, this operation returns a summary of its properties, including its Amazon Resource Name (ARN). To retrieve the complete set of properties, use the ARN with the DescribeForecastExportJob operation. You can filter the list using an array of Filter objects.
ListForecasts
Show Description Returns a list of forecasts created using the CreateForecast operation. For each forecast, this operation returns a summary of its properties, including its Amazon Resource Name (ARN). To retrieve the complete set of properties, specify the ARN with the DescribeForecast operation. You can filter the list using an array of Filter objects.
ListPredictorBacktestExportJobs
Show Description Returns a list of predictor backtest export jobs created using the CreatePredictorBacktestExportJob operation. This operation returns a summary for each backtest export job. You can filter the list using an array of Filter objects. To retrieve the complete set of properties for a particular backtest export job, use the ARN with the DescribePredictorBacktestExportJob operation.
ListPredictors
Show Description Returns a list of predictors created using the CreatePredictor operation. For each predictor, this operation returns a summary of its properties, including its Amazon Resource Name (ARN). You can retrieve the complete set of properties by using the ARN with the DescribePredictor operation. You can filter the list using an array of Filter objects.
ListTagsForResource
Show Description Lists the tags for an Amazon Forecast resource.
StopResource
TagResource
Show Description Associates the specified tags to a resource with the specified resourceArn. If existing tags on a resource are not specified in the request parameters, they are not changed. When a resource is deleted, the tags associated with that resource are also deleted.
UntagResource
Show Description Deletes the specified tags from a resource.

Forecastquery Events

Service Event Name Description
forecastquery QueryForecast
Show Description Retrieves a forecast for a single item, filtered by the supplied criteria. The criteria is a key-value pair. The key is either item_id (or the equivalent non-timestamp, non-target field) from the TARGET_TIME_SERIES dataset, or one of the forecast dimensions specified as part of the FeaturizationConfig object. By default, QueryForecast returns the complete date range for the filtered forecast. You can request a specific date range. To get the full forecast, use the CreateForecastExportJob operation. The forecasts generated by Amazon Forecast are in the same timezone as the dataset that was used to create the predictor.

Gamelift Events

Service Event Name Description
gamelift AcceptMatch
Show Description Registers a player's acceptance or rejection of a proposed FlexMatch match. A matchmaking configuration may require player acceptance; if so, then matches built with that configuration cannot be completed unless all players accept the proposed match within a specified time limit. When FlexMatch builds a match, all the matchmaking tickets involved in the proposed match are placed into status REQUIRES_ACCEPTANCE. This is a trigger for your game to get acceptance from all players in the ticket. Acceptances are only valid for tickets when they are in this status; all other acceptances result in an error. To register acceptance, specify the ticket ID, a response, and one or more players. Once all players have registered acceptance, the matchmaking tickets advance to status PLACING, where a new game session is created for the match. If any player rejects the match, or if acceptances are not received before a specified timeout, the proposed match is dropped. The matchmaking tickets are then handled in one of two ways: For tickets where one or more players rejected the match, the ticket status is returned to SEARCHING to find a new match. For tickets where one or more players failed to respond, the ticket status is set to CANCELLED, and processing is terminated. A new matchmaking request for these players can be submitted as needed. Learn more Add FlexMatch to a game client FlexMatch events (reference) Related actions StartMatchmaking
ClaimGameServer
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Locates an available game server and temporarily reserves it to host gameplay and players. This operation is called from a game client or client service (such as a matchmaker) to request hosting resources for a new game session. In response, GameLift FleetIQ locates an available game server, places it in CLAIMED status for 60 seconds, and returns connection information that players can use to connect to the game server. To claim a game server, identify a game server group. You can also specify a game server ID, although this approach bypasses GameLift FleetIQ placement optimization. Optionally, include game data to pass to the game server at the start of a game session, such as a game map or player information. When a game server is successfully claimed, connection information is returned. A claimed game server's utilization status remains AVAILABLE while the claim status is set to CLAIMED for up to 60 seconds. This time period gives the game server time to update its status to UTILIZED (using UpdateGameServer) once players join. If the game server's status is not updated within 60 seconds, the game server reverts to unclaimed status and is available to be claimed by another request. The claim time period is a fixed value and is not configurable. If you try to claim a specific game server, this request will fail in the following cases:
  • If the game server utilization status is UTILIZED.
  • If the game server claim status is CLAIMED.
When claiming a specific game server, this request will succeed even if the game server is running on an instance in DRAINING status. To avoid this, first check the instance status by calling DescribeGameServerInstances. Learn more GameLift FleetIQ Guide Related actions RegisterGameServer
CreateAlias
Show Description Creates an alias for a fleet. In most situations, you can use an alias ID in place of a fleet ID. An alias provides a level of abstraction for a fleet that is useful when redirecting player traffic from one fleet to another, such as when updating your game build. Amazon GameLift supports two types of routing strategies for aliases: simple and terminal. A simple alias points to an active fleet. A terminal alias is used to display messaging or link to a URL instead of routing players to an active fleet. For example, you might use a terminal alias when a game version is no longer supported and you want to direct players to an upgrade site. To create a fleet alias, specify an alias name, routing strategy, and optional description. Each simple alias can point to only one fleet, but a fleet can have multiple aliases. If successful, a new alias record is returned, including an alias ID and an ARN. You can reassign an alias to another fleet by calling UpdateAlias. Related actions CreateAlias
CreateBuild
Show Description Creates a new Amazon GameLift build resource for your game server binary files. Game server binaries must be combined into a zip file for use with Amazon GameLift. When setting up a new game build for GameLift, we recommend using the AWS CLI command upload-build . This helper command combines two tasks: (1) it uploads your build files from a file directory to a GameLift Amazon S3 location, and (2) it creates a new build resource. The CreateBuild operation can used in the following scenarios:
  • To create a new game build with build files that are in an Amazon S3 location under an AWS account that you control. To use this option, you must first give Amazon GameLift access to the Amazon S3 bucket. With permissions in place, call CreateBuild and specify a build name, operating system, and the Amazon S3 storage location of your game build.
  • To directly upload your build files to a GameLift Amazon S3 location. To use this option, first call CreateBuild and specify a build name and operating system. This operation creates a new build resource and also returns an Amazon S3 location with temporary access credentials. Use the credentials to manually upload your build files to the specified Amazon S3 location. For more information, see Uploading Objects in the Amazon S3 Developer Guide. Build files can be uploaded to the GameLift Amazon S3 location once only; that can't be updated.
If successful, this operation creates a new build resource with a unique build ID and places it in INITIALIZED status. A build must be in READY status before you can create fleets with it. Learn more Uploading Your Game Create a Build with Files in Amazon S3 Related actions CreateBuild
CreateFleet
Show Description Creates a fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances to host your custom game server or Realtime Servers. Use this operation to configure the computing resources for your fleet and provide instructions for running game servers on each instance. Most GameLift fleets can deploy instances to multiple locations, including the home Region (where the fleet is created) and an optional set of remote locations. Fleets that are created in the following AWS Regions support multiple locations: us-east-1 (N. Virginia), us-west-2 (Oregon), eu-central-1 (Frankfurt), eu-west-1 (Ireland), ap-southeast-2 (Sydney), ap-northeast-1 (Tokyo), and ap-northeast-2 (Seoul). Fleets that are created in other GameLift Regions can deploy instances in the fleet's home Region only. All fleet instances use the same configuration regardless of location; however, you can adjust capacity settings and turn auto-scaling on/off for each location. To create a fleet, choose the hardware for your instances, specify a game server build or Realtime script to deploy, and provide a runtime configuration to direct GameLift how to start and run game servers on each instance in the fleet. Set permissions for inbound traffic to your game servers, and enable optional features as needed. When creating a multi-location fleet, provide a list of additional remote locations. If successful, this operation creates a new Fleet resource and places it in NEW status, which prompts GameLift to initiate the fleet creation workflow. You can track fleet creation by checking fleet status using DescribeFleetAttributes and DescribeFleetLocationAttributes/, or by monitoring fleet creation events using DescribeFleetEvents. As soon as the fleet status changes to ACTIVE, you can enable automatic scaling for the fleet with PutScalingPolicy and set capacity for the home Region with UpdateFleetCapacity. When the status of each remote location reaches ACTIVE, you can set capacity by location using UpdateFleetCapacity. Learn more Setting up fleets Debug fleet creation issues Multi-location fleets Related actions CreateFleet
CreateFleetLocations
Show Description Adds remote locations to a fleet and begins populating the new locations with EC2 instances. The new instances conform to the fleet's instance type, auto-scaling, and other configuration settings. This operation cannot be used with fleets that don't support remote locations. Fleets can have multiple locations only if they reside in AWS Regions that support this feature (see CreateFleet for the complete list) and were created after the feature was released in March 2021. To add fleet locations, specify the fleet to be updated and provide a list of one or more locations. If successful, this operation returns the list of added locations with their status set to NEW. GameLift initiates the process of starting an instance in each added location. You can track the status of each new location by monitoring location creation events using DescribeFleetEvents. Alternatively, you can poll location status by calling DescribeFleetLocationAttributes. After a location status becomes ACTIVE, you can adjust the location's capacity as needed with UpdateFleetCapacity. Learn more Setting up fleets Multi-location fleets Related actions CreateFleetLocations
CreateGameServerGroup
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Creates a GameLift FleetIQ game server group for managing game hosting on a collection of Amazon EC2 instances for game hosting. This operation creates the game server group, creates an Auto Scaling group in your AWS account, and establishes a link between the two groups. You can view the status of your game server groups in the GameLift console. Game server group metrics and events are emitted to Amazon CloudWatch. Before creating a new game server group, you must have the following:
  • An Amazon EC2 launch template that specifies how to launch Amazon EC2 instances with your game server build. For more information, see Launching an Instance from a Launch Template in the Amazon EC2 User Guide.
  • An IAM role that extends limited access to your AWS account to allow GameLift FleetIQ to create and interact with the Auto Scaling group. For more information, see Create IAM roles for cross-service interaction in the GameLift FleetIQ Developer Guide.
To create a new game server group, specify a unique group name, IAM role and Amazon EC2 launch template, and provide a list of instance types that can be used in the group. You must also set initial maximum and minimum limits on the group's instance count. You can optionally set an Auto Scaling policy with target tracking based on a GameLift FleetIQ metric. Once the game server group and corresponding Auto Scaling group are created, you have full access to change the Auto Scaling group's configuration as needed. Several properties that are set when creating a game server group, including maximum/minimum size and auto-scaling policy settings, must be updated directly in the Auto Scaling group. Keep in mind that some Auto Scaling group properties are periodically updated by GameLift FleetIQ as part of its balancing activities to optimize for availability and cost. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
CreateGameSession
Show Description Creates a multiplayer game session for players in a specific fleet location. This operation prompts an available server process to start a game session and retrieves connection information for the new game session. As an alternative, consider using the GameLift game session placement feature with with StartGameSessionPlacement, which uses FleetIQ algorithms and queues to optimize the placement process. When creating a game session, you specify exactly where you want to place it and provide a set of game session configuration settings. The fleet must be in ACTIVE status before a game session can be created in it. This operation can be used in the following ways:
  • To create a game session on an instance in a fleet's home Region, provide a fleet or alias ID along with your game session configuration.
  • To create a game session on an instance in a fleet's remote location, provide a fleet or alias ID and a location name, along with your game session configuration.
If successful, a workflow is initiated to start a new game session. A GameSession object is returned containing the game session configuration and status. When the status is ACTIVE, game session connection information is provided and player sessions can be created for the game session. By default, newly created game sessions are open to new players. You can restrict new player access by using UpdateGameSession to change the game session's player session creation policy. Game session logs are retained for all active game sessions for 14 days. To access the logs, call GetGameSessionLogUrl to download the log files. Available in GameLift Local. Learn more Start a game session Related actions CreateGameSession
CreateGameSessionQueue
Show Description Creates a placement queue that processes requests for new game sessions. A queue uses FleetIQ algorithms to determine the best placement locations and find an available game server there, then prompts the game server process to start a new game session. A game session queue is configured with a set of destinations (GameLift fleets or aliases), which determine the locations where the queue can place new game sessions. These destinations can span multiple fleet types (Spot and On-Demand), instance types, and AWS Regions. If the queue includes multi-location fleets, the queue is able to place game sessions in all of a fleet's remote locations. You can opt to filter out individual locations if needed. The queue configuration also determines how FleetIQ selects the best available placement for a new game session. Before searching for an available game server, FleetIQ first prioritizes the queue's destinations and locations, with the best placement locations on top. You can set up the queue to use the FleetIQ default prioritization or provide an alternate set of priorities. To create a new queue, provide a name, timeout value, and a list of destinations. Optionally, specify a sort configuration and/or a filter, and define a set of latency cap policies. You can also include the ARN for an Amazon Simple Notification Service (SNS) topic to receive notifications of game session placement activity. Notifications using SNS or CloudWatch events is the preferred way to track placement activity. If successful, a new GameSessionQueue object is returned with an assigned queue ARN. New game session requests, which are submitted to the queue with StartGameSessionPlacement or StartMatchmaking, reference a queue's name or ARN. Learn more Design a game session queue Create a game session queue Related actions CreateGameSessionQueue
CreateMatchmakingConfiguration
Show Description Defines a new matchmaking configuration for use with FlexMatch. Whether your are using FlexMatch with GameLift hosting or as a standalone matchmaking service, the matchmaking configuration sets out rules for matching players and forming teams. If you're also using GameLift hosting, it defines how to start game sessions for each match. Your matchmaking system can use multiple configurations to handle different game scenarios. All matchmaking requests (StartMatchmaking or StartMatchBackfill) identify the matchmaking configuration to use and provide player attributes consistent with that configuration. To create a matchmaking configuration, you must provide the following: configuration name and FlexMatch mode (with or without GameLift hosting); a rule set that specifies how to evaluate players and find acceptable matches; whether player acceptance is required; and the maximum time allowed for a matchmaking attempt. When using FlexMatch with GameLift hosting, you also need to identify the game session queue to use when starting a game session for the match. In addition, you must set up an Amazon Simple Notification Service (SNS) topic to receive matchmaking notifications. Provide the topic ARN in the matchmaking configuration. An alternative method, continuously polling ticket status with DescribeMatchmaking, is only suitable for games in development with low matchmaking usage. Learn more Design a FlexMatch matchmaker Set up FlexMatch event notification Related actions CreateMatchmakingConfiguration
CreateMatchmakingRuleSet
Show Description Creates a new rule set for FlexMatch matchmaking. A rule set describes the type of match to create, such as the number and size of teams. It also sets the parameters for acceptable player matches, such as minimum skill level or character type. A rule set is used by a MatchmakingConfiguration. To create a matchmaking rule set, provide unique rule set name and the rule set body in JSON format. Rule sets must be defined in the same Region as the matchmaking configuration they are used with. Since matchmaking rule sets cannot be edited, it is a good idea to check the rule set syntax using ValidateMatchmakingRuleSet before creating a new rule set. Learn more Related actions CreateMatchmakingConfiguration
CreatePlayerSession
Show Description Reserves an open player slot in a game session for a player. New player sessions can be created in any game session with an open slot that is in ACTIVE status and has a player creation policy of ACCEPT_ALL. You can add a group of players to a game session with CreatePlayerSessions. To create a player session, specify a game session ID, player ID, and optionally a set of player data. If successful, a slot is reserved in the game session for the player and a new PlayerSession object is returned with a player session ID. The player references the player session ID when sending a connection request to the game session, and the game server can use it to validate the player reservation with the GameLift service. Player sessions cannot be updated. Available in Amazon GameLift Local. Related actions CreatePlayerSession
CreatePlayerSessions
Show Description Reserves open slots in a game session for a group of players. New player sessions can be created in any game session with an open slot that is in ACTIVE status and has a player creation policy of ACCEPT_ALL. To add a single player to a game session, use CreatePlayerSession. To create player sessions, specify a game session ID and a list of player IDs. Optionally, provide a set of player data for each player ID. If successful, a slot is reserved in the game session for each player, and new PlayerSession objects are returned with player session IDs. Each player references their player session ID when sending a connection request to the game session, and the game server can use it to validate the player reservation with the GameLift service. Player sessions cannot be updated. Available in Amazon GameLift Local. Related actions CreatePlayerSession
CreateScript
Show Description Creates a new script record for your Realtime Servers script. Realtime scripts are JavaScript that provide configuration settings and optional custom game logic for your game. The script is deployed when you create a Realtime Servers fleet to host your game sessions. Script logic is executed during an active game session. To create a new script record, specify a script name and provide the script file(s). The script files and all dependencies must be zipped into a single file. You can pull the zip file from either of these locations:
  • A locally available directory. Use the ZipFile parameter for this option.
  • An Amazon Simple Storage Service (Amazon S3) bucket under your AWS account. Use the StorageLocation parameter for this option. You'll need to have an Identity Access Management (IAM) role that allows the Amazon GameLift service to access your S3 bucket.
If the call is successful, a new script record is created with a unique script ID. If the script file is provided as a local file, the file is uploaded to an Amazon GameLift-owned S3 bucket and the script record's storage location reflects this location. If the script file is provided as an S3 bucket, Amazon GameLift accesses the file at this storage location as needed for deployment. Learn more Amazon GameLift Realtime Servers Set Up a Role for Amazon GameLift Access Related actions CreateScript
CreateVpcPeeringAuthorization
Show Description Requests authorization to create or delete a peer connection between the VPC for your Amazon GameLift fleet and a virtual private cloud (VPC) in your AWS account. VPC peering enables the game servers on your fleet to communicate directly with other AWS resources. Once you've received authorization, call CreateVpcPeeringConnection to establish the peering connection. For more information, see VPC Peering with Amazon GameLift Fleets. You can peer with VPCs that are owned by any AWS account you have access to, including the account that you use to manage your Amazon GameLift fleets. You cannot peer with VPCs that are in different Regions. To request authorization to create a connection, call this operation from the AWS account with the VPC that you want to peer to your Amazon GameLift fleet. For example, to enable your game servers to retrieve data from a DynamoDB table, use the account that manages that DynamoDB resource. Identify the following values: (1) The ID of the VPC that you want to peer with, and (2) the ID of the AWS account that you use to manage Amazon GameLift. If successful, VPC peering is authorized for the specified VPC. To request authorization to delete a connection, call this operation from the AWS account with the VPC that is peered with your Amazon GameLift fleet. Identify the following values: (1) VPC ID that you want to delete the peering connection for, and (2) ID of the AWS account that you use to manage Amazon GameLift. The authorization remains valid for 24 hours unless it is canceled by a call to DeleteVpcPeeringAuthorization. You must create or delete the peering connection while the authorization is valid. Related actions CreateVpcPeeringAuthorization
CreateVpcPeeringConnection
Show Description Establishes a VPC peering connection between a virtual private cloud (VPC) in an AWS account with the VPC for your Amazon GameLift fleet. VPC peering enables the game servers on your fleet to communicate directly with other AWS resources. You can peer with VPCs in any AWS account that you have access to, including the account that you use to manage your Amazon GameLift fleets. You cannot peer with VPCs that are in different Regions. For more information, see VPC Peering with Amazon GameLift Fleets. Before calling this operation to establish the peering connection, you first need to call CreateVpcPeeringAuthorization and identify the VPC you want to peer with. Once the authorization for the specified VPC is issued, you have 24 hours to establish the connection. These two operations handle all tasks necessary to peer the two VPCs, including acceptance, updating routing tables, etc. To establish the connection, call this operation from the AWS account that is used to manage the Amazon GameLift fleets. Identify the following values: (1) The ID of the fleet you want to be enable a VPC peering connection for; (2) The AWS account with the VPC that you want to peer with; and (3) The ID of the VPC you want to peer with. This operation is asynchronous. If successful, a VpcPeeringConnection request is created. You can use continuous polling to track the request's status using DescribeVpcPeeringConnections, or by monitoring fleet events for success or failure using DescribeFleetEvents. Related actions CreateVpcPeeringAuthorization
DeleteAlias
DeleteBuild
DeleteFleet
DeleteFleetLocations
Show Description Removes locations from a multi-location fleet. When deleting a location, all game server process and all instances that are still active in the location are shut down. To delete fleet locations, identify the fleet ID and provide a list of the locations to be deleted. If successful, GameLift sets the location status to DELETING, and begins to shut down existing server processes and terminate instances in each location being deleted. When completed, the location status changes to TERMINATED. Learn more Setting up GameLift fleets Related actions CreateFleetLocations
DeleteGameServerGroup
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Terminates a game server group and permanently deletes the game server group record. You have several options for how these resources are impacted when deleting the game server group. Depending on the type of delete operation selected, this operation might affect these resources:
  • The game server group
  • The corresponding Auto Scaling group
  • All game servers that are currently running in the group
To delete a game server group, identify the game server group to delete and specify the type of delete operation to initiate. Game server groups can only be deleted if they are in ACTIVE or ERROR status. If the delete request is successful, a series of operations are kicked off. The game server group status is changed to DELETE_SCHEDULED, which prevents new game servers from being registered and stops automatic scaling activity. Once all game servers in the game server group are deregistered, GameLift FleetIQ can begin deleting resources. If any of the delete operations fail, the game server group is placed in ERROR status. GameLift FleetIQ emits delete events to Amazon CloudWatch. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
DeleteGameSessionQueue
Show Description Deletes a game session queue. Once a queue is successfully deleted, unfulfilled StartGameSessionPlacement requests that reference the queue will fail. To delete a queue, specify the queue name. Learn more Using Multi-Region Queues Related actions CreateGameSessionQueue
DeleteMatchmakingConfiguration
Show Description Permanently removes a FlexMatch matchmaking configuration. To delete, specify the configuration name. A matchmaking configuration cannot be deleted if it is being used in any active matchmaking tickets. Related actions CreateMatchmakingConfiguration
DeleteMatchmakingRuleSet
Show Description Deletes an existing matchmaking rule set. To delete the rule set, provide the rule set name. Rule sets cannot be deleted if they are currently being used by a matchmaking configuration. Learn more Related actions CreateMatchmakingConfiguration
DeleteScalingPolicy
DeleteScript
DeleteVpcPeeringAuthorization
Show Description Cancels a pending VPC peering authorization for the specified VPC. If you need to delete an existing VPC peering connection, call DeleteVpcPeeringConnection. Related actions CreateVpcPeeringAuthorization
DeleteVpcPeeringConnection
Show Description Removes a VPC peering connection. To delete the connection, you must have a valid authorization for the VPC peering connection that you want to delete. You can check for an authorization by calling DescribeVpcPeeringAuthorizations or request a new one using CreateVpcPeeringAuthorization. Once a valid authorization exists, call this operation from the AWS account that is used to manage the Amazon GameLift fleets. Identify the connection to delete by the connection ID and fleet ID. If successful, the connection is removed. Related actions CreateVpcPeeringAuthorization
DeregisterGameServer
DescribeAlias
Show Description Retrieves properties for an alias. This operation returns all alias metadata and settings. To get an alias's target fleet ID only, use ResolveAlias. To get alias properties, specify the alias ID. If successful, the requested alias record is returned. Related actions CreateAlias
DescribeBuild
Show Description Retrieves properties for a custom game build. To request a build resource, specify a build ID. If successful, an object containing the build properties is returned. Learn more Upload a Custom Server Build Related actions CreateBuild
DescribeEC2InstanceLimits
Show Description The GameLift service limits and current utilization for an AWS Region or location. Instance limits control the number of instances, per instance type, per location, that your AWS account can use. Learn more at Amazon EC2 Instance Types. The information returned includes the maximum number of instances allowed and your account's current usage across all fleets. This information can affect your ability to scale your GameLift fleets. You can request a limit increase for your account by using the Service limits page in the GameLift console. Instance limits differ based on whether the instances are deployed in a fleet's home Region or in a remote location. For remote locations, limits also differ based on the combination of home Region and remote location. All requests must specify an AWS Region (either explicitly or as your default settings). To get the limit for a remote location, you must also specify the location. For example, the following requests all return different results:
  • Request specifies the Region ap-northeast-1 with no location. The result is limits and usage data on all instance types that are deployed in us-east-2, by all of the fleets that reside in ap-northeast-1.
  • Request specifies the Region us-east-1 with location ca-central-1. The result is limits and usage data on all instance types that are deployed in ca-central-1, by all of the fleets that reside in us-east-2. These limits do not affect fleets in any other Regions that deploy instances to ca-central-1.
  • Request specifies the Region eu-west-1 with location ca-central-1. The result is limits and usage data on all instance types that are deployed in ca-central-1, by all of the fleets that reside in eu-west-1.
This operation can be used in the following ways:
  • To get limit and usage data for all instance types that are deployed in an AWS Region by fleets that reside in the same Region: Specify the Region only. Optionally, specify a single instance type to retrieve information for.
  • To get limit and usage data for all instance types that are deployed to a remote location by fleets that reside in different AWS Region: Provide both the AWS Region and the remote location. Optionally, specify a single instance type to retrieve information for.
If successful, an EC2InstanceLimits object is returned with limits and usage data for each requested instance type. Learn more Setting up GameLift fleets Related actions CreateFleet
DescribeFleetAttributes
Show Description Retrieves core fleet-wide properties, including the computing hardware and deployment configuration for all instances in the fleet. This operation can be used in the following ways:
  • To get attributes for one or more specific fleets, provide a list of fleet IDs or fleet ARNs.
  • To get attributes for all fleets, do not provide a fleet identifier.
When requesting attributes for multiple fleets, use the pagination parameters to retrieve results as a set of sequential pages. If successful, a FleetAttributes object is returned for each fleet requested, unless the fleet identifier is not found. Some API operations limit the number of fleet IDs that allowed in one request. If a request exceeds this limit, the request fails and the error message contains the maximum allowed number. Learn more Setting up GameLift fleets Related actions ListFleets
DescribeFleetCapacity
Show Description Retrieves the resource capacity settings for one or more fleets. The data returned includes the current fleet capacity (number of EC2 instances), and settings that can control how capacity scaling. For fleets with remote locations, this operation retrieves data for the fleet's home Region only. See DescribeFleetLocationCapacity to get capacity settings for a fleet's remote locations. This operation can be used in the following ways:
  • To get capacity data for one or more specific fleets, provide a list of fleet IDs or fleet ARNs.
  • To get capacity data for all fleets, do not provide a fleet identifier.
When requesting multiple fleets, use the pagination parameters to retrieve results as a set of sequential pages. If successful, a FleetCapacity object is returned for each requested fleet ID. Each FleetCapacity object includes a Location property, which is set to the fleet's home Region. When a list of fleet IDs is provided, attribute objects are returned only for fleets that currently exist. Some API operations may limit the number of fleet IDs that are allowed in one request. If a request exceeds this limit, the request fails and the error message includes the maximum allowed. Learn more Setting up GameLift fleets GameLift metrics for fleets Related actions ListFleets
DescribeFleetEvents
Show Description Retrieves entries from a fleet's event log. Fleet events are initiated by changes in status, such as during fleet creation and termination, changes in capacity, etc. If a fleet has multiple locations, events are also initiated by changes to status and capacity in remote locations. You can specify a time range to limit the result set. Use the pagination parameters to retrieve results as a set of sequential pages. If successful, a collection of event log entries matching the request are returned. Learn more Setting up GameLift fleets Related actions ListFleets
DescribeFleetLocationAttributes
Show Description Retrieves information on a fleet's remote locations, including life-cycle status and any suspended fleet activity. This operation can be used in the following ways:
  • To get data for specific locations, provide a fleet identifier and a list of locations. Location data is returned in the order that it is requested.
  • To get data for all locations, provide a fleet identifier only. Location data is returned in no particular order.
When requesting attributes for multiple locations, use the pagination parameters to retrieve results as a set of sequential pages. If successful, a LocationAttributes object is returned for each requested location. If the fleet does not have a requested location, no information is returned. This operation does not return the home Region. To get information on a fleet's home Region, call DescribeFleetAttributes. Learn more Setting up GameLift fleets Related actions CreateFleetLocations
DescribeFleetLocationCapacity
Show Description Retrieves the resource capacity settings for a fleet location. The data returned includes the current capacity (number of EC2 instances) and some scaling settings for the requested fleet location. Use this operation to retrieve capacity information for a fleet's remote location or home Region (you can also retrieve home Region capacity by calling DescribeFleetCapacity). To retrieve capacity data, identify a fleet and location. If successful, a FleetCapacity object is returned for the requested fleet location. Learn more Setting up GameLift fleets GameLift metrics for fleets Related actions CreateFleetLocations
DescribeFleetLocationUtilization
Show Description Retrieves current usage data for a fleet location. Utilization data provides a snapshot of current game hosting activity at the requested location. Use this operation to retrieve utilization information for a fleet's remote location or home Region (you can also retrieve home Region utilization by calling DescribeFleetUtilization). To retrieve utilization data, identify a fleet and location. If successful, a FleetUtilization object is returned for the requested fleet location. Learn more Setting up GameLift fleets GameLift metrics for fleets Related actions CreateFleetLocations
DescribeFleetPortSettings
Show Description Retrieves a fleet's inbound connection permissions. Connection permissions specify the range of IP addresses and port settings that incoming traffic can use to access server processes in the fleet. Game sessions that are running on instances in the fleet must use connections that fall in this range. This operation can be used in the following ways:
  • To retrieve the inbound connection permissions for a fleet, identify the fleet's unique identifier.
  • To check the status of recent updates to a fleet remote location, specify the fleet ID and a location. Port setting updates can take time to propagate across all locations.
If successful, a set of IpPermission objects is returned for the requested fleet ID. When a location is specified, a pending status is included. If the requested fleet has been deleted, the result set is empty. Learn more Setting up GameLift fleets Related actions ListFleets
DescribeFleetUtilization
Show Description Retrieves utilization statistics for one or more fleets. Utilization data provides a snapshot of how the fleet's hosting resources are currently being used. For fleets with remote locations, this operation retrieves data for the fleet's home Region only. See DescribeFleetLocationUtilization to get utilization statistics for a fleet's remote locations. This operation can be used in the following ways:
  • To get utilization data for one or more specific fleets, provide a list of fleet IDs or fleet ARNs.
  • To get utilization data for all fleets, do not provide a fleet identifier.
When requesting multiple fleets, use the pagination parameters to retrieve results as a set of sequential pages. If successful, a FleetUtilization object is returned for each requested fleet ID, unless the fleet identifier is not found. Each fleet utilization object includes a Location property, which is set to the fleet's home Region. Some API operations may limit the number of fleet IDs allowed in one request. If a request exceeds this limit, the request fails and the error message includes the maximum allowed. Learn more Setting up GameLift Fleets GameLift Metrics for Fleets Related actions ListFleets
DescribeGameServer
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Retrieves information for a registered game server. Information includes game server status, health check info, and the instance that the game server is running on. To retrieve game server information, specify the game server ID. If successful, the requested game server object is returned. Learn more GameLift FleetIQ Guide Related actions RegisterGameServer
DescribeGameServerGroup
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Retrieves information on a game server group. This operation returns only properties related to GameLift FleetIQ. To view or update properties for the corresponding Auto Scaling group, such as launch template, auto scaling policies, and maximum/minimum group size, access the Auto Scaling group directly. To get attributes for a game server group, provide a group name or ARN value. If successful, a GameServerGroup object is returned. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
DescribeGameServerInstances
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Retrieves status information about the Amazon EC2 instances associated with a GameLift FleetIQ game server group. Use this operation to detect when instances are active or not available to host new game servers. If you are looking for instance configuration information, call DescribeGameServerGroup or access the corresponding Auto Scaling group properties. To request status for all instances in the game server group, provide a game server group ID only. To request status for specific instances, provide the game server group ID and one or more instance IDs. Use the pagination parameters to retrieve results in sequential segments. If successful, a collection of GameServerInstance objects is returned. This operation is not designed to be called with every game server claim request; this practice can cause you to exceed your API limit, which results in errors. Instead, as a best practice, cache the results and refresh your cache no more than once every 10 seconds. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
DescribeGameSessionDetails
Show Description Retrieves additional game session properties, including the game session protection policy in force, a set of one or more game sessions in a specific fleet location. You can optionally filter the results by current game session status. Alternatively, use SearchGameSessions to request a set of active game sessions that are filtered by certain criteria. To retrieve all game session properties, use DescribeGameSessions. This operation can be used in the following ways:
  • To retrieve details for all game sessions that are currently running on all locations in a fleet, provide a fleet or alias ID, with an optional status filter. This approach returns details from the fleet's home Region and all remote locations.
  • To retrieve details for all game sessions that are currently running on a specific fleet location, provide a fleet or alias ID and a location name, with optional status filter. The location can be the fleet's home Region or any remote location.
  • To retrieve details for a specific game session, provide the game session ID. This approach looks for the game session ID in all fleets that reside in the AWS Region defined in the request.
Use the pagination parameters to retrieve results as a set of sequential pages. If successful, a GameSessionDetail object is returned for each game session that matches the request. Learn more Find a game session Related actions CreateGameSession
DescribeGameSessionPlacement
Show Description Retrieves information, including current status, about a game session placement request. To get game session placement details, specify the placement ID. If successful, a GameSessionPlacement object is returned. Related actions CreateGameSession
DescribeGameSessionQueues
Show Description Retrieves the properties for one or more game session queues. When requesting multiple queues, use the pagination parameters to retrieve results as a set of sequential pages. If successful, a GameSessionQueue object is returned for each requested queue. When specifying a list of queues, objects are returned only for queues that currently exist in the Region. Learn more View Your Queues Related actions CreateGameSessionQueue
DescribeGameSessions
Show Description Retrieves a set of one or more game sessions in a specific fleet location. You can optionally filter the results by current game session status. Alternatively, use SearchGameSessions to request a set of active game sessions that are filtered by certain criteria. To retrieve the protection policy for game sessions, use DescribeGameSessionDetails. This operation can be used in the following ways:
  • To retrieve all game sessions that are currently running on all locations in a fleet, provide a fleet or alias ID, with an optional status filter. This approach returns all game sessions in the fleet's home Region and all remote locations.
  • To retrieve all game sessions that are currently running on a specific fleet location, provide a fleet or alias ID and a location name, with optional status filter. The location can be the fleet's home Region or any remote location.
  • To retrieve a specific game session, provide the game session ID. This approach looks for the game session ID in all fleets that reside in the AWS Region defined in the request.
Use the pagination parameters to retrieve results as a set of sequential pages. If successful, a GameSession object is returned for each game session that matches the request. Available in GameLift Local. Learn more Find a game session Related actions CreateGameSession
DescribeInstances
Show Description Retrieves information about a fleet's instances, including instance IDs, connection data, and status. This operation can be used in the following ways:
  • To get information on all instances that are deployed to a fleet's home Region, provide the fleet ID.
  • To get information on all instances that are deployed to a fleet's remote location, provide the fleet ID and location name.
  • To get information on a specific instance in a fleet, provide the fleet ID and instance ID.
Use the pagination parameters to retrieve results as a set of sequential pages. If successful, an Instance object is returned for each requested instance. Instances are not returned in any particular order. Learn more Remotely Access Fleet Instances Debug Fleet Issues Related actions DescribeInstances
DescribeMatchmaking
Show Description Retrieves one or more matchmaking tickets. Use this operation to retrieve ticket information, including--after a successful match is made--connection information for the resulting new game session. To request matchmaking tickets, provide a list of up to 10 ticket IDs. If the request is successful, a ticket object is returned for each requested ID that currently exists. This operation is not designed to be continually called to track matchmaking ticket status. This practice can cause you to exceed your API limit, which results in errors. Instead, as a best practice, set up an Amazon Simple Notification Service (SNS) to receive notifications, and provide the topic ARN in the matchmaking configuration. Continuously poling ticket status with DescribeMatchmaking should only be used for games in development with low matchmaking usage.

Learn more Add FlexMatch to a game client Set Up FlexMatch event notification Related actions StartMatchmaking

DescribeMatchmakingConfigurations
Show Description Retrieves the details of FlexMatch matchmaking configurations. This operation offers the following options: (1) retrieve all matchmaking configurations, (2) retrieve configurations for a specified list, or (3) retrieve all configurations that use a specified rule set name. When requesting multiple items, use the pagination parameters to retrieve results as a set of sequential pages. If successful, a configuration is returned for each requested name. When specifying a list of names, only configurations that currently exist are returned. Learn more Setting up FlexMatch matchmakers Related actions CreateMatchmakingConfiguration
DescribeMatchmakingRuleSets
Show Description Retrieves the details for FlexMatch matchmaking rule sets. You can request all existing rule sets for the Region, or provide a list of one or more rule set names. When requesting multiple items, use the pagination parameters to retrieve results as a set of sequential pages. If successful, a rule set is returned for each requested name. Learn more Related actions CreateMatchmakingConfiguration
DescribePlayerSessions
Show Description Retrieves properties for one or more player sessions. This action can be used in the following ways:
  • To retrieve a specific player session, provide the player session ID only.
  • To retrieve all player sessions in a game session, provide the game session ID only.
  • To retrieve all player sessions for a specific player, provide a player ID only.
To request player sessions, specify either a player session ID, game session ID, or player ID. You can filter this request by player session status. Use the pagination parameters to retrieve results as a set of sequential pages. If successful, a PlayerSession object is returned for each session that matches the request. Available in Amazon GameLift Local. Related actions CreatePlayerSession
DescribeRuntimeConfiguration
Show Description Retrieves a fleet's runtime configuration settings. The runtime configuration tells GameLift which server processes to run (and how) on each instance in the fleet. To get the runtime configuration that is currently in forces for a fleet, provide the fleet ID. If successful, a RuntimeConfiguration object is returned for the requested fleet. If the requested fleet has been deleted, the result set is empty. Learn more Setting up GameLift fleets Running multiple processes on a fleet Related actions ListFleets
DescribeScalingPolicies
Show Description Retrieves all scaling policies applied to a fleet. To get a fleet's scaling policies, specify the fleet ID. You can filter this request by policy status, such as to retrieve only active scaling policies. Use the pagination parameters to retrieve results as a set of sequential pages. If successful, set of ScalingPolicy objects is returned for the fleet. A fleet may have all of its scaling policies suspended (StopFleetActions). This operation does not affect the status of the scaling policies, which remains ACTIVE. To see whether a fleet's scaling policies are in force or suspended, call DescribeFleetAttributes and check the stopped actions. Related actions DescribeFleetCapacity
DescribeScript
Show Description Retrieves properties for a Realtime script. To request a script record, specify the script ID. If successful, an object containing the script properties is returned. Learn more Amazon GameLift Realtime Servers Related actions CreateScript
DescribeVpcPeeringAuthorizations
Show Description Retrieves valid VPC peering authorizations that are pending for the AWS account. This operation returns all VPC peering authorizations and requests for peering. This includes those initiated and received by this account. Related actions CreateVpcPeeringAuthorization
DescribeVpcPeeringConnections
Show Description Retrieves information on VPC peering connections. Use this operation to get peering information for all fleets or for one specific fleet ID. To retrieve connection information, call this operation from the AWS account that is used to manage the Amazon GameLift fleets. Specify a fleet ID or leave the parameter empty to retrieve all connection records. If successful, the retrieved information includes both active and pending connections. Active connections identify the IpV4 CIDR block that the VPC uses to connect. Related actions CreateVpcPeeringAuthorization
GetGameSessionLogUrl
Show Description Retrieves the location of stored game session logs for a specified game session. When a game session is terminated, GameLift automatically stores the logs in Amazon S3 and retains them for 14 days. Use this URL to download the logs. See the AWS Service Limits page for maximum log file sizes. Log files that exceed this limit are not saved. Related actions CreateGameSession
GetInstanceAccess
Show Description Requests remote access to a fleet instance. Remote access is useful for debugging, gathering benchmarking data, or observing activity in real time. To remotely access an instance, you need credentials that match the operating system of the instance. For a Windows instance, GameLift returns a user name and password as strings for use with a Windows Remote Desktop client. For a Linux instance, GameLift returns a user name and RSA private key, also as strings, for use with an SSH client. The private key must be saved in the proper format to a .pem file before using. If you're making this request using the AWS CLI, saving the secret can be handled as part of the GetInstanceAccess request, as shown in one of the examples for this operation. To request access to a specific instance, specify the IDs of both the instance and the fleet it belongs to. You can retrieve a fleet's instance IDs by calling DescribeInstances. If successful, an InstanceAccess object is returned that contains the instance's IP address and a set of credentials. Learn more Remotely Access Fleet Instances Debug Fleet Issues Related actions DescribeInstances
ListAliases
Show Description Retrieves all aliases for this AWS account. You can filter the result set by alias name and/or routing strategy type. Use the pagination parameters to retrieve results in sequential pages. Returned aliases are not listed in any particular order. Related actions CreateAlias
ListBuilds
Show Description Retrieves build resources for all builds associated with the AWS account in use. You can limit results to builds that are in a specific status by using the Status parameter. Use the pagination parameters to retrieve results in a set of sequential pages. Build resources are not listed in any particular order. Learn more Upload a Custom Server Build Related actions CreateBuild
ListFleets
Show Description Retrieves a collection of fleet resources in an AWS Region. You can call this operation to get fleets in a previously selected default Region (see https://docs.aws.amazon.com/credref/latest/refdocs/setting-global-region.htmlor specify a Region in your request. You can filter the result set to find only those fleets that are deployed with a specific build or script. For fleets that have multiple locations, this operation retrieves fleets based on their home Region only. This operation can be used in the following ways:
  • To get a list of all fleets in a Region, don't provide a build or script identifier.
  • To get a list of all fleets where a specific custom game build is deployed, provide the build ID.
  • To get a list of all Realtime Servers fleets with a specific configuration script, provide the script ID.
Use the pagination parameters to retrieve results as a set of sequential pages. If successful, a list of fleet IDs that match the request parameters is returned. A NextToken value is also returned if there are more result pages to retrieve. Fleet resources are not listed in a particular order. Learn more Setting up GameLift fleets Related actions CreateFleet
ListGameServerGroups
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Retrieves information on all game servers groups that exist in the current AWS account for the selected Region. Use the pagination parameters to retrieve results in a set of sequential segments. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
ListGameServers
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Retrieves information on all game servers that are currently active in a specified game server group. You can opt to sort the list by game server age. Use the pagination parameters to retrieve results in a set of sequential segments. Learn more GameLift FleetIQ Guide Related actions RegisterGameServer
ListScripts
Show Description Retrieves script records for all Realtime scripts that are associated with the AWS account in use. Learn more Amazon GameLift Realtime Servers Related actions CreateScript
ListTagsForResource
Show Description Retrieves all tags that are assigned to a GameLift resource. Resource tags are used to organize AWS resources for a range of purposes. This operation handles the permissions necessary to manage tags for the following GameLift resource types:
  • Build
  • Script
  • Fleet
  • Alias
  • GameSessionQueue
  • MatchmakingConfiguration
  • MatchmakingRuleSet
To list tags for a resource, specify the unique ARN value for the resource. Learn more Tagging AWS Resources in the AWS General Reference AWS Tagging Strategies Related actions TagResource
PutScalingPolicy
Show Description Creates or updates a scaling policy for a fleet. Scaling policies are used to automatically scale a fleet's hosting capacity to meet player demand. An active scaling policy instructs Amazon GameLift to track a fleet metric and automatically change the fleet's capacity when a certain threshold is reached. There are two types of scaling policies: target-based and rule-based. Use a target-based policy to quickly and efficiently manage fleet scaling; this option is the most commonly used. Use rule-based policies when you need to exert fine-grained control over auto-scaling. Fleets can have multiple scaling policies of each type in force at the same time; you can have one target-based policy, one or multiple rule-based scaling policies, or both. We recommend caution, however, because multiple auto-scaling policies can have unintended consequences. You can temporarily suspend all scaling policies for a fleet by calling StopFleetActions with the fleet action AUTO_SCALING. To resume scaling policies, call StartFleetActions with the same fleet action. To stop just one scaling policy--or to permanently remove it, you must delete the policy with DeleteScalingPolicy. Learn more about how to work with auto-scaling in Set Up Fleet Automatic Scaling. Target-based policy A target-based policy tracks a single metric: PercentAvailableGameSessions. This metric tells us how much of a fleet's hosting capacity is ready to host game sessions but is not currently in use. This is the fleet's buffer; it measures the additional player demand that the fleet could handle at current capacity. With a target-based policy, you set your ideal buffer size and leave it to Amazon GameLift to take whatever action is needed to maintain that target. For example, you might choose to maintain a 10% buffer for a fleet that has the capacity to host 100 simultaneous game sessions. This policy tells Amazon GameLift to take action whenever the fleet's available capacity falls below or rises above 10 game sessions. Amazon GameLift will start new instances or stop unused instances in order to return to the 10% buffer. To create or update a target-based policy, specify a fleet ID and name, and set the policy type to "TargetBased". Specify the metric to track (PercentAvailableGameSessions) and reference a TargetConfiguration object with your desired buffer value. Exclude all other parameters. On a successful request, the policy name is returned. The scaling policy is automatically in force as soon as it's successfully created. If the fleet's auto-scaling actions are temporarily suspended, the new policy will be in force once the fleet actions are restarted. Rule-based policy A rule-based policy tracks specified fleet metric, sets a threshold value, and specifies the type of action to initiate when triggered. With a rule-based policy, you can select from several available fleet metrics. Each policy specifies whether to scale up or scale down (and by how much), so you need one policy for each type of action. For example, a policy may make the following statement: "If the percentage of idle instances is greater than 20% for more than 15 minutes, then reduce the fleet capacity by 10%." A policy's rule statement has the following structure: If [MetricName] is [ComparisonOperator] [Threshold] for [EvaluationPeriods] minutes, then [ScalingAdjustmentType] to/by [ScalingAdjustment]. To implement the example, the rule statement would look like this: If [PercentIdleInstances] is [GreaterThanThreshold] [20] for [15] minutes, then [PercentChangeInCapacity] to/by [10]. To create or update a scaling policy, specify a unique combination of name and fleet ID, and set the policy type to "RuleBased". Specify the parameter values for a policy rule statement. On a successful request, the policy name is returned. Scaling policies are automatically in force as soon as they're successfully created. If the fleet's auto-scaling actions are temporarily suspended, the new policy will be in force once the fleet actions are restarted. Related actions DescribeFleetCapacity
RegisterGameServer
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Creates a new game server resource and notifies GameLift FleetIQ that the game server is ready to host gameplay and players. This operation is called by a game server process that is running on an instance in a game server group. Registering game servers enables GameLift FleetIQ to track available game servers and enables game clients and services to claim a game server for a new game session. To register a game server, identify the game server group and instance where the game server is running, and provide a unique identifier for the game server. You can also include connection and game server data. When a game client or service requests a game server by calling ClaimGameServer, this information is returned in the response. Once a game server is successfully registered, it is put in status AVAILABLE. A request to register a game server may fail if the instance it is running on is in the process of shutting down as part of instance balancing or scale-down activity. Learn more GameLift FleetIQ Guide Related actions RegisterGameServer
RequestUploadCredentials
Show Description Retrieves a fresh set of credentials for use when uploading a new set of game build files to Amazon GameLift's Amazon S3. This is done as part of the build creation process; see CreateBuild. To request new credentials, specify the build ID as returned with an initial CreateBuild request. If successful, a new set of credentials are returned, along with the S3 storage location associated with the build ID. Learn more Create a Build with Files in S3 Related actions CreateBuild
ResolveAlias
Show Description Retrieves the fleet ID that an alias is currently pointing to. Related actions CreateAlias
ResumeGameServerGroup
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Reinstates activity on a game server group after it has been suspended. A game server group might be suspended by theSuspendGameServerGroup operation, or it might be suspended involuntarily due to a configuration problem. In the second case, you can manually resume activity on the group once the configuration problem has been resolved. Refer to the game server group status and status reason for more information on why group activity is suspended. To resume activity, specify a game server group ARN and the type of activity to be resumed. If successful, a GameServerGroup object is returned showing that the resumed activity is no longer listed in SuspendedActions. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
SearchGameSessions
Show Description Retrieves all active game sessions that match a set of search criteria and sorts them into a specified order. When searching for game sessions, you specify exactly where you want to search and provide a search filter expression, a sort expression, or both. A search request can search only one fleet, but it can search all of a fleet's locations. This operation can be used in the following ways:
  • To search all game sessions that are currently running on all locations in a fleet, provide a fleet or alias ID. This approach returns game sessions in the fleet's home Region and all remote locations that fit the search criteria.
  • To search all game sessions that are currently running on a specific fleet location, provide a fleet or alias ID and a location name. For location, you can specify a fleet's home Region or any remote location.
Use the pagination parameters to retrieve results as a set of sequential pages. If successful, a GameSession object is returned for each game session that matches the request. Search finds game sessions that are in ACTIVE status only. To retrieve information on game sessions in other statuses, use DescribeGameSessions. You can search or sort by the following game session attributes:
  • gameSessionId -- A unique identifier for the game session. You can use either a GameSessionId or GameSessionArn value.
  • gameSessionName -- Name assigned to a game session. This value is set when requesting a new game session with CreateGameSession or updating with UpdateGameSession. Game session names do not need to be unique to a game session.
  • gameSessionProperties -- Custom data defined in a game session's GameProperty parameter. GameProperty values are stored as key:value pairs; the filter expression must indicate the key and a string to search the data values for. For example, to search for game sessions with custom data containing the key:value pair "gameMode:brawl", specify the following: gameSessionProperties.gameMode = "brawl". All custom data values are searched as strings.
  • maximumSessions -- Maximum number of player sessions allowed for a game session. This value is set when requesting a new game session with CreateGameSession or updating with UpdateGameSession.
  • creationTimeMillis -- Value indicating when a game session was created. It is expressed in Unix time as milliseconds.
  • playerSessionCount -- Number of players currently connected to a game session. This value changes rapidly as players join the session or drop out.
  • hasAvailablePlayerSessions -- Boolean value indicating whether a game session has reached its maximum number of players. It is highly recommended that all search requests include this filter attribute to optimize search performance and return only sessions that players can join.
Returned values for playerSessionCount and hasAvailablePlayerSessions change quickly as players join sessions and others drop out. Results should be considered a snapshot in time. Be sure to refresh search results often, and handle sessions that fill up before a player can join. Related actions CreateGameSession
StartFleetActions
Show Description Resumes certain types of activity on fleet instances that were suspended with StopFleetActions. For multi-location fleets, fleet actions are managed separately for each location. Currently, this operation is used to restart a fleet's auto-scaling activity. This operation can be used in the following ways:
  • To restart actions on instances in the fleet's home Region, provide a fleet ID and the type of actions to resume.
  • To restart actions on instances in one of the fleet's remote locations, provide a fleet ID, a location name, and the type of actions to resume.
If successful, GameLift once again initiates scaling events as triggered by the fleet's scaling policies. If actions on the fleet location were never stopped, this operation will have no effect. You can view a fleet's stopped actions using DescribeFleetAttributes or DescribeFleetLocationAttributes. Learn more Setting up GameLift fleets Related actions CreateFleet
StartGameSessionPlacement
Show Description Places a request for a new game session in a queue (see CreateGameSessionQueue). When processing a placement request, Amazon GameLift searches for available resources on the queue's destinations, scanning each until it finds resources or the placement request times out. A game session placement request can also request player sessions. When a new game session is successfully created, Amazon GameLift creates a player session for each player included in the request. When placing a game session, by default Amazon GameLift tries each fleet in the order they are listed in the queue configuration. Ideally, a queue's destinations are listed in preference order. Alternatively, when requesting a game session with players, you can also provide latency data for each player in relevant Regions. Latency data indicates the performance lag a player experiences when connected to a fleet in the Region. Amazon GameLift uses latency data to reorder the list of destinations to place the game session in a Region with minimal lag. If latency data is provided for multiple players, Amazon GameLift calculates each Region's average lag for all players and reorders to get the best game play across all players. To place a new game session request, specify the following:
  • The queue name and a set of game session properties and settings
  • A unique ID (such as a UUID) for the placement. You use this ID to track the status of the placement request
  • (Optional) A set of player data and a unique player ID for each player that you are joining to the new game session (player data is optional, but if you include it, you must also provide a unique ID for each player)
  • Latency data for all players (if you want to optimize game play for the players)
If successful, a new game session placement is created. To track the status of a placement request, call DescribeGameSessionPlacement and check the request's status. If the status is FULFILLED, a new game session has been created and a game session ARN and Region are referenced. If the placement request times out, you can resubmit the request or retry it with a different queue. Related actions CreateGameSession
StartMatchBackfill
Show Description Finds new players to fill open slots in currently running game sessions. The backfill match process is essentially identical to the process of forming new matches. Backfill requests use the same matchmaker that was used to make the original match, and they provide matchmaking data for all players currently in the game session. FlexMatch uses this information to select new players so that backfilled match continues to meet the original match requirements. When using FlexMatch with GameLift managed hosting, you can request a backfill match from a client service by calling this operation with a GameSession identifier. You also have the option of making backfill requests directly from your game server. In response to a request, FlexMatch creates player sessions for the new players, updates the GameSession resource, and sends updated matchmaking data to the game server. You can request a backfill match at any point after a game session is started. Each game session can have only one active backfill request at a time; a subsequent request automatically replaces the earlier request. When using FlexMatch as a standalone component, request a backfill match by calling this operation without a game session identifier. As with newly formed matches, matchmaking results are returned in a matchmaking event so that your game can update the game session that is being backfilled. To request a backfill match, specify a unique ticket ID, the original matchmaking configuration, and matchmaking data for all current players in the game session being backfilled. Optionally, specify the GameSession ARN. If successful, a match backfill ticket is created and returned with status set to QUEUED. Track the status of backfill tickets using the same method for tracking tickets for new matches. Learn more Backfill existing games with FlexMatch Matchmaking events (reference) How GameLift FlexMatch works Related actions StartMatchmaking
StartMatchmaking
Show Description Uses FlexMatch to create a game match for a group of players based on custom matchmaking rules. With games that use GameLift managed hosting, this operation also triggers GameLift to find hosting resources and start a new game session for the new match. Each matchmaking request includes information on one or more players and specifies the FlexMatch matchmaker to use. When a request is for multiple players, FlexMatch attempts to build a match that includes all players in the request, placing them in the same team and finding additional players as needed to fill the match. To start matchmaking, provide a unique ticket ID, specify a matchmaking configuration, and include the players to be matched. You must also include any player attributes that are required by the matchmaking configuration's rule set. If successful, a matchmaking ticket is returned with status set to QUEUED. Track matchmaking events to respond as needed and acquire game session connection information for successfully completed matches. Ticket status updates are tracked using event notification through Amazon Simple Notification Service (SNS), which is defined in the matchmaking configuration. Learn more Add FlexMatch to a game client Set Up FlexMatch event notification How GameLift FlexMatch works Related actions StartMatchmaking
StopFleetActions
Show Description Suspends certain types of activity in a fleet location. Currently, this operation is used to stop auto-scaling activity. For multi-location fleets, fleet actions are managed separately for each location. Stopping fleet actions has several potential purposes. It allows you to temporarily stop auto-scaling activity but retain your scaling policies for use in the future. For multi-location fleets, you can set up fleet-wide auto-scaling, and then opt out of it for certain locations. This operation can be used in the following ways:
  • To stop actions on instances in the fleet's home Region, provide a fleet ID and the type of actions to suspend.
  • To stop actions on instances in one of the fleet's remote locations, provide a fleet ID, a location name, and the type of actions to suspend.
If successful, GameLift no longer initiates scaling events except in response to manual changes using UpdateFleetCapacity. You can view a fleet's stopped actions using DescribeFleetAttributes or DescribeFleetLocationAttributes. Suspended activity can be restarted using StartFleetActions. Learn more Setting up GameLift Fleets Related actions CreateFleet
StopGameSessionPlacement
Show Description Cancels a game session placement that is in PENDING status. To stop a placement, provide the placement ID values. If successful, the placement is moved to CANCELLED status. Related actions CreateGameSession
StopMatchmaking
Show Description Cancels a matchmaking ticket or match backfill ticket that is currently being processed. To stop the matchmaking operation, specify the ticket ID. If successful, work on the ticket is stopped, and the ticket status is changed to CANCELLED. This call is also used to turn off automatic backfill for an individual game session. This is for game sessions that are created with a matchmaking configuration that has automatic backfill enabled. The ticket ID is included in the MatchmakerData of an updated game session object, which is provided to the game server. If the operation is successful, the service sends back an empty JSON struct with the HTTP 200 response (not an empty HTTP body). Learn more Add FlexMatch to a game client Related actions StartMatchmaking
SuspendGameServerGroup
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Temporarily stops activity on a game server group without terminating instances or the game server group. You can restart activity by calling ResumeGameServerGroup. You can suspend the following activity:
  • Instance type replacement - This activity evaluates the current game hosting viability of all Spot instance types that are defined for the game server group. It updates the Auto Scaling group to remove nonviable Spot Instance types, which have a higher chance of game server interruptions. It then balances capacity across the remaining viable Spot Instance types. When this activity is suspended, the Auto Scaling group continues with its current balance, regardless of viability. Instance protection, utilization metrics, and capacity scaling activities continue to be active.
To suspend activity, specify a game server group ARN and the type of activity to be suspended. If successful, a GameServerGroup object is returned showing that the activity is listed in SuspendedActions. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
TagResource
Show Description Assigns a tag to a GameLift resource. AWS resource tags provide an additional management tool set. You can use tags to organize resources, create IAM permissions policies to manage access to groups of resources, customize AWS cost breakdowns, etc. This operation handles the permissions necessary to manage tags for the following GameLift resource types:
  • Build
  • Script
  • Fleet
  • Alias
  • GameSessionQueue
  • MatchmakingConfiguration
  • MatchmakingRuleSet
To add a tag to a resource, specify the unique ARN value for the resource and provide a tag list containing one or more tags. The operation succeeds even if the list includes tags that are already assigned to the specified resource. Learn more Tagging AWS Resources in the AWS General Reference AWS Tagging Strategies Related actions TagResource
UntagResource
Show Description Removes a tag that is assigned to a GameLift resource. Resource tags are used to organize AWS resources for a range of purposes. This operation handles the permissions necessary to manage tags for the following GameLift resource types:
  • Build
  • Script
  • Fleet
  • Alias
  • GameSessionQueue
  • MatchmakingConfiguration
  • MatchmakingRuleSet
To remove a tag from a resource, specify the unique ARN value for the resource and provide a string list containing one or more tags to be removed. This operation succeeds even if the list includes tags that are not currently assigned to the specified resource. Learn more Tagging AWS Resources in the AWS General Reference AWS Tagging Strategies Related actions TagResource
UpdateAlias
Show Description Updates properties for an alias. To update properties, specify the alias ID to be updated and provide the information to be changed. To reassign an alias to another fleet, provide an updated routing strategy. If successful, the updated alias record is returned. Related actions CreateAlias
UpdateBuild
Show Description Updates metadata in a build resource, including the build name and version. To update the metadata, specify the build ID to update and provide the new values. If successful, a build object containing the updated metadata is returned. Learn more Upload a Custom Server Build Related actions CreateBuild
UpdateFleetAttributes
Show Description Updates a fleet's mutable attributes, including game session protection and resource creation limits. To update fleet attributes, specify the fleet ID and the property values that you want to change. If successful, an updated FleetAttributes object is returned. Learn more Setting up GameLift fleets Related actions CreateFleetLocations
UpdateFleetCapacity
Show Description Updates capacity settings for a fleet. For fleets with multiple locations, use this operation to manage capacity settings in each location individually. Fleet capacity determines the number of game sessions and players that can be hosted based on the fleet configuration. Use this operation to set the following fleet capacity properties:
  • Minimum/maximum size: Set hard limits on fleet capacity. GameLift cannot set the fleet's capacity to a value outside of this range, whether the capacity is changed manually or through automatic scaling.
  • Desired capacity: Manually set the number of EC2 instances to be maintained in a fleet location. Before changing a fleet's desired capacity, you may want to call DescribeEC2InstanceLimits to get the maximum capacity of the fleet's EC2 instance type. Alternatively, consider using automatic scaling to adjust capacity based on player demand.
This operation can be used in the following ways:
  • To update capacity for a fleet's home Region, or if the fleet has no remote locations, omit the Location parameter. The fleet must be in ACTIVE status.
  • To update capacity for a fleet's remote location, include the Location parameter set to the location to be updated. The location must be in ACTIVE status.
If successful, capacity settings are updated immediately. In response a change in desired capacity, GameLift initiates steps to start new instances or terminate existing instances in the requested fleet location. This continues until the location's active instance count matches the new desired instance count. You can track a fleet's current capacity by calling DescribeFleetCapacity or DescribeFleetLocationCapacity. If the requested desired instance count is higher than the instance type's limit, the LimitExceeded exception occurs. Learn more Scaling fleet capacity Related actions CreateFleetLocations
UpdateFleetPortSettings
Show Description Updates permissions that allow inbound traffic to connect to game sessions that are being hosted on instances in the fleet. To update settings, specify the fleet ID to be updated and specify the changes to be made. List the permissions you want to add in InboundPermissionAuthorizations, and permissions you want to remove in InboundPermissionRevocations. Permissions to be removed must match existing fleet permissions. If successful, the fleet ID for the updated fleet is returned. For fleets with remote locations, port setting updates can take time to propagate across all locations. You can check the status of updates in each location by calling DescribeFleetPortSettings with a location name. Learn more Setting up GameLift fleets Related actions CreateFleetLocations
UpdateGameServer
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Updates information about a registered game server to help GameLift FleetIQ to track game server availability. This operation is called by a game server process that is running on an instance in a game server group. Use this operation to update the following types of game server information. You can make all three types of updates in the same request:
  • To update the game server's utilization status, identify the game server and game server group and specify the current utilization status. Use this status to identify when game servers are currently hosting games and when they are available to be claimed.
  • To report health status, identify the game server and game server group and set health check to HEALTHY. If a game server does not report health status for a certain length of time, the game server is no longer considered healthy. As a result, it will be eventually deregistered from the game server group to avoid affecting utilization metrics. The best practice is to report health every 60 seconds.
  • To change game server metadata, provide updated game server data.
Once a game server is successfully updated, the relevant statuses and timestamps are updated. Learn more GameLift FleetIQ Guide Related actions RegisterGameServer
UpdateGameServerGroup
Show Description This operation is used with the GameLift FleetIQ solution and game server groups. Updates GameLift FleetIQ-specific properties for a game server group. Many Auto Scaling group properties are updated on the Auto Scaling group directly, including the launch template, Auto Scaling policies, and maximum/minimum/desired instance counts. To update the game server group, specify the game server group ID and provide the updated values. Before applying the updates, the new values are validated to ensure that GameLift FleetIQ can continue to perform instance balancing activity. If successful, a GameServerGroup object is returned. Learn more GameLift FleetIQ Guide Related actions CreateGameServerGroup
UpdateGameSession
Show Description Updates the mutable properties of a game session. To update a game session, specify the game session ID and the values you want to change. If successful, the updated GameSession object is returned. Related actions CreateGameSession
UpdateGameSessionQueue
Show Description Updates the configuration of a game session queue, which determines how the queue processes new game session requests. To update settings, specify the queue name to be updated and provide the new settings. When updating destinations, provide a complete list of destinations. Learn more Using Multi-Region Queues Related actions CreateGameSessionQueue
UpdateMatchmakingConfiguration
Show Description Updates settings for a FlexMatch matchmaking configuration. These changes affect all matches and game sessions that are created after the update. To update settings, specify the configuration name to be updated and provide the new settings. Learn more Design a FlexMatch matchmaker Related actions CreateMatchmakingConfiguration
UpdateRuntimeConfiguration
Show Description Updates the current runtime configuration for the specified fleet, which tells GameLift how to launch server processes on all instances in the fleet. You can update a fleet's runtime configuration at any time after the fleet is created; it does not need to be in ACTIVE status. To update runtime configuration, specify the fleet ID and provide a RuntimeConfiguration with an updated set of server process configurations. If successful, the fleet's runtime configuration settings are updated. Each instance in the fleet regularly checks for and retrieves updated runtime configurations. Instances immediately begin complying with the new configuration by launching new server processes or not replacing existing processes when they shut down. Updating a fleet's runtime configuration never affects existing server processes. Learn more Setting up GameLift fleets Related actions CreateFleetLocations
UpdateScript
Show Description Updates Realtime script metadata and content. To update script metadata, specify the script ID and provide updated name and/or version values. To update script content, provide an updated zip file by pointing to either a local file or an Amazon S3 bucket location. You can use either method regardless of how the original script was uploaded. Use the Version parameter to track updates to the script. If the call is successful, the updated metadata is stored in the script record and a revised script is uploaded to the Amazon GameLift service. Once the script is updated and acquired by a fleet instance, the new version is used for all new game sessions. Learn more Amazon GameLift Realtime Servers Related actions CreateScript

Glacier Events

Service Event Name Description
glacier AbortMultipartUpload
AbortVaultLock
AddTagsToVault
CompleteMultipartUpload
Show Description You call this operation to inform Amazon S3 Glacier (Glacier) that all the archive parts have been uploaded and that Glacier can now assemble the archive from the uploaded parts. After assembling and saving the archive to the vault, Glacier returns the URI path of the newly created archive resource. Using the URI path, you can then access the archive. After you upload an archive, you should save the archive ID returned to retrieve the archive at a later point. You can also get the vault inventory to obtain a list of archive IDs in a vault. For more information, see InitiateJob. In the request, you must include the computed SHA256 tree hash of the entire archive you have uploaded. For information about computing a SHA256 tree hash, see Computing Checksums. On the server side, Glacier also constructs the SHA256 tree hash of the assembled archive. If the values match, Glacier saves the archive to the vault; otherwise, it returns an error, and the operation fails. The ListParts operation returns a list of parts uploaded for a specific multipart upload. It includes checksum information for each uploaded part that can be used to debug a bad checksum issue. Additionally, Glacier also checks for any missing content ranges when assembling the archive, if missing content ranges are found, Glacier returns an error and the operation fails. Complete Multipart Upload is an idempotent operation. After your first successful complete multipart upload, if you call the operation again within a short period, the operation will succeed and return the same archive ID. This is useful in the event you experience a network issue that causes an aborted connection or receive a 500 server error, in which case you can repeat your Complete Multipart Upload request and get the same archive ID without creating duplicate archives. Note, however, that after the multipart upload completes, you cannot call the List Parts operation and the multipart upload will not appear in List Multipart Uploads response, even if idempotent complete is possible. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and underlying REST API, see Uploading Large Archives in Parts (Multipart Upload) and Complete Multipart Upload in the Amazon Glacier Developer Guide.
CompleteVaultLock
CreateVault
Show Description This operation creates a new vault with the specified name. The name of the vault must be unique within a region for an AWS account. You can create up to 1,000 vaults per account. If you need to create more vaults, contact Amazon S3 Glacier. You must use the following guidelines when naming a vault.
  • Names can be between 1 and 255 characters long.
  • Allowed characters are a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), and '.' (period).
This operation is idempotent. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and underlying REST API, see Creating a Vault in Amazon Glacier and Create Vault in the Amazon Glacier Developer Guide.
DeleteArchive
DeleteVault
DeleteVaultAccessPolicy
DeleteVaultNotifications
DescribeJob
Show Description This operation returns information about a job you previously initiated, including the job initiation date, the user who initiated the job, the job status code/message and the Amazon SNS topic to notify after Amazon S3 Glacier (Glacier) completes the job. For more information about initiating a job, see InitiateJob. This operation enables you to check the status of your job. However, it is strongly recommended that you set up an Amazon SNS topic and specify it in your initiate job request so that Glacier can notify the topic after it completes the job. A job ID will not expire for at least 24 hours after Glacier completes the job. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For more information about using this operation, see the documentation for the underlying REST API Describe Job in the Amazon Glacier Developer Guide.
DescribeVault
Show Description This operation returns information about a vault, including the vault's Amazon Resource Name (ARN), the date the vault was created, the number of archives it contains, and the total size of all the archives in the vault. The number of archives and their total size are as of the last inventory generation. This means that if you add or remove an archive from a vault, and then immediately use Describe Vault, the change in contents will not be immediately reflected. If you want to retrieve the latest inventory of the vault, use InitiateJob. Amazon S3 Glacier generates vault inventories approximately daily. For more information, see Downloading a Vault Inventory in Amazon S3 Glacier. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and underlying REST API, see Retrieving Vault Metadata in Amazon S3 Glacier and Describe Vault in the Amazon Glacier Developer Guide.
GetDataRetrievalPolicy
Show Description This operation returns the current data retrieval policy for the account and region specified in the GET request. For more information about data retrieval policies, see Amazon Glacier Data Retrieval Policies.
GetJobOutput
Show Description This operation downloads the output of the job you initiated using InitiateJob. Depending on the job type you specified when you initiated the job, the output will be either the content of an archive or a vault inventory. You can download all the job output or download a portion of the output by specifying a byte range. In the case of an archive retrieval job, depending on the byte range you specify, Amazon S3 Glacier (Glacier) returns the checksum for the portion of the data. You can compute the checksum on the client and verify that the values match to ensure the portion you downloaded is the correct data. A job ID will not expire for at least 24 hours after Glacier completes the job. That a byte range. For both archive and inventory retrieval jobs, you should verify the downloaded size against the size returned in the headers from the Get Job Output response. For archive retrieval jobs, you should also verify that the size is what you expected. If you download a portion of the output, the expected size is based on the range of bytes you specified. For example, if you specify a range of bytes=0-1048575, you should verify your download size is 1,048,576 bytes. If you download an entire archive, the expected size is the size of the archive when you uploaded it to Amazon S3 Glacier The expected size is also returned in the headers from the Get Job Output response. In the case of an archive retrieval job, depending on the byte range you specify, Glacier returns the checksum for the portion of the data. To ensure the portion you downloaded is the correct data, compute the checksum on the client, verify that the values match, and verify that the size is what you expected. A job ID does not expire for at least 24 hours after Glacier completes the job. That is, you can download the job output within the 24 hours period after Amazon Glacier completes the job. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and the underlying REST API, see Downloading a Vault Inventory, Downloading an Archive, and Get Job Output
GetVaultAccessPolicy
Show Description This operation retrieves the access-policy subresource set on the vault; for more information on setting this subresource, see Set Vault Access Policy (PUT access-policy). If there is no access policy set on the vault, the operation returns a 404 Not found error. For more information about vault access policies, see Amazon Glacier Access Control with Vault Access Policies.
GetVaultLock
Show Description This operation retrieves the following attributes from the lock-policy subresource set on the specified vault:
  • The vault lock policy set on the vault.
  • The state of the vault lock, which is either InProgess or Locked.
  • When the lock ID expires. The lock ID is used to complete the vault locking process.
  • When the vault lock was initiated and put into the InProgress state.
A vault lock is put into the InProgress state by calling InitiateVaultLock. A vault lock is put into the Locked state by calling CompleteVaultLock. You can abort the vault locking process by calling AbortVaultLock. For more information about the vault locking process, Amazon Glacier Vault Lock. If there is no vault lock policy set on the vault, the operation returns a 404 Not found error. For more information about vault lock policies, Amazon Glacier Access Control with Vault Lock Policies.
GetVaultNotifications
Show Description This operation retrieves the notification-configuration subresource of the specified vault. For information about setting a notification configuration on a vault, see SetVaultNotifications. If a notification configuration for a vault is not set, the operation returns a 404 Not Found error. For more information about vault notifications, see Configuring Vault Notifications in Amazon S3 Glacier. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and underlying REST API, see Configuring Vault Notifications in Amazon S3 Glacier and Get Vault Notification Configuration in the Amazon Glacier Developer Guide.
InitiateJob
Show Description This operation initiates a job of the specified type, which can be a select, an archival retrieval, or a vault retrieval. For more information about using this operation, see the documentation for the underlying REST API Initiate a Job.
InitiateMultipartUpload
Show Description This operation initiates a multipart upload. Amazon S3 Glacier creates a multipart upload resource and returns its ID in the response. The multipart upload ID is used in subsequent requests to upload parts of an archive (see UploadMultipartPart). When you initiate a multipart upload, you specify the part size in number of bytes. The part size must be a megabyte (1024 KB) multiplied by a power of 2-for example, 1048576 (1 MB), 2097152 (2 MB), 4194304 (4 MB), 8388608 (8 MB), and so on. The minimum allowable part size is 1 MB, and the maximum is 4 GB. Every part you upload to this resource (see UploadMultipartPart), except the last one, must have the same size. The last one can be the same size or smaller. For example, suppose you want to upload a 16.2 MB file. If you initiate the multipart upload with a part size of 4 MB, you will upload four parts of 4 MB each and one part of 0.2 MB. You don't need to know the size of the archive when you start a multipart upload because Amazon S3 Glacier does not require you to specify the overall archive size. After you complete the multipart upload, Amazon S3 Glacier (Glacier) removes the multipart upload resource referenced by the ID. Glacier also removes the multipart upload resource if you cancel the multipart upload or it may be removed if there is no activity for a period of 24 hours. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and underlying REST API, see Uploading Large Archives in Parts (Multipart Upload) and Initiate Multipart Upload in the Amazon Glacier Developer Guide.
InitiateVaultLock
Show Description This operation initiates the vault locking process by doing the following:
  • Installing a vault lock policy on the specified vault.
  • Setting the lock state of vault lock to InProgress.
  • Returning a lock ID, which is used to complete the vault locking process.
You can set one vault lock policy for each vault and this policy can be up to 20 KB in size. For more information about vault lock policies, see Amazon Glacier Access Control with Vault Lock Policies. You must complete the vault locking process within 24 hours after the vault lock enters the InProgress state. After the 24 hour window ends, the lock ID expires, the vault automatically exits the InProgress state, and the vault lock policy is removed from the vault. You call CompleteVaultLock to complete the vault locking process by setting the state of the vault lock to Locked. After a vault lock is in the Locked state, you cannot initiate a new vault lock for the vault. You can abort the vault locking process by calling AbortVaultLock. You can get the state of the vault lock by calling GetVaultLock. For more information about the vault locking process, Amazon Glacier Vault Lock. If this operation is called when the vault lock is in the InProgress state, the operation returns an AccessDeniedException error. When the vault lock is in the InProgress state you must call AbortVaultLock before you can initiate a new vault lock policy.
ListJobs
Show Description This operation lists jobs for a vault, including jobs that are in-progress and jobs that have recently finished. The List Job operation returns a list of these jobs sorted by job initiation time. Amazon Glacier retains recently completed jobs for a period before deleting them; however, it eventually removes completed jobs. The output of completed jobs can be retrieved. Retaining completed jobs for a period of time after they have completed enables you to get a job output in the event you miss the job completion notification or your first attempt to download it fails. For example, suppose you start an archive retrieval job to download an archive. After the job completes, you start to download the archive but encounter a network error. In this scenario, you can retry and download the archive while the job exists. The List Jobs operation supports pagination. You should always check the response Marker field. If there are no more jobs to list, the Marker field is set to null. If there are more jobs to list, the Marker field is set to a non-null value, which you can use to continue the pagination of the list. To return a list of jobs that begins at a specific job, set the marker request parameter to the Marker value for that job that you obtained from a previous List Jobs request. You can set a maximum limit for the number of jobs returned in the response by specifying the limit parameter in the request. The default limit is 50. The number of jobs returned might be fewer than the limit, but the number of returned jobs never exceeds the limit. Additionally, you can filter the jobs list returned by specifying the optional statuscode parameter or completed parameter, or both. Using the statuscode parameter, you can specify to return only jobs that match either the InProgress, Succeeded, or Failed status. Using the completed parameter, you can specify to return only jobs that were completed (true) or jobs that were not completed (false). For more information about using this operation, see the documentation for the underlying REST API List Jobs.
ListMultipartUploads
Show Description This operation lists in-progress multipart uploads for the specified vault. An in-progress multipart upload is a multipart upload that has been initiated by an InitiateMultipartUpload request, but has not yet been completed or aborted. The list returned in the List Multipart Upload response has no guaranteed order. The List Multipart Uploads operation supports pagination. By default, this operation returns up to 50 multipart uploads in the response. You should always check the response for a marker at which to continue the list; if there are no more items the marker is null. To return a list of multipart uploads that begins at a specific upload, set the marker request parameter to the value you obtained from a previous List Multipart Upload request. You can also limit the number of uploads returned in the response by specifying the limit parameter in the request. Note the difference between this operation and listing parts (ListParts). The List Multipart Uploads operation lists all multipart uploads for a vault and does not require a multipart upload ID. The List Parts operation requires a multipart upload ID since parts are associated with a single upload. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and the underlying REST API, see Working with Archives in Amazon S3 Glacier and List Multipart Uploads in the Amazon Glacier Developer Guide.
ListParts
Show Description This operation lists the parts of an archive that have been uploaded in a specific multipart upload. You can make this request at any time during an in-progress multipart upload before you complete the upload (see CompleteMultipartUpload. List Parts returns an error for completed uploads. The list returned in the List Parts response is sorted by part range. The List Parts operation supports pagination. By default, this operation returns up to 50 uploaded parts in the response. You should always check the response for a marker at which to continue the list; if there are no more items the marker is null. To return a list of parts that begins at a specific part, set the marker request parameter to the value you obtained from a previous List Parts request. You can also limit the number of parts returned in the response by specifying the limit parameter in the request. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and the underlying REST API, see Working with Archives in Amazon S3 Glacier and List Parts in the Amazon Glacier Developer Guide.
ListProvisionedCapacity
Show Description This operation lists the provisioned capacity units for the specified AWS account.
ListTagsForVault
Show Description This operation lists all the tags attached to a vault. The operation returns an empty map if there are no tags. For more information about tags, see Tagging Amazon S3 Glacier Resources.
ListVaults
Show Description This operation lists all vaults owned by the calling user's account. The list returned in the response is ASCII-sorted by vault name. By default, this operation returns up to 10 items. If there are more vaults to list, the response marker field contains the vault Amazon Resource Name (ARN) at which to continue the list with a new List Vaults request; otherwise, the marker field is null. To return a list of vaults that begins at a specific vault, set the marker request parameter to the vault ARN you obtained from a previous List Vaults request. You can also limit the number of vaults returned in the response by specifying the limit parameter in the request. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and underlying REST API, see Retrieving Vault Metadata in Amazon S3 Glacier and List Vaults in the Amazon Glacier Developer Guide.
PurchaseProvisionedCapacity
Show Description This operation purchases a provisioned capacity unit for an AWS account.
RemoveTagsFromVault
SetDataRetrievalPolicy
SetVaultAccessPolicy
SetVaultNotifications
UploadArchive
Show Description This operation adds an archive to a vault. This is a synchronous operation, and for a successful upload, your data is durably persisted. Amazon S3 Glacier returns the archive ID in the x-amz-archive-id header of the response. You must use the archive ID to access your data in Amazon S3 Glacier. After you upload an archive, you should save the archive ID returned so that you can retrieve or delete the archive later. Besides saving the archive ID, you can also index it and give it a friendly name to allow for better searching. You can also use the optional archive description field to specify how the archive is referred to in an external index of archives, such as you might create in Amazon DynamoDB. You can also get the vault inventory to obtain a list of archive IDs in a vault. For more information, see InitiateJob. You must provide a SHA256 tree hash of the data you are uploading. For information about computing a SHA256 tree hash, see Computing Checksums. You can optionally specify an archive description of up to 1,024 printable ASCII characters. You can get the archive description when you either retrieve the archive or get the vault inventory. For more information, see InitiateJob. Amazon Glacier does not interpret the description in any way. An archive description does not need to be unique. You cannot use the description to retrieve or sort the archive list. Archives are immutable. After you upload an archive, you cannot edit the archive or its description. An AWS account has full permission to perform all operations (actions). However, AWS Identity and Access Management (IAM) users don't have any permissions by default. You must grant them explicit permission to perform specific actions. For more information, see Access Control Using AWS Identity and Access Management (IAM). For conceptual information and underlying REST API, see Uploading an Archive in Amazon Glacier and Upload Archive in the Amazon Glacier Developer Guide.

Globalaccelerator Events

Service Event Name Description
globalaccelerator AddCustomRoutingEndpoints
Show Description Associate a virtual private cloud (VPC) subnet endpoint with your custom routing accelerator. The listener port range must be large enough to support the number of IP addresses that can be specified in your subnet. The number of ports required is: subnet size times the number of ports per destination EC2 instances. For example, a subnet defined as /24 requires a listener port range of at least 255 ports. Note: You must have enough remaining listener ports available to map to the subnet ports, or the call will fail with a LimitExceededException. By default, all destinations in a subnet in a custom routing accelerator cannot receive traffic. To enable all destinations to receive traffic, or to specify individual port mappings that can receive traffic, see the AllowCustomRoutingTraffic operation.
AdvertiseByoipCidr
Show Description Advertises an IPv4 address range that is provisioned for use with your AWS resources through bring your own IP addresses (BYOIP). It can take a few minutes before traffic to the specified addresses starts routing to AWS because of propagation delays. To stop advertising the BYOIP address range, use WithdrawByoipCidr. For more information, see Bring Your Own IP Addresses (BYOIP) in the AWS Global Accelerator Developer Guide.
AllowCustomRoutingTraffic
CreateAccelerator
Show Description Create an accelerator. An accelerator includes one or more listeners that process inbound connections and direct traffic to one or more endpoint groups, each of which includes endpoints, such as Network Load Balancers. Global Accelerator is a global service that supports endpoints in multiple AWS Regions but you must specify the US West (Oregon) Region to create or update accelerators.
CreateCustomRoutingAccelerator
Show Description Create a custom routing accelerator. A custom routing accelerator directs traffic to one of possibly thousands of Amazon EC2 instance destinations running in a single or multiple virtual private clouds (VPC) subnet endpoints. Be aware that, by default, all destination EC2 instances in a VPC subnet endpoint cannot receive traffic. To enable all destinations to receive traffic, or to specify individual port mappings that can receive traffic, see the AllowCustomRoutingTraffic operation. Global Accelerator is a global service that supports endpoints in multiple AWS Regions but you must specify the US West (Oregon) Region to create or update accelerators.
CreateCustomRoutingEndpointGroup
Show Description Create an endpoint group for the specified listener for a custom routing accelerator. An endpoint group is a collection of endpoints in one AWS Region.
CreateCustomRoutingListener
Show Description Create a listener to process inbound connections from clients to a custom routing accelerator. Connections arrive to assigned static IP addresses on the port range that you specify.
CreateEndpointGroup
Show Description Create an endpoint group for the specified listener. An endpoint group is a collection of endpoints in one AWS Region. A resource must be valid and active when you add it as an endpoint.
CreateListener
Show Description Create a listener to process inbound connections from clients to an accelerator. Connections arrive to assigned static IP addresses on a port, port range, or list of port ranges that you specify.
DeleteAccelerator
DeleteCustomRoutingAccelerator
DeleteCustomRoutingEndpointGroup
DeleteCustomRoutingListener
DeleteEndpointGroup
DeleteListener
DenyCustomRoutingTraffic
DeprovisionByoipCidr
Show Description Releases the specified address range that you provisioned to use with your AWS resources through bring your own IP addresses (BYOIP) and deletes the corresponding address pool. Before you can release an address range, you must stop advertising it by using WithdrawByoipCidr and you must not have any accelerators that are using static IP addresses allocated from its address range. For more information, see Bring Your Own IP Addresses (BYOIP) in the AWS Global Accelerator Developer Guide.
DescribeAccelerator
Show Description Describe an accelerator.
DescribeAcceleratorAttributes
Show Description Describe the attributes of an accelerator.
DescribeCustomRoutingAccelerator
Show Description Describe a custom routing accelerator.
DescribeCustomRoutingAcceleratorAttributes
Show Description Describe the attributes of a custom routing accelerator.
DescribeCustomRoutingEndpointGroup
Show Description Describe an endpoint group for a custom routing accelerator.
DescribeCustomRoutingListener
Show Description The description of a listener for a custom routing accelerator.
DescribeEndpointGroup
Show Description Describe an endpoint group.
DescribeListener
Show Description Describe a listener.
ListAccelerators
Show Description List the accelerators for an AWS account.
ListByoipCidrs
Show Description Lists the IP address ranges that were specified in calls to ProvisionByoipCidr, including the current state and a history of state changes.
ListCustomRoutingAccelerators
Show Description List the custom routing accelerators for an AWS account.
ListCustomRoutingEndpointGroups
Show Description List the endpoint groups that are associated with a listener for a custom routing accelerator.
ListCustomRoutingListeners
Show Description List the listeners for a custom routing accelerator.
ListCustomRoutingPortMappings
Show Description Provides a complete mapping from the public accelerator IP address and port to destination EC2 instance IP addresses and ports in the virtual public cloud (VPC) subnet endpoint for a custom routing accelerator. For each subnet endpoint that you add, Global Accelerator creates a new static port mapping for the accelerator. The port mappings don't change after Global Accelerator generates them, so you can retrieve and cache the full mapping on your servers. If you remove a subnet from your accelerator, Global Accelerator removes (reclaims) the port mappings. If you add a subnet to your accelerator, Global Accelerator creates new port mappings (the existing ones don't change). If you add or remove EC2 instances in your subnet, the port mappings don't change, because the mappings are created when you add the subnet to Global Accelerator. The mappings also include a flag for each destination denoting which destination IP addresses and ports are allowed or denied traffic.
ListCustomRoutingPortMappingsByDestination
Show Description List the port mappings for a specific EC2 instance (destination) in a VPC subnet endpoint. The response is the mappings for one destination IP address. This is useful when your subnet endpoint has mappings that span multiple custom routing accelerators in your account, or for scenarios where you only want to list the port mappings for a specific destination instance.
ListEndpointGroups
Show Description List the endpoint groups that are associated with a listener.
ListListeners
Show Description List the listeners for an accelerator.
ListTagsForResource
Show Description List all tags for an accelerator. For more information, see Tagging in AWS Global Accelerator in the AWS Global Accelerator Developer Guide.
ProvisionByoipCidr
Show Description Provisions an IP address range to use with your AWS resources through bring your own IP addresses (BYOIP) and creates a corresponding address pool. After the address range is provisioned, it is ready to be advertised using AdvertiseByoipCidr. For more information, see Bring Your Own IP Addresses (BYOIP) in the AWS Global Accelerator Developer Guide.
RemoveCustomRoutingEndpoints
TagResource
Show Description Add tags to an accelerator resource. For more information, see Tagging in AWS Global Accelerator in the AWS Global Accelerator Developer Guide.
UntagResource
Show Description Remove tags from a Global Accelerator resource. When you specify a tag key, the action removes both that key and its associated value. The operation succeeds even if you attempt to remove tags from an accelerator that was already removed. For more information, see Tagging in AWS Global Accelerator in the AWS Global Accelerator Developer Guide.
UpdateAccelerator
Show Description Update an accelerator. Global Accelerator is a global service that supports endpoints in multiple AWS Regions but you must specify the US West (Oregon) Region to create or update accelerators.
UpdateAcceleratorAttributes
Show Description Update the attributes for an accelerator.
UpdateCustomRoutingAccelerator
Show Description Update a custom routing accelerator.
UpdateCustomRoutingAcceleratorAttributes
Show Description Update the attributes for a custom routing accelerator.
UpdateCustomRoutingListener
Show Description Update a listener for a custom routing accelerator.
UpdateEndpointGroup
Show Description Update an endpoint group. A resource must be valid and active when you add it as an endpoint.
UpdateListener
Show Description Update a listener.

Grafana Events

Service Event Name Description
grafana AssociateLicense
Show Description Assigns a Grafana Enterprise license to a workspace. Upgrading to Grafana Enterprise incurs additional fees. For more information, see Upgrade a workspace to Grafana Enterprise.
CreateWorkspace
Show Description Creates a workspace. In a workspace, you can create Grafana dashboards and visualizations to analyze your metrics, logs, and traces. You don't have to build, package, or deploy any hardware to run the Grafana server. Don't use CreateWorkspace to modify an existing workspace. Instead, use UpdateWorkspace.
DeleteWorkspace
Show Description Deletes an Amazon Managed Grafana workspace.
DescribeWorkspace
Show Description Displays information about one Amazon Managed Grafana workspace.
DescribeWorkspaceAuthentication
Show Description Displays information about the authentication methods used in one Amazon Managed Grafana workspace.
DisassociateLicense
Show Description Removes the Grafana Enterprise license from a workspace.
ListPermissions
Show Description Lists the users and groups who have the Grafana Admin and Editor roles in this workspace. If you use this operation without specifying userId or groupId, the operation returns the roles of all users and groups. If you specify a userId or a groupId, only the roles for that user or group are returned. If you do this, you can specify only one userId or one groupId.
ListWorkspaces
Show Description Returns a list of Amazon Managed Grafana workspaces in the account, with some information about each workspace. For more complete information about one workspace, use DescribeWorkspace.
UpdatePermissions
Show Description Updates which users in a workspace have the Grafana Admin or Editor roles.
UpdateWorkspace
Show Description Modifies an existing Amazon Managed Grafana workspace. If you use this operation and omit any optional parameters, the existing values of those parameters are not changed. To modify the user authentication methods that the workspace uses, such as SAML or Amazon Web Services SSO, use UpdateWorkspaceAuthentication. To modify which users in the workspace have the Admin and Editor Grafana roles, use UpdatePermissions.

Greengrass Events

Service Event Name Description
greengrass AssociateRoleToGroup
Show Description Associates a role with a group. Your Greengrass core will use the role to access AWS cloud services. The role's permissions should allow Greengrass core Lambda functions to perform actions against the cloud.
AssociateServiceRoleToAccount
Show Description Associates a role with your account. AWS IoT Greengrass will use the role to access your Lambda functions and AWS IoT resources. This is necessary for deployments to succeed. The role must have at least minimum permissions in the policy ''AWSGreengrassResourceAccessRolePolicy''.
CreateConnectorDefinition
Show Description Creates a connector definition. You may provide the initial version of the connector definition now or use ''CreateConnectorDefinitionVersion'' at a later time.
CreateConnectorDefinitionVersion
Show Description Creates a version of a connector definition which has already been defined.
CreateCoreDefinition
Show Description Creates a core definition. You may provide the initial version of the core definition now or use ''CreateCoreDefinitionVersion'' at a later time. Greengrass groups must each contain exactly one Greengrass core.
CreateCoreDefinitionVersion
Show Description Creates a version of a core definition that has already been defined. Greengrass groups must each contain exactly one Greengrass core.
CreateDeployment
Show Description Creates a deployment. ''CreateDeployment'' requests are idempotent with respect to the ''X-Amzn-Client-Token'' token and the request parameters.
CreateDeviceDefinition
Show Description Creates a device definition. You may provide the initial version of the device definition now or use ''CreateDeviceDefinitionVersion'' at a later time.
CreateDeviceDefinitionVersion
Show Description Creates a version of a device definition that has already been defined.
CreateFunctionDefinition
Show Description Creates a Lambda function definition which contains a list of Lambda functions and their configurations to be used in a group. You can create an initial version of the definition by providing a list of Lambda functions and their configurations now, or use ''CreateFunctionDefinitionVersion'' later.
CreateFunctionDefinitionVersion
Show Description Creates a version of a Lambda function definition that has already been defined.
CreateGroup
Show Description Creates a group. You may provide the initial version of the group or use ''CreateGroupVersion'' at a later time. Tip: You can use the ''gg_group_setup'' package (https://github.com/awslabs/aws-greengrass-group-setup) as a library or command-line application to create and deploy Greengrass groups.
CreateGroupCertificateAuthority
Show Description Creates a CA for the group. If a CA already exists, it will rotate the existing CA.
CreateGroupVersion
Show Description Creates a version of a group which has already been defined.
CreateLoggerDefinition
Show Description Creates a logger definition. You may provide the initial version of the logger definition now or use ''CreateLoggerDefinitionVersion'' at a later time.
CreateLoggerDefinitionVersion
Show Description Creates a version of a logger definition that has already been defined.
CreateResourceDefinition
Show Description Creates a resource definition which contains a list of resources to be used in a group. You can create an initial version of the definition by providing a list of resources now, or use ''CreateResourceDefinitionVersion'' later.
CreateResourceDefinitionVersion
Show Description Creates a version of a resource definition that has already been defined.
CreateSoftwareUpdateJob
Show Description Creates a software update for a core or group of cores (specified as an IoT thing group.) Use this to update the OTA Agent as well as the Greengrass core software. It makes use of the IoT Jobs feature which provides additional commands to manage a Greengrass core software update job.
CreateSubscriptionDefinition
Show Description Creates a subscription definition. You may provide the initial version of the subscription definition now or use ''CreateSubscriptionDefinitionVersion'' at a later time.
CreateSubscriptionDefinitionVersion
Show Description Creates a version of a subscription definition which has already been defined.
DeleteConnectorDefinition
Show Description Deletes a connector definition.
DeleteCoreDefinition
Show Description Deletes a core definition.
DeleteDeviceDefinition
Show Description Deletes a device definition.
DeleteFunctionDefinition
Show Description Deletes a Lambda function definition.
DeleteGroup
Show Description Deletes a group.
DeleteLoggerDefinition
Show Description Deletes a logger definition.
DeleteResourceDefinition
Show Description Deletes a resource definition.
DeleteSubscriptionDefinition
Show Description Deletes a subscription definition.
DisassociateRoleFromGroup
Show Description Disassociates the role from a group.
DisassociateServiceRoleFromAccount
Show Description Disassociates the service role from your account. Without a service role, deployments will not work.
GetAssociatedRole
Show Description Retrieves the role associated with a particular group.
GetBulkDeploymentStatus
Show Description Returns the status of a bulk deployment.
GetConnectivityInfo
Show Description Retrieves the connectivity information for a core.
GetConnectorDefinition
Show Description Retrieves information about a connector definition.
GetConnectorDefinitionVersion
Show Description Retrieves information about a connector definition version, including the connectors that the version contains. Connectors are prebuilt modules that interact with local infrastructure, device protocols, AWS, and other cloud services.
GetCoreDefinition
Show Description Retrieves information about a core definition version.
GetCoreDefinitionVersion
Show Description Retrieves information about a core definition version.
GetDeploymentStatus
Show Description Returns the status of a deployment.
GetDeviceDefinition
Show Description Retrieves information about a device definition.
GetDeviceDefinitionVersion
Show Description Retrieves information about a device definition version.
GetFunctionDefinition
Show Description Retrieves information about a Lambda function definition, including its creation time and latest version.
GetFunctionDefinitionVersion
Show Description Retrieves information about a Lambda function definition version, including which Lambda functions are included in the version and their configurations.
GetGroup
Show Description Retrieves information about a group.
GetGroupCertificateAuthority
Show Description Retreives the CA associated with a group. Returns the public key of the CA.
GetGroupCertificateConfiguration
Show Description Retrieves the current configuration for the CA used by the group.
GetGroupVersion
Show Description Retrieves information about a group version.
GetLoggerDefinition
Show Description Retrieves information about a logger definition.
GetLoggerDefinitionVersion
Show Description Retrieves information about a logger definition version.
GetResourceDefinition
Show Description Retrieves information about a resource definition, including its creation time and latest version.
GetResourceDefinitionVersion
Show Description Retrieves information about a resource definition version, including which resources are included in the version.
GetServiceRoleForAccount
Show Description Retrieves the service role that is attached to your account.
GetSubscriptionDefinition
Show Description Retrieves information about a subscription definition.
GetSubscriptionDefinitionVersion
Show Description Retrieves information about a subscription definition version.
GetThingRuntimeConfiguration
Show Description Get the runtime configuration of a thing.
ListBulkDeploymentDetailedReports
Show Description Gets a paginated list of the deployments that have been started in a bulk deployment operation, and their current deployment status.
ListBulkDeployments
Show Description Returns a list of bulk deployments.
ListConnectorDefinitionVersions
Show Description Lists the versions of a connector definition, which are containers for connectors. Connectors run on the Greengrass core and contain built-in integration with local infrastructure, device protocols, AWS, and other cloud services.
ListConnectorDefinitions
Show Description Retrieves a list of connector definitions.
ListCoreDefinitionVersions
Show Description Lists the versions of a core definition.
ListCoreDefinitions
Show Description Retrieves a list of core definitions.
ListDeployments
Show Description Returns a history of deployments for the group.
ListDeviceDefinitionVersions
Show Description Lists the versions of a device definition.
ListDeviceDefinitions
Show Description Retrieves a list of device definitions.
ListFunctionDefinitionVersions
Show Description Lists the versions of a Lambda function definition.
ListFunctionDefinitions
Show Description Retrieves a list of Lambda function definitions.
ListGroupCertificateAuthorities
Show Description Retrieves the current CAs for a group.
ListGroupVersions
Show Description Lists the versions of a group.
ListGroups
Show Description Retrieves a list of groups.
ListLoggerDefinitionVersions
Show Description Lists the versions of a logger definition.
ListLoggerDefinitions
Show Description Retrieves a list of logger definitions.
ListResourceDefinitionVersions
Show Description Lists the versions of a resource definition.
ListResourceDefinitions
Show Description Retrieves a list of resource definitions.
ListSubscriptionDefinitionVersions
Show Description Lists the versions of a subscription definition.
ListSubscriptionDefinitions
Show Description Retrieves a list of subscription definitions.
ListTagsForResource
Show Description Retrieves a list of resource tags for a resource arn.
ResetDeployments
Show Description Resets a group's deployments.
StartBulkDeployment
Show Description Deploys multiple groups in one operation. This action starts the bulk deployment of a specified set of group versions. Each group version deployment will be triggered with an adaptive rate that has a fixed upper limit. We recommend that you include an ''X-Amzn-Client-Token'' token in every ''StartBulkDeployment'' request. These requests are idempotent with respect to the token and the request parameters.
StopBulkDeployment
Show Description Stops the execution of a bulk deployment. This action returns a status of ''Stopping'' until the deployment is stopped. You cannot start a new bulk deployment while a previous deployment is in the ''Stopping'' state. This action doesn't rollback completed deployments or cancel pending deployments.
TagResource
UntagResource
UpdateConnectivityInfo
Show Description Updates the connectivity information for the core. Any devices that belong to the group which has this core will receive this information in order to find the location of the core and connect to it.
UpdateConnectorDefinition
Show Description Updates a connector definition.
UpdateCoreDefinition
Show Description Updates a core definition.
UpdateDeviceDefinition
Show Description Updates a device definition.
UpdateFunctionDefinition
Show Description Updates a Lambda function definition.
UpdateGroup
Show Description Updates a group.
UpdateGroupCertificateConfiguration
Show Description Updates the Certificate expiry time for a group.
UpdateLoggerDefinition
Show Description Updates a logger definition.
UpdateResourceDefinition
Show Description Updates a resource definition.
UpdateSubscriptionDefinition
Show Description Updates a subscription definition.

Greengrassv2 Events

Service Event Name Description
greengrassv2 BatchAssociateClientDeviceWithCoreDevice
Show Description Associate a list of client devices with a core device. Use this API operation to specify which client devices can discover a core device through cloud discovery. With cloud discovery, client devices connect to IoT Greengrass to retrieve associated core devices' connectivity information and certificates. For more information, see Configure cloud discovery in the IoT Greengrass V2 Developer Guide. Client devices are local IoT devices that connect to and communicate with an IoT Greengrass core device over MQTT. You can connect client devices to a core device to sync MQTT messages and data to Amazon Web Services IoT Core and interact with client devices in Greengrass components. For more information, see Interact with local IoT devices in the IoT Greengrass V2 Developer Guide.
BatchDisassociateClientDeviceFromCoreDevice
Show Description Disassociate a list of client devices from a core device. After you disassociate a client device from a core device, the client device won't be able to use cloud discovery to retrieve the core device's connectivity information and certificates.
CancelDeployment
Show Description Cancels a deployment. This operation cancels the deployment for devices that haven't yet received it. If a device already received the deployment, this operation doesn't change anything for that device.
CreateComponentVersion
Show Description Creates a component. Components are software that run on Greengrass core devices. After you develop and test a component on your core device, you can use this operation to upload your component to IoT Greengrass. Then, you can deploy the component to other core devices. You can use this operation to do the following:
  • Create components from recipes Create a component from a recipe, which is a file that defines the component's metadata, parameters, dependencies, lifecycle, artifacts, and platform capability. For more information, see IoT Greengrass component recipe reference in the IoT Greengrass V2 Developer Guide. To create a component from a recipe, specify inlineRecipe when you call this operation.
  • Create components from Lambda functions Create a component from an Lambda function that runs on IoT Greengrass. This creates a recipe and artifacts from the Lambda function's deployment package. You can use this operation to migrate Lambda functions from IoT Greengrass V1 to IoT Greengrass V2. This function only accepts Lambda functions that use the following runtimes:
    • Python 2.7 – python2.7
    • Python 3.7 – python3.7
    • Python 3.8 – python3.8
    • Java 8 – java8
    • Node.js 10 – nodejs10.x
    • Node.js 12 – nodejs12.x
    To create a component from a Lambda function, specify lambdaFunction when you call this operation.
CreateDeployment
Show Description Creates a continuous deployment for a target, which is a Greengrass core device or group of core devices. When you add a new core device to a group of core devices that has a deployment, IoT Greengrass deploys that group's deployment to the new device. You can define one deployment for each target. When you create a new deployment for a target that has an existing deployment, you replace the previous deployment. IoT Greengrass applies the new deployment to the target devices. Every deployment has a revision number that indicates how many deployment revisions you define for a target. Use this operation to create a new revision of an existing deployment. This operation returns the revision number of the new deployment when you create it. For more information, see the Create deployments in the IoT Greengrass V2 Developer Guide.
DeleteComponent
DeleteCoreDevice
DescribeComponent
Show Description Retrieves metadata for a version of a component.
GetComponent
Show Description Gets the recipe for a version of a component. Core devices can call this operation to identify the artifacts and requirements to install a component.
GetComponentVersionArtifact
Show Description Gets the pre-signed URL to download a public component artifact. Core devices call this operation to identify the URL that they can use to download an artifact to install.
GetCoreDevice
Show Description Retrieves metadata for a Greengrass core device.
GetDeployment
Show Description Gets a deployment. Deployments define the components that run on Greengrass core devices.
ListClientDevicesAssociatedWithCoreDevice
Show Description Retrieves a paginated list of client devices that are associated with a core device.
ListComponentVersions
Show Description Retrieves a paginated list of all versions for a component. Greater versions are listed first.
ListComponents
Show Description Retrieves a paginated list of component summaries. This list includes components that you have permission to view.
ListCoreDevices
Show Description Retrieves a paginated list of Greengrass core devices.
ListDeployments
Show Description Retrieves a paginated list of deployments.
ListEffectiveDeployments
Show Description Retrieves a paginated list of deployment jobs that IoT Greengrass sends to Greengrass core devices.
ListInstalledComponents
Show Description Retrieves a paginated list of the components that a Greengrass core device runs.
ListTagsForResource
Show Description Retrieves the list of tags for an IoT Greengrass resource.
ResolveComponentCandidates
Show Description Retrieves a list of components that meet the component, version, and platform requirements of a deployment. Greengrass core devices call this operation when they receive a deployment to identify the components to install. This operation identifies components that meet all dependency requirements for a deployment. If the requirements conflict, then this operation returns an error and the deployment fails. For example, this occurs if component A requires version >2.0.0 and component B requires version <2.0.0 of a component dependency. When you specify the component candidates to resolve, IoT Greengrass compares each component's digest from the core device with the component's digest in the Amazon Web Services Cloud. If the digests don't match, then IoT Greengrass specifies to use the version from the Amazon Web Services Cloud. To use this operation, you must use the data plane API endpoint and authenticate with an IoT device certificate. For more information, see IoT Greengrass endpoints and quotas.
TagResource
Show Description Adds tags to an IoT Greengrass resource. If a tag already exists for the resource, this operation updates the tag's value.

Guardduty Events

Service Event Name Description
guardduty AcceptInvitation
Show Description Accepts the invitation to be monitored by a GuardDuty administrator account.
ArchiveFindings
Show Description Archives GuardDuty findings that are specified by the list of finding IDs. Only the administrator account can archive findings. Member accounts don't have permission to archive findings from their accounts.
CreateDetector
Show Description Creates a single Amazon GuardDuty detector. A detector is a resource that represents the GuardDuty service. To start using GuardDuty, you must create a detector in each Region where you enable the service. You can have only one detector per account per Region. All data sources are enabled in a new detector by default.
CreateFilter
Show Description Creates a filter using the specified finding criteria.
CreateIPSet
Show Description Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with AWS infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.
CreateMembers
Show Description Creates member accounts of the current AWS account by specifying a list of AWS account IDs. This step is a prerequisite for managing the associated member accounts either by invitation or through an organization. When using Create Members as an organizations delegated administrator this action will enable GuardDuty in the added member accounts, with the exception of the organization delegated administrator account, which must enable GuardDuty prior to being added as a member. If you are adding accounts by invitation use this action after GuardDuty has been enabled in potential member accounts and before using Invite Members .
CreatePublishingDestination
Show Description Creates a publishing destination to export findings to. The resource to export findings to must exist before you use this operation.
CreateSampleFindings
Show Description Generates example findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates example findings of all supported finding types.
CreateThreatIntelSet
Show Description Creates a new ThreatIntelSet. ThreatIntelSets consist of known malicious IP addresses. GuardDuty generates findings based on ThreatIntelSets. Only users of the administrator account can use this operation.
DeclineInvitations
Show Description Declines invitations sent to the current member account by AWS accounts specified by their account IDs.
DeleteDetector
Show Description Deletes an Amazon GuardDuty detector that is specified by the detector ID.
DeleteFilter
Show Description Deletes the filter specified by the filter name.
DeleteIPSet
Show Description Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.
DeleteInvitations
Show Description Deletes invitations sent to the current member account by AWS accounts specified by their account IDs.
DeleteMembers
Show Description Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs.
DeletePublishingDestination
Show Description Deletes the publishing definition with the specified destinationId.
DeleteThreatIntelSet
Show Description Deletes the ThreatIntelSet specified by the ThreatIntelSet ID.
DescribeOrganizationConfiguration
Show Description Returns information about the account selected as the delegated administrator for GuardDuty.
DescribePublishingDestination
Show Description Returns information about the publishing destination specified by the provided destinationId.
DisableOrganizationAdminAccount
Show Description Disables an AWS account within the Organization as the GuardDuty delegated administrator.
DisassociateFromMasterAccount
Show Description Disassociates the current GuardDuty member account from its administrator account.
DisassociateMembers
Show Description Disassociates GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs.
EnableOrganizationAdminAccount
Show Description Enables an AWS account within the organization as the GuardDuty delegated administrator.
GetDetector
Show Description Retrieves an Amazon GuardDuty detector specified by the detectorId.
GetFilter
Show Description Returns the details of the filter specified by the filter name.
GetFindings
Show Description Describes Amazon GuardDuty findings specified by finding IDs.
GetFindingsStatistics
Show Description Lists Amazon GuardDuty findings statistics for the specified detector ID.
GetIPSet
Show Description Retrieves the IPSet specified by the ipSetId.
GetInvitationsCount
Show Description Returns the count of all GuardDuty membership invitations that were sent to the current member account except the currently accepted invitation.
GetMasterAccount
Show Description Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.
GetMemberDetectors
Show Description Describes which data sources are enabled for the member account's detector.
GetMembers
Show Description Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.
GetThreatIntelSet
Show Description Retrieves the ThreatIntelSet that is specified by the ThreatIntelSet ID.
GetUsageStatistics
Show Description Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources the cost returned will include only the usage so far under 30 days, this may differ from the cost metrics in the console, which projects usage over 30 days to provide a monthly cost estimate. For more information see Understanding How Usage Costs are Calculated.
InviteMembers
Show Description Invites other AWS accounts (created as members of the current AWS account by CreateMembers) to enable GuardDuty, and allow the current AWS account to view and manage these accounts' findings on their behalf as the GuardDuty administrator account.
ListDetectors
Show Description Lists detectorIds of all the existing Amazon GuardDuty detector resources.
ListFilters
Show Description Returns a paginated list of the current filters.
ListFindings
Show Description Lists Amazon GuardDuty findings for the specified detector ID.
ListIPSets
Show Description Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.
ListInvitations
Show Description Lists all GuardDuty membership invitations that were sent to the current AWS account.
ListMembers
Show Description Lists details about all member accounts for the current GuardDuty administrator account.
ListOrganizationAdminAccounts
Show Description Lists the accounts configured as GuardDuty delegated administrators.
ListPublishingDestinations
Show Description Returns a list of publishing destinations associated with the specified dectectorId.
ListTagsForResource
Show Description Lists tags for a resource. Tagging is currently supported for detectors, finding filters, IP sets, and threat intel sets, with a limit of 50 tags per resource. When invoked, this operation returns all assigned tags for a given resource.
ListThreatIntelSets
Show Description Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.
StartMonitoringMembers
Show Description Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.
StopMonitoringMembers
Show Description Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts.
TagResource
Show Description Adds tags to a resource.
UnarchiveFindings
Show Description Unarchives GuardDuty findings specified by the findingIds.
UntagResource
Show Description Removes tags from a resource.
UpdateDetector
Show Description Updates the Amazon GuardDuty detector specified by the detectorId.
UpdateFilter
Show Description Updates the filter specified by the filter name.
UpdateFindingsFeedback
Show Description Marks the specified GuardDuty findings as useful or not useful.
UpdateIPSet
Show Description Updates the IPSet specified by the IPSet ID.
UpdateMemberDetectors
Show Description Contains information on member accounts to be updated.
UpdateOrganizationConfiguration
Show Description Updates the delegated administrator account with the values provided.
UpdatePublishingDestination
Show Description Updates information about the publishing destination specified by the destinationId.

Health Events

Service Event Name Description
health DescribeAffectedAccountsForOrganization
Show Description Returns a list of accounts in the organization from AWS Organizations that are affected by the provided event. For more information about the different types of AWS Health events, see Event. Before you can call this operation, you must first enable AWS Health to work with AWS Organizations. To do this, call the EnableHealthServiceAccessForOrganization operation from your organization's management account. This API operation uses pagination. Specify the nextToken parameter in the next request to return more results.
DescribeAffectedEntities
Show Description Returns a list of entities that have been affected by the specified events, based on the specified filter criteria. Entities can refer to individual customer resources, groups of customer resources, or any other construct, depending on the AWS service. Events that have impact beyond that of the affected entities, or where the extent of impact is unknown, include at least one entity indicating this. At least one event ARN is required. Results are sorted by the lastUpdatedTime of the entity, starting with the most recent.
  • This API operation uses pagination. Specify the nextToken parameter in the next request to return more results.
  • This operation supports resource-level permissions. You can use this operation to allow or deny access to specific AWS Health events. For more information, see Resource- and action-based conditions in the AWS Health User Guide.
DescribeAffectedEntitiesForOrganization
Show Description Returns a list of entities that have been affected by one or more events for one or more accounts in your organization in AWS Organizations, based on the filter criteria. Entities can refer to individual customer resources, groups of customer resources, or any other construct, depending on the AWS service. At least one event Amazon Resource Name (ARN) and account ID are required. Results are sorted by the lastUpdatedTime of the entity, starting with the most recent. Before you can call this operation, you must first enable AWS Health to work with AWS Organizations. To do this, call the EnableHealthServiceAccessForOrganization operation from your organization's management account.
  • This API operation uses pagination. Specify the nextToken parameter in the next request to return more results.
  • This operation doesn't support resource-level permissions. You can't use this operation to allow or deny access to specific AWS Health events. For more information, see Resource- and action-based conditions in the AWS Health User Guide.
DescribeEntityAggregates
Show Description Returns the number of entities that are affected by each of the specified events. If no events are specified, the counts of all affected entities are returned.
DescribeEventAggregates
Show Description Returns the number of events of each event type (issue, scheduled change, and account notification). If no filter is specified, the counts of all events in each category are returned. This API operation uses pagination. Specify the nextToken parameter in the next request to return more results.
DescribeEventDetails
Show Description Returns detailed information about one or more specified events. Information includes standard event data (AWS Region, service, and so on, as returned by DescribeEvents), a detailed event description, and possible additional metadata that depends upon the nature of the event. Affected entities are not included. To retrieve the entities, use the DescribeAffectedEntities operation. If a specified event can't be retrieved, an error message is returned for that event. This operation supports resource-level permissions. You can use this operation to allow or deny access to specific AWS Health events. For more information, see Resource- and action-based conditions in the AWS Health User Guide.
DescribeEventDetailsForOrganization
Show Description Returns detailed information about one or more specified events for one or more AWS accounts in your organization. This information includes standard event data (such as the AWS Region and service), an event description, and (depending on the event) possible metadata. This operation doesn't return affected entities, such as the resources related to the event. To return affected entities, use the DescribeAffectedEntitiesForOrganization operation. Before you can call this operation, you must first enable AWS Health to work with AWS Organizations. To do this, call the EnableHealthServiceAccessForOrganization operation from your organization's management account. When you call the DescribeEventDetailsForOrganization operation, specify the organizationEventDetailFilters object in the request. Depending on the AWS Health event type, note the following differences:
  • To return event details for a public event, you must specify a null value for the awsAccountId parameter. If you specify an account ID for a public event, AWS Health returns an error message because public events aren't specific to an account.
  • To return event details for an event that is specific to an account in your organization, you must specify the awsAccountId parameter in the request. If you don't specify an account ID, AWS Health returns an error message because the event is specific to an account in your organization.
For more information, see Event. This operation doesn't support resource-level permissions. You can't use this operation to allow or deny access to specific AWS Health events. For more information, see Resource- and action-based conditions in the AWS Health User Guide.
DescribeEventTypes
Show Description Returns the event types that meet the specified filter criteria. You can use this API operation to find information about the AWS Health event, such as the category, AWS service, and event code. The metadata for each event appears in the EventType object. If you don't specify a filter criteria, the API operation returns all event types, in no particular order. This API operation uses pagination. Specify the nextToken parameter in the next request to return more results.
DescribeEvents
Show Description Returns information about events that meet the specified filter criteria. Events are returned in a summary form and do not include the detailed description, any additional metadata that depends on the event type, or any affected resources. To retrieve that information, use the DescribeEventDetails and DescribeAffectedEntities operations. If no filter criteria are specified, all events are returned. Results are sorted by lastModifiedTime, starting with the most recent event.
  • When you call the DescribeEvents operation and specify an entity for the entityValues parameter, AWS Health might return public events that aren't specific to that resource. For example, if you call DescribeEvents and specify an ID for an Amazon Elastic Compute Cloud (Amazon EC2) instance, AWS Health might return events that aren't specific to that resource or service. To get events that are specific to a service, use the services parameter in the filter object. For more information, see Event.
  • This API operation uses pagination. Specify the nextToken parameter in the next request to return more results.
DescribeEventsForOrganization
Show Description Returns information about events across your organization in AWS Organizations. You can use thefilters parameter to specify the events that you want to return. Events are returned in a summary form and don't include the affected accounts, detailed description, any additional metadata that depends on the event type, or any affected resources. To retrieve that information, use the following operations: If you don't specify a filter, the DescribeEventsForOrganizations returns all events across your organization. Results are sorted by lastModifiedTime, starting with the most recent event. For more information about the different types of AWS Health events, see Event. Before you can call this operation, you must first enable AWS Health to work with AWS Organizations. To do this, call the EnableHealthServiceAccessForOrganization operation from your organization's management account. This API operation uses pagination. Specify the nextToken parameter in the next request to return more results.
DescribeHealthServiceStatusForOrganization
Show Description This operation provides status information on enabling or disabling AWS Health to work with your organization. To call this operation, you must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization's management account.
DisableHealthServiceAccessForOrganization

Healthlake Events

Service Event Name Description
healthlake CreateFHIRDatastore
Show Description Creates a Data Store that can ingest and export FHIR formatted data.
DeleteFHIRDatastore
Show Description Deletes a Data Store.
DescribeFHIRDatastore
Show Description Gets the properties associated with the FHIR Data Store, including the Data Store ID, Data Store ARN, Data Store name, Data Store status, created at, Data Store type version, and Data Store endpoint.
DescribeFHIRExportJob
Show Description Displays the properties of a FHIR export job, including the ID, ARN, name, and the status of the job.
DescribeFHIRImportJob
Show Description Displays the properties of a FHIR import job, including the ID, ARN, name, and the status of the job.
ListFHIRDatastores
Show Description Lists all FHIR Data Stores that are in the user’s account, regardless of Data Store status.
ListFHIRExportJobs
Show Description Lists all FHIR export jobs associated with an account and their statuses.
ListFHIRImportJobs
Show Description Lists all FHIR import jobs associated with an account and their statuses.
ListTagsForResource
Show Description Returns a list of all existing tags associated with a Data Store.
StartFHIRExportJob
Show Description Begins a FHIR export job.
StartFHIRImportJob
Show Description Begins a FHIR Import job.
TagResource
Show Description Adds a user specifed key and value tag to a Data Store.

Honeycode Events

Service Event Name Description
honeycode BatchCreateTableRows
Show Description The BatchCreateTableRows API allows you to create one or more rows at the end of a table in a workbook. The API allows you to specify the values to set in some or all of the columns in the new rows. If a column is not explicitly set in a specific row, then the column level formula specified in the table will be applied to the new row. If there is no column level formula but the last row of the table has a formula, then that formula will be copied down to the new row. If there is no column level formula and no formula in the last row of the table, then that column will be left blank for the new rows.
BatchDeleteTableRows
Show Description The BatchDeleteTableRows API allows you to delete one or more rows from a table in a workbook. You need to specify the ids of the rows that you want to delete from the table.
BatchUpdateTableRows
Show Description The BatchUpdateTableRows API allows you to update one or more rows in a table in a workbook. You can specify the values to set in some or all of the columns in the table for the specified rows. If a column is not explicitly specified in a particular row, then that column will not be updated for that row. To clear out the data in a specific cell, you need to set the value as an empty string ("").
BatchUpsertTableRows
Show Description The BatchUpsertTableRows API allows you to upsert one or more rows in a table. The upsert operation takes a filter expression as input and evaluates it to find matching rows on the destination table. If matching rows are found, it will update the cells in the matching rows to new values specified in the request. If no matching rows are found, a new row is added at the end of the table and the cells in that row are set to the new values specified in the request. You can specify the values to set in some or all of the columns in the table for the matching or newly appended rows. If a column is not explicitly specified for a particular row, then that column will not be updated for that row. To clear out the data in a specific cell, you need to set the value as an empty string ("").
DescribeTableDataImportJob
Show Description The DescribeTableDataImportJob API allows you to retrieve the status and details of a table data import job.
GetScreenData
Show Description The GetScreenData API allows retrieval of data from a screen in a Honeycode app. The API allows setting local variables in the screen to filter, sort or otherwise affect what will be displayed on the screen.
InvokeScreenAutomation
Show Description The InvokeScreenAutomation API allows invoking an action defined in a screen in a Honeycode app. The API allows setting local variables, which can then be used in the automation being invoked. This allows automating the Honeycode app interactions to write, update or delete data in the workbook.
ListTableColumns
Show Description The ListTableColumns API allows you to retrieve a list of all the columns in a table in a workbook.
ListTableRows
Show Description The ListTableRows API allows you to retrieve a list of all the rows in a table in a workbook.
ListTables
Show Description The ListTables API allows you to retrieve a list of all the tables in a workbook.
QueryTableRows
Show Description The QueryTableRows API allows you to use a filter formula to query for specific rows in a table.

Iam Events

Service Event Name Description
iam AddClientIDToOpenIDConnectProvider
AddRoleToInstanceProfile
AddUserToGroup
AttachGroupPolicy
AttachRolePolicy
AttachUserPolicy
ChangePassword
CreateAccessKey
Show Description Creates a new Amazon Web Services secret access key and corresponding Amazon Web Services access key ID for the specified user. The default status for new keys is Active. If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID signing the request. This operation works for access keys under the Amazon Web Services account. Consequently, you can use this operation to manage Amazon Web Services account root user credentials. This is true even if the Amazon Web Services account has no associated users. For information about quotas on the number of keys you can create, see IAM and STS quotas in the IAM User Guide. To ensure the security of your Amazon Web Services account, the secret access key is accessible only during key and user creation. You must save the key (for example, in a text file) if you want to be able to access it again. If a secret key is lost, you can delete the access keys for the associated user and then create new keys.
CreateAccountAlias
CreateGroup
Show Description Creates a new group. For information about the number of groups you can create, see IAM and STS quotas in the IAM User Guide.
CreateInstanceProfile
Show Description Creates a new instance profile. For information about instance profiles, see Using roles for applications on Amazon EC2 in the IAM User Guide, and Instance profiles in the Amazon EC2 User Guide. For information about the number of instance profiles you can create, see IAM object quotas in the IAM User Guide.
CreateLoginProfile
Show Description Creates a password for the specified IAM user. A password allows an IAM user to access Amazon Web Services services through the Amazon Web Services Management Console. You can use the CLI, the Amazon Web Services API, or the Users page in the IAM console to create a password for any IAM user. Use ChangePassword to update your own existing password in the My Security Credentials page in the Amazon Web Services Management Console. For more information about managing passwords, see Managing passwords in the IAM User Guide.
CreateOpenIDConnectProvider
Show Description Creates an IAM entity to describe an identity provider (IdP) that supports OpenID Connect (OIDC). The OIDC provider that you create with this operation can be used as a principal in a role's trust policy. Such a policy establishes a trust relationship between Amazon Web Services and the OIDC provider. If you are using an OIDC identity provider from Google, Facebook, or Amazon Cognito, you don't need to create a separate IAM identity provider. These OIDC identity providers are already built-in to Amazon Web Services and are available for your use. Instead, you can move directly to creating new roles using your identity provider. To learn more, see Creating a role for web identity or OpenID connect federation in the IAM User Guide. When you create the IAM OIDC provider, you specify the following:
  • The URL of the OIDC identity provider (IdP) to trust
  • A list of client IDs (also known as audiences) that identify the application or applications allowed to authenticate using the OIDC provider
  • A list of thumbprints of one or more server certificates that the IdP uses
You get all of this information from the OIDC IdP you want to use to access Amazon Web Services. Amazon Web Services secures communication with some OIDC identity providers (IdPs) through our library of trusted certificate authorities (CAs) instead of using a certificate thumbprint to verify your IdP server certificate. These OIDC IdPs include Google, and those that use an Amazon S3 bucket to host a JSON Web Key Set (JWKS) endpoint. In these cases, your legacy thumbprint remains in your configuration, but is no longer used for validation. The trust for the OIDC provider is derived from the IAM provider that this operation creates. Therefore, it is best to limit access to the CreateOpenIDConnectProvider operation to highly privileged users.
CreatePolicy
Show Description Creates a new managed policy for your Amazon Web Services account. This operation creates a policy version with a version identifier of v1 and sets v1 as the policy's default version. For more information about policy versions, see Versioning for managed policies in the IAM User Guide. As a best practice, you can validate your IAM policies. To learn more, see Validating IAM policies in the IAM User Guide. For more information about managed policies in general, see Managed policies and inline policies in the IAM User Guide.
CreatePolicyVersion
Show Description Creates a new version of the specified managed policy. To update a managed policy, you create a new policy version. A managed policy can have up to five versions. If the policy has five versions, you must delete an existing version using DeletePolicyVersion before you create a new version. Optionally, you can set the new version as the policy's default version. The default version is the version that is in effect for the IAM users, groups, and roles to which the policy is attached. For more information about managed policy versions, see Versioning for managed policies in the IAM User Guide.
CreateRole
Show Description Creates a new role for your Amazon Web Services account. For more information about roles, see IAM roles. For information about quotas for role names and the number of roles you can create, see IAM and STS quotas in the IAM User Guide.
CreateSAMLProvider
Show Description Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0. The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy. Such a policy can enable federated users who sign in using the SAML IdP to assume the role. You can create an IAM role that supports Web-based single sign-on (SSO) to the Amazon Web Services Management Console or one that supports API access to Amazon Web Services. When you create the SAML provider resource, you upload a SAML metadata document that you get from your IdP. That document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that the IdP sends. You must generate the metadata document using the identity management software that is used as your organization's IdP. This operation requires Signature Version 4. For more information, see Enabling SAML 2.0 federated users to access the Amazon Web Services Management Console and About SAML 2.0-based federation in the IAM User Guide.
CreateServiceLinkedRole
Show Description Creates an IAM role that is linked to a specific Amazon Web Services service. The service controls the attached policies and when the role can be deleted. This helps ensure that the service is not broken by an unexpectedly changed or deleted role, which could put your Amazon Web Services resources into an unknown state. Allowing the service to control the role helps improve service stability and proper cleanup when a service and its role are no longer needed. For more information, see Using service-linked roles in the IAM User Guide. To attach a policy to this service-linked role, you must make the request using the Amazon Web Services service that depends on this role.
CreateServiceSpecificCredential
Show Description Generates a set of credentials consisting of a user name and password that can be used to access the service specified in the request. These credentials are generated by IAM, and can be used only for the specified service. You can have a maximum of two sets of service-specific credentials for each supported service per user. You can create service-specific credentials for CodeCommit and Amazon Keyspaces (for Apache Cassandra). You can reset the password to a new service-generated value by calling ResetServiceSpecificCredential. For more information about service-specific credentials, see Using IAM with CodeCommit: Git credentials, SSH keys, and Amazon Web Services access keys in the IAM User Guide.
CreateUser
Show Description Creates a new IAM user for your Amazon Web Services account. For information about quotas for the number of IAM users you can create, see IAM and STS quotas in the IAM User Guide.
CreateVirtualMFADevice
Show Description Creates a new virtual MFA device for the Amazon Web Services account. After creating the virtual MFA, use EnableMFADevice to attach the MFA device to an IAM user. For more information about creating and working with virtual MFA devices, see Using a virtual MFA device in the IAM User Guide. For information about the maximum number of MFA devices you can create, see IAM and STS quotas in the IAM User Guide. The seed information contained in the QR code and the Base32 string should be treated like any other secret access information. In other words, protect the seed information as you would your Amazon Web Services access keys or your passwords. After you provision your virtual device, you should ensure that the information is destroyed following secure procedures.
DeactivateMFADevice
DeleteAccessKey
DeleteAccountAlias
DeleteAccountPasswordPolicy
DeleteGroup
DeleteGroupPolicy
DeleteInstanceProfile
DeleteLoginProfile
DeleteOpenIDConnectProvider
DeletePolicy
DeletePolicyVersion
DeleteRole
DeleteRolePermissionsBoundary
DeleteRolePolicy
DeleteSAMLProvider
DeleteSSHPublicKey
DeleteServerCertificate
DeleteServiceLinkedRole
Show Description Submits a service-linked role deletion request and returns a DeletionTaskId, which you can use to check the status of the deletion. Before you call this operation, confirm that the role has no active sessions and that any resources used by the role in the linked service are deleted. If you call this operation more than once for the same service-linked role and an earlier deletion task is not complete, then the DeletionTaskId of the earlier request is returned. If you submit a deletion request for a service-linked role whose linked service is still accessing a resource, then the deletion task fails. If it fails, the GetServiceLinkedRoleDeletionStatus operation returns the reason for the failure, usually including the resources that must be deleted. To delete the service-linked role, you must first remove those resources from the linked service and then submit the deletion request again. Resources are specific to the service that is linked to the role. For more information about removing resources from a service, see the Amazon Web Services documentation for your service. For more information about service-linked roles, see Roles terms and concepts: Amazon Web Services service-linked role in the IAM User Guide.
DeleteServiceSpecificCredential
DeleteSigningCertificate
DeleteUser
DeleteUserPermissionsBoundary
DeleteUserPolicy
DeleteVirtualMFADevice
DetachGroupPolicy
DetachRolePolicy
DetachUserPolicy
EnableMFADevice
GenerateCredentialReport
Show Description Generates a credential report for the Amazon Web Services account. For more information about the credential report, see Getting credential reports in the IAM User Guide.
GenerateOrganizationsAccessReport
Show Description Generates a report for service last accessed data for Organizations. You can generate a report for any entities (organization root, organizational unit, or account) or policies in your organization. To call this operation, you must be signed in using your Organizations management account credentials. You can use your long-term IAM user or root user credentials, or temporary credentials from assuming an IAM role. SCPs must be enabled for your organization root. You must have the required IAM and Organizations permissions. For more information, see Refining permissions using service last accessed data in the IAM User Guide. You can generate a service last accessed data report for entities by specifying only the entity's path. This data includes a list of services that are allowed by any service control policies (SCPs) that apply to the entity. You can generate a service last accessed data report for a policy by specifying an entity's path and an optional Organizations policy ID. This data includes a list of services that are allowed by the specified SCP. For each service in both report types, the data includes the most recent account activity that the policy allows to account principals in the entity or the entity's children. For important information about the data, reporting period, permissions required, troubleshooting, and supported Regions see Reducing permissions using service last accessed data in the IAM User Guide. The data includes all attempts to access Amazon Web Services, not just the successful ones. This includes all attempts that were made using the Amazon Web Services Management Console, the Amazon Web Services API through any of the SDKs, or any of the command line tools. An unexpected entry in the service last accessed data does not mean that an account has been compromised, because the request might have been denied. Refer to your CloudTrail logs as the authoritative source for information about all API calls and whether they were successful or denied access. For more information, see Logging IAM events with CloudTrail in the IAM User Guide. This operation returns a JobId. Use this parameter in the GetOrganizationsAccessReport operation to check the status of the report generation. To check the status of this request, use the JobId parameter in the GetOrganizationsAccessReport operation and test the JobStatus response parameter. When the job is complete, you can retrieve the report. To generate a service last accessed data report for entities, specify an entity path without specifying the optional Organizations policy ID. The type of entity that you specify determines the data returned in the report.
  • Root – When you specify the organizations root as the entity, the resulting report lists all of the services allowed by SCPs that are attached to your root. For each service, the report includes data for all accounts in your organization except the management account, because the management account is not limited by SCPs.
  • OU – When you specify an organizational unit (OU) as the entity, the resulting report lists all of the services allowed by SCPs that are attached to the OU and its parents. For each service, the report includes data for all accounts in the OU or its children. This data excludes the management account, because the management account is not limited by SCPs.
  • management account – When you specify the management account, the resulting report lists all Amazon Web Services services, because the management account is not limited by SCPs. For each service, the report includes data for only the management account.
  • Account – When you specify another account as the entity, the resulting report lists all of the services allowed by SCPs that are attached to the account and its parents. For each service, the report includes data for only the specified account.
To generate a service last accessed data report for policies, specify an entity path and the optional Organizations policy ID. The type of entity that you specify determines the data returned for each service.
  • Root – When you specify the root entity and a policy ID, the resulting report lists all of the services that are allowed by the specified SCP. For each service, the report includes data for all accounts in your organization to which the SCP applies. This data excludes the management account, because the management account is not limited by SCPs. If the SCP is not attached to any entities in the organization, then the report will return a list of services with no data.
  • OU – When you specify an OU entity and a policy ID, the resulting report lists all of the services that are allowed by the specified SCP. For each service, the report includes data for all accounts in the OU or its children to which the SCP applies. This means that other accounts outside the OU that are affected by the SCP might not be included in the data. This data excludes the management account, because the management account is not limited by SCPs. If the SCP is not attached to the OU or one of its children, the report will return a list of services with no data.
  • management account – When you specify the management account, the resulting report lists all Amazon Web Services services, because the management account is not limited by SCPs. If you specify a policy ID in the CLI or API, the policy is ignored. For each service, the report includes data for only the management account.
  • Account – When you specify another account entity and a policy ID, the resulting report lists all of the services that are allowed by the specified SCP. For each service, the report includes data for only the specified account. This means that other accounts in the organization that are affected by the SCP might not be included in the data. If the SCP is not attached to the account, the report will return a list of services with no data.
Service last accessed data does not use other policy types when determining whether a principal could access a service. These other policy types include identity-based policies, resource-based policies, access control lists, IAM permissions boundaries, and STS assume role policies. It only applies SCP logic. For more about the evaluation of policy types, see Evaluating policies in the IAM User Guide. For more information about service last accessed data, see Reducing policy scope by viewing user activity in the IAM User Guide.
GenerateServiceLastAccessedDetails
Show Description Generates a report that includes details about when an IAM resource (user, group, role, or policy) was last used in an attempt to access Amazon Web Services services. Recent activity usually appears within four hours. IAM reports activity for the last 365 days, or less if your Region began supporting this feature within the last year. For more information, see Regions where data is tracked. The service last accessed data includes all attempts to access an Amazon Web Services API, not just the successful ones. This includes all attempts that were made using the Amazon Web Services Management Console, the Amazon Web Services API through any of the SDKs, or any of the command line tools. An unexpected entry in the service last accessed data does not mean that your account has been compromised, because the request might have been denied. Refer to your CloudTrail logs as the authoritative source for information about all API calls and whether they were successful or denied access. For more information, see Logging IAM events with CloudTrail in the IAM User Guide. The GenerateServiceLastAccessedDetails operation returns a JobId. Use this parameter in the following operations to retrieve the following details from your report:
  • GetServiceLastAccessedDetails – Use this operation for users, groups, roles, or policies to list every Amazon Web Services service that the resource could access using permissions policies. For each service, the response includes information about the most recent access attempt. The JobId returned by GenerateServiceLastAccessedDetail must be used by the same role within a session, or by the same user when used to call GetServiceLastAccessedDetail.
  • GetServiceLastAccessedDetailsWithEntities – Use this operation for groups and policies to list information about the associated entities (users or roles) that attempted to access a specific Amazon Web Services service.
To check the status of the GenerateServiceLastAccessedDetails request, use the JobId parameter in the same operations and test the JobStatus response parameter. For additional information about the permissions policies that allow an identity (user, group, or role) to access specific services, use the ListPoliciesGrantingServiceAccess operation. Service last accessed data does not use other policy types when determining whether a resource could access a service. These other policy types include resource-based policies, access control lists, Organizations policies, IAM permissions boundaries, and STS assume role policies. It only applies permissions policy logic. For more about the evaluation of policy types, see Evaluating policies in the IAM User Guide. For more information about service and action last accessed data, see Reducing permissions using service last accessed data in the IAM User Guide.
GetAccessKeyLastUsed
Show Description Retrieves information about when the specified access key was last used. The information includes the date and time of last use, along with the Amazon Web Services service and Region that were specified in the last request made with that key.
GetAccountAuthorizationDetails
Show Description Retrieves information about all IAM users, groups, roles, and policies in your Amazon Web Services account, including their relationships to one another. Use this operation to obtain a snapshot of the configuration of IAM permissions (users, groups, roles, and policies) in your account. Policies returned by this operation are URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality. You can optionally filter the results using the Filter parameter. You can paginate the results using the MaxItems and Marker parameters.
GetAccountPasswordPolicy
Show Description Retrieves the password policy for the Amazon Web Services account. This tells you the complexity requirements and mandatory rotation periods for the IAM user passwords in your account. For more information about using a password policy, see Managing an IAM password policy.
GetAccountSummary
Show Description Retrieves information about IAM entity usage and IAM quotas in the Amazon Web Services account. For information about IAM quotas, see IAM and STS quotas in the IAM User Guide.
GetContextKeysForCustomPolicy
Show Description Gets a list of all of the context keys referenced in the input policies. The policies are supplied as a list of one or more strings. To get the context keys from policies associated with an IAM user, group, or role, use GetContextKeysForPrincipalPolicy. Context keys are variables maintained by Amazon Web Services and its services that provide details about the context of an API query request. Context keys can be evaluated by testing against a value specified in an IAM policy. Use GetContextKeysForCustomPolicy to understand what key names and values you must supply when you call SimulateCustomPolicy. Note that all parameters are shown in unencoded form here for clarity but must be URL encoded to be included as a part of a real HTML request.
GetContextKeysForPrincipalPolicy
Show Description Gets a list of all of the context keys referenced in all the IAM policies that are attached to the specified IAM entity. The entity can be an IAM user, group, or role. If you specify a user, then the request also includes all of the policies attached to groups that the user is a member of. You can optionally include a list of one or more additional policies, specified as strings. If you want to include only a list of policies by string, use GetContextKeysForCustomPolicy instead. Note: This operation discloses information about the permissions granted to other users. If you do not want users to see other user's permissions, then consider allowing them to use GetContextKeysForCustomPolicy instead. Context keys are variables maintained by Amazon Web Services and its services that provide details about the context of an API query request. Context keys can be evaluated by testing against a value in an IAM policy. Use GetContextKeysForPrincipalPolicy to understand what key names and values you must supply when you call SimulatePrincipalPolicy.
GetCredentialReport
Show Description Retrieves a credential report for the Amazon Web Services account. For more information about the credential report, see Getting credential reports in the IAM User Guide.
GetGroup
Show Description Returns a list of IAM users that are in the specified IAM group. You can paginate the results using the MaxItems and Marker parameters.
GetGroupPolicy
Show Description Retrieves the specified inline policy document that is embedded in the specified IAM group. Policies returned by this operation are URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality. An IAM group can also have managed policies attached to it. To retrieve a managed policy document that is attached to a group, use GetPolicy to determine the policy's default version, then use GetPolicyVersion to retrieve the policy document. For more information about policies, see Managed policies and inline policies in the IAM User Guide.
GetInstanceProfile
Show Description Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role. For more information about instance profiles, see About instance profiles in the IAM User Guide.
GetLoginProfile
Show Description Retrieves the user name for the specified IAM user. A login profile is created when you create a password for the user to access the Amazon Web Services Management Console. If the user does not exist or does not have a password, the operation returns a 404 (NoSuchEntity) error. If you create an IAM user with access to the console, the CreateDate reflects the date you created the initial password for the user. If you create an IAM user with programmatic access, and then later add a password for the user to access the Amazon Web Services Management Console, the CreateDate reflects the initial password creation date. A user with programmatic access does not have a login profile unless you create a password for the user to access the Amazon Web Services Management Console.
GetOpenIDConnectProvider
Show Description Returns information about the specified OpenID Connect (OIDC) provider resource object in IAM.
GetOrganizationsAccessReport
Show Description Retrieves the service last accessed data report for Organizations that was previously generated using the GenerateOrganizationsAccessReport operation. This operation retrieves the status of your report job and the report contents. Depending on the parameters that you passed when you generated the report, the data returned could include different information. For details, see GenerateOrganizationsAccessReport. To call this operation, you must be signed in to the management account in your organization. SCPs must be enabled for your organization root. You must have permissions to perform this operation. For more information, see Refining permissions using service last accessed data in the IAM User Guide. For each service that principals in an account (root users, IAM users, or IAM roles) could access using SCPs, the operation returns details about the most recent access attempt. If there was no attempt, the service is listed without details about the most recent attempt to access the service. If the operation fails, it returns the reason that it failed. By default, the list is sorted by service namespace.
GetPolicy
Show Description Retrieves information about the specified managed policy, including the policy's default version and the total number of IAM users, groups, and roles to which the policy is attached. To retrieve the list of the specific users, groups, and roles that the policy is attached to, use ListEntitiesForPolicy. This operation returns metadata about the policy. To retrieve the actual policy document for a specific version of the policy, use GetPolicyVersion. This operation retrieves information about managed policies. To retrieve information about an inline policy that is embedded with an IAM user, group, or role, use GetUserPolicy, GetGroupPolicy, or GetRolePolicy. For more information about policies, see Managed policies and inline policies in the IAM User Guide.
GetPolicyVersion
Show Description Retrieves information about the specified version of the specified managed policy, including the policy document. Policies returned by this operation are URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality. To list the available versions for a policy, use ListPolicyVersions. This operation retrieves information about managed policies. To retrieve information about an inline policy that is embedded in a user, group, or role, use GetUserPolicy, GetGroupPolicy, or GetRolePolicy. For more information about the types of policies, see Managed policies and inline policies in the IAM User Guide. For more information about managed policy versions, see Versioning for managed policies in the IAM User Guide.
GetRole
Show Description Retrieves information about the specified role, including the role's path, GUID, ARN, and the role's trust policy that grants permission to assume the role. For more information about roles, see Working with roles. Policies returned by this operation are URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality.
GetRolePolicy
Show Description Retrieves the specified inline policy document that is embedded with the specified IAM role. Policies returned by this operation are URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality. An IAM role can also have managed policies attached to it. To retrieve a managed policy document that is attached to a role, use GetPolicy to determine the policy's default version, then use GetPolicyVersion to retrieve the policy document. For more information about policies, see Managed policies and inline policies in the IAM User Guide. For more information about roles, see Using roles to delegate permissions and federate identities.
GetSAMLProvider
Show Description Returns the SAML provider metadocument that was uploaded when the IAM SAML provider resource object was created or updated. This operation requires Signature Version 4.
GetSSHPublicKey
Show Description Retrieves the specified SSH public key, including metadata about the key. The SSH public key retrieved by this operation is used only for authenticating the associated IAM user to an CodeCommit repository. For more information about using SSH keys to authenticate to an CodeCommit repository, see Set up CodeCommit for SSH connections in the CodeCommit User Guide.
GetServerCertificate
Show Description Retrieves information about the specified server certificate stored in IAM. For more information about working with server certificates, see Working with server certificates in the IAM User Guide. This topic includes a list of Amazon Web Services services that can use the server certificates that you manage with IAM.
GetServiceLastAccessedDetails
Show Description Retrieves a service last accessed report that was created using the GenerateServiceLastAccessedDetails operation. You can use the JobId parameter in GetServiceLastAccessedDetails to retrieve the status of your report job. When the report is complete, you can retrieve the generated report. The report includes a list of Amazon Web Services services that the resource (user, group, role, or managed policy) can access. Service last accessed data does not use other policy types when determining whether a resource could access a service. These other policy types include resource-based policies, access control lists, Organizations policies, IAM permissions boundaries, and STS assume role policies. It only applies permissions policy logic. For more about the evaluation of policy types, see Evaluating policies in the IAM User Guide. For each service that the resource could access using permissions policies, the operation returns details about the most recent access attempt. If there was no attempt, the service is listed without details about the most recent attempt to access the service. If the operation fails, the GetServiceLastAccessedDetails operation returns the reason that it failed. The GetServiceLastAccessedDetails operation returns a list of services. This list includes the number of entities that have attempted to access the service and the date and time of the last attempt. It also returns the ARN of the following entity, depending on the resource ARN that you used to generate the report:
  • User – Returns the user ARN that you used to generate the report
  • Group – Returns the ARN of the group member (user) that last attempted to access the service
  • Role – Returns the role ARN that you used to generate the report
  • Policy – Returns the ARN of the user or role that last used the policy to attempt to access the service
By default, the list is sorted by service namespace. If you specified ACTION_LEVEL granularity when you generated the report, this operation returns service and action last accessed data. This includes the most recent access attempt for each tracked action within a service. Otherwise, this operation returns only service data. For more information about service and action last accessed data, see Reducing permissions using service last accessed data in the IAM User Guide.
GetServiceLastAccessedDetailsWithEntities
Show Description After you generate a group or policy report using the GenerateServiceLastAccessedDetails operation, you can use the JobId parameter in GetServiceLastAccessedDetailsWithEntities. This operation retrieves the status of your report job and a list of entities that could have used group or policy permissions to access the specified service.
  • Group – For a group report, this operation returns a list of users in the group that could have used the group’s policies in an attempt to access the service.
  • Policy – For a policy report, this operation returns a list of entities (users or roles) that could have used the policy in an attempt to access the service.
You can also use this operation for user or role reports to retrieve details about those entities. If the operation fails, the GetServiceLastAccessedDetailsWithEntities operation returns the reason that it failed. By default, the list of associated entities is sorted by date, with the most recent access listed first.
GetServiceLinkedRoleDeletionStatus
Show Description Retrieves the status of your service-linked role deletion. After you use DeleteServiceLinkedRole to submit a service-linked role for deletion, you can use the DeletionTaskId parameter in GetServiceLinkedRoleDeletionStatus to check the status of the deletion. If the deletion fails, this operation returns the reason that it failed, if that information is returned by the service.
GetUser
Show Description Retrieves information about the specified IAM user, including the user's creation date, path, unique ID, and ARN. If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID used to sign the request to this operation.
GetUserPolicy
Show Description Retrieves the specified inline policy document that is embedded in the specified IAM user. Policies returned by this operation are URL-encoded compliant with RFC 3986. You can use a URL decoding method to convert the policy back to plain JSON text. For example, if you use Java, you can use the decode method of the java.net.URLDecoder utility class in the Java SDK. Other languages and SDKs provide similar functionality. An IAM user can also have managed policies attached to it. To retrieve a managed policy document that is attached to a user, use GetPolicy to determine the policy's default version. Then use GetPolicyVersion to retrieve the policy document. For more information about policies, see Managed policies and inline policies in the IAM User Guide.
ListAccessKeys
Show Description Returns information about the access key IDs associated with the specified IAM user. If there is none, the operation returns an empty list. Although each user is limited to a small number of keys, you can still paginate the results using the MaxItems and Marker parameters. If the UserName field is not specified, the user name is determined implicitly based on the Amazon Web Services access key ID used to sign the request. This operation works for access keys under the Amazon Web Services account. Consequently, you can use this operation to manage Amazon Web Services account root user credentials even if the Amazon Web Services account has no associated users. To ensure the security of your Amazon Web Services account, the secret access key is accessible only during key and user creation.
ListAccountAliases
Show Description Lists the account alias associated with the Amazon Web Services account (Note: you can have only one). For information about using an Amazon Web Services account alias, see Using an alias for your Amazon Web Services account ID in the IAM User Guide.
ListAttachedGroupPolicies
Show Description Lists all managed policies that are attached to the specified IAM group. An IAM group can also have inline policies embedded with it. To list the inline policies for a group, use ListGroupPolicies. For information about policies, see Managed policies and inline policies in the IAM User Guide. You can paginate the results using the MaxItems and Marker parameters. You can use the PathPrefix parameter to limit the list of policies to only those matching the specified path prefix. If there are no policies attached to the specified group (or none that match the specified path prefix), the operation returns an empty list.
ListAttachedRolePolicies
Show Description Lists all managed policies that are attached to the specified IAM role. An IAM role can also have inline policies embedded with it. To list the inline policies for a role, use ListRolePolicies. For information about policies, see Managed policies and inline policies in the IAM User Guide. You can paginate the results using the MaxItems and Marker parameters. You can use the PathPrefix parameter to limit the list of policies to only those matching the specified path prefix. If there are no policies attached to the specified role (or none that match the specified path prefix), the operation returns an empty list.
ListAttachedUserPolicies
Show Description Lists all managed policies that are attached to the specified IAM user. An IAM user can also have inline policies embedded with it. To list the inline policies for a user, use ListUserPolicies. For information about policies, see Managed policies and inline policies in the IAM User Guide. You can paginate the results using the MaxItems and Marker parameters. You can use the PathPrefix parameter to limit the list of policies to only those matching the specified path prefix. If there are no policies attached to the specified group (or none that match the specified path prefix), the operation returns an empty list.
ListEntitiesForPolicy
Show Description Lists all IAM users, groups, and roles that the specified managed policy is attached to. You can use the optional EntityFilter parameter to limit the results to a particular type of entity (users, groups, or roles). For example, to list only the roles that are attached to the specified policy, set EntityFilter to Role. You can paginate the results using the MaxItems and Marker parameters.
ListGroupPolicies
Show Description Lists the names of the inline policies that are embedded in the specified IAM group. An IAM group can also have managed policies attached to it. To list the managed policies that are attached to a group, use ListAttachedGroupPolicies. For more information about policies, see Managed policies and inline policies in the IAM User Guide. You can paginate the results using the MaxItems and Marker parameters. If there are no inline policies embedded with the specified group, the operation returns an empty list.
ListGroups
Show Description Lists the IAM groups that have the specified path prefix. You can paginate the results using the MaxItems and Marker parameters.
ListGroupsForUser
Show Description Lists the IAM groups that the specified IAM user belongs to. You can paginate the results using the MaxItems and Marker parameters.
ListInstanceProfileTags
Show Description Lists the tags that are attached to the specified IAM instance profile. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
ListInstanceProfiles
Show Description Lists the instance profiles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about instance profiles, see About instance profiles. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for an instance profile, see GetInstanceProfile. You can paginate the results using the MaxItems and Marker parameters.
ListInstanceProfilesForRole
Show Description Lists the instance profiles that have the specified associated IAM role. If there are none, the operation returns an empty list. For more information about instance profiles, go to About instance profiles. You can paginate the results using the MaxItems and Marker parameters.
ListMFADeviceTags
Show Description Lists the tags that are attached to the specified IAM virtual multi-factor authentication (MFA) device. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
ListMFADevices
Show Description Lists the MFA devices for an IAM user. If the request includes a IAM user name, then this operation lists all the MFA devices associated with the specified user. If you do not specify a user name, IAM determines the user name implicitly based on the Amazon Web Services access key ID signing the request for this operation. You can paginate the results using the MaxItems and Marker parameters.
ListOpenIDConnectProviderTags
Show Description Lists the tags that are attached to the specified OpenID Connect (OIDC)-compatible identity provider. The returned list of tags is sorted by tag key. For more information, see About web identity federation. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
ListOpenIDConnectProviders
Show Description Lists information about the IAM OpenID Connect (OIDC) provider resource objects defined in the Amazon Web Services account. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for an OIDC provider, see GetOpenIDConnectProvider.
ListPolicies
Show Description Lists all the managed policies that are available in your Amazon Web Services account, including your own customer-defined managed policies and all Amazon Web Services managed policies. You can filter the list of policies that is returned using the optional OnlyAttached, Scope, and PathPrefix parameters. For example, to list only the customer managed policies in your Amazon Web Services account, set Scope to Local. To list only Amazon Web Services managed policies, set Scope to AWS. You can paginate the results using the MaxItems and Marker parameters. For more information about managed policies, see Managed policies and inline policies in the IAM User Guide. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a customer manged policy, see GetPolicy.
ListPoliciesGrantingServiceAccess
Show Description Retrieves a list of policies that the IAM identity (user, group, or role) can use to access each specified service. This operation does not use other policy types when determining whether a resource could access a service. These other policy types include resource-based policies, access control lists, Organizations policies, IAM permissions boundaries, and STS assume role policies. It only applies permissions policy logic. For more about the evaluation of policy types, see Evaluating policies in the IAM User Guide. The list of policies returned by the operation depends on the ARN of the identity that you provide.
  • User – The list of policies includes the managed and inline policies that are attached to the user directly. The list also includes any additional managed and inline policies that are attached to the group to which the user belongs.
  • Group – The list of policies includes only the managed and inline policies that are attached to the group directly. Policies that are attached to the group’s user are not included.
  • Role – The list of policies includes only the managed and inline policies that are attached to the role.
For each managed policy, this operation returns the ARN and policy name. For each inline policy, it returns the policy name and the entity to which it is attached. Inline policies do not have an ARN. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide. Policies that are attached to users and roles as permissions boundaries are not returned. To view which managed policy is currently used to set the permissions boundary for a user or role, use the GetUser or GetRole operations.
ListPolicyTags
Show Description Lists the tags that are attached to the specified IAM customer managed policy. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
ListPolicyVersions
Show Description Lists information about the versions of the specified managed policy, including the version that is currently set as the policy's default version. For more information about managed policies, see Managed policies and inline policies in the IAM User Guide.
ListRolePolicies
Show Description Lists the names of the inline policies that are embedded in the specified IAM role. An IAM role can also have managed policies attached to it. To list the managed policies that are attached to a role, use ListAttachedRolePolicies. For more information about policies, see Managed policies and inline policies in the IAM User Guide. You can paginate the results using the MaxItems and Marker parameters. If there are no inline policies embedded with the specified role, the operation returns an empty list.
ListRoleTags
Show Description Lists the tags that are attached to the specified role. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
ListRoles
Show Description Lists the IAM roles that have the specified path prefix. If there are none, the operation returns an empty list. For more information about roles, see Working with roles. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a role, see GetRole. You can paginate the results using the MaxItems and Marker parameters.
ListSAMLProviderTags
Show Description Lists the tags that are attached to the specified Security Assertion Markup Language (SAML) identity provider. The returned list of tags is sorted by tag key. For more information, see About SAML 2.0-based federation. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
ListSAMLProviders
Show Description Lists the SAML provider resource objects defined in IAM in the account. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a SAML provider, see GetSAMLProvider. This operation requires Signature Version 4.
ListSSHPublicKeys
Show Description Returns information about the SSH public keys associated with the specified IAM user. If none exists, the operation returns an empty list. The SSH public keys returned by this operation are used only for authenticating the IAM user to an CodeCommit repository. For more information about using SSH keys to authenticate to an CodeCommit repository, see Set up CodeCommit for SSH connections in the CodeCommit User Guide. Although each user is limited to a small number of keys, you can still paginate the results using the MaxItems and Marker parameters.
ListServerCertificateTags
Show Description Lists the tags that are attached to the specified IAM server certificate. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide. For certificates in a Region supported by Certificate Manager (ACM), we recommend that you don't use IAM server certificates. Instead, use ACM to provision, manage, and deploy your server certificates. For more information about IAM server certificates, Working with server certificates in the IAM User Guide.
ListServerCertificates
Show Description Lists the server certificates stored in IAM that have the specified path prefix. If none exist, the operation returns an empty list. You can paginate the results using the MaxItems and Marker parameters. For more information about working with server certificates, see Working with server certificates in the IAM User Guide. This topic also includes a list of Amazon Web Services services that can use the server certificates that you manage with IAM. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a servercertificate, see GetServerCertificate.
ListServiceSpecificCredentials
Show Description Returns information about the service-specific credentials associated with the specified IAM user. If none exists, the operation returns an empty list. The service-specific credentials returned by this operation are used only for authenticating the IAM user to a specific service. For more information about using service-specific credentials to authenticate to an Amazon Web Services service, see Set up service-specific credentials in the CodeCommit User Guide.
ListSigningCertificates
Show Description Returns information about the signing certificates associated with the specified IAM user. If none exists, the operation returns an empty list. Although each user is limited to a small number of signing certificates, you can still paginate the results using the MaxItems and Marker parameters. If the UserName field is not specified, the user name is determined implicitly based on the Amazon Web Services access key ID used to sign the request for this operation. This operation works for access keys under the Amazon Web Services account. Consequently, you can use this operation to manage Amazon Web Services account root user credentials even if the Amazon Web Services account has no associated users.
ListUserPolicies
Show Description Lists the names of the inline policies embedded in the specified IAM user. An IAM user can also have managed policies attached to it. To list the managed policies that are attached to a user, use ListAttachedUserPolicies. For more information about policies, see Managed policies and inline policies in the IAM User Guide. You can paginate the results using the MaxItems and Marker parameters. If there are no inline policies embedded with the specified user, the operation returns an empty list.
ListUserTags
Show Description Lists the tags that are attached to the specified IAM user. The returned list of tags is sorted by tag key. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
ListUsers
Show Description Lists the IAM users that have the specified path prefix. If no path prefix is specified, the operation returns all users in the Amazon Web Services account. If there are none, the operation returns an empty list. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a user, see GetUser. You can paginate the results using the MaxItems and Marker parameters.
ListVirtualMFADevices
Show Description Lists the virtual MFA devices defined in the Amazon Web Services account by assignment status. If you do not specify an assignment status, the operation returns a list of all virtual MFA devices. Assignment status can be Assigned, Unassigned, or Any. IAM resource-listing operations return a subset of the available attributes for the resource. For example, this operation does not return tags, even though they are an attribute of the returned object. To view all of the information for a virtual MFA device, see ListVirtualMFADevices. You can paginate the results using the MaxItems and Marker parameters.
PutGroupPolicy
PutRolePermissionsBoundary
PutRolePolicy
PutUserPermissionsBoundary
PutUserPolicy
RemoveClientIDFromOpenIDConnectProvider
RemoveRoleFromInstanceProfile
RemoveUserFromGroup
ResetServiceSpecificCredential
Show Description Resets the password for a service-specific credential. The new password is Amazon Web Services generated and cryptographically strong. It cannot be configured by the user. Resetting the password immediately invalidates the previous password associated with this user.
ResyncMFADevice
SetDefaultPolicyVersion
SetSecurityTokenServicePreferences
SimulateCustomPolicy
Show Description Simulate how a set of IAM policies and optionally a resource-based policy works with a list of API operations and Amazon Web Services resources to determine the policies' effective permissions. The policies are provided as strings. The simulation does not perform the API operations; it only checks the authorization to determine if the simulated policies allow or deny the operations. You can simulate resources that don't exist in your account. If you want to simulate existing policies that are attached to an IAM user, group, or role, use SimulatePrincipalPolicy instead. Context keys are variables that are maintained by Amazon Web Services and its services and which provide details about the context of an API query request. You can use the Condition element of an IAM policy to evaluate context keys. To get the list of context keys that the policies require for correct simulation, use GetContextKeysForCustomPolicy. If the output is long, you can use MaxItems and Marker parameters to paginate the results. For more information about using the policy simulator, see Testing IAM policies with the IAM policy simulator in the IAM User Guide.
SimulatePrincipalPolicy
Show Description Simulate how a set of IAM policies attached to an IAM entity works with a list of API operations and Amazon Web Services resources to determine the policies' effective permissions. The entity can be an IAM user, group, or role. If you specify a user, then the simulation also includes all of the policies that are attached to groups that the user belongs to. You can simulate resources that don't exist in your account. You can optionally include a list of one or more additional policies specified as strings to include in the simulation. If you want to simulate only policies specified as strings, use SimulateCustomPolicy instead. You can also optionally include one resource-based policy to be evaluated with each of the resources included in the simulation. The simulation does not perform the API operations; it only checks the authorization to determine if the simulated policies allow or deny the operations. Note: This operation discloses information about the permissions granted to other users. If you do not want users to see other user's permissions, then consider allowing them to use SimulateCustomPolicy instead. Context keys are variables maintained by Amazon Web Services and its services that provide details about the context of an API query request. You can use the Condition element of an IAM policy to evaluate context keys. To get the list of context keys that the policies require for correct simulation, use GetContextKeysForPrincipalPolicy. If the output is long, you can use the MaxItems and Marker parameters to paginate the results. For more information about using the policy simulator, see Testing IAM policies with the IAM policy simulator in the IAM User Guide.
TagInstanceProfile
TagMFADevice
TagOpenIDConnectProvider
TagPolicy
TagRole
TagSAMLProvider
TagServerCertificate
TagUser
UntagInstanceProfile
UntagMFADevice
UntagOpenIDConnectProvider
UntagPolicy
UntagRole
UntagSAMLProvider
UntagServerCertificate
UntagUser
UpdateAccessKey
UpdateAccountPasswordPolicy
UpdateAssumeRolePolicy
UpdateGroup
UpdateLoginProfile
UpdateOpenIDConnectProviderThumbprint
UpdateRole
Show Description Updates the description or maximum session duration setting of a role.
UpdateRoleDescription
Show Description Use UpdateRole instead. Modifies only the description of a role. This operation performs the same function as the Description parameter in the UpdateRole operation.
UpdateSAMLProvider
Show Description Updates the metadata document for an existing SAML provider resource object. This operation requires Signature Version 4.
UpdateSSHPublicKey
UpdateServerCertificate
UpdateServiceSpecificCredential
UpdateSigningCertificate
UpdateUser
UploadSSHPublicKey
Show Description Uploads an SSH public key and associates it with the specified IAM user. The SSH public key uploaded by this operation can be used only for authenticating the associated IAM user to an CodeCommit repository. For more information about using SSH keys to authenticate to an CodeCommit repository, see Set up CodeCommit for SSH connections in the CodeCommit User Guide.
UploadServerCertificate
Show Description Uploads a server certificate entity for the Amazon Web Services account. The server certificate entity includes a public key certificate, a private key, and an optional certificate chain, which should all be PEM-encoded. We recommend that you use Certificate Manager to provision, manage, and deploy your server certificates. With ACM you can request a certificate, deploy it to Amazon Web Services resources, and let ACM handle certificate renewals for you. Certificates provided by ACM are free. For more information about using ACM, see the Certificate Manager User Guide. For more information about working with server certificates, see Working with server certificates in the IAM User Guide. This topic includes a list of Amazon Web Services services that can use the server certificates that you manage with IAM. For information about the number of server certificates you can upload, see IAM and STS quotas in the IAM User Guide. Because the body of the public key certificate, private key, and the certificate chain can be large, you should use POST rather than GET when calling UploadServerCertificate. For information about setting up signatures and authorization through the API, see Signing Amazon Web Services API requests in the Amazon Web Services General Reference. For general information about using the Query API with IAM, see Calling the API by making HTTP query requests in the IAM User Guide.

Identitystore Events

Service Event Name Description
identitystore DescribeGroup
Show Description Retrieves the group metadata and attributes from GroupId in an identity store.
DescribeUser
Show Description Retrieves the user metadata and attributes from UserId in an identity store.
ListGroups
Show Description Lists the attribute name and value of the group that you specified in the search. We only support DisplayName as a valid filter attribute path currently, and filter is required. This API returns minimum attributes, including GroupId and group DisplayName in the response.

Imagebuilder Events

Service Event Name Description
imagebuilder CancelImageCreation
Show Description CancelImageCreation cancels the creation of Image. This operation can only be used on images in a non-terminal state.
CreateComponent
Show Description Creates a new component that can be used to build, validate, test, and assess your image.
CreateContainerRecipe
Show Description Creates a new container recipe. Container recipes define how images are configured, tested, and assessed.
CreateDistributionConfiguration
Show Description Creates a new distribution configuration. Distribution configurations define and configure the outputs of your pipeline.
CreateImage
Show Description Creates a new image. This request will create a new image along with all of the configured output resources defined in the distribution configuration. You must specify exactly one recipe for your image, using either a ContainerRecipeArn or an ImageRecipeArn.
CreateImagePipeline
Show Description Creates a new image pipeline. Image pipelines enable you to automate the creation and distribution of images.
CreateImageRecipe
Show Description Creates a new image recipe. Image recipes define how images are configured, tested, and assessed.
CreateInfrastructureConfiguration
Show Description Creates a new infrastructure configuration. An infrastructure configuration defines the environment in which your image will be built and tested.
DeleteComponent
Show Description Deletes a component build version.
DeleteContainerRecipe
Show Description Deletes a container recipe.
DeleteDistributionConfiguration
Show Description Deletes a distribution configuration.
DeleteImage
Show Description Deletes an Image Builder image resource. This does not delete any EC2 AMIs or ECR container images that are created during the image build process. You must clean those up separately, using the appropriate Amazon EC2 or Amazon ECR console actions, or API or CLI commands.
DeleteImagePipeline
Show Description Deletes an image pipeline.
DeleteImageRecipe
Show Description Deletes an image recipe.
DeleteInfrastructureConfiguration
Show Description Deletes an infrastructure configuration.
GetComponent
Show Description Gets a component object.
GetComponentPolicy
Show Description Gets a component policy.
GetContainerRecipe
Show Description Retrieves a container recipe.
GetContainerRecipePolicy
Show Description Retrieves the policy for a container recipe.
GetDistributionConfiguration
Show Description Gets a distribution configuration.
GetImage
Show Description Gets an image.
GetImagePipeline
Show Description Gets an image pipeline.
GetImagePolicy
Show Description Gets an image policy.
GetImageRecipe
Show Description Gets an image recipe.
GetImageRecipePolicy
Show Description Gets an image recipe policy.
GetInfrastructureConfiguration
Show Description Gets an infrastructure configuration.
ImportComponent
Show Description Imports a component and transforms its data into a component document.
ListComponentBuildVersions
Show Description Returns the list of component build versions for the specified semantic version. The semantic version has four nodes: <major>.<minor>.<patch>/<build>. You can assign values for the first three, and can filter on all of them. Filtering: With semantic versioning, you have the flexibility to use wildcards (x) to specify the most recent versions or nodes when selecting the base image or components for your recipe. When you use a wildcard in any node, all nodes to the right of the first wildcard must also be wildcards.
ListComponents
Show Description Returns the list of component build versions for the specified semantic version. The semantic version has four nodes: <major>.<minor>.<patch>/<build>. You can assign values for the first three, and can filter on all of them. Filtering: With semantic versioning, you have the flexibility to use wildcards (x) to specify the most recent versions or nodes when selecting the base image or components for your recipe. When you use a wildcard in any node, all nodes to the right of the first wildcard must also be wildcards.
ListContainerRecipes
Show Description Returns a list of container recipes.
ListDistributionConfigurations
Show Description Returns a list of distribution configurations.
ListImageBuildVersions
Show Description Returns a list of image build versions.
ListImagePackages
Show Description List the Packages that are associated with an Image Build Version, as determined by Amazon Web Services Systems Manager Inventory at build time.
ListImagePipelineImages
Show Description Returns a list of images created by the specified pipeline.
ListImagePipelines
Show Description Returns a list of image pipelines.
ListImageRecipes
Show Description Returns a list of image recipes.
ListImages
Show Description Returns the list of images that you have access to.
ListInfrastructureConfigurations
Show Description Returns a list of infrastructure configurations.
ListTagsForResource
Show Description Returns the list of tags for the specified resource.
PutComponentPolicy
Show Description Applies a policy to a component. We recommend that you call the RAM API CreateResourceShare to share resources. If you call the Image Builder API PutComponentPolicy, you must also call the RAM API PromoteResourceShareCreatedFromPolicy in order for the resource to be visible to all principals with whom the resource is shared.
PutContainerRecipePolicy
Show Description Applies a policy to a container image. We recommend that you call the RAM API CreateResourceShare (https://docs.aws.amazon.com/ram/latest/APIReference/API_CreateResourceShare.html) to share resources. If you call the Image Builder API PutContainerImagePolicy, you must also call the RAM API PromoteResourceShareCreatedFromPolicy (https://docs.aws.amazon.com/ram/latest/APIReference/API_PromoteResourceShareCreatedFromPolicy.html) in order for the resource to be visible to all principals with whom the resource is shared.
PutImagePolicy
Show Description Applies a policy to an image. We recommend that you call the RAM API CreateResourceShare to share resources. If you call the Image Builder API PutImagePolicy, you must also call the RAM API PromoteResourceShareCreatedFromPolicy in order for the resource to be visible to all principals with whom the resource is shared.
PutImageRecipePolicy
Show Description Applies a policy to an image recipe. We recommend that you call the RAM API CreateResourceShare to share resources. If you call the Image Builder API PutImageRecipePolicy, you must also call the RAM API PromoteResourceShareCreatedFromPolicy in order for the resource to be visible to all principals with whom the resource is shared.
StartImagePipelineExecution
Show Description Manually triggers a pipeline to create an image.
TagResource
Show Description Adds a tag to a resource.
UntagResource
Show Description Removes a tag from a resource.
UpdateDistributionConfiguration
Show Description Updates a new distribution configuration. Distribution configurations define and configure the outputs of your pipeline.
UpdateImagePipeline
Show Description Updates an image pipeline. Image pipelines enable you to automate the creation and distribution of images. UpdateImagePipeline does not support selective updates for the pipeline. You must specify all of the required properties in the update request, not just the properties that have changed.

Importexport Events

Service Event Name Description
importexport CancelJob
Show Description This operation cancels a specified job. Only the job owner can cancel it. The operation fails if the job has already started or is complete.
CreateJob
Show Description This operation initiates the process of scheduling an upload or download of your data. You include in the request a manifest that describes the data transfer specifics. The response to the request includes a job ID, which you can use in other operations, a signature that you use to identify your storage device, and the address where you should ship your storage device.
GetShippingLabel
Show Description This operation generates a pre-paid UPS shipping label that you will use to ship your device to AWS for processing.
GetStatus
Show Description This operation returns information about a job, including where the job is in the processing pipeline, the status of the results, and the signature value associated with the job. You can only return information about jobs you own.
ListJobs
Show Description This operation returns the jobs associated with the requester. AWS Import/Export lists the jobs in reverse chronological order based on the date of creation. For example if Job Test1 was created 2009Dec30 and Test2 was created 2010Feb05, the ListJobs operation would return Test2 followed by Test1.

Inspector Events

Service Event Name Description
inspector AddAttributesToFindings
Show Description Assigns attributes (key and value pairs) to the findings that are specified by the ARNs of the findings.
CreateAssessmentTarget
Show Description Creates a new assessment target using the ARN of the resource group that is generated by CreateResourceGroup. If resourceGroupArn is not specified, all EC2 instances in the current AWS account and region are included in the assessment target. If the service-linked role isn’t already registered, this action also creates and registers a service-linked role to grant Amazon Inspector access to AWS Services needed to perform security assessments. You can create up to 50 assessment targets per AWS account. You can run up to 500 concurrent agents per AWS account. For more information, see Amazon Inspector Assessment Targets.
CreateAssessmentTemplate
Show Description Creates an assessment template for the assessment target that is specified by the ARN of the assessment target. If the service-linked role isn’t already registered, this action also creates and registers a service-linked role to grant Amazon Inspector access to AWS Services needed to perform security assessments.
CreateExclusionsPreview
Show Description Starts the generation of an exclusions preview for the specified assessment template. The exclusions preview lists the potential exclusions (ExclusionPreview) that Inspector can detect before it runs the assessment.
CreateResourceGroup
Show Description Creates a resource group using the specified set of tags (key and value pairs) that are used to select the EC2 instances to be included in an Amazon Inspector assessment target. The created resource group is then used to create an Amazon Inspector assessment target. For more information, see CreateAssessmentTarget.
DeleteAssessmentRun
DeleteAssessmentTarget
DeleteAssessmentTemplate
DescribeAssessmentRuns
Show Description Describes the assessment runs that are specified by the ARNs of the assessment runs.
DescribeAssessmentTargets
Show Description Describes the assessment targets that are specified by the ARNs of the assessment targets.
DescribeAssessmentTemplates
Show Description Describes the assessment templates that are specified by the ARNs of the assessment templates.
DescribeCrossAccountAccessRole
Show Description Describes the IAM role that enables Amazon Inspector to access your AWS account.
DescribeExclusions
Show Description Describes the exclusions that are specified by the exclusions' ARNs.
DescribeFindings
Show Description Describes the findings that are specified by the ARNs of the findings.
DescribeResourceGroups
Show Description Describes the resource groups that are specified by the ARNs of the resource groups.
DescribeRulesPackages
Show Description Describes the rules packages that are specified by the ARNs of the rules packages.
GetAssessmentReport
Show Description Produces an assessment report that includes detailed and comprehensive results of a specified assessment run.
GetExclusionsPreview
Show Description Retrieves the exclusions preview (a list of ExclusionPreview objects) specified by the preview token. You can obtain the preview token by running the CreateExclusionsPreview API.
GetTelemetryMetadata
Show Description Information about the data that is collected for the specified assessment run.
ListAssessmentRunAgents
Show Description Lists the agents of the assessment runs that are specified by the ARNs of the assessment runs.
ListAssessmentRuns
Show Description Lists the assessment runs that correspond to the assessment templates that are specified by the ARNs of the assessment templates.
ListAssessmentTargets
Show Description Lists the ARNs of the assessment targets within this AWS account. For more information about assessment targets, see Amazon Inspector Assessment Targets.
ListAssessmentTemplates
Show Description Lists the assessment templates that correspond to the assessment targets that are specified by the ARNs of the assessment targets.
ListEventSubscriptions
Show Description Lists all the event subscriptions for the assessment template that is specified by the ARN of the assessment template. For more information, see SubscribeToEvent and UnsubscribeFromEvent.
ListExclusions
Show Description List exclusions that are generated by the assessment run.
ListFindings
Show Description Lists findings that are generated by the assessment runs that are specified by the ARNs of the assessment runs.
ListRulesPackages
Show Description Lists all available Amazon Inspector rules packages.
ListTagsForResource
Show Description Lists all tags associated with an assessment template.
PreviewAgents
Show Description Previews the agents installed on the EC2 instances that are part of the specified assessment target.
RegisterCrossAccountAccessRole
RemoveAttributesFromFindings
Show Description Removes entire attributes (key and value pairs) from the findings that are specified by the ARNs of the findings where an attribute with the specified key exists.
SetTagsForResource
StartAssessmentRun
Show Description Starts the assessment run specified by the ARN of the assessment template. For this API to function properly, you must not exceed the limit of running up to 500 concurrent agents per AWS account.
StopAssessmentRun
SubscribeToEvent
UnsubscribeFromEvent

Iot-data Events

Service Event Name Description
iot-data DeleteThingShadow
Show Description Deletes the shadow for the specified thing. Requires permission to access the DeleteThingShadow action. For more information, see DeleteThingShadow in the IoT Developer Guide.
GetRetainedMessage
Show Description Gets the details of a single retained message for the specified topic. This action returns the message payload of the retained message, which can incur messaging costs. To list only the topic names of the retained messages, call ListRetainedMessages. Requires permission to access the GetRetainedMessage action. For more information about messaging costs, see IoT Core pricing - Messaging.
GetThingShadow
Show Description Gets the shadow for the specified thing. Requires permission to access the GetThingShadow action. For more information, see GetThingShadow in the IoT Developer Guide.
ListNamedShadowsForThing
Show Description Lists the shadows for the specified thing. Requires permission to access the ListNamedShadowsForThing action.
ListRetainedMessages
Show Description Lists summary information about the retained messages stored for the account. This action returns only the topic names of the retained messages. It doesn't return any message payloads. Although this action doesn't return a message payload, it can still incur messaging costs. To get the message payload of a retained message, call GetRetainedMessage with the topic name of the retained message. Requires permission to access the ListRetainedMessages action. For more information about messaging costs, see IoT Core pricing - Messaging.
Publish

Iot-jobs-data Events

Service Event Name Description
iot-jobs-data DescribeJobExecution
Show Description Gets details of a job execution.
GetPendingJobExecutions
Show Description Gets the list of all jobs for a thing that are not in a terminal status.
StartNextPendingJobExecution
Show Description Gets and starts the next pending (status IN_PROGRESS or QUEUED) job execution for a thing.

Iot Events

Service Event Name Description
iot AcceptCertificateTransfer
AddThingToBillingGroup
Show Description Adds a thing to a billing group. Requires permission to access the AddThingToBillingGroup action.
AddThingToThingGroup
Show Description Adds a thing to a thing group. Requires permission to access the AddThingToThingGroup action.
AssociateTargetsWithJob
Show Description Associates a group with a continuous job. The following criteria must be met:
  • The job must have been created with the targetSelection field set to "CONTINUOUS".
  • The job status must currently be "IN_PROGRESS".
  • The total number of targets associated with a job must not exceed 100.
Requires permission to access the AssociateTargetsWithJob action.
AttachPolicy
AttachPrincipalPolicy
AttachSecurityProfile
Show Description Associates a Device Defender security profile with a thing group or this account. Each thing group or account can have up to five security profiles associated with it. Requires permission to access the AttachSecurityProfile action.
AttachThingPrincipal
Show Description Attaches the specified principal to the specified thing. A principal can be X.509 certificates, IAM users, groups, and roles, Amazon Cognito identities or federated identities. Requires permission to access the AttachThingPrincipal action.
CancelAuditMitigationActionsTask
Show Description Cancels a mitigation action task that is in progress. If the task is not in progress, an InvalidRequestException occurs. Requires permission to access the CancelAuditMitigationActionsTask action.
CancelAuditTask
Show Description Cancels an audit that is in progress. The audit can be either scheduled or on demand. If the audit isn't in progress, an "InvalidRequestException" occurs. Requires permission to access the CancelAuditTask action.
CancelCertificateTransfer
CancelDetectMitigationActionsTask
Show Description Cancels a Device Defender ML Detect mitigation action. Requires permission to access the CancelDetectMitigationActionsTask action.
CancelJob
Show Description Cancels a job. Requires permission to access the CancelJob action.
CancelJobExecution
ClearDefaultAuthorizer
Show Description Clears the default authorizer. Requires permission to access the ClearDefaultAuthorizer action.
ConfirmTopicRuleDestination
Show Description Confirms a topic rule destination. When you create a rule requiring a destination, IoT sends a confirmation message to the endpoint or base address you specify. The message includes a token which you pass back when calling ConfirmTopicRuleDestination to confirm that you own or have access to the endpoint. Requires permission to access the ConfirmTopicRuleDestination action.
CreateAuditSuppression
Show Description Creates a Device Defender audit suppression. Requires permission to access the CreateAuditSuppression action.
CreateAuthorizer
Show Description Creates an authorizer. Requires permission to access the CreateAuthorizer action.
CreateBillingGroup
Show Description Creates a billing group. Requires permission to access the CreateBillingGroup action.
CreateCertificateFromCsr
Show Description Creates an X.509 certificate using the specified certificate signing request. Note: The CSR must include a public key that is either an RSA key with a length of at least 2048 bits or an ECC key from NIST P-256 or NIST P-384 curves. Note: Reusing the same certificate signing request (CSR) results in a distinct certificate. Requires permission to access the CreateCertificateFromCsr action. You can create multiple certificates in a batch by creating a directory, copying multiple .csr files into that directory, and then specifying that directory on the command line. The following commands show how to create a batch of certificates given a batch of CSRs. Assuming a set of CSRs are located inside of the directory my-csr-directory: On Linux and OS X, the command is: $ ls my-csr-directory/
CreateCustomMetric
Show Description Use this API to define a Custom Metric published by your devices to Device Defender. Requires permission to access the CreateCustomMetric action.
CreateDimension
Show Description Create a dimension that you can use to limit the scope of a metric used in a security profile for IoT Device Defender. For example, using a TOPIC_FILTER dimension, you can narrow down the scope of the metric only to MQTT topics whose name match the pattern specified in the dimension. Requires permission to access the CreateDimension action.
CreateDomainConfiguration
Show Description Creates a domain configuration. Requires permission to access the CreateDomainConfiguration action.
CreateDynamicThingGroup
Show Description Creates a dynamic thing group. Requires permission to access the CreateDynamicThingGroup action.
CreateFleetMetric
Show Description Creates a fleet metric. Requires permission to access the CreateFleetMetric action.
CreateJob
Show Description Creates a job. Requires permission to access the CreateJob action.
CreateJobTemplate
Show Description Creates a job template. Requires permission to access the CreateJobTemplate action.
CreateKeysAndCertificate
Show Description Creates a 2048-bit RSA key pair and issues an X.509 certificate using the issued public key. You can also call CreateKeysAndCertificate over MQTT from a device, for more information, see Provisioning MQTT API. Note This is the only time IoT issues the private key for this certificate, so it is important to keep it in a secure location. Requires permission to access the CreateKeysAndCertificate action.
CreateMitigationAction
Show Description Defines an action that can be applied to audit findings by using StartAuditMitigationActionsTask. Only certain types of mitigation actions can be applied to specific check names. For more information, see Mitigation actions. Each mitigation action can apply only one type of change. Requires permission to access the CreateMitigationAction action.
CreateOTAUpdate
Show Description Creates an IoT OTA update on a target group of things or groups. Requires permission to access the CreateOTAUpdate action.
CreatePolicy
Show Description Creates an IoT policy. The created policy is the default version for the policy. This operation creates a policy version with a version identifier of 1 and sets 1 as the policy's default version. Requires permission to access the CreatePolicy action.
CreatePolicyVersion
Show Description Creates a new version of the specified IoT policy. To update a policy, create a new policy version. A managed policy can have up to five versions. If the policy has five versions, you must use DeletePolicyVersion to delete an existing version before you create a new one. Optionally, you can set the new version as the policy's default version. The default version is the operative version (that is, the version that is in effect for the certificates to which the policy is attached). Requires permission to access the CreatePolicyVersion action.
CreateProvisioningClaim
Show Description Creates a provisioning claim. Requires permission to access the CreateProvisioningClaim action.
CreateProvisioningTemplate
Show Description Creates a fleet provisioning template. Requires permission to access the CreateProvisioningTemplate action.
CreateProvisioningTemplateVersion
Show Description Creates a new version of a fleet provisioning template. Requires permission to access the CreateProvisioningTemplateVersion action.
CreateRoleAlias
Show Description Creates a role alias. Requires permission to access the CreateRoleAlias action.
CreateScheduledAudit
Show Description Creates a scheduled audit that is run at a specified time interval. Requires permission to access the CreateScheduledAudit action.
CreateSecurityProfile
Show Description Creates a Device Defender security profile. Requires permission to access the CreateSecurityProfile action.
CreateStream
Show Description Creates a stream for delivering one or more large files in chunks over MQTT. A stream transports data bytes in chunks or blocks packaged as MQTT messages from a source like S3. You can have one or more files associated with a stream. Requires permission to access the CreateStream action.
CreateThing
Show Description Creates a thing record in the registry. If this call is made multiple times using the same thing name and configuration, the call will succeed. If this call is made with the same thing name but different configuration a ResourceAlreadyExistsException is thrown. This is a control plane operation. See Authorization for information about authorizing control plane actions. Requires permission to access the CreateThing action.
CreateThingGroup
Show Description Create a thing group. This is a control plane operation. See Authorization for information about authorizing control plane actions. Requires permission to access the CreateThingGroup action.
CreateThingType
Show Description Creates a new thing type. Requires permission to access the CreateThingType action.
CreateTopicRule
CreateTopicRuleDestination
Show Description Creates a topic rule destination. The destination must be confirmed prior to use. Requires permission to access the CreateTopicRuleDestination action.
DeleteAccountAuditConfiguration
Show Description Restores the default settings for Device Defender audits for this account. Any configuration data you entered is deleted and all audit checks are reset to disabled. Requires permission to access the DeleteAccountAuditConfiguration action.
DeleteAuditSuppression
Show Description Deletes a Device Defender audit suppression. Requires permission to access the DeleteAuditSuppression action.
DeleteAuthorizer
Show Description Deletes an authorizer. Requires permission to access the DeleteAuthorizer action.
DeleteBillingGroup
Show Description Deletes the billing group. Requires permission to access the DeleteBillingGroup action.
DeleteCACertificate
Show Description Deletes a registered CA certificate. Requires permission to access the DeleteCACertificate action.
DeleteCertificate
DeleteCustomMetric
Show Description Deletes a Device Defender detect custom metric. Requires permission to access the DeleteCustomMetric action. Before you can delete a custom metric, you must first remove the custom metric from all security profiles it's a part of. The security profile associated with the custom metric can be found using the ListSecurityProfiles API with metricName set to your custom metric name.
DeleteDimension
Show Description Removes the specified dimension from your Amazon Web Services accounts. Requires permission to access the DeleteDimension action.
DeleteDomainConfiguration
Show Description Deletes the specified domain configuration. Requires permission to access the DeleteDomainConfiguration action.
DeleteDynamicThingGroup
Show Description Deletes a dynamic thing group. Requires permission to access the DeleteDynamicThingGroup action.
DeleteFleetMetric
DeleteJob
DeleteJobExecution
DeleteJobTemplate
DeleteMitigationAction
Show Description Deletes a defined mitigation action from your Amazon Web Services accounts. Requires permission to access the DeleteMitigationAction action.
DeleteOTAUpdate
Show Description Delete an OTA update. Requires permission to access the DeleteOTAUpdate action.
DeletePolicy
DeletePolicyVersion
DeleteProvisioningTemplate
Show Description Deletes a fleet provisioning template. Requires permission to access the DeleteProvisioningTemplate action.
DeleteProvisioningTemplateVersion
Show Description Deletes a fleet provisioning template version. Requires permission to access the DeleteProvisioningTemplateVersion action.
DeleteRegistrationCode
Show Description Deletes a CA certificate registration code. Requires permission to access the DeleteRegistrationCode action.
DeleteRoleAlias
Show Description Deletes a role alias Requires permission to access the DeleteRoleAlias action.
DeleteScheduledAudit
Show Description Deletes a scheduled audit. Requires permission to access the DeleteScheduledAudit action.
DeleteSecurityProfile
Show Description Deletes a Device Defender security profile. Requires permission to access the DeleteSecurityProfile action.
DeleteStream
Show Description Deletes a stream. Requires permission to access the DeleteStream action.
DeleteThing
Show Description Deletes the specified thing. Returns successfully with no error if the deletion is successful or you specify a thing that doesn't exist. Requires permission to access the DeleteThing action.
DeleteThingGroup
Show Description Deletes a thing group. Requires permission to access the DeleteThingGroup action.
DeleteThingType
Show Description Deletes the specified thing type. You cannot delete a thing type if it has things associated with it. To delete a thing type, first mark it as deprecated by calling DeprecateThingType, then remove any associated things by calling UpdateThing to change the thing type on any associated thing, and finally use DeleteThingType to delete the thing type. Requires permission to access the DeleteThingType action.
DeleteTopicRule
DeleteTopicRuleDestination
Show Description Deletes a topic rule destination. Requires permission to access the DeleteTopicRuleDestination action.
DeleteV2LoggingLevel
DeprecateThingType
Show Description Deprecates a thing type. You can not associate new things with deprecated thing type. Requires permission to access the DeprecateThingType action.
DescribeAccountAuditConfiguration
Show Description Gets information about the Device Defender audit settings for this account. Settings include how audit notifications are sent and which audit checks are enabled or disabled. Requires permission to access the DescribeAccountAuditConfiguration action.
DescribeAuditFinding
Show Description Gets information about a single audit finding. Properties include the reason for noncompliance, the severity of the issue, and the start time when the audit that returned the finding. Requires permission to access the DescribeAuditFinding action.
DescribeAuditMitigationActionsTask
Show Description Gets information about an audit mitigation task that is used to apply mitigation actions to a set of audit findings. Properties include the actions being applied, the audit checks to which they're being applied, the task status, and aggregated task statistics.
DescribeAuditSuppression
Show Description Gets information about a Device Defender audit suppression.
DescribeAuditTask
Show Description Gets information about a Device Defender audit. Requires permission to access the DescribeAuditTask action.
DescribeAuthorizer
Show Description Describes an authorizer. Requires permission to access the DescribeAuthorizer action.
DescribeBillingGroup
Show Description Returns information about a billing group. Requires permission to access the DescribeBillingGroup action.
DescribeCACertificate
Show Description Describes a registered CA certificate. Requires permission to access the DescribeCACertificate action.
DescribeCertificate
Show Description Gets information about the specified certificate. Requires permission to access the DescribeCertificate action.
DescribeCustomMetric
Show Description Gets information about a Device Defender detect custom metric. Requires permission to access the DescribeCustomMetric action.
DescribeDefaultAuthorizer
Show Description Describes the default authorizer. Requires permission to access the DescribeDefaultAuthorizer action.
DescribeDetectMitigationActionsTask
Show Description Gets information about a Device Defender ML Detect mitigation action. Requires permission to access the DescribeDetectMitigationActionsTask action.
DescribeDimension
Show Description Provides details about a dimension that is defined in your Amazon Web Services accounts. Requires permission to access the DescribeDimension action.
DescribeDomainConfiguration
Show Description Gets summary information about a domain configuration. Requires permission to access the DescribeDomainConfiguration action.
DescribeEndpoint
Show Description Returns a unique endpoint specific to the Amazon Web Services account making the call. Requires permission to access the DescribeEndpoint action.
DescribeEventConfigurations
Show Description Describes event configurations. Requires permission to access the DescribeEventConfigurations action.
DescribeFleetMetric
Show Description Gets information about the specified fleet metric. Requires permission to access the DescribeFleetMetric action.
DescribeIndex
Show Description Describes a search index. Requires permission to access the DescribeIndex action.
DescribeJob
Show Description Describes a job. Requires permission to access the DescribeJob action.
DescribeJobExecution
Show Description Describes a job execution. Requires permission to access the DescribeJobExecution action.
DescribeJobTemplate
Show Description Returns information about a job template.
DescribeMitigationAction
Show Description Gets information about a mitigation action. Requires permission to access the DescribeMitigationAction action.
DescribeProvisioningTemplate
Show Description Returns information about a fleet provisioning template. Requires permission to access the DescribeProvisioningTemplate action.
DescribeProvisioningTemplateVersion
Show Description Returns information about a fleet provisioning template version. Requires permission to access the DescribeProvisioningTemplateVersion action.
DescribeRoleAlias
Show Description Describes a role alias. Requires permission to access the DescribeRoleAlias action.
DescribeScheduledAudit
Show Description Gets information about a scheduled audit. Requires permission to access the DescribeScheduledAudit action.
DescribeSecurityProfile
Show Description Gets information about a Device Defender security profile. Requires permission to access the DescribeSecurityProfile action.
DescribeStream
Show Description Gets information about a stream. Requires permission to access the DescribeStream action.
DescribeThing
Show Description Gets information about the specified thing. Requires permission to access the DescribeThing action.
DescribeThingGroup
Show Description Describe a thing group. Requires permission to access the DescribeThingGroup action.
DescribeThingRegistrationTask
Show Description Describes a bulk thing provisioning task. Requires permission to access the DescribeThingRegistrationTask action.
DescribeThingType
Show Description Gets information about the specified thing type. Requires permission to access the DescribeThingType action.
DetachPolicy
DetachPrincipalPolicy
DetachSecurityProfile
Show Description Disassociates a Device Defender security profile from a thing group or from this account. Requires permission to access the DetachSecurityProfile action.
DetachThingPrincipal
Show Description Detaches the specified principal from the specified thing. A principal can be X.509 certificates, IAM users, groups, and roles, Amazon Cognito identities or federated identities. This call is asynchronous. It might take several seconds for the detachment to propagate. Requires permission to access the DetachThingPrincipal action.
DisableTopicRule
EnableTopicRule
GetBehaviorModelTrainingSummaries
Show Description Returns a Device Defender's ML Detect Security Profile training model's status. Requires permission to access the GetBehaviorModelTrainingSummaries action.
GetBucketsAggregation
Show Description Aggregates on indexed data with search queries pertaining to particular fields. Requires permission to access the GetBucketsAggregation action.
GetCardinality
Show Description Returns the approximate count of unique values that match the query. Requires permission to access the GetCardinality action.
GetEffectivePolicies
Show Description Gets a list of the policies that have an effect on the authorization behavior of the specified device when it connects to the IoT device gateway. Requires permission to access the GetEffectivePolicies action.
GetIndexingConfiguration
Show Description Gets the indexing configuration. Requires permission to access the GetIndexingConfiguration action.
GetJobDocument
Show Description Gets a job document. Requires permission to access the GetJobDocument action.
GetLoggingOptions
Show Description Gets the logging options. NOTE: use of this command is not recommended. Use GetV2LoggingOptions instead. Requires permission to access the GetLoggingOptions action.
GetOTAUpdate
Show Description Gets an OTA update. Requires permission to access the GetOTAUpdate action.
GetPercentiles
Show Description Groups the aggregated values that match the query into percentile groupings. The default percentile groupings are: 1,5,25,50,75,95,99, although you can specify your own when you call GetPercentiles. This function returns a value for each percentile group specified (or the default percentile groupings). The percentile group "1" contains the aggregated field value that occurs in approximately one percent of the values that match the query. The percentile group "5" contains the aggregated field value that occurs in approximately five percent of the values that match the query, and so on. The result is an approximation, the more values that match the query, the more accurate the percentile values. Requires permission to access the GetPercentiles action.
GetPolicy
Show Description Gets information about the specified policy with the policy document of the default version. Requires permission to access the GetPolicy action.
GetPolicyVersion
Show Description Gets information about the specified policy version. Requires permission to access the GetPolicyVersion action.
GetRegistrationCode
Show Description Gets a registration code used to register a CA certificate with IoT. Requires permission to access the GetRegistrationCode action.
GetStatistics
Show Description Returns the count, average, sum, minimum, maximum, sum of squares, variance, and standard deviation for the specified aggregated field. If the aggregation field is of type String, only the count statistic is returned. Requires permission to access the GetStatistics action.
GetTopicRule
Show Description Gets information about the rule. Requires permission to access the GetTopicRule action.
GetTopicRuleDestination
Show Description Gets information about a topic rule destination. Requires permission to access the GetTopicRuleDestination action.
GetV2LoggingOptions
Show Description Gets the fine grained logging options. Requires permission to access the GetV2LoggingOptions action.
ListActiveViolations
Show Description Lists the active violations for a given Device Defender security profile. Requires permission to access the ListActiveViolations action.
ListAttachedPolicies
Show Description Lists the policies attached to the specified thing group. Requires permission to access the ListAttachedPolicies action.
ListAuditFindings
Show Description Lists the findings (results) of a Device Defender audit or of the audits performed during a specified time period. (Findings are retained for 90 days.) Requires permission to access the ListAuditFindings action.
ListAuditMitigationActionsExecutions
Show Description Gets the status of audit mitigation action tasks that were executed. Requires permission to access the ListAuditMitigationActionsExecutions action.
ListAuditMitigationActionsTasks
Show Description Gets a list of audit mitigation action tasks that match the specified filters. Requires permission to access the ListAuditMitigationActionsTasks action.
ListAuditSuppressions
Show Description Lists your Device Defender audit listings. Requires permission to access the ListAuditSuppressions action.
ListAuditTasks
Show Description Lists the Device Defender audits that have been performed during a given time period. Requires permission to access the ListAuditTasks action.
ListAuthorizers
Show Description Lists the authorizers registered in your account. Requires permission to access the ListAuthorizers action.
ListBillingGroups
Show Description Lists the billing groups you have created. Requires permission to access the ListBillingGroups action.
ListCACertificates
Show Description Lists the CA certificates registered for your Amazon Web Services account. The results are paginated with a default page size of 25. You can use the returned marker to retrieve additional results. Requires permission to access the ListCACertificates action.
ListCertificates
Show Description Lists the certificates registered in your Amazon Web Services account. The results are paginated with a default page size of 25. You can use the returned marker to retrieve additional results. Requires permission to access the ListCertificates action.
ListCertificatesByCA
Show Description List the device certificates signed by the specified CA certificate. Requires permission to access the ListCertificatesByCA action.
ListCustomMetrics
Show Description Lists your Device Defender detect custom metrics. Requires permission to access the ListCustomMetrics action.
ListDetectMitigationActionsExecutions
Show Description Lists mitigation actions executions for a Device Defender ML Detect Security Profile. Requires permission to access the ListDetectMitigationActionsExecutions action.
ListDetectMitigationActionsTasks
Show Description List of Device Defender ML Detect mitigation actions tasks. Requires permission to access the ListDetectMitigationActionsTasks action.
ListDimensions
Show Description List the set of dimensions that are defined for your Amazon Web Services accounts. Requires permission to access the ListDimensions action.
ListDomainConfigurations
Show Description Gets a list of domain configurations for the user. This list is sorted alphabetically by domain configuration name. Requires permission to access the ListDomainConfigurations action.
ListFleetMetrics
Show Description Lists all your fleet metrics. Requires permission to access the ListFleetMetrics action.
ListIndices
Show Description Lists the search indices. Requires permission to access the ListIndices action.
ListJobExecutionsForJob
Show Description Lists the job executions for a job. Requires permission to access the ListJobExecutionsForJob action.
ListJobExecutionsForThing
Show Description Lists the job executions for the specified thing. Requires permission to access the ListJobExecutionsForThing action.
ListJobTemplates
Show Description Returns a list of job templates. Requires permission to access the ListJobTemplates action.
ListJobs
Show Description Lists jobs. Requires permission to access the ListJobs action.
ListMitigationActions
Show Description Gets a list of all mitigation actions that match the specified filter criteria. Requires permission to access the ListMitigationActions action.
ListOTAUpdates
Show Description Lists OTA updates. Requires permission to access the ListOTAUpdates action.
ListOutgoingCertificates
Show Description Lists certificates that are being transferred but not yet accepted. Requires permission to access the ListOutgoingCertificates action.
ListPolicies
Show Description Lists your policies. Requires permission to access the ListPolicies action.
ListPolicyPrincipals
Show Description Lists the principals associated with the specified policy. Note: This action is deprecated. Please use ListTargetsForPolicy instead. Requires permission to access the ListPolicyPrincipals action.
ListPolicyVersions
Show Description Lists the versions of the specified policy and identifies the default version. Requires permission to access the ListPolicyVersions action.
ListPrincipalPolicies
Show Description Lists the policies attached to the specified principal. If you use an Cognito identity, the ID must be in AmazonCognito Identity format. Note: This action is deprecated. Please use ListAttachedPolicies instead. Requires permission to access the ListPrincipalPolicies action.
ListPrincipalThings
Show Description Lists the things associated with the specified principal. A principal can be X.509 certificates, IAM users, groups, and roles, Amazon Cognito identities or federated identities. Requires permission to access the ListPrincipalThings action.
ListProvisioningTemplateVersions
Show Description A list of fleet provisioning template versions. Requires permission to access the ListProvisioningTemplateVersions action.
ListProvisioningTemplates
Show Description Lists the fleet provisioning templates in your Amazon Web Services account. Requires permission to access the ListProvisioningTemplates action.
ListRoleAliases
Show Description Lists the role aliases registered in your account. Requires permission to access the ListRoleAliases action.
ListScheduledAudits
Show Description Lists all of your scheduled audits. Requires permission to access the ListScheduledAudits action.
ListSecurityProfiles
Show Description Lists the Device Defender security profiles you've created. You can filter security profiles by dimension or custom metric. Requires permission to access the ListSecurityProfiles action. dimensionName and metricName cannot be used in the same request.
ListSecurityProfilesForTarget
Show Description Lists the Device Defender security profiles attached to a target (thing group). Requires permission to access the ListSecurityProfilesForTarget action.
ListStreams
Show Description Lists all of the streams in your Amazon Web Services account. Requires permission to access the ListStreams action.
ListTagsForResource
Show Description Lists the tags (metadata) you have assigned to the resource. Requires permission to access the ListTagsForResource action.
ListTargetsForPolicy
Show Description List targets for the specified policy. Requires permission to access the ListTargetsForPolicy action.
ListTargetsForSecurityProfile
Show Description Lists the targets (thing groups) associated with a given Device Defender security profile. Requires permission to access the ListTargetsForSecurityProfile action.
ListThingGroups
Show Description List the thing groups in your account. Requires permission to access the ListThingGroups action.
ListThingGroupsForThing
Show Description List the thing groups to which the specified thing belongs. Requires permission to access the ListThingGroupsForThing action.
ListThingPrincipals
Show Description Lists the principals associated with the specified thing. A principal can be X.509 certificates, IAM users, groups, and roles, Amazon Cognito identities or federated identities. Requires permission to access the ListThingPrincipals action.
ListThingRegistrationTaskReports
Show Description Information about the thing registration tasks.
ListThingRegistrationTasks
Show Description List bulk thing provisioning tasks. Requires permission to access the ListThingRegistrationTasks action.
ListThingTypes
Show Description Lists the existing thing types. Requires permission to access the ListThingTypes action.
ListThings
Show Description Lists your things. Use the attributeName and attributeValue parameters to filter your things. For example, calling ListThings with attributeName=Color and attributeValue=Red retrieves all things in the registry that contain an attribute Color with the value Red. Requires permission to access the ListThings action. You will not be charged for calling this API if an Access denied error is returned. You will also not be charged if no attributes or pagination token was provided in request and no pagination token and no results were returned.
ListThingsInBillingGroup
Show Description Lists the things you have added to the given billing group. Requires permission to access the ListThingsInBillingGroup action.
ListThingsInThingGroup
Show Description Lists the things in the specified group. Requires permission to access the ListThingsInThingGroup action.
ListTopicRuleDestinations
Show Description Lists all the topic rule destinations in your Amazon Web Services account. Requires permission to access the ListTopicRuleDestinations action.
ListTopicRules
Show Description Lists the rules for the specific topic. Requires permission to access the ListTopicRules action.
ListV2LoggingLevels
Show Description Lists logging levels. Requires permission to access the ListV2LoggingLevels action.
ListViolationEvents
Show Description Lists the Device Defender security profile violations discovered during the given time period. You can use filters to limit the results to those alerts issued for a particular security profile, behavior, or thing (device). Requires permission to access the ListViolationEvents action.
PutVerificationStateOnViolation
Show Description Set a verification state and provide a description of that verification state on a violation (detect alarm).
RegisterCACertificate
Show Description Registers a CA certificate with IoT. This CA certificate can then be used to sign device certificates, which can be then registered with IoT. You can register up to 10 CA certificates per Amazon Web Services account that have the same subject field. This enables you to have up to 10 certificate authorities sign your device certificates. If you have more than one CA certificate registered, make sure you pass the CA certificate when you register your device certificates with the RegisterCertificate action. Requires permission to access the RegisterCACertificate action.
RegisterCertificate
Show Description Registers a device certificate with IoT. If you have more than one CA certificate that has the same subject field, you must specify the CA certificate that was used to sign the device certificate being registered. Requires permission to access the RegisterCertificate action.
RegisterCertificateWithoutCA
Show Description Register a certificate that does not have a certificate authority (CA).
RegisterThing
Show Description Provisions a thing in the device registry. RegisterThing calls other IoT control plane APIs. These calls might exceed your account level IoT Throttling Limits and cause throttle errors. Please contact Amazon Web Services Customer Support to raise your throttling limits if necessary. Requires permission to access the RegisterThing action.
RejectCertificateTransfer
RemoveThingFromBillingGroup
Show Description Removes the given thing from the billing group. Requires permission to access the RemoveThingFromBillingGroup action.
RemoveThingFromThingGroup
Show Description Remove the specified thing from the specified group. You must specify either a thingGroupArn or a thingGroupName to identify the thing group and either a thingArn or a thingName to identify the thing to remove from the thing group. Requires permission to access the RemoveThingFromThingGroup action.
ReplaceTopicRule
SearchIndex
Show Description The query search index. Requires permission to access the SearchIndex action.
SetDefaultAuthorizer
Show Description Sets the default authorizer. This will be used if a websocket connection is made without specifying an authorizer. Requires permission to access the SetDefaultAuthorizer action.
SetDefaultPolicyVersion
SetLoggingOptions
SetV2LoggingLevel
SetV2LoggingOptions
StartAuditMitigationActionsTask
Show Description Starts a task that applies a set of mitigation actions to the specified target. Requires permission to access the StartAuditMitigationActionsTask action.
StartDetectMitigationActionsTask
Show Description Starts a Device Defender ML Detect mitigation actions task. Requires permission to access the StartDetectMitigationActionsTask action.
StartOnDemandAuditTask
Show Description Starts an on-demand Device Defender audit. Requires permission to access the StartOnDemandAuditTask action.
StartThingRegistrationTask
Show Description Creates a bulk thing provisioning task. Requires permission to access the StartThingRegistrationTask action.
StopThingRegistrationTask
Show Description Cancels a bulk thing provisioning task. Requires permission to access the StopThingRegistrationTask action.
TagResource
Show Description Adds to or modifies the tags of the given resource. Tags are metadata which can be used to manage a resource. Requires permission to access the TagResource action.
TestAuthorization
Show Description Tests if a specified principal is authorized to perform an IoT action on a specified resource. Use this to test and debug the authorization behavior of devices that connect to the IoT device gateway. Requires permission to access the TestAuthorization action.
TestInvokeAuthorizer
Show Description Tests a custom authorization behavior by invoking a specified custom authorizer. Use this to test and debug the custom authorization behavior of devices that connect to the IoT device gateway. Requires permission to access the TestInvokeAuthorizer action.
TransferCertificate
Show Description Transfers the specified certificate to the specified Amazon Web Services account. Requires permission to access the TransferCertificate action. You can cancel the transfer until it is acknowledged by the recipient. No notification is sent to the transfer destination's account. It is up to the caller to notify the transfer target. The certificate being transferred must not be in the ACTIVE state. You can use the UpdateCertificate action to deactivate it. The certificate must not have any policies attached to it. You can use the DetachPolicy action to detach them.
UntagResource
Show Description Removes the given tags (metadata) from the resource. Requires permission to access the UntagResource action.
UpdateAccountAuditConfiguration
Show Description Configures or reconfigures the Device Defender audit settings for this account. Settings include how audit notifications are sent and which audit checks are enabled or disabled. Requires permission to access the UpdateAccountAuditConfiguration action.
UpdateAuditSuppression
Show Description Updates a Device Defender audit suppression.
UpdateAuthorizer
Show Description Updates an authorizer. Requires permission to access the UpdateAuthorizer action.
UpdateBillingGroup
Show Description Updates information about the billing group. Requires permission to access the UpdateBillingGroup action.
UpdateCACertificate
UpdateCertificate
UpdateCustomMetric
Show Description Updates a Device Defender detect custom metric. Requires permission to access the UpdateCustomMetric action.
UpdateDimension
Show Description Updates the definition for a dimension. You cannot change the type of a dimension after it is created (you can delete it and recreate it). Requires permission to access the UpdateDimension action.
UpdateDomainConfiguration
Show Description Updates values stored in the domain configuration. Domain configurations for default endpoints can't be updated. Requires permission to access the UpdateDomainConfiguration action.
UpdateDynamicThingGroup
Show Description Updates a dynamic thing group. Requires permission to access the UpdateDynamicThingGroup action.
UpdateEventConfigurations
Show Description Updates the event configurations. Requires permission to access the UpdateEventConfigurations action.
UpdateFleetMetric
UpdateIndexingConfiguration
Show Description Updates the search configuration. Requires permission to access the UpdateIndexingConfiguration action.
UpdateJob
UpdateMitigationAction
Show Description Updates the definition for the specified mitigation action. Requires permission to access the UpdateMitigationAction action.
UpdateProvisioningTemplate
Show Description Updates a fleet provisioning template. Requires permission to access the UpdateProvisioningTemplate action.
UpdateRoleAlias
Show Description Updates a role alias. Requires permission to access the UpdateRoleAlias action.
UpdateScheduledAudit
Show Description Updates a scheduled audit, including which checks are performed and how often the audit takes place. Requires permission to access the UpdateScheduledAudit action.
UpdateSecurityProfile
Show Description Updates a Device Defender security profile. Requires permission to access the UpdateSecurityProfile action.
UpdateStream
Show Description Updates an existing stream. The stream version will be incremented by one. Requires permission to access the UpdateStream action.
UpdateThing
Show Description Updates the data for a thing. Requires permission to access the UpdateThing action.
UpdateThingGroup
Show Description Update a thing group. Requires permission to access the UpdateThingGroup action.
UpdateThingGroupsForThing
Show Description Updates the groups to which the thing belongs. Requires permission to access the UpdateThingGroupsForThing action.
UpdateTopicRuleDestination
Show Description Updates a topic rule destination. You use this to change the status, endpoint URL, or confirmation URL of the destination. Requires permission to access the UpdateTopicRuleDestination action.

Iot1click-projects Events

Service Event Name Description
iot1click-projects AssociateDeviceWithPlacement
Show Description Associates a physical device with a placement.
CreatePlacement
Show Description Creates an empty placement.
CreateProject
Show Description Creates an empty project with a placement template. A project contains zero or more placements that adhere to the placement template defined in the project.
DeletePlacement
Show Description Deletes a placement. To delete a placement, it must not have any devices associated with it. When you delete a placement, all associated data becomes irretrievable.
DeleteProject
Show Description Deletes a project. To delete a project, it must not have any placements associated with it. When you delete a project, all associated data becomes irretrievable.
DescribePlacement
Show Description Describes a placement in a project.
DescribeProject
Show Description Returns an object describing a project.
DisassociateDeviceFromPlacement
Show Description Removes a physical device from a placement.
GetDevicesInPlacement
Show Description Returns an object enumerating the devices in a placement.
ListPlacements
Show Description Lists the placement(s) of a project.
ListProjects
Show Description Lists the AWS IoT 1-Click project(s) associated with your AWS account and region.
ListTagsForResource
Show Description Lists the tags (metadata key/value pairs) which you have assigned to the resource.
TagResource
Show Description Creates or modifies tags for a resource. Tags are key/value pairs (metadata) that can be used to manage a resource. For more information, see AWS Tagging Strategies.
UntagResource
Show Description Removes one or more tags (metadata key/value pairs) from a resource.
UpdatePlacement
Show Description Updates a placement with the given attributes. To clear an attribute, pass an empty value (i.e., "").

Iotanalytics Events

Service Event Name Description
iotanalytics BatchPutMessage
Show Description Sends messages to a channel.
CancelPipelineReprocessing
Show Description Cancels the reprocessing of data through the pipeline.
CreateChannel
Show Description Used to create a channel. A channel collects data from an MQTT topic and archives the raw, unprocessed messages before publishing the data to a pipeline.
CreateDataset
Show Description Used to create a dataset. A dataset stores data retrieved from a data store by applying a queryAction (a SQL query) or a containerAction (executing a containerized application). This operation creates the skeleton of a dataset. The dataset can be populated manually by calling CreateDatasetContent or automatically according to a trigger you specify.
CreateDatasetContent
Show Description Creates the content of a dataset by applying a queryAction (a SQL query) or a containerAction (executing a containerized application).
CreateDatastore
Show Description Creates a data store, which is a repository for messages.
CreatePipeline
Show Description Creates a pipeline. A pipeline consumes messages from a channel and allows you to process the messages before storing them in a data store. You must specify both a channel and a datastore activity and, optionally, as many as 23 additional activities in the pipelineActivities array.
DeleteChannel
DeleteDataset
DeleteDatasetContent
DeleteDatastore
DeletePipeline
DescribeChannel
Show Description Retrieves information about a channel.
DescribeDataset
Show Description Retrieves information about a dataset.
DescribeDatastore
Show Description Retrieves information about a data store.
DescribeLoggingOptions
Show Description Retrieves the current settings of the IoT Analytics logging options.
DescribePipeline
Show Description Retrieves information about a pipeline.
GetDatasetContent
Show Description Retrieves the contents of a dataset as presigned URIs.
ListChannels
Show Description Retrieves a list of channels.
ListDatasetContents
Show Description Lists information about dataset contents that have been created.
ListDatasets
Show Description Retrieves information about datasets.
ListDatastores
Show Description Retrieves a list of data stores.
ListPipelines
Show Description Retrieves a list of pipelines.
ListTagsForResource
Show Description Lists the tags (metadata) that you have assigned to the resource.
PutLoggingOptions
RunPipelineActivity
Show Description Simulates the results of running a pipeline activity on a message payload.
SampleChannelData
Show Description Retrieves a sample of messages from the specified channel ingested during the specified timeframe. Up to 10 messages can be retrieved.
StartPipelineReprocessing
Show Description Starts the reprocessing of raw message data through the pipeline.
TagResource
Show Description Adds to or modifies the tags of the given resource. Tags are metadata that can be used to manage a resource.
UntagResource
Show Description Removes the given tags (metadata) from the resource.
UpdateChannel
UpdateDataset
UpdateDatastore

Iotdeviceadvisor Events

Service Event Name Description
iotdeviceadvisor CreateSuiteDefinition
Show Description Creates a Device Advisor test suite.
DeleteSuiteDefinition
Show Description Deletes a Device Advisor test suite.
GetSuiteDefinition
Show Description Gets information about a Device Advisor test suite.
GetSuiteRun
Show Description Gets information about a Device Advisor test suite run.
GetSuiteRunReport
Show Description Gets a report download link for a successful Device Advisor qualifying test suite run.
ListSuiteDefinitions
Show Description Lists the Device Advisor test suites you have created.
ListSuiteRuns
Show Description Lists the runs of the specified Device Advisor test suite. You can list all runs of the test suite, or the runs of a specific version of the test suite.
ListTagsForResource
Show Description Lists the tags attached to an IoT Device Advisor resource.
StartSuiteRun
Show Description Starts a Device Advisor test suite run.
StopSuiteRun
Show Description Stops a Device Advisor test suite run that is currently running.
TagResource
Show Description Adds to and modifies existing tags of an IoT Device Advisor resource.
UntagResource
Show Description Removes tags from an IoT Device Advisor resource.

Iotevents-data Events

Service Event Name Description
iotevents-data BatchAcknowledgeAlarm
Show Description Acknowledges one or more alarms. The alarms change to the ACKNOWLEDGED state after you acknowledge them.
BatchDisableAlarm
Show Description Disables one or more alarms. The alarms change to the DISABLED state after you disable them.
BatchEnableAlarm
Show Description Enables one or more alarms. The alarms change to the NORMAL state after you enable them.
BatchPutMessage
Show Description Sends a set of messages to the AWS IoT Events system. Each message payload is transformed into the input you specify ("inputName") and ingested into any detectors that monitor that input. If multiple messages are sent, the order in which the messages are processed isn't guaranteed. To guarantee ordering, you must send messages one at a time and wait for a successful response.
BatchResetAlarm
Show Description Resets one or more alarms. The alarms return to the NORMAL state after you reset them.
BatchSnoozeAlarm
Show Description Changes one or more alarms to the snooze mode. The alarms change to the SNOOZE_DISABLED state after you set them to the snooze mode.
BatchUpdateDetector
Show Description Updates the state, variable values, and timer settings of one or more detectors (instances) of a specified detector model.
DescribeAlarm
Show Description Retrieves information about an alarm.
DescribeDetector
Show Description Returns information about the specified detector (instance).
ListAlarms
Show Description Lists one or more alarms. The operation returns only the metadata associated with each alarm.

Iotevents Events

Service Event Name Description
iotevents CreateAlarmModel
Show Description Creates an alarm model to monitor an AWS IoT Events input attribute. You can use the alarm to get notified when the value is outside a specified range. For more information, see Create an alarm model in the AWS IoT Events Developer Guide.
CreateDetectorModel
Show Description Creates a detector model.
CreateInput
Show Description Creates an input.
DeleteAlarmModel
Show Description Deletes an alarm model. Any alarm instances that were created based on this alarm model are also deleted. This action can't be undone.
DeleteDetectorModel
Show Description Deletes a detector model. Any active instances of the detector model are also deleted.
DeleteInput
Show Description Deletes an input.
DescribeAlarmModel
Show Description Retrieves information about an alarm model. If you don't specify a value for the alarmModelVersion parameter, the latest version is returned.
DescribeDetectorModel
Show Description Describes a detector model. If the version parameter is not specified, information about the latest version is returned.
DescribeDetectorModelAnalysis
Show Description Retrieves runtime information about a detector model analysis. After AWS IoT Events starts analyzing your detector model, you have up to 24 hours to retrieve the analysis results.
DescribeInput
Show Description Describes an input.
DescribeLoggingOptions
Show Description Retrieves the current settings of the AWS IoT Events logging options.
GetDetectorModelAnalysisResults
Show Description Retrieves one or more analysis results of the detector model. After AWS IoT Events starts analyzing your detector model, you have up to 24 hours to retrieve the analysis results.
ListAlarmModelVersions
Show Description Lists all the versions of an alarm model. The operation returns only the metadata associated with each alarm model version.
ListAlarmModels
Show Description Lists the alarm models that you created. The operation returns only the metadata associated with each alarm model.
ListDetectorModelVersions
Show Description Lists all the versions of a detector model. Only the metadata associated with each detector model version is returned.
ListDetectorModels
Show Description Lists the detector models you have created. Only the metadata associated with each detector model is returned.
ListInputRoutings
Show Description Lists one or more input routings.
ListInputs
Show Description Lists the inputs you have created.
ListTagsForResource
Show Description Lists the tags (metadata) you have assigned to the resource.
PutLoggingOptions
StartDetectorModelAnalysis
Show Description Performs an analysis of your detector model. For more information, see Troubleshooting a detector model in the AWS IoT Events Developer Guide.
TagResource
Show Description Adds to or modifies the tags of the given resource. Tags are metadata that can be used to manage a resource.
UntagResource
Show Description Removes the given tags (metadata) from the resource.
UpdateAlarmModel
Show Description Updates an alarm model. Any alarms that were created based on the previous version are deleted and then created again as new data arrives.
UpdateDetectorModel
Show Description Updates a detector model. Detectors (instances) spawned by the previous version are deleted and then re-created as new inputs arrive.

Iotfleethub Events

Service Event Name Description
iotfleethub CreateApplication
Show Description Creates a Fleet Hub for AWS IoT Device Management web application. Fleet Hub for AWS IoT Device Management is in public preview and is subject to change.
DeleteApplication
Show Description Deletes a Fleet Hub for AWS IoT Device Management web application. Fleet Hub for AWS IoT Device Management is in public preview and is subject to change.
DescribeApplication
Show Description Gets information about a Fleet Hub for AWS IoT Device Management web application. Fleet Hub for AWS IoT Device Management is in public preview and is subject to change.
ListApplications
Show Description Gets a list of Fleet Hub for AWS IoT Device Management web applications for the current account. Fleet Hub for AWS IoT Device Management is in public preview and is subject to change.
ListTagsForResource
Show Description Lists the tags for the specified resource. Fleet Hub for AWS IoT Device Management is in public preview and is subject to change.
TagResource
Show Description Adds to or modifies the tags of the specified resource. Tags are metadata which can be used to manage a resource. Fleet Hub for AWS IoT Device Management is in public preview and is subject to change.
UntagResource
Show Description Removes the specified tags (metadata) from the resource. Fleet Hub for AWS IoT Device Management is in public preview and is subject to change.

Iotsecuretunneling Events

Service Event Name Description
iotsecuretunneling CloseTunnel
Show Description Closes a tunnel identified by the unique tunnel id. When a CloseTunnel request is received, we close the WebSocket connections between the client and proxy server so no data can be transmitted.
DescribeTunnel
Show Description Gets information about a tunnel identified by the unique tunnel id.
ListTagsForResource
Show Description Lists the tags for the specified resource.
ListTunnels
Show Description List all tunnels for an AWS account. Tunnels are listed by creation time in descending order, newer tunnels will be listed before older tunnels.
OpenTunnel
Show Description Creates a new tunnel, and returns two client access tokens for clients to use to connect to the AWS IoT Secure Tunneling proxy server.
TagResource
Show Description A resource tag.

Iotsitewise Events

Service Event Name Description
iotsitewise AssociateAssets
BatchAssociateProjectAssets
Show Description Associates a group (batch) of assets with an IoT SiteWise Monitor project.
BatchDisassociateProjectAssets
Show Description Disassociates a group (batch) of assets from an IoT SiteWise Monitor project.
BatchPutAssetPropertyValue
Show Description Sends a list of asset property values to IoT SiteWise. Each value is a timestamp-quality-value (TQV) data point. For more information, see Ingesting data using the API in the IoT SiteWise User Guide. To identify an asset property, you must specify one of the following:
  • The assetId and propertyId of an asset property.
  • A propertyAlias, which is a data stream alias (for example, /company/windfarm/3/turbine/7/temperature). To define an asset property's alias, see UpdateAssetProperty.
With respect to Unix epoch time, IoT SiteWise accepts only TQVs that have a timestamp of no more than 7 days in the past and no more than 10 minutes in the future. IoT SiteWise rejects timestamps outside of the inclusive range of [-7 days, +10 minutes] and returns a TimestampOutOfRangeException error. For each asset property, IoT SiteWise overwrites TQVs with duplicate timestamps unless the newer TQV has a different quality. For example, if you store a TQV {T1, GOOD, V1}, then storing {T1, GOOD, V2} replaces the existing TQV. IoT SiteWise authorizes access to each BatchPutAssetPropertyValue entry individually. For more information, see BatchPutAssetPropertyValue authorization in the IoT SiteWise User Guide.
CreateAccessPolicy
Show Description Creates an access policy that grants the specified identity (Amazon Web Services SSO user, Amazon Web Services SSO group, or IAM user) access to the specified IoT SiteWise Monitor portal or project resource.
CreateAsset
Show Description Creates an asset from an existing asset model. For more information, see Creating assets in the IoT SiteWise User Guide.
CreateAssetModel
Show Description Creates an asset model from specified property and hierarchy definitions. You create assets from asset models. With asset models, you can easily create assets of the same type that have standardized definitions. Each asset created from a model inherits the asset model's property and hierarchy definitions. For more information, see Defining asset models in the IoT SiteWise User Guide.
CreateDashboard
Show Description Creates a dashboard in an IoT SiteWise Monitor project.
CreateGateway
Show Description Creates a gateway, which is a virtual or edge device that delivers industrial data streams from local servers to IoT SiteWise. For more information, see Ingesting data using a gateway in the IoT SiteWise User Guide.
CreatePortal
Show Description Creates a portal, which can contain projects and dashboards. IoT SiteWise Monitor uses Amazon Web Services SSO or IAM to authenticate portal users and manage user permissions. Before you can sign in to a new portal, you must add at least one identity to that portal. For more information, see Adding or removing portal administrators in the IoT SiteWise User Guide.
CreateProject
Show Description Creates a project in the specified portal.
DeleteAccessPolicy
Show Description Deletes an access policy that grants the specified identity access to the specified IoT SiteWise Monitor resource. You can use this operation to revoke access to an IoT SiteWise Monitor resource.
DeleteAsset
Show Description Deletes an asset. This action can't be undone. For more information, see Deleting assets and models in the IoT SiteWise User Guide. You can't delete an asset that's associated to another asset. For more information, see DisassociateAssets.
DeleteAssetModel
Show Description Deletes an asset model. This action can't be undone. You must delete all assets created from an asset model before you can delete the model. Also, you can't delete an asset model if a parent asset model exists that contains a property formula expression that depends on the asset model that you want to delete. For more information, see Deleting assets and models in the IoT SiteWise User Guide.
DeleteDashboard
Show Description Deletes a dashboard from IoT SiteWise Monitor.
DeleteGateway
DeletePortal
Show Description Deletes a portal from IoT SiteWise Monitor.
DeleteProject
Show Description Deletes a project from IoT SiteWise Monitor.
DescribeAccessPolicy
Show Description Describes an access policy, which specifies an identity's access to an IoT SiteWise Monitor portal or project.
DescribeAsset
Show Description Retrieves information about an asset.
DescribeAssetModel
Show Description Retrieves information about an asset model.
DescribeAssetProperty
Show Description Retrieves information about an asset property. When you call this operation for an attribute property, this response includes the default attribute value that you define in the asset model. If you update the default value in the model, this operation's response includes the new default value. This operation doesn't return the value of the asset property. To get the value of an asset property, use GetAssetPropertyValue.
DescribeDashboard
Show Description Retrieves information about a dashboard.
DescribeDefaultEncryptionConfiguration
Show Description Retrieves information about the default encryption configuration for the Amazon Web Services account in the default or specified Region. For more information, see Key management in the IoT SiteWise User Guide.
DescribeGateway
Show Description Retrieves information about a gateway.
DescribeGatewayCapabilityConfiguration
Show Description Retrieves information about a gateway capability configuration. Each gateway capability defines data sources for a gateway. A capability configuration can contain multiple data source configurations. If you define OPC-UA sources for a gateway in the IoT SiteWise console, all of your OPC-UA sources are stored in one capability configuration. To list all capability configurations for a gateway, use DescribeGateway.
DescribeLoggingOptions
Show Description Retrieves the current IoT SiteWise logging options.
DescribePortal
Show Description Retrieves information about a portal.
DescribeProject
Show Description Retrieves information about a project.
DescribeStorageConfiguration
Show Description Retrieves information about the storage configuration for IoT SiteWise.
DisassociateAssets
GetAssetPropertyAggregates
Show Description Gets aggregated values for an asset property. For more information, see Querying aggregates in the IoT SiteWise User Guide. To identify an asset property, you must specify one of the following:
  • The assetId and propertyId of an asset property.
  • A propertyAlias, which is a data stream alias (for example, /company/windfarm/3/turbine/7/temperature). To define an asset property's alias, see UpdateAssetProperty.
GetAssetPropertyValue
Show Description Gets an asset property's current value. For more information, see Querying current values in the IoT SiteWise User Guide. To identify an asset property, you must specify one of the following:
  • The assetId and propertyId of an asset property.
  • A propertyAlias, which is a data stream alias (for example, /company/windfarm/3/turbine/7/temperature). To define an asset property's alias, see UpdateAssetProperty.
GetAssetPropertyValueHistory
Show Description Gets the history of an asset property's values. For more information, see Querying historical values in the IoT SiteWise User Guide. To identify an asset property, you must specify one of the following:
  • The assetId and propertyId of an asset property.
  • A propertyAlias, which is a data stream alias (for example, /company/windfarm/3/turbine/7/temperature). To define an asset property's alias, see UpdateAssetProperty.
GetInterpolatedAssetPropertyValues
Show Description Get interpolated values for an asset property for a specified time interval, during a period of time. If your time series is missing data points during the specified time interval, you can use interpolation to estimate the missing data. For example, you can use this operation to return the interpolated temperature values for a wind turbine every 24 hours over a duration of 7 days. To identify an asset property, you must specify one of the following:
  • The assetId and propertyId of an asset property.
  • A propertyAlias, which is a data stream alias (for example, /company/windfarm/3/turbine/7/temperature). To define an asset property's alias, see UpdateAssetProperty.
ListAccessPolicies
Show Description Retrieves a paginated list of access policies for an identity (an Amazon Web Services SSO user, an Amazon Web Services SSO group, or an IAM user) or an IoT SiteWise Monitor resource (a portal or project).
ListAssetModels
Show Description Retrieves a paginated list of summaries of all asset models.
ListAssetRelationships
Show Description Retrieves a paginated list of asset relationships for an asset. You can use this operation to identify an asset's root asset and all associated assets between that asset and its root.
ListAssets
Show Description Retrieves a paginated list of asset summaries. You can use this operation to do the following:
  • List assets based on a specific asset model.
  • List top-level assets.
You can't use this operation to list all assets. To retrieve summaries for all of your assets, use ListAssetModels to get all of your asset model IDs. Then, use ListAssets to get all assets for each asset model.
ListAssociatedAssets
Show Description Retrieves a paginated list of associated assets. You can use this operation to do the following:
  • List child assets associated to a parent asset by a hierarchy that you specify.
  • List an asset's parent asset.
ListDashboards
Show Description Retrieves a paginated list of dashboards for an IoT SiteWise Monitor project.
ListGateways
Show Description Retrieves a paginated list of gateways.
ListPortals
Show Description Retrieves a paginated list of IoT SiteWise Monitor portals.
ListProjectAssets
Show Description Retrieves a paginated list of assets associated with an IoT SiteWise Monitor project.
ListProjects
Show Description Retrieves a paginated list of projects for an IoT SiteWise Monitor portal.
ListTagsForResource
Show Description Retrieves the list of tags for an IoT SiteWise resource.
PutDefaultEncryptionConfiguration
Show Description Sets the default encryption configuration for the Amazon Web Services account. For more information, see Key management in the IoT SiteWise User Guide.
PutLoggingOptions
Show Description Sets logging options for IoT SiteWise.
PutStorageConfiguration
Show Description Configures storage settings for IoT SiteWise.
TagResource
Show Description Adds tags to an IoT SiteWise resource. If a tag already exists for the resource, this operation updates the tag's value.
UntagResource
Show Description Removes a tag from an IoT SiteWise resource.
UpdateAccessPolicy
Show Description Updates an existing access policy that specifies an identity's access to an IoT SiteWise Monitor portal or project resource.
UpdateAsset
Show Description Updates an asset's name. For more information, see Updating assets and models in the IoT SiteWise User Guide.
UpdateAssetModel
Show Description Updates an asset model and all of the assets that were created from the model. Each asset created from the model inherits the updated asset model's property and hierarchy definitions. For more information, see Updating assets and models in the IoT SiteWise User Guide. This operation overwrites the existing model with the provided model. To avoid deleting your asset model's properties or hierarchies, you must include their IDs and definitions in the updated asset model payload. For more information, see DescribeAssetModel. If you remove a property from an asset model, IoT SiteWise deletes all previous data for that property. If you remove a hierarchy definition from an asset model, IoT SiteWise disassociates every asset associated with that hierarchy. You can't change the type or data type of an existing property.
UpdateAssetProperty
UpdateDashboard
Show Description Updates an IoT SiteWise Monitor dashboard.
UpdateGateway
UpdateGatewayCapabilityConfiguration
Show Description Updates a gateway capability configuration or defines a new capability configuration. Each gateway capability defines data sources for a gateway. A capability configuration can contain multiple data source configurations. If you define OPC-UA sources for a gateway in the IoT SiteWise console, all of your OPC-UA sources are stored in one capability configuration. To list all capability configurations for a gateway, use DescribeGateway.
UpdatePortal
Show Description Updates an IoT SiteWise Monitor portal.

Iotthingsgraph Events

Service Event Name Description
iotthingsgraph AssociateEntityToThing
Show Description Associates a device with a concrete thing that is in the user's registry. A thing can be associated with only one device at a time. If you associate a thing with a new device id, its previous association will be removed.
CreateFlowTemplate
Show Description Creates a workflow template. Workflows can be created only in the user's namespace. (The public namespace contains only entities.) The workflow can contain only entities in the specified namespace. The workflow is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.
CreateSystemInstance
Show Description Creates a system instance. This action validates the system instance, prepares the deployment-related resources. For Greengrass deployments, it updates the Greengrass group that is specified by the greengrassGroupName parameter. It also adds a file to the S3 bucket specified by the s3BucketName parameter. You need to call DeploySystemInstance after running this action. For Greengrass deployments, since this action modifies and adds resources to a Greengrass group and an S3 bucket on the caller's behalf, the calling identity must have write permissions to both the specified Greengrass group and S3 bucket. Otherwise, the call will fail with an authorization error. For cloud deployments, this action requires a flowActionsRoleArn value. This is an IAM role that has permissions to access AWS services, such as AWS Lambda and AWS IoT, that the flow uses when it executes. If the definition document doesn't specify a version of the user's namespace, the latest version will be used by default.
CreateSystemTemplate
Show Description Creates a system. The system is validated against the entities in the latest version of the user's namespace unless another namespace version is specified in the request.
DeleteFlowTemplate
Show Description Deletes a workflow. Any new system or deployment that contains this workflow will fail to update or deploy. Existing deployments that contain the workflow will continue to run (since they use a snapshot of the workflow taken at the time of deployment).
DeleteNamespace
Show Description Deletes the specified namespace. This action deletes all of the entities in the namespace. Delete the systems and flows that use entities in the namespace before performing this action.
DeleteSystemInstance
Show Description Deletes a system instance. Only system instances that have never been deployed, or that have been undeployed can be deleted. Users can create a new system instance that has the same ID as a deleted system instance.
DeleteSystemTemplate
Show Description Deletes a system. New deployments can't contain the system after its deletion. Existing deployments that contain the system will continue to work because they use a snapshot of the system that is taken when it is deployed.
DeploySystemInstance
Show Description Greengrass and Cloud Deployments Deploys the system instance to the target specified in CreateSystemInstance. Greengrass Deployments If the system or any workflows and entities have been updated before this action is called, then the deployment will create a new Amazon Simple Storage Service resource file and then deploy it. Since this action creates a Greengrass deployment on the caller's behalf, the calling identity must have write permissions to the specified Greengrass group. Otherwise, the call will fail with an authorization error. For information about the artifacts that get added to your Greengrass core device when you use this API, see AWS IoT Things Graph and AWS IoT Greengrass.
DeprecateFlowTemplate
Show Description Deprecates the specified workflow. This action marks the workflow for deletion. Deprecated flows can't be deployed, but existing deployments will continue to run.
DeprecateSystemTemplate
Show Description Deprecates the specified system.
DescribeNamespace
Show Description Gets the latest version of the user's namespace and the public version that it is tracking.
DissociateEntityFromThing
Show Description Dissociates a device entity from a concrete thing. The action takes only the type of the entity that you need to dissociate because only one entity of a particular type can be associated with a thing.
GetEntities
Show Description Gets definitions of the specified entities. Uses the latest version of the user's namespace by default. This API returns the following TDM entities.
  • Properties
  • States
  • Events
  • Actions
  • Capabilities
  • Mappings
  • Devices
  • Device Models
  • Services
This action doesn't return definitions for systems, flows, and deployments.
GetFlowTemplate
Show Description Gets the latest version of the DefinitionDocument and FlowTemplateSummary for the specified workflow.
GetFlowTemplateRevisions
Show Description Gets revisions of the specified workflow. Only the last 100 revisions are stored. If the workflow has been deprecated, this action will return revisions that occurred before the deprecation. This action won't work for workflows that have been deleted.
GetNamespaceDeletionStatus
Show Description Gets the status of a namespace deletion task.
GetSystemInstance
Show Description Gets a system instance.
GetSystemTemplate
Show Description Gets a system.
GetSystemTemplateRevisions
Show Description Gets revisions made to the specified system template. Only the previous 100 revisions are stored. If the system has been deprecated, this action will return the revisions that occurred before its deprecation. This action won't work with systems that have been deleted.
GetUploadStatus
Show Description Gets the status of the specified upload.
ListFlowExecutionMessages
Show Description Returns a list of objects that contain information about events in a flow execution.
ListTagsForResource
Show Description Lists all tags on an AWS IoT Things Graph resource.
SearchEntities
Show Description Searches for entities of the specified type. You can search for entities in your namespace and the public namespace that you're tracking.
SearchFlowExecutions
Show Description Searches for AWS IoT Things Graph workflow execution instances.
SearchFlowTemplates
Show Description Searches for summary information about workflows.
SearchSystemInstances
Show Description Searches for system instances in the user's account.
SearchSystemTemplates
Show Description Searches for summary information about systems in the user's account. You can filter by the ID of a workflow to return only systems that use the specified workflow.
SearchThings
Show Description Searches for things associated with the specified entity. You can search by both device and device model. For example, if two different devices, camera1 and camera2, implement the camera device model, the user can associate thing1 to camera1 and thing2 to camera2. SearchThings(camera2) will return only thing2, but SearchThings(camera) will return both thing1 and thing2. This action searches for exact matches and doesn't perform partial text matching.
TagResource
Show Description Creates a tag for the specified resource.
UndeploySystemInstance
Show Description Removes a system instance from its target (Cloud or Greengrass).
UntagResource
Show Description Removes a tag from the specified resource.
UpdateFlowTemplate
Show Description Updates the specified workflow. All deployed systems and system instances that use the workflow will see the changes in the flow when it is redeployed. If you don't want this behavior, copy the workflow (creating a new workflow with a different ID), and update the copy. The workflow can contain only entities in the specified namespace.
UpdateSystemTemplate
Show Description Updates the specified system. You don't need to run this action after updating a workflow. Any deployment that uses the system will see the changes in the system when it is redeployed.

Iotwireless Events

Service Event Name Description
iotwireless AssociateAwsAccountWithPartnerAccount
Show Description Associates a partner account with your AWS account.
AssociateMulticastGroupWithFuotaTask
Show Description Associate a multicast group with a FUOTA task.
AssociateWirelessDeviceWithFuotaTask
Show Description Associate a wireless device with a FUOTA task.
AssociateWirelessDeviceWithMulticastGroup
Show Description Associates a wireless device with a multicast group.
AssociateWirelessDeviceWithThing
Show Description Associates a wireless device with a thing.
AssociateWirelessGatewayWithCertificate
Show Description Associates a wireless gateway with a certificate.
AssociateWirelessGatewayWithThing
Show Description Associates a wireless gateway with a thing.
CancelMulticastGroupSession
Show Description Cancels an existing multicast group session.
CreateDestination
Show Description Creates a new destination that maps a device message to an AWS IoT rule.
CreateDeviceProfile
Show Description Creates a new device profile.
CreateFuotaTask
Show Description Creates a FUOTA task.
CreateMulticastGroup
Show Description Creates a multicast group.
CreateServiceProfile
Show Description Creates a new service profile.
CreateWirelessDevice
Show Description Provisions a wireless device.
CreateWirelessGateway
Show Description Provisions a wireless gateway.
CreateWirelessGatewayTask
Show Description Creates a task for a wireless gateway.
CreateWirelessGatewayTaskDefinition
Show Description Creates a gateway task definition.
DeleteDestination
Show Description Deletes a destination.
DeleteDeviceProfile
Show Description Deletes a device profile.
DeleteFuotaTask
Show Description Deletes a FUOTA task.
DeleteMulticastGroup
Show Description Deletes a multicast group if it is not in use by a fuota task.
DeleteServiceProfile
Show Description Deletes a service profile.
DeleteWirelessDevice
Show Description Deletes a wireless device.
DeleteWirelessGateway
Show Description Deletes a wireless gateway.
DeleteWirelessGatewayTask
Show Description Deletes a wireless gateway task.
DeleteWirelessGatewayTaskDefinition
Show Description Deletes a wireless gateway task definition. Deleting this task definition does not affect tasks that are currently in progress.
DisassociateAwsAccountFromPartnerAccount
Show Description Disassociates your AWS account from a partner account. If PartnerAccountId and PartnerType are null, disassociates your AWS account from all partner accounts.
DisassociateMulticastGroupFromFuotaTask
Show Description Disassociates a multicast group from a fuota task.
DisassociateWirelessDeviceFromFuotaTask
Show Description Disassociates a wireless device from a FUOTA task.
DisassociateWirelessDeviceFromMulticastGroup
Show Description Disassociates a wireless device from a multicast group.
DisassociateWirelessDeviceFromThing
Show Description Disassociates a wireless device from its currently associated thing.
DisassociateWirelessGatewayFromCertificate
Show Description Disassociates a wireless gateway from its currently associated certificate.
DisassociateWirelessGatewayFromThing
Show Description Disassociates a wireless gateway from its currently associated thing.
GetDestination
Show Description Gets information about a destination.
GetDeviceProfile
Show Description Gets information about a device profile.
GetFuotaTask
Show Description Gets information about a FUOTA task.
GetLogLevelsByResourceTypes
Show Description Returns current default log levels or log levels by resource types. Based on resource types, log levels can be for wireless device log options or wireless gateway log options.
GetMulticastGroup
Show Description Gets information about a multicast group.
GetMulticastGroupSession
Show Description Gets information about a multicast group session.
GetPartnerAccount
Show Description Gets information about a partner account. If PartnerAccountId and PartnerType are null, returns all partner accounts.
GetResourceEventConfiguration
Show Description Get the event configuration for a particular resource identifier.
GetResourceLogLevel
Show Description Fetches the log-level override, if any, for a given resource-ID and resource-type. It can be used for a wireless device or a wireless gateway.
GetServiceEndpoint
Show Description Gets the account-specific endpoint for Configuration and Update Server (CUPS) protocol or LoRaWAN Network Server (LNS) connections.
GetServiceProfile
Show Description Gets information about a service profile.
GetWirelessDevice
Show Description Gets information about a wireless device.
GetWirelessDeviceStatistics
Show Description Gets operating information about a wireless device.
GetWirelessGateway
Show Description Gets information about a wireless gateway.
GetWirelessGatewayCertificate
Show Description Gets the ID of the certificate that is currently associated with a wireless gateway.
GetWirelessGatewayFirmwareInformation
Show Description Gets the firmware version and other information about a wireless gateway.
GetWirelessGatewayStatistics
Show Description Gets operating information about a wireless gateway.
GetWirelessGatewayTask
Show Description Gets information about a wireless gateway task.
GetWirelessGatewayTaskDefinition
Show Description Gets information about a wireless gateway task definition.
ListDestinations
Show Description Lists the destinations registered to your AWS account.
ListDeviceProfiles
Show Description Lists the device profiles registered to your AWS account.
ListFuotaTasks
Show Description Lists the FUOTA tasks registered to your AWS account.
ListMulticastGroups
Show Description Lists the multicast groups registered to your AWS account.
ListMulticastGroupsByFuotaTask
Show Description List all multicast groups associated with a fuota task.
ListPartnerAccounts
Show Description Lists the partner accounts associated with your AWS account.
ListServiceProfiles
Show Description Lists the service profiles registered to your AWS account.
ListTagsForResource
Show Description Lists the tags (metadata) you have assigned to the resource.
ListWirelessDevices
Show Description Lists the wireless devices registered to your AWS account.
ListWirelessGatewayTaskDefinitions
Show Description List the wireless gateway tasks definitions registered to your AWS account.
ListWirelessGateways
Show Description Lists the wireless gateways registered to your AWS account.
PutResourceLogLevel
Show Description Sets the log-level override for a resource-ID and resource-type. This option can be specified for a wireless gateway or a wireless device. A limit of 200 log level override can be set per account.
ResetAllResourceLogLevels
Show Description Removes the log-level overrides for all resources; both wireless devices and wireless gateways.
ResetResourceLogLevel
Show Description Removes the log-level override, if any, for a specific resource-ID and resource-type. It can be used for a wireless device or a wireless gateway.
SendDataToMulticastGroup
Show Description Sends the specified data to a multicast group.
SendDataToWirelessDevice
Show Description Sends a decrypted application data frame to a device.
StartBulkAssociateWirelessDeviceWithMulticastGroup
Show Description Starts a bulk association of all qualifying wireless devices with a multicast group.
StartBulkDisassociateWirelessDeviceFromMulticastGroup
Show Description Starts a bulk disassociatin of all qualifying wireless devices from a multicast group.
StartFuotaTask
Show Description Starts a FUOTA task.
StartMulticastGroupSession
Show Description Starts a multicast group session.
TagResource
Show Description Adds a tag to a resource.
TestWirelessDevice
Show Description Simulates a provisioned device by sending an uplink data payload of Hello.
UntagResource
Show Description Removes one or more tags from a resource.
UpdateDestination
Show Description Updates properties of a destination.
UpdateFuotaTask
Show Description Updates properties of a FUOTA task.
UpdateLogLevelsByResourceTypes
Show Description Set default log level, or log levels by resource types. This can be for wireless device log options or wireless gateways log options and is used to control the log messages that'll be displayed in CloudWatch.
UpdateMulticastGroup
Show Description Updates properties of a multicast group session.
UpdatePartnerAccount
Show Description Updates properties of a partner account.
UpdateResourceEventConfiguration
Show Description Update the event configuration for a particular resource identifier.
UpdateWirelessDevice
Show Description Updates properties of a wireless device.

Ivs Events

Service Event Name Description
ivs BatchGetChannel
Show Description Performs GetChannel on multiple ARNs simultaneously.
BatchGetStreamKey
Show Description Performs GetStreamKey on multiple ARNs simultaneously.
CreateChannel
Show Description Creates a new channel and an associated stream key to start streaming.
CreateRecordingConfiguration
Show Description Creates a new recording configuration, used to enable recording to Amazon S3. Known issue: In the us-east-1 region, if you use the Amazon Web Services CLI to create a recording configuration, it returns success even if the S3 bucket is in a different region. In this case, the state of the recording configuration is CREATE_FAILED (instead of ACTIVE). (In other regions, the CLI correctly returns failure if the bucket is in a different region.) Workaround: Ensure that your S3 bucket is in the same region as the recording configuration. If you create a recording configuration in a different region as your S3 bucket, delete that recording configuration and create a new one with an S3 bucket from the correct region.
CreateStreamKey
Show Description Creates a stream key, used to initiate a stream, for the specified channel ARN. Note that CreateChannel creates a stream key. If you subsequently use CreateStreamKey on the same channel, it will fail because a stream key already exists and there is a limit of 1 stream key per channel. To reset the stream key on a channel, use DeleteStreamKey and then CreateStreamKey.
DeleteChannel
DeletePlaybackKeyPair
Show Description Deletes a specified authorization key pair. This invalidates future viewer tokens generated using the key pair’s privateKey. For more information, see Setting Up Private Channels in the Amazon IVS User Guide.
DeleteRecordingConfiguration
DeleteStreamKey
GetChannel
Show Description Gets the channel configuration for the specified channel ARN. See also BatchGetChannel.
GetPlaybackKeyPair
Show Description Gets a specified playback authorization key pair and returns the arn and fingerprint. The privateKey held by the caller can be used to generate viewer authorization tokens, to grant viewers access to private channels. For more information, see Setting Up Private Channels in the Amazon IVS User Guide.
GetRecordingConfiguration
Show Description Gets the recording configuration for the specified ARN.
GetStream
Show Description Gets information about the active (live) stream on a specified channel.
GetStreamKey
Show Description Gets stream-key information for a specified ARN.
ImportPlaybackKeyPair
Show Description Imports the public portion of a new key pair and returns its arn and fingerprint. The privateKey can then be used to generate viewer authorization tokens, to grant viewers access to private channels. For more information, see Setting Up Private Channels in the Amazon IVS User Guide.
ListChannels
Show Description Gets summary information about all channels in your account, in the Amazon Web Services region where the API request is processed. This list can be filtered to match a specified name or recording-configuration ARN. Filters are mutually exclusive and cannot be used together. If you try to use both filters, you will get an error (409 ConflictException).
ListPlaybackKeyPairs
Show Description Gets summary information about playback key pairs. For more information, see Setting Up Private Channels in the Amazon IVS User Guide.
ListRecordingConfigurations
Show Description Gets summary information about all recording configurations in your account, in the Amazon Web Services region where the API request is processed.
ListStreamKeys
Show Description Gets summary information about stream keys for the specified channel.
ListStreams
Show Description Gets summary information about live streams in your account, in the Amazon Web Services region where the API request is processed.
ListTagsForResource
Show Description Gets information about Amazon Web Services tags for the specified ARN.
PutMetadata
StopStream
Show Description Disconnects the incoming RTMPS stream for the specified channel. Can be used in conjunction with DeleteStreamKey to prevent further streaming to a channel. Many streaming client-software libraries automatically reconnect a dropped RTMPS session, so to stop the stream permanently, you may want to first revoke the streamKey attached to the channel.
TagResource
Show Description Adds or updates tags for the Amazon Web Services resource with the specified ARN.
UntagResource
Show Description Removes tags from the resource with the specified ARN.

Kafka Events

Service Event Name Description
kafka BatchAssociateScramSecret
CreateCluster
CreateConfiguration
DeleteCluster
DeleteConfiguration
DescribeCluster
DescribeClusterOperation
DescribeConfiguration
DescribeConfigurationRevision
BatchDisassociateScramSecret
GetBootstrapBrokers
GetCompatibleKafkaVersions
ListClusterOperations
ListClusters
ListConfigurationRevisions
ListConfigurations
ListKafkaVersions
ListNodes
ListScramSecrets
ListTagsForResource
RebootBroker
Show Description Reboots brokers.
TagResource
UntagResource
UpdateBrokerCount
UpdateBrokerType
UpdateBrokerStorage
UpdateConfiguration
UpdateClusterConfiguration
UpdateClusterKafkaVersion
UpdateMonitoring

Kafkaconnect Events

Service Event Name Description
kafkaconnect CreateConnector
Show Description Creates a connector using the specified properties.
CreateCustomPlugin
Show Description Creates a custom plugin using the specified properties.
CreateWorkerConfiguration
Show Description Creates a worker configuration using the specified properties.
DeleteConnector
Show Description Deletes the specified connector.
DescribeConnector
Show Description Returns summary information about the connector.
DescribeCustomPlugin
Show Description A summary description of the custom plugin.
DescribeWorkerConfiguration
Show Description Returns information about a worker configuration.
ListConnectors
Show Description Returns a list of all the connectors in this account and Region. The list is limited to connectors whose name starts with the specified prefix. The response also includes a description of each of the listed connectors.
ListCustomPlugins
Show Description Returns a list of all of the custom plugins in this account and Region.
ListWorkerConfigurations
Show Description Returns a list of all of the worker configurations in this account and Region.

Kendra Events

Service Event Name Description
kendra BatchDeleteDocument
Show Description Removes one or more documents from an index. The documents must have been added with the BatchPutDocument operation. The documents are deleted asynchronously. You can see the progress of the deletion by using Amazon Web Services CloudWatch. Any error messages related to the processing of the batch are sent to you CloudWatch log.
BatchGetDocumentStatus
Show Description Returns the indexing status for one or more documents submitted with the BatchPutDocument operation. When you use the BatchPutDocument operation, documents are indexed asynchronously. You can use the BatchGetDocumentStatus operation to get the current status of a list of documents so that you can determine if they have been successfully indexed. You can also use the BatchGetDocumentStatus operation to check the status of the BatchDeleteDocument operation. When a document is deleted from the index, Amazon Kendra returns NOT_FOUND as the status.
BatchPutDocument
Show Description Adds one or more documents to an index. The BatchPutDocument operation enables you to ingest inline documents or a set of documents stored in an Amazon S3 bucket. Use this operation to ingest your text and unstructured text into an index, add custom attributes to the documents, and to attach an access control list to the documents added to the index. The documents are indexed asynchronously. You can see the progress of the batch using Amazon Web Services CloudWatch. Any error messages related to processing the batch are sent to your Amazon Web Services CloudWatch log.
ClearQuerySuggestions
CreateDataSource
Show Description Creates a data source that you want to use with an Amazon Kendra index. You specify a name, data source connector type and description for your data source. You also specify configuration information for the data source connector. CreateDataSource is a synchronous operation. The operation returns 200 if the data source was successfully created. Otherwise, an exception is raised.
CreateFaq
Show Description Creates an new set of frequently asked question (FAQ) questions and answers.
CreateIndex
Show Description Creates a new Amazon Kendra index. Index creation is an asynchronous operation. To determine if index creation has completed, check the Status field returned from a call to DescribeIndex. The Status field is set to ACTIVE when the index is ready to use. Once the index is active you can index your documents using the BatchPutDocument operation or using one of the supported data sources.
CreateQuerySuggestionsBlockList
Show Description Creates a block list to exlcude certain queries from suggestions. Any query that contains words or phrases specified in the block list is blocked or filtered out from being shown as a suggestion. You need to provide the file location of your block list text file in your S3 bucket. In your text file, enter each block word or phrase on a separate line. For information on the current quota limits for block lists, see Quotas for Amazon Kendra.
CreateThesaurus
Show Description Creates a thesaurus for an index. The thesaurus contains a list of synonyms in Solr format.
DeleteDataSource
DeleteFaq
DeleteIndex
DeletePrincipalMapping
DeleteQuerySuggestionsBlockList
DeleteThesaurus
DescribeDataSource
Show Description Gets information about a Amazon Kendra data source.
DescribeFaq
Show Description Gets information about an FAQ list.
DescribeIndex
Show Description Describes an existing Amazon Kendra index
DescribePrincipalMapping
Show Description Describes the processing of PUT and DELETE actions for mapping users to their groups. This includes information on the status of actions currently processing or yet to be processed, when actions were last updated, when actions were received by Amazon Kendra, the latest action that should process and apply after other actions, and useful error messages if an action could not be processed.
DescribeQuerySuggestionsBlockList
Show Description Describes a block list used for query suggestions for an index. This is used to check the current settings that are applied to a block list.
DescribeQuerySuggestionsConfig
Show Description Describes the settings of query suggestions for an index. This is used to check the current settings applied to query suggestions.
DescribeThesaurus
Show Description Describes an existing Amazon Kendra thesaurus.
GetQuerySuggestions
Show Description Fetches the queries that are suggested to your users.
ListDataSourceSyncJobs
Show Description Gets statistics about synchronizing Amazon Kendra with a data source.
ListDataSources
Show Description Lists the data sources that you have created.
ListFaqs
Show Description Gets a list of FAQ lists associated with an index.
ListGroupsOlderThanOrderingId
Show Description Provides a list of groups that are mapped to users before a given ordering or timestamp identifier.
ListIndices
Show Description Lists the Amazon Kendra indexes that you have created.
ListQuerySuggestionsBlockLists
Show Description Lists the block lists used for query suggestions for an index. For information on the current quota limits for block lists, see Quotas for Amazon Kendra.
ListTagsForResource
Show Description Gets a list of tags associated with a specified resource. Indexes, FAQs, and data sources can have tags associated with them.
ListThesauri
Show Description Lists the Amazon Kendra thesauri associated with an index.
PutPrincipalMapping
Query
Show Description Searches an active index. Use this API to search your documents using query. The Query operation enables to do faceted search and to filter results based on document attributes. It also enables you to provide user context that Amazon Kendra uses to enforce document access control in the search results. Amazon Kendra searches your index for text content and question and answer (FAQ) content. By default the response contains three types of results.
  • Relevant passages
  • Matching FAQs
  • Relevant documents
You can specify that the query return only one type of result using the QueryResultTypeConfig parameter. Each query returns the 100 most relevant results.
StartDataSourceSyncJob
Show Description Starts a synchronization job for a data source. If a synchronization job is already in progress, Amazon Kendra returns a ResourceInUseException exception.
StopDataSourceSyncJob
SubmitFeedback
TagResource
Show Description Adds the specified tag to the specified index, FAQ, or data source resource. If the tag already exists, the existing value is replaced with the new value.
UntagResource
Show Description Removes a tag from an index, FAQ, or a data source.
UpdateDataSource
UpdateIndex
UpdateQuerySuggestionsBlockList
UpdateQuerySuggestionsConfig

Kinesis-video-media Events

Service Event Name Description
kinesis-video-media GetMedia
Show Description Use this API to retrieve media content from a Kinesis video stream. In the request, you identify the stream name or stream Amazon Resource Name (ARN), and the starting chunk. Kinesis Video Streams then returns a stream of chunks in order by fragment number. You must first call the GetDataEndpoint API to get an endpoint. Then send the GetMedia requests to this endpoint using the --endpoint-url parameter. When you put media data (fragments) on a stream, Kinesis Video Streams stores each incoming fragment and related metadata in what is called a "chunk." For more information, see PutMedia. The GetMedia API returns a stream of these chunks starting from the chunk that you specify in the request. The following limits apply when using the GetMedia API:
  • A client can call GetMedia up to five times per second per stream.
  • Kinesis Video Streams sends media data at a rate of up to 25 megabytes per second (or 200 megabits per second) during a GetMedia session.
If an error is thrown after invoking a Kinesis Video Streams media API, in addition to the HTTP status code and the response body, it includes the following pieces of information:
  • x-amz-ErrorType HTTP header – contains a more specific error type in addition to what the HTTP status code provides.
  • x-amz-RequestId HTTP header – if you want to report an issue to AWS, the support team can better diagnose the problem if given the Request Id.
Both the HTTP status code and the ErrorType header can be utilized to make programmatic decisions about whether errors are retry-able and under what conditions, as well as provide information on what actions the client programmer might need to take in order to successfully try again. For more information, see the Errors section at the bottom of this topic, as well as Common Errors.

Kinesis-video-signaling Events

Service Event Name Description
kinesis-video-signaling GetIceServerConfig
Show Description Gets the Interactive Connectivity Establishment (ICE) server configuration information, including URIs, username, and password which can be used to configure the WebRTC connection. The ICE component uses this configuration information to setup the WebRTC connection, including authenticating with the Traversal Using Relays around NAT (TURN) relay server. TURN is a protocol that is used to improve the connectivity of peer-to-peer applications. By providing a cloud-based relay service, TURN ensures that a connection can be established even when one or more peers are incapable of a direct peer-to-peer connection. For more information, see A REST API For Access To TURN Services. You can invoke this API to establish a fallback mechanism in case either of the peers is unable to establish a direct peer-to-peer connection over a signaling channel. You must specify either a signaling channel ARN or the client ID in order to invoke this API.

Kinesis Events

Service Event Name Description
kinesis AddTagsToStream
CreateStream
DecreaseStreamRetentionPeriod
DeleteStream
DeregisterStreamConsumer
DescribeLimits
Show Description Describes the shard limits and usage for the account. If you update your account limits, the old limits might be returned for a few minutes. This operation has a limit of one transaction per second per account.
DescribeStream
Show Description Describes the specified Kinesis data stream. The information returned includes the stream name, Amazon Resource Name (ARN), creation time, enhanced metric configuration, and shard map. The shard map is an array of shard objects. For each shard object, there is the hash key and sequence number ranges that the shard spans, and the IDs of any earlier shards that played in a role in creating the shard. Every record ingested in the stream is identified by a sequence number, which is assigned when the record is put into the stream. You can limit the number of shards returned by each call. For more information, see Retrieving Shards from a Stream in the Amazon Kinesis Data Streams Developer Guide. There are no guarantees about the chronological order shards returned. To process shards in chronological order, use the ID of the parent shard to track the lineage to the oldest shard. This operation has a limit of 10 transactions per second per account.
DescribeStreamConsumer
Show Description To get the description of a registered consumer, provide the ARN of the consumer. Alternatively, you can provide the ARN of the data stream and the name you gave the consumer when you registered it. You may also provide all three parameters, as long as they don't conflict with each other. If you don't know the name or ARN of the consumer that you want to describe, you can use the ListStreamConsumers operation to get a list of the descriptions of all the consumers that are currently registered with a given data stream. This operation has a limit of 20 transactions per second per stream.
DescribeStreamSummary
Show Description Provides a summarized description of the specified Kinesis data stream without the shard list. The information returned includes the stream name, Amazon Resource Name (ARN), status, record retention period, approximate creation time, monitoring, encryption details, and open shard count. DescribeStreamSummary has a limit of 20 transactions per second per account.
DisableEnhancedMonitoring
Show Description Disables enhanced monitoring.
EnableEnhancedMonitoring
Show Description Enables enhanced Kinesis data stream monitoring for shard-level metrics.
GetRecords
Show Description Gets data records from a Kinesis data stream's shard. Specify a shard iterator using the ShardIterator parameter. The shard iterator specifies the position in the shard from which you want to start reading data records sequentially. If there are no records available in the portion of the shard that the iterator points to, GetRecords returns an empty list. It might take multiple calls to get to a portion of the shard that contains records. You can scale by provisioning multiple shards per stream while considering service limits (for more information, see Amazon Kinesis Data Streams Limits in the Amazon Kinesis Data Streams Developer Guide). Your application should have one thread per shard, each reading continuously from its stream. To read from a stream continually, call GetRecords in a loop. Use GetShardIterator to get the shard iterator to specify in the first GetRecords call. GetRecords returns a new shard iterator in NextShardIterator. Specify the shard iterator returned in NextShardIterator in subsequent calls to GetRecords. If the shard has been closed, the shard iterator can't return more data and GetRecords returns null in NextShardIterator. You can terminate the loop when the shard is closed, or when the shard iterator reaches the record with the sequence number or other attribute that marks it as the last record to process. Each data record can be up to 1 MiB in size, and each shard can read up to 2 MiB per second. You can ensure that your calls don't exceed the maximum supported size or throughput by using the Limit parameter to specify the maximum number of records that GetRecords can return. Consider your average record size when determining this limit. The maximum number of records that can be returned per call is 10,000. The size of the data returned by GetRecords varies depending on the utilization of the shard. The maximum size of data that GetRecords can return is 10 MiB. If a call returns this amount of data, subsequent calls made within the next 5 seconds throw ProvisionedThroughputExceededException. If there is insufficient provisioned throughput on the stream, subsequent calls made within the next 1 second throw ProvisionedThroughputExceededException. GetRecords doesn't return any data when it throws an exception. For this reason, we recommend that you wait 1 second between calls to GetRecords. However, it's possible that the application will get exceptions for longer than 1 second. To detect whether the application is falling behind in processing, you can use the MillisBehindLatest response attribute. You can also monitor the stream using CloudWatch metrics and other mechanisms (see Monitoring in the Amazon Kinesis Data Streams Developer Guide). Each Amazon Kinesis record includes a value, ApproximateArrivalTimestamp, that is set when a stream successfully receives and stores a record. This is commonly referred to as a server-side time stamp, whereas a client-side time stamp is set when a data producer creates or sends the record to a stream (a data producer is any data source putting data records into a stream, for example with PutRecords). The time stamp has millisecond precision. There are no guarantees about the time stamp accuracy, or that the time stamp is always increasing. For example, records in a shard or across a stream might have time stamps that are out of order. This operation has a limit of five transactions per second per shard.
GetShardIterator
Show Description Gets an Amazon Kinesis shard iterator. A shard iterator expires 5 minutes after it is returned to the requester. A shard iterator specifies the shard position from which to start reading data records sequentially. The position is specified using the sequence number of a data record in a shard. A sequence number is the identifier associated with every record ingested in the stream, and is assigned when a record is put into the stream. Each stream has one or more shards. You must specify the shard iterator type. For example, you can set the ShardIteratorType parameter to read exactly from the position denoted by a specific sequence number by using the AT_SEQUENCE_NUMBER shard iterator type. Alternatively, the parameter can read right after the sequence number by using the AFTER_SEQUENCE_NUMBER shard iterator type, using sequence numbers returned by earlier calls to PutRecord, PutRecords, GetRecords, or DescribeStream. In the request, you can specify the shard iterator type AT_TIMESTAMP to read records from an arbitrary point in time, TRIM_HORIZON to cause ShardIterator to point to the last untrimmed record in the shard in the system (the oldest data record in the shard), or LATEST so that you always read the most recent data in the shard. When you read repeatedly from a stream, use a GetShardIterator request to get the first shard iterator for use in your first GetRecords request and for subsequent reads use the shard iterator returned by the GetRecords request in NextShardIterator. A new shard iterator is returned by every GetRecords request in NextShardIterator, which you use in the ShardIterator parameter of the next GetRecords request. If a GetShardIterator request is made too often, you receive a ProvisionedThroughputExceededException. For more information about throughput limits, see GetRecords, and Streams Limits in the Amazon Kinesis Data Streams Developer Guide. If the shard is closed, GetShardIterator returns a valid iterator for the last sequence number of the shard. A shard can be closed as a result of using SplitShard or MergeShards. GetShardIterator has a limit of five transactions per second per account per open shard.
IncreaseStreamRetentionPeriod
ListShards
Show Description Lists the shards in a stream and provides information about each shard. This operation has a limit of 100 transactions per second per data stream. This API is a new operation that is used by the Amazon Kinesis Client Library (KCL). If you have a fine-grained IAM policy that only allows specific operations, you must update your policy to allow calls to this API. For more information, see Controlling Access to Amazon Kinesis Data Streams Resources Using IAM.
ListStreamConsumers
Show Description Lists the consumers registered to receive data from a stream using enhanced fan-out, and provides information about each consumer. This operation has a limit of 5 transactions per second per stream.
ListStreams
Show Description Lists your Kinesis data streams. The number of streams may be too large to return from a single call to ListStreams. You can limit the number of returned streams using the Limit parameter. If you do not specify a value for the Limit parameter, Kinesis Data Streams uses the default limit, which is currently 10. You can detect if there are more streams available to list by using the HasMoreStreams flag from the returned output. If there are more streams available, you can request more streams by using the name of the last stream returned by the ListStreams request in the ExclusiveStartStreamName parameter in a subsequent request to ListStreams. The group of stream names returned by the subsequent request is then added to the list. You can continue this process until all the stream names have been collected in the list. ListStreams has a limit of five transactions per second per account.
ListTagsForStream
Show Description Lists the tags for the specified Kinesis data stream. This operation has a limit of five transactions per second per account.
MergeShards
PutRecord
Show Description Writes a single data record into an Amazon Kinesis data stream. Call PutRecord to send data into the stream for real-time ingestion and subsequent processing, one record at a time. Each shard can support writes up to 1,000 records per second, up to a maximum data write total of 1 MiB per second. You must specify the name of the stream that captures, stores, and transports the data; a partition key; and the data blob itself. The data blob can be any type of data; for example, a segment from a log file, geographic/location data, website clickstream data, and so on. The partition key is used by Kinesis Data Streams to distribute data across shards. Kinesis Data Streams segregates the data records that belong to a stream into multiple shards, using the partition key associated with each data record to determine the shard to which a given data record belongs. Partition keys are Unicode strings, with a maximum length limit of 256 characters for each key. An MD5 hash function is used to map partition keys to 128-bit integer values and to map associated data records to shards using the hash key ranges of the shards. You can override hashing the partition key to determine the shard by explicitly specifying a hash value using the ExplicitHashKey parameter. For more information, see Adding Data to a Stream in the Amazon Kinesis Data Streams Developer Guide. PutRecord returns the shard ID of where the data record was placed and the sequence number that was assigned to the data record. Sequence numbers increase over time and are specific to a shard within a stream, not across all shards within a stream. To guarantee strictly increasing ordering, write serially to a shard and use the SequenceNumberForOrdering parameter. For more information, see Adding Data to a Stream in the Amazon Kinesis Data Streams Developer Guide. After you write a record to a stream, you cannot modify that record or its order within the stream. If a PutRecord request cannot be processed because of insufficient provisioned throughput on the shard involved in the request, PutRecord throws ProvisionedThroughputExceededException. By default, data records are accessible for 24 hours from the time that they are added to a stream. You can use IncreaseStreamRetentionPeriod or DecreaseStreamRetentionPeriod to modify this retention period.
PutRecords
Show Description Writes multiple data records into a Kinesis data stream in a single call (also referred to as a PutRecords request). Use this operation to send data into the stream for data ingestion and processing. Each PutRecords request can support up to 500 records. Each record in the request can be as large as 1 MiB, up to a limit of 5 MiB for the entire request, including partition keys. Each shard can support writes up to 1,000 records per second, up to a maximum data write total of 1 MiB per second. You must specify the name of the stream that captures, stores, and transports the data; and an array of request Records, with each record in the array requiring a partition key and data blob. The record size limit applies to the total size of the partition key and data blob. The data blob can be any type of data; for example, a segment from a log file, geographic/location data, website clickstream data, and so on. The partition key is used by Kinesis Data Streams as input to a hash function that maps the partition key and associated data to a specific shard. An MD5 hash function is used to map partition keys to 128-bit integer values and to map associated data records to shards. As a result of this hashing mechanism, all data records with the same partition key map to the same shard within the stream. For more information, see Adding Data to a Stream in the Amazon Kinesis Data Streams Developer Guide. Each record in the Records array may include an optional parameter, ExplicitHashKey, which overrides the partition key to shard mapping. This parameter allows a data producer to determine explicitly the shard where the record is stored. For more information, see Adding Multiple Records with PutRecords in the Amazon Kinesis Data Streams Developer Guide. The PutRecords response includes an array of response Records. Each record in the response array directly correlates with a record in the request array using natural ordering, from the top to the bottom of the request and response. The response Records array always includes the same number of records as the request array. The response Records array includes both successfully and unsuccessfully processed records. Kinesis Data Streams attempts to process all records in each PutRecords request. A single record failure does not stop the processing of subsequent records. As a result, PutRecords doesn't guarantee the ordering of records. If you need to read records in the same order they are written to the stream, use PutRecord instead of PutRecords, and write to the same shard. A successfully processed record includes ShardId and SequenceNumber values. The ShardId parameter identifies the shard in the stream where the record is stored. The SequenceNumber parameter is an identifier assigned to the put record, unique to all records in the stream. An unsuccessfully processed record includes ErrorCode and ErrorMessage values. ErrorCode reflects the type of error and can be one of the following values: ProvisionedThroughputExceededException or InternalFailure. ErrorMessage provides more detailed information about the ProvisionedThroughputExceededException exception including the account ID, stream name, and shard ID of the record that was throttled. For more information about partially successful responses, see Adding Multiple Records with PutRecords in the Amazon Kinesis Data Streams Developer Guide. After you write a record to a stream, you cannot modify that record or its order within the stream. By default, data records are accessible for 24 hours from the time that they are added to a stream. You can use IncreaseStreamRetentionPeriod or DecreaseStreamRetentionPeriod to modify this retention period.
RegisterStreamConsumer
Show Description Registers a consumer with a Kinesis data stream. When you use this operation, the consumer you register can then call SubscribeToShard to receive data from the stream using enhanced fan-out, at a rate of up to 2 MiB per second for every shard you subscribe to. This rate is unaffected by the total number of consumers that read from the same stream. You can register up to 20 consumers per stream. A given consumer can only be registered with one stream at a time. For an example of how to use this operations, see Enhanced Fan-Out Using the Kinesis Data Streams API. The use of this operation has a limit of five transactions per second per account. Also, only 5 consumers can be created simultaneously. In other words, you cannot have more than 5 consumers in a CREATING status at the same time. Registering a 6th consumer while there are 5 in a CREATING status results in a LimitExceededException.
RemoveTagsFromStream
SplitShard
StartStreamEncryption
StopStreamEncryption
SubscribeToShard
Show Description This operation establishes an HTTP/2 connection between the consumer you specify in the ConsumerARN parameter and the shard you specify in the ShardId parameter. After the connection is successfully established, Kinesis Data Streams pushes records from the shard to the consumer over this connection. Before you call this operation, call RegisterStreamConsumer to register the consumer with Kinesis Data Streams. When the SubscribeToShard call succeeds, your consumer starts receiving events of type SubscribeToShardEvent over the HTTP/2 connection for up to 5 minutes, after which time you need to call SubscribeToShard again to renew the subscription if you want to continue to receive records. You can make one call to SubscribeToShard per second per registered consumer per shard. For example, if you have a 4000 shard stream and two registered stream consumers, you can make one SubscribeToShard request per second for each combination of shard and registered consumer, allowing you to subscribe both consumers to all 4000 shards in one second. If you call SubscribeToShard again with the same ConsumerARN and ShardId within 5 seconds of a successful call, you'll get a ResourceInUseException. If you call SubscribeToShard 5 seconds or more after a successful call, the first connection will expire and the second call will take over the subscription. For an example of how to use this operations, see Enhanced Fan-Out Using the Kinesis Data Streams API.

Kinesisanalytics Events

Service Event Name Description
kinesisanalytics AddApplicationCloudWatchLoggingOption
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Adds a CloudWatch log stream to monitor application configuration errors. For more information about using CloudWatch log streams with Amazon Kinesis Analytics applications, see Working with Amazon CloudWatch Logs.
AddApplicationInput
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Adds a streaming source to your Amazon Kinesis application. For conceptual information, see Configuring Application Input. You can add a streaming source either when you create an application or you can use this operation to add a streaming source after you create an application. For more information, see CreateApplication. Any configuration update, including adding a streaming source using this operation, results in a new version of the application. You can use the DescribeApplication operation to find the current application version. This operation requires permissions to perform the kinesisanalytics:AddApplicationInput action.
AddApplicationInputProcessingConfiguration
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Adds an InputProcessingConfiguration to an application. An input processor preprocesses records on the input stream before the application's SQL code executes. Currently, the only input processor available is AWS Lambda.
AddApplicationOutput
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Adds an external destination to your Amazon Kinesis Analytics application. If you want Amazon Kinesis Analytics to deliver data from an in-application stream within your application to an external destination (such as an Amazon Kinesis stream, an Amazon Kinesis Firehose delivery stream, or an AWS Lambda function), you add the relevant configuration to your application using this operation. You can configure one or more outputs for your application. Each output configuration maps an in-application stream and an external destination. You can use one of the output configurations to deliver data from your in-application error stream to an external destination so that you can analyze the errors. For more information, see Understanding Application Output (Destination). Any configuration update, including adding a streaming source using this operation, results in a new version of the application. You can use the DescribeApplication operation to find the current application version. For the limits on the number of application inputs and outputs you can configure, see Limits. This operation requires permissions to perform the kinesisanalytics:AddApplicationOutput action.
AddApplicationReferenceDataSource
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Adds a reference data source to an existing application. Amazon Kinesis Analytics reads reference data (that is, an Amazon S3 object) and creates an in-application table within your application. In the request, you provide the source (S3 bucket name and object key name), name of the in-application table to create, and the necessary mapping information that describes how data in Amazon S3 object maps to columns in the resulting in-application table. For conceptual information, see Configuring Application Input. For the limits on data sources you can add to your application, see Limits. This operation requires permissions to perform the kinesisanalytics:AddApplicationOutput action.
CreateApplication
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Creates an Amazon Kinesis Analytics application. You can configure each application with one streaming source as input, application code to process the input, and up to three destinations where you want Amazon Kinesis Analytics to write the output data from your application. For an overview, see How it Works. In the input configuration, you map the streaming source to an in-application stream, which you can think of as a constantly updating table. In the mapping, you must provide a schema for the in-application stream and map each data column in the in-application stream to a data element in the streaming source. Your application code is one or more SQL statements that read input data, transform it, and generate output. Your application code can create one or more SQL artifacts like SQL streams or pumps. In the output configuration, you can configure the application to write data from in-application streams created in your applications to up to three destinations. To read data from your source stream or write data to destination streams, Amazon Kinesis Analytics needs your permissions. You grant these permissions by creating IAM roles. This operation requires permissions to perform the kinesisanalytics:CreateApplication action. For introductory exercises to create an Amazon Kinesis Analytics application, see Getting Started.
DeleteApplication
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Deletes the specified application. Amazon Kinesis Analytics halts application execution and deletes the application, including any application artifacts (such as in-application streams, reference table, and application code). This operation requires permissions to perform the kinesisanalytics:DeleteApplication action.
DeleteApplicationCloudWatchLoggingOption
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Deletes a CloudWatch log stream from an application. For more information about using CloudWatch log streams with Amazon Kinesis Analytics applications, see Working with Amazon CloudWatch Logs.
DeleteApplicationInputProcessingConfiguration
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Deletes an InputProcessingConfiguration from an input.
DeleteApplicationOutput
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Deletes output destination configuration from your application configuration. Amazon Kinesis Analytics will no longer write data from the corresponding in-application stream to the external output destination. This operation requires permissions to perform the kinesisanalytics:DeleteApplicationOutput action.
DeleteApplicationReferenceDataSource
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Deletes a reference data source configuration from the specified application configuration. If the application is running, Amazon Kinesis Analytics immediately removes the in-application table that you created using the AddApplicationReferenceDataSource operation. This operation requires permissions to perform the kinesisanalytics.DeleteApplicationReferenceDataSource action.
DescribeApplication
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Returns information about a specific Amazon Kinesis Analytics application. If you want to retrieve a list of all applications in your account, use the ListApplications operation. This operation requires permissions to perform the kinesisanalytics:DescribeApplication action. You can use DescribeApplication to get the current application versionId, which you need to call other operations such as Update.
DiscoverInputSchema
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Infers a schema by evaluating sample records on the specified streaming source (Amazon Kinesis stream or Amazon Kinesis Firehose delivery stream) or S3 object. In the response, the operation returns the inferred schema and also the sample records that the operation used to infer the schema. You can use the inferred schema when configuring a streaming source for your application. For conceptual information, see Configuring Application Input. Note that when you create an application using the Amazon Kinesis Analytics console, the console uses this operation to infer a schema and show it in the console user interface. This operation requires permissions to perform the kinesisanalytics:DiscoverInputSchema action.
ListApplications
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Returns a list of Amazon Kinesis Analytics applications in your account. For each application, the response includes the application name, Amazon Resource Name (ARN), and status. If the response returns the HasMoreApplications value as true, you can send another request by adding the ExclusiveStartApplicationName in the request body, and set the value of this to the last application name from the previous response. If you want detailed information about a specific application, use DescribeApplication. This operation requires permissions to perform the kinesisanalytics:ListApplications action.
ListTagsForResource
Show Description Retrieves the list of key-value tags assigned to the application. For more information, see Using Tagging.
StartApplication
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Starts the specified Amazon Kinesis Analytics application. After creating an application, you must exclusively call this operation to start your application. After the application starts, it begins consuming the input data, processes it, and writes the output to the configured destination. The application status must be READY for you to start an application. You can get the application status in the console or using the DescribeApplication operation. After you start the application, you can stop the application from processing the input by calling the StopApplication operation. This operation requires permissions to perform the kinesisanalytics:StartApplication action.
StopApplication
Show Description This documentation is for version 1 of the Amazon Kinesis Data Analytics API, which only supports SQL applications. Version 2 of the API supports SQL and Java applications. For more information about version 2, see Amazon Kinesis Data Analytics API V2 Documentation. Stops the application from processing input data. You can stop an application only if it is in the running state. You can use the DescribeApplication operation to find the application state. After the application is stopped, Amazon Kinesis Analytics stops reading data from the input, the application stops processing data, and there is no output written to the destination. This operation requires permissions to perform the kinesisanalytics:StopApplication action.
TagResource
Show Description Adds one or more key-value tags to a Kinesis Analytics application. Note that the maximum number of application tags includes system tags. The maximum number of user-defined application tags is 50. For more information, see Using Tagging.
UntagResource
Show Description Removes one or more tags from a Kinesis Analytics application. For more information, see Using Tagging.

Kinesisanalyticsv2 Events

Service Event Name Description
kinesisanalyticsv2 AddApplicationCloudWatchLoggingOption
Show Description Adds an Amazon CloudWatch log stream to monitor application configuration errors.
AddApplicationInput
Show Description Adds a streaming source to your SQL-based Kinesis Data Analytics application. You can add a streaming source when you create an application, or you can use this operation to add a streaming source after you create an application. For more information, see CreateApplication. Any configuration update, including adding a streaming source using this operation, results in a new version of the application. You can use the DescribeApplication operation to find the current application version.
AddApplicationInputProcessingConfiguration
Show Description Adds an InputProcessingConfiguration to a SQL-based Kinesis Data Analytics application. An input processor pre-processes records on the input stream before the application's SQL code executes. Currently, the only input processor available is Amazon Lambda.
AddApplicationOutput
Show Description Adds an external destination to your SQL-based Kinesis Data Analytics application. If you want Kinesis Data Analytics to deliver data from an in-application stream within your application to an external destination (such as an Kinesis data stream, a Kinesis Data Firehose delivery stream, or an Amazon Lambda function), you add the relevant configuration to your application using this operation. You can configure one or more outputs for your application. Each output configuration maps an in-application stream and an external destination. You can use one of the output configurations to deliver data from your in-application error stream to an external destination so that you can analyze the errors. Any configuration update, including adding a streaming source using this operation, results in a new version of the application. You can use the DescribeApplication operation to find the current application version.
AddApplicationReferenceDataSource
Show Description Adds a reference data source to an existing SQL-based Kinesis Data Analytics application. Kinesis Data Analytics reads reference data (that is, an Amazon S3 object) and creates an in-application table within your application. In the request, you provide the source (S3 bucket name and object key name), name of the in-application table to create, and the necessary mapping information that describes how data in an Amazon S3 object maps to columns in the resulting in-application table.
AddApplicationVpcConfiguration
Show Description Adds a Virtual Private Cloud (VPC) configuration to the application. Applications can use VPCs to store and access resources securely. Note the following about VPC configurations for Kinesis Data Analytics applications:
  • VPC configurations are not supported for SQL applications.
  • When a VPC is added to a Kinesis Data Analytics application, the application can no longer be accessed from the Internet directly. To enable Internet access to the application, add an Internet gateway to your VPC.
CreateApplication
Show Description Creates a Kinesis Data Analytics application. For information about creating a Kinesis Data Analytics application, see Creating an Application.
CreateApplicationPresignedUrl
Show Description Creates and returns a URL that you can use to connect to an application's extension. Currently, the only available extension is the Apache Flink dashboard. The IAM role or user used to call this API defines the permissions to access the extension. After the presigned URL is created, no additional permission is required to access this URL. IAM authorization policies for this API are also enforced for every HTTP request that attempts to connect to the extension. You control the amount of time that the URL will be valid using the SessionExpirationDurationInSeconds parameter. If you do not provide this parameter, the returned URL is valid for twelve hours. The URL that you get from a call to CreateApplicationPresignedUrl must be used within 3 minutes to be valid. If you first try to use the URL after the 3-minute limit expires, the service returns an HTTP 403 Forbidden error.
CreateApplicationSnapshot
Show Description Creates a snapshot of the application's state data.
DeleteApplication
Show Description Deletes the specified application. Kinesis Data Analytics halts application execution and deletes the application.
DeleteApplicationCloudWatchLoggingOption
Show Description Deletes an Amazon CloudWatch log stream from an Kinesis Data Analytics application.
DeleteApplicationInputProcessingConfiguration
Show Description Deletes an InputProcessingConfiguration from an input.
DeleteApplicationOutput
Show Description Deletes the output destination configuration from your SQL-based Kinesis Data Analytics application's configuration. Kinesis Data Analytics will no longer write data from the corresponding in-application stream to the external output destination.
DeleteApplicationReferenceDataSource
Show Description Deletes a reference data source configuration from the specified SQL-based Kinesis Data Analytics application's configuration. If the application is running, Kinesis Data Analytics immediately removes the in-application table that you created using the AddApplicationReferenceDataSource operation.
DeleteApplicationSnapshot
Show Description Deletes a snapshot of application state.
DeleteApplicationVpcConfiguration
Show Description Removes a VPC configuration from a Kinesis Data Analytics application.
DescribeApplication
Show Description Returns information about a specific Kinesis Data Analytics application. If you want to retrieve a list of all applications in your account, use the ListApplications operation.
DescribeApplicationSnapshot
Show Description Returns information about a snapshot of application state data.
DescribeApplicationVersion
Show Description Provides a detailed description of a specified version of the application. To see a list of all the versions of an application, invoke the ListApplicationVersions operation. This operation is supported only for Amazon Kinesis Data Analytics for Apache Flink.
DiscoverInputSchema
Show Description Infers a schema for a SQL-based Kinesis Data Analytics application by evaluating sample records on the specified streaming source (Kinesis data stream or Kinesis Data Firehose delivery stream) or Amazon S3 object. In the response, the operation returns the inferred schema and also the sample records that the operation used to infer the schema. You can use the inferred schema when configuring a streaming source for your application. When you create an application using the Kinesis Data Analytics console, the console uses this operation to infer a schema and show it in the console user interface.
ListApplicationSnapshots
Show Description Lists information about the current application snapshots.
ListApplicationVersions
Show Description Lists all the versions for the specified application, including versions that were rolled back. The response also includes a summary of the configuration associated with each version. To get the complete description of a specific application version, invoke the DescribeApplicationVersion operation. This operation is supported only for Amazon Kinesis Data Analytics for Apache Flink.
ListApplications
Show Description Returns a list of Kinesis Data Analytics applications in your account. For each application, the response includes the application name, Amazon Resource Name (ARN), and status. If you want detailed information about a specific application, use DescribeApplication.
ListTagsForResource
Show Description Retrieves the list of key-value tags assigned to the application. For more information, see Using Tagging.
RollbackApplication
Show Description Reverts the application to the previous running version. You can roll back an application if you suspect it is stuck in a transient status. You can roll back an application only if it is in the UPDATING or AUTOSCALING status. When you rollback an application, it loads state data from the last successful snapshot. If the application has no snapshots, Kinesis Data Analytics rejects the rollback request. This action is not supported for Kinesis Data Analytics for SQL applications.
StartApplication
Show Description Starts the specified Kinesis Data Analytics application. After creating an application, you must exclusively call this operation to start your application.
StopApplication
Show Description Stops the application from processing data. You can stop an application only if it is in the running status, unless you set the Force parameter to true. You can use the DescribeApplication operation to find the application status. Kinesis Data Analytics takes a snapshot when the application is stopped, unless Force is set to true.
TagResource
Show Description Adds one or more key-value tags to a Kinesis Data Analytics application. Note that the maximum number of application tags includes system tags. The maximum number of user-defined application tags is 50. For more information, see Using Tagging.
UntagResource
Show Description Removes one or more tags from a Kinesis Data Analytics application. For more information, see Using Tagging.
UpdateApplication
Show Description Updates an existing Kinesis Data Analytics application. Using this operation, you can update application code, input configuration, and output configuration. Kinesis Data Analytics updates the ApplicationVersionId each time you update your application. You cannot update the RuntimeEnvironment of an existing application. If you need to update an application's RuntimeEnvironment, you must delete the application and create it again.

Kinesisvideo Events

Service Event Name Description
kinesisvideo CreateSignalingChannel
Show Description Creates a signaling channel. CreateSignalingChannel is an asynchronous operation.
CreateStream
Show Description Creates a new Kinesis video stream. When you create a new stream, Kinesis Video Streams assigns it a version number. When you change the stream's metadata, Kinesis Video Streams updates the version. CreateStream is an asynchronous operation. For information about how the service works, see How it Works. You must have permissions for the KinesisVideo:CreateStream action.
DeleteSignalingChannel
Show Description Deletes a specified signaling channel. DeleteSignalingChannel is an asynchronous operation. If you don't specify the channel's current version, the most recent version is deleted.
DeleteStream
Show Description Deletes a Kinesis video stream and the data contained in the stream. This method marks the stream for deletion, and makes the data in the stream inaccessible immediately. To ensure that you have the latest version of the stream before deleting it, you can specify the stream version. Kinesis Video Streams assigns a version to each stream. When you update a stream, Kinesis Video Streams assigns a new version number. To get the latest stream version, use the DescribeStream API. This operation requires permission for the KinesisVideo:DeleteStream action.
DescribeSignalingChannel
Show Description Returns the most current information about the signaling channel. You must specify either the name or the Amazon Resource Name (ARN) of the channel that you want to describe.
DescribeStream
Show Description Returns the most current information about the specified stream. You must specify either the StreamName or the StreamARN.
GetDataEndpoint
Show Description Gets an endpoint for a specified stream for either reading or writing. Use this endpoint in your application to read from the specified stream (using the GetMedia or GetMediaForFragmentList operations) or write to it (using the PutMedia operation). The returned endpoint does not have the API name appended. The client needs to add the API name to the returned endpoint. In the request, specify the stream either by StreamName or StreamARN.
GetSignalingChannelEndpoint
Show Description Provides an endpoint for the specified signaling channel to send and receive messages. This API uses the SingleMasterChannelEndpointConfiguration input parameter, which consists of the Protocols and Role properties. Protocols is used to determine the communication mechanism. For example, if you specify WSS as the protocol, this API produces a secure websocket endpoint. If you specify HTTPS as the protocol, this API generates an HTTPS endpoint. Role determines the messaging permissions. A MASTER role results in this API generating an endpoint that a client can use to communicate with any of the viewers on the channel. A VIEWER role results in this API generating an endpoint that a client can use to communicate only with a MASTER.
ListSignalingChannels
Show Description Returns an array of ChannelInfo objects. Each object describes a signaling channel. To retrieve only those channels that satisfy a specific condition, you can specify a ChannelNameCondition.
ListStreams
Show Description Returns an array of StreamInfo objects. Each object describes a stream. To retrieve only streams that satisfy a specific condition, you can specify a StreamNameCondition.
ListTagsForResource
Show Description Returns a list of tags associated with the specified signaling channel.
ListTagsForStream
Show Description Returns a list of tags associated with the specified stream. In the request, you must specify either the StreamName or the StreamARN.
TagResource
Show Description Adds one or more tags to a signaling channel. A tag is a key-value pair (the value is optional) that you can define and assign to AWS resources. If you specify a tag that already exists, the tag value is replaced with the value that you specify in the request. For more information, see Using Cost Allocation Tags in the AWS Billing and Cost Management User Guide.
TagStream
Show Description Adds one or more tags to a stream. A tag is a key-value pair (the value is optional) that you can define and assign to AWS resources. If you specify a tag that already exists, the tag value is replaced with the value that you specify in the request. For more information, see Using Cost Allocation Tags in the AWS Billing and Cost Management User Guide. You must provide either the StreamName or the StreamARN. This operation requires permission for the KinesisVideo:TagStream action. Kinesis video streams support up to 50 tags.
UntagResource
Show Description Removes one or more tags from a signaling channel. In the request, specify only a tag key or keys; don't specify the value. If you specify a tag key that does not exist, it's ignored.
UntagStream
Show Description Removes one or more tags from a stream. In the request, specify only a tag key or keys; don't specify the value. If you specify a tag key that does not exist, it's ignored. In the request, you must provide the StreamName or StreamARN.
UpdateDataRetention
Show Description Increases or decreases the stream's data retention period by the value that you specify. To indicate whether you want to increase or decrease the data retention period, specify the Operation parameter in the request body. In the request, you must specify either the StreamName or the StreamARN. The retention period that you specify replaces the current value. This operation requires permission for the KinesisVideo:UpdateDataRetention action. Changing the data retention period affects the data in the stream as follows:
  • If the data retention period is increased, existing data is retained for the new retention period. For example, if the data retention period is increased from one hour to seven hours, all existing data is retained for seven hours.
  • If the data retention period is decreased, existing data is retained for the new retention period. For example, if the data retention period is decreased from seven hours to one hour, all existing data is retained for one hour, and any data older than one hour is deleted immediately.
UpdateSignalingChannel
Show Description Updates the existing signaling channel. This is an asynchronous operation and takes time to complete. If the MessageTtlSeconds value is updated (either increased or reduced), it only applies to new messages sent via this channel after it's been updated. Existing messages are still expired as per the previous MessageTtlSeconds value.

Kms Events

Service Event Name Description
kms CancelKeyDeletion
Show Description Cancels the deletion of a KMS key. When this operation succeeds, the key state of the KMS key is Disabled. To enable the KMS key, use EnableKey. For more information about scheduling and canceling deletion of a KMS key, see Deleting KMS keys in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:CancelKeyDeletion (key policy) Related operations: ScheduleKeyDeletion
ConnectCustomKeyStore
Show Description Connects or reconnects a custom key store to its associated CloudHSM cluster. The custom key store must be connected before you can create KMS keys in the key store or use the KMS keys it contains. You can disconnect and reconnect a custom key store at any time. To connect a custom key store, its associated CloudHSM cluster must have at least one active HSM. To get the number of active HSMs in a cluster, use the DescribeClusters operation. To add HSMs to the cluster, use the CreateHsm operation. Also, the kmsuser crypto user (CU) must not be logged into the cluster. This prevents KMS from using this account to log in. The connection process can take an extended amount of time to complete; up to 20 minutes. This operation starts the connection process, but it does not wait for it to complete. When it succeeds, this operation quickly returns an HTTP 200 response and a JSON object with no properties. However, this response does not indicate that the custom key store is connected. To get the connection state of the custom key store, use the DescribeCustomKeyStores operation. During the connection process, KMS finds the CloudHSM cluster that is associated with the custom key store, creates the connection infrastructure, connects to the cluster, logs into the CloudHSM client as the kmsuser CU, and rotates its password. The ConnectCustomKeyStore operation might fail for various reasons. To find the reason, use the DescribeCustomKeyStores operation and see the ConnectionErrorCode in the response. For help interpreting the ConnectionErrorCode, see CustomKeyStoresListEntry. To fix the failure, use the DisconnectCustomKeyStore operation to disconnect the custom key store, correct the error, use the UpdateCustomKeyStore operation if necessary, and then use ConnectCustomKeyStore again. If you are having trouble connecting or disconnecting a custom key store, see Troubleshooting a Custom Key Store in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account. Required permissions: kms:ConnectCustomKeyStore (IAM policy) Related operations
CreateAlias
CreateCustomKeyStore
Show Description Creates a custom key store that is associated with an CloudHSM cluster that you own and manage. This operation is part of the Custom Key Store feature feature in KMS, which combines the convenience and extensive integration of KMS with the isolation and control of a single-tenant key store. Before you create the custom key store, you must assemble the required elements, including an CloudHSM cluster that fulfills the requirements for a custom key store. For details about the required elements, see Assemble the Prerequisites in the Key Management Service Developer Guide. When the operation completes successfully, it returns the ID of the new custom key store. Before you can use your new custom key store, you need to use the ConnectCustomKeyStore operation to connect the new key store to its CloudHSM cluster. Even if you are not going to use your custom key store immediately, you might want to connect it to verify that all settings are correct and then disconnect it until you are ready to use it. For help with failures, see Troubleshooting a Custom Key Store in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account. Required permissions: kms:CreateCustomKeyStore (IAM policy). Related operations:
CreateGrant
Show Description Adds a grant to a KMS key. A grant is a policy instrument that allows Amazon Web Services principals to use KMS keys in cryptographic operations. It also can allow them to view a KMS key (DescribeKey) and create and manage grants. When authorizing access to a KMS key, grants are considered along with key policies and IAM policies. Grants are often used for temporary permissions because you can create one, use its permissions, and delete it without changing your key policies or IAM policies. For detailed information about grants, including grant terminology, see Using grants in the Key Management Service Developer Guide . For examples of working with grants in several programming languages, see Programming grants. The CreateGrant operation returns a GrantToken and a GrantId.
  • When you create, retire, or revoke a grant, there might be a brief delay, usually less than five minutes, until the grant is available throughout KMS. This state is known as eventual consistency. Once the grant has achieved eventual consistency, the grantee principal can use the permissions in the grant without identifying the grant. However, to use the permissions in the grant immediately, use the GrantToken that CreateGrant returns. For details, see Using a grant token in the Key Management Service Developer Guide .
  • The CreateGrant operation also returns a GrantId. You can use the GrantId and a key identifier to identify the grant in the RetireGrant and RevokeGrant operations. To find the grant ID, use the ListGrants or ListRetirableGrants operations.
The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation on a KMS key in a different Amazon Web Services account, specify the key ARN in the value of the KeyId parameter. Required permissions: kms:CreateGrant (key policy) Related operations:
CreateKey
Show Description Creates a unique customer managed KMS key in your Amazon Web Services account and Region. KMS is replacing the term customer master key (CMK) with KMS key and KMS key. The concept has not changed. To prevent breaking changes, KMS is keeping some variations of this term. You can use the CreateKey operation to create symmetric or asymmetric KMS keys.
  • Symmetric KMS keys contain a 256-bit symmetric key that never leaves KMS unencrypted. To use the KMS key, you must call KMS. You can use a symmetric KMS key to encrypt and decrypt small amounts of data, but they are typically used to generate data keys and data keys pairs. For details, see GenerateDataKey and GenerateDataKeyPair.
  • Asymmetric KMS keys can contain an RSA key pair or an Elliptic Curve (ECC) key pair. The private key in an asymmetric KMS key never leaves KMS unencrypted. However, you can use the GetPublicKey operation to download the public key so it can be used outside of KMS. KMS keys with RSA key pairs can be used to encrypt or decrypt data or sign and verify messages (but not both). KMS keys with ECC key pairs can be used only to sign and verify messages.
For information about symmetric and asymmetric KMS keys, see Using Symmetric and Asymmetric KMS keys in the Key Management Service Developer Guide. To create different types of KMS keys, use the following guidance:
Asymmetric KMS keys
To create an asymmetric KMS key, use the KeySpec parameter to specify the type of key material in the KMS key. Then, use the KeyUsage parameter to determine whether the KMS key will be used to encrypt and decrypt or sign and verify. You can't change these properties after the KMS key is created.
Symmetric KMS keys
When creating a symmetric KMS key, you don't need to specify the KeySpec or KeyUsage parameters. The default value for KeySpec, SYMMETRIC_DEFAULT, and the default value for KeyUsage, ENCRYPT_DECRYPT, are the only valid values for symmetric KMS keys.
Multi-Region primary keys
Imported key material
To create a multi-Region primary key in the local Amazon Web Services Region, use the MultiRegion parameter with a value of True. To create a multi-Region replica key, that is, a KMS key with the same key ID and key material as a primary key, but in a different Amazon Web Services Region, use the ReplicateKey operation. To change a replica key to a primary key, and its primary key to a replica key, use the UpdatePrimaryRegion operation. This operation supports multi-Region keys, an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide. You can create symmetric and asymmetric multi-Region keys and multi-Region keys with imported key material. You cannot create multi-Region keys in a custom key store.
To import your own key material, begin by creating a symmetric KMS key with no key material. To do this, use the Origin parameter of CreateKey with a value of EXTERNAL. Next, use GetParametersForImport operation to get a public key and import token, and use the public key to encrypt your key material. Then, use ImportKeyMaterial with your import token to import the key material. For step-by-step instructions, see Importing Key Material in the Key Management Service Developer Guide . You cannot import the key material into an asymmetric KMS key. To create a multi-Region primary key with imported key material, use the Origin parameter of CreateKey with a value of EXTERNAL and the MultiRegion parameter with a value of True. To create replicas of the multi-Region primary key, use the ReplicateKey operation. For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide.
Custom key store
To create a symmetric KMS key in a custom key store, use the CustomKeyStoreId parameter to specify the custom key store. You must also use the Origin parameter with a value of AWS_CLOUDHSM. The CloudHSM cluster that is associated with the custom key store must have at least two active HSMs in different Availability Zones in the Amazon Web Services Region. You cannot create an asymmetric KMS key in a custom key store. For information about custom key stores in KMS see Using Custom Key Stores in the Key Management Service Developer Guide .
Cross-account use: No. You cannot use this operation to create a KMS key in a different Amazon Web Services account. Required permissions: kms:CreateKey (IAM policy). To use the Tags parameter, kms:TagResource (IAM policy). For examples and information about related permissions, see Allow a user to create KMS keys in the Key Management Service Developer Guide. Related operations:
Decrypt
Show Description Decrypts ciphertext that was encrypted by a KMS key using any of the following operations: You can use this operation to decrypt ciphertext that was encrypted under a symmetric or asymmetric KMS key. When the KMS key is asymmetric, you must specify the KMS key and the encryption algorithm that was used to encrypt the ciphertext. For information about symmetric and asymmetric KMS keys, see Using Symmetric and Asymmetric KMS keys in the Key Management Service Developer Guide. The Decrypt operation also decrypts ciphertext that was encrypted outside of KMS by the public key in an KMS asymmetric KMS key. However, it cannot decrypt ciphertext produced by other libraries, such as the Amazon Web Services Encryption SDK or Amazon S3 client-side encryption. These libraries return a ciphertext format that is incompatible with KMS. If the ciphertext was encrypted under a symmetric KMS key, the KeyId parameter is optional. KMS can get this information from metadata that it adds to the symmetric ciphertext blob. This feature adds durability to your implementation by ensuring that authorized users can decrypt ciphertext decades after it was encrypted, even if they've lost track of the key ID. However, specifying the KMS key is always recommended as a best practice. When you use the KeyId parameter to specify a KMS key, KMS only uses the KMS key you specify. If the ciphertext was encrypted under a different KMS key, the Decrypt operation fails. This practice ensures that you use the KMS key that you intend. Whenever possible, use key policies to give users permission to call the Decrypt operation on a particular KMS key, instead of using IAM policies. Otherwise, you might create an IAM user policy that gives the user Decrypt permission on all KMS keys. This user could decrypt ciphertext that was encrypted by KMS keys in other accounts if the key policy for the cross-account KMS key permits it. If you must use an IAM policy for Decrypt permissions, limit the user to particular KMS keys or particular trusted accounts. For details, see Best practices for IAM policies in the Key Management Service Developer Guide. Applications in Amazon Web Services Nitro Enclaves can call this operation by using the Amazon Web Services Nitro Enclaves Development Kit. For information about the supporting parameters, see How Amazon Web Services Nitro Enclaves use KMS in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:Decrypt (key policy) Related operations:
DeleteAlias
DeleteCustomKeyStore
Show Description Deletes a custom key store. This operation does not delete the CloudHSM cluster that is associated with the custom key store, or affect any users or keys in the cluster. The custom key store that you delete cannot contain any KMS KMS keys. Before deleting the key store, verify that you will never need to use any of the KMS keys in the key store for any cryptographic operations. Then, use ScheduleKeyDeletion to delete the KMS keys from the key store. When the scheduled waiting period expires, the ScheduleKeyDeletion operation deletes the KMS keys. Then it makes a best effort to delete the key material from the associated cluster. However, you might need to manually delete the orphaned key material from the cluster and its backups. After all KMS keys are deleted from KMS, use DisconnectCustomKeyStore to disconnect the key store from KMS. Then, you can delete the custom key store. Instead of deleting the custom key store, consider using DisconnectCustomKeyStore to disconnect it from KMS. While the key store is disconnected, you cannot create or use the KMS keys in the key store. But, you do not need to delete KMS keys and you can reconnect a disconnected custom key store at any time. If the operation succeeds, it returns a JSON object with no properties. This operation is part of the Custom Key Store feature feature in KMS, which combines the convenience and extensive integration of KMS with the isolation and control of a single-tenant key store. Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account. Required permissions: kms:DeleteCustomKeyStore (IAM policy) Related operations:
DeleteImportedKeyMaterial
DescribeCustomKeyStores
Show Description Gets information about custom key stores in the account and Region. This operation is part of the Custom Key Store feature feature in KMS, which combines the convenience and extensive integration of KMS with the isolation and control of a single-tenant key store. By default, this operation returns information about all custom key stores in the account and Region. To get only information about a particular custom key store, use either the CustomKeyStoreName or CustomKeyStoreId parameter (but not both). To determine whether the custom key store is connected to its CloudHSM cluster, use the ConnectionState element in the response. If an attempt to connect the custom key store failed, the ConnectionState value is FAILED and the ConnectionErrorCode element in the response indicates the cause of the failure. For help interpreting the ConnectionErrorCode, see CustomKeyStoresListEntry. Custom key stores have a DISCONNECTED connection state if the key store has never been connected or you use the DisconnectCustomKeyStore operation to disconnect it. If your custom key store state is CONNECTED but you are having trouble using it, make sure that its associated CloudHSM cluster is active and contains the minimum number of HSMs required for the operation, if any. For help repairing your custom key store, see the Troubleshooting Custom Key Stores topic in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account. Required permissions: kms:DescribeCustomKeyStores (IAM policy) Related operations:
DescribeKey
Show Description Provides detailed information about a KMS key. You can run DescribeKey on a customer managed key or an Amazon Web Services managed key. This detailed information includes the key ARN, creation date (and deletion date, if applicable), the key state, and the origin and expiration date (if any) of the key material. It includes fields, like KeySpec, that help you distinguish symmetric from asymmetric KMS keys. It also provides information that is particularly important to asymmetric keys, such as the key usage (encryption or signing) and the encryption algorithms or signing algorithms that the KMS key supports. For KMS keys in custom key stores, it includes information about the custom key store, such as the key store ID and the CloudHSM cluster ID. For multi-Region keys, it displays the primary key and all related replica keys. DescribeKey does not return the following information:
  • Aliases associated with the KMS key. To get this information, use ListAliases.
  • Whether automatic key rotation is enabled on the KMS key. To get this information, use GetKeyRotationStatus. Also, some key states prevent a KMS key from being automatically rotated. For details, see How Automatic Key Rotation Works in Key Management Service Developer Guide.
  • Tags on the KMS key. To get this information, use ListResourceTags.
  • Key policies and grants on the KMS key. To get this information, use GetKeyPolicy and ListGrants.
If you call the DescribeKey operation on a predefined Amazon Web Services alias, that is, an Amazon Web Services alias with no key ID, KMS creates an Amazon Web Services managed key. Then, it associates the alias with the new KMS key, and returns the KeyId and Arn of the new KMS key in the response. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:DescribeKey (key policy) Related operations:
DisableKey
DisableKeyRotation
DisconnectCustomKeyStore
Show Description Disconnects the custom key store from its associated CloudHSM cluster. While a custom key store is disconnected, you can manage the custom key store and its KMS keys, but you cannot create or use KMS keys in the custom key store. You can reconnect the custom key store at any time. While a custom key store is disconnected, all attempts to create KMS keys in the custom key store or to use existing KMS keys in cryptographic operations will fail. This action can prevent users from storing and accessing sensitive data.

To find the connection state of a custom key store, use the DescribeCustomKeyStores operation. To reconnect a custom key store, use the ConnectCustomKeyStore operation. If the operation succeeds, it returns a JSON object with no properties. This operation is part of the Custom Key Store feature feature in KMS, which combines the convenience and extensive integration of KMS with the isolation and control of a single-tenant key store. Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account. Required permissions: kms:DisconnectCustomKeyStore (IAM policy) Related operations:

EnableKey
EnableKeyRotation
Encrypt
Show Description Encrypts plaintext into ciphertext by using a KMS key. The Encrypt operation has two primary use cases:
  • You can encrypt small amounts of arbitrary data, such as a personal identifier or database password, or other sensitive information.
  • You can use the Encrypt operation to move encrypted data from one Amazon Web Services Region to another. For example, in Region A, generate a data key and use the plaintext key to encrypt your data. Then, in Region A, use the Encrypt operation to encrypt the plaintext data key under a KMS key in Region B. Now, you can move the encrypted data and the encrypted data key to Region B. When necessary, you can decrypt the encrypted data key and the encrypted data entirely within in Region B.
You don't need to use the Encrypt operation to encrypt a data key. The GenerateDataKey and GenerateDataKeyPair operations return a plaintext data key and an encrypted copy of that data key. When you encrypt data, you must specify a symmetric or asymmetric KMS key to use in the encryption operation. The KMS key must have a KeyUsage value of ENCRYPT_DECRYPT. To find the KeyUsage of a KMS key, use the DescribeKey operation. If you use a symmetric KMS key, you can use an encryption context to add additional security to your encryption operation. If you specify an EncryptionContext when encrypting data, you must specify the same encryption context (a case-sensitive exact match) when decrypting the data. Otherwise, the request to decrypt fails with an InvalidCiphertextException. For more information, see Encryption Context in the Key Management Service Developer Guide. If you specify an asymmetric KMS key, you must also specify the encryption algorithm. The algorithm must be compatible with the KMS key type. When you use an asymmetric KMS key to encrypt or reencrypt data, be sure to record the KMS key and encryption algorithm that you choose. You will be required to provide the same KMS key and encryption algorithm when you decrypt the data. If the KMS key and algorithm do not match the values used to encrypt the data, the decrypt operation fails. You are not required to supply the key ID and encryption algorithm when you decrypt with symmetric KMS keys because KMS stores this information in the ciphertext blob. KMS cannot store metadata in ciphertext generated with asymmetric keys. The standard format for asymmetric key ciphertext does not include configurable fields. The maximum size of the data that you can encrypt varies with the type of KMS key and the encryption algorithm that you choose.
  • Symmetric KMS keys
    • SYMMETRIC_DEFAULT: 4096 bytes
  • RSA_2048
    • RSAES_OAEP_SHA_1: 214 bytes
    • RSAES_OAEP_SHA_256: 190 bytes
  • RSA_3072
    • RSAES_OAEP_SHA_1: 342 bytes
    • RSAES_OAEP_SHA_256: 318 bytes
  • RSA_4096
    • RSAES_OAEP_SHA_1: 470 bytes
    • RSAES_OAEP_SHA_256: 446 bytes
The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:Encrypt (key policy) Related operations:
GenerateDataKey
Show Description Generates a unique symmetric data key for client-side encryption. This operation returns a plaintext copy of the data key and a copy that is encrypted under a KMS key that you specify. You can use the plaintext key to encrypt your data outside of KMS and store the encrypted data key with the encrypted data. GenerateDataKey returns a unique data key for each request. The bytes in the plaintext key are not related to the caller or the KMS key. To generate a data key, specify the symmetric KMS key that will be used to encrypt the data key. You cannot use an asymmetric KMS key to generate data keys. To get the type of your KMS key, use the DescribeKey operation. You must also specify the length of the data key. Use either the KeySpec or NumberOfBytes parameters (but not both). For 128-bit and 256-bit data keys, use the KeySpec parameter. To get only an encrypted copy of the data key, use GenerateDataKeyWithoutPlaintext. To generate an asymmetric data key pair, use the GenerateDataKeyPair or GenerateDataKeyPairWithoutPlaintext operation. To get a cryptographically secure random byte string, use GenerateRandom. You can use the optional encryption context to add additional security to the encryption operation. If you specify an EncryptionContext, you must specify the same encryption context (a case-sensitive exact match) when decrypting the encrypted data key. Otherwise, the request to decrypt fails with an InvalidCiphertextException. For more information, see Encryption Context in the Key Management Service Developer Guide. Applications in Amazon Web Services Nitro Enclaves can call this operation by using the Amazon Web Services Nitro Enclaves Development Kit. For information about the supporting parameters, see How Amazon Web Services Nitro Enclaves use KMS in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. How to use your data key We recommend that you use the following pattern to encrypt data locally in your application. You can write your own code or use a client-side encryption library, such as the Amazon Web Services Encryption SDK, the Amazon DynamoDB Encryption Client, or Amazon S3 client-side encryption to do these tasks for you. To encrypt data outside of KMS:
  1. Use the GenerateDataKey operation to get a data key.
  2. Use the plaintext data key (in the Plaintext field of the response) to encrypt your data outside of KMS. Then erase the plaintext data key from memory.
  3. Store the encrypted data key (in the CiphertextBlob field of the response) with the encrypted data.
To decrypt data outside of KMS:
  1. Use the Decrypt operation to decrypt the encrypted data key. The operation returns a plaintext copy of the data key.
  2. Use the plaintext data key to decrypt data outside of KMS, then erase the plaintext data key from memory.
Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:GenerateDataKey (key policy) Related operations:
GenerateDataKeyPair
Show Description Generates a unique asymmetric data key pair. The GenerateDataKeyPair operation returns a plaintext public key, a plaintext private key, and a copy of the private key that is encrypted under the symmetric KMS key you specify. You can use the data key pair to perform asymmetric cryptography and implement digital signatures outside of KMS. You can use the public key that GenerateDataKeyPair returns to encrypt data or verify a signature outside of KMS. Then, store the encrypted private key with the data. When you are ready to decrypt data or sign a message, you can use the Decrypt operation to decrypt the encrypted private key. To generate a data key pair, you must specify a symmetric KMS key to encrypt the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the DescribeKey operation. Use the KeyPairSpec parameter to choose an RSA or Elliptic Curve (ECC) data key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for either encryption or signing, but not both. However, KMS cannot enforce any restrictions on the use of data key pairs outside of KMS. If you are using the data key pair to encrypt data, or for any operation where you don't immediately need a private key, consider using the GenerateDataKeyPairWithoutPlaintext operation. GenerateDataKeyPairWithoutPlaintext returns a plaintext public key and an encrypted private key, but omits the plaintext private key that you need only to decrypt ciphertext or sign a message. Later, when you need to decrypt the data or sign a message, use the Decrypt operation to decrypt the encrypted private key in the data key pair. GenerateDataKeyPair returns a unique data key pair for each request. The bytes in the keys are not related to the caller or the KMS key that is used to encrypt the private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as specified in RFC 5280. The private key is a DER-encoded PKCS8 PrivateKeyInfo, as specified in RFC 5958. You can use the optional encryption context to add additional security to the encryption operation. If you specify an EncryptionContext, you must specify the same encryption context (a case-sensitive exact match) when decrypting the encrypted data key. Otherwise, the request to decrypt fails with an InvalidCiphertextException. For more information, see Encryption Context in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:GenerateDataKeyPair (key policy) Related operations:
GenerateDataKeyPairWithoutPlaintext
Show Description Generates a unique asymmetric data key pair. The GenerateDataKeyPairWithoutPlaintext operation returns a plaintext public key and a copy of the private key that is encrypted under the symmetric KMS key you specify. Unlike GenerateDataKeyPair, this operation does not return a plaintext private key. You can use the public key that GenerateDataKeyPairWithoutPlaintext returns to encrypt data or verify a signature outside of KMS. Then, store the encrypted private key with the data. When you are ready to decrypt data or sign a message, you can use the Decrypt operation to decrypt the encrypted private key. To generate a data key pair, you must specify a symmetric KMS key to encrypt the private key in a data key pair. You cannot use an asymmetric KMS key or a KMS key in a custom key store. To get the type and origin of your KMS key, use the DescribeKey operation. Use the KeyPairSpec parameter to choose an RSA or Elliptic Curve (ECC) data key pair. KMS recommends that your use ECC key pairs for signing, and use RSA key pairs for either encryption or signing, but not both. However, KMS cannot enforce any restrictions on the use of data key pairs outside of KMS. GenerateDataKeyPairWithoutPlaintext returns a unique data key pair for each request. The bytes in the key are not related to the caller or KMS key that is used to encrypt the private key. The public key is a DER-encoded X.509 SubjectPublicKeyInfo, as specified in RFC 5280. You can use the optional encryption context to add additional security to the encryption operation. If you specify an EncryptionContext, you must specify the same encryption context (a case-sensitive exact match) when decrypting the encrypted data key. Otherwise, the request to decrypt fails with an InvalidCiphertextException. For more information, see Encryption Context in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:GenerateDataKeyPairWithoutPlaintext (key policy) Related operations:
GenerateDataKeyWithoutPlaintext
Show Description Generates a unique symmetric data key. This operation returns a data key that is encrypted under a KMS key that you specify. To request an asymmetric data key pair, use the GenerateDataKeyPair or GenerateDataKeyPairWithoutPlaintext operations. GenerateDataKeyWithoutPlaintext is identical to the GenerateDataKey operation except that returns only the encrypted copy of the data key. This operation is useful for systems that need to encrypt data at some point, but not immediately. When you need to encrypt the data, you call the Decrypt operation on the encrypted copy of the key. It's also useful in distributed systems with different levels of trust. For example, you might store encrypted data in containers. One component of your system creates new containers and stores an encrypted data key with each container. Then, a different component puts the data into the containers. That component first decrypts the data key, uses the plaintext data key to encrypt data, puts the encrypted data into the container, and then destroys the plaintext data key. In this system, the component that creates the containers never sees the plaintext data key. GenerateDataKeyWithoutPlaintext returns a unique data key for each request. The bytes in the keys are not related to the caller or KMS key that is used to encrypt the private key. To generate a data key, you must specify the symmetric KMS key that is used to encrypt the data key. You cannot use an asymmetric KMS key to generate a data key. To get the type of your KMS key, use the DescribeKey operation. If the operation succeeds, you will find the encrypted copy of the data key in the CiphertextBlob field. You can use the optional encryption context to add additional security to the encryption operation. If you specify an EncryptionContext, you must specify the same encryption context (a case-sensitive exact match) when decrypting the encrypted data key. Otherwise, the request to decrypt fails with an InvalidCiphertextException. For more information, see Encryption Context in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:GenerateDataKeyWithoutPlaintext (key policy) Related operations:
GenerateRandom
Show Description Returns a random byte string that is cryptographically secure. By default, the random byte string is generated in KMS. To generate the byte string in the CloudHSM cluster that is associated with a custom key store, specify the custom key store ID. Applications in Amazon Web Services Nitro Enclaves can call this operation by using the Amazon Web Services Nitro Enclaves Development Kit. For information about the supporting parameters, see How Amazon Web Services Nitro Enclaves use KMS in the Key Management Service Developer Guide. For more information about entropy and random number generation, see Key Management Service Cryptographic Details. Required permissions: kms:GenerateRandom (IAM policy)
GetKeyPolicy
Show Description Gets a key policy attached to the specified KMS key. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:GetKeyPolicy (key policy) Related operations: PutKeyPolicy
GetKeyRotationStatus
Show Description Gets a Boolean value that indicates whether automatic rotation of the key material is enabled for the specified KMS key. You cannot enable automatic rotation of asymmetric KMS keys, KMS keys with imported key material, or KMS keys in a custom key store. To enable or disable automatic rotation of a set of related multi-Region keys, set the property on the primary key. The key rotation status for these KMS keys is always false. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide.
  • Disabled: The key rotation status does not change when you disable a KMS key. However, while the KMS key is disabled, KMS does not rotate the key material.
  • Pending deletion: While a KMS key is pending deletion, its key rotation status is false and KMS does not rotate the key material. If you cancel the deletion, the original key rotation status is restored.
Cross-account use: Yes. To perform this operation on a KMS key in a different Amazon Web Services account, specify the key ARN in the value of the KeyId parameter. Required permissions: kms:GetKeyRotationStatus (key policy) Related operations:
GetParametersForImport
Show Description Returns the items you need to import key material into a symmetric, customer managed KMS key. For more information about importing key material into KMS, see Importing Key Material in the Key Management Service Developer Guide. This operation returns a public key and an import token. Use the public key to encrypt the symmetric key material. Store the import token to send with a subsequent ImportKeyMaterial request. You must specify the key ID of the symmetric KMS key into which you will import key material. This KMS key's Origin must be EXTERNAL. You must also specify the wrapping algorithm and type of wrapping key (public key) that you will use to encrypt the key material. You cannot perform this operation on an asymmetric KMS key or on any KMS key in a different Amazon Web Services account. To import key material, you must use the public key and import token from the same response. These items are valid for 24 hours. The expiration date and time appear in the GetParametersForImport response. You cannot use an expired token in an ImportKeyMaterial request. If your key and token expire, send another GetParametersForImport request. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:GetParametersForImport (key policy) Related operations:
GetPublicKey
Show Description Returns the public key of an asymmetric KMS key. Unlike the private key of a asymmetric KMS key, which never leaves KMS unencrypted, callers with kms:GetPublicKey permission can download the public key of an asymmetric KMS key. You can share the public key to allow others to encrypt messages and verify signatures outside of KMS. For information about symmetric and asymmetric KMS keys, see Using Symmetric and Asymmetric KMS keys in the Key Management Service Developer Guide. You do not need to download the public key. Instead, you can use the public key within KMS by calling the Encrypt, ReEncrypt, or Verify operations with the identifier of an asymmetric KMS key. When you use the public key within KMS, you benefit from the authentication, authorization, and logging that are part of every KMS operation. You also reduce of risk of encrypting data that cannot be decrypted. These features are not effective outside of KMS. For details, see Special Considerations for Downloading Public Keys. To help you use the public key safely outside of KMS, GetPublicKey returns important information about the public key in the response, including:
  • KeySpec: The type of key material in the public key, such as RSA_4096 or ECC_NIST_P521.
  • KeyUsage: Whether the key is used for encryption or signing.
  • EncryptionAlgorithms or SigningAlgorithms: A list of the encryption algorithms or the signing algorithms for the key.
Although KMS cannot enforce these restrictions on external operations, it is crucial that you use this information to prevent the public key from being used improperly. For example, you can prevent a public signing key from being used encrypt data, or prevent a public key from being used with an encryption algorithm that is not supported by KMS. You can also avoid errors, such as using the wrong signing algorithm in a verification operation. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:GetPublicKey (key policy) Related operations: CreateKey
ImportKeyMaterial
Show Description Imports key material into an existing symmetric KMS KMS key that was created without key material. After you successfully import key material into a KMS key, you can reimport the same key material into that KMS key, but you cannot import different key material. You cannot perform this operation on an asymmetric KMS key or on any KMS key in a different Amazon Web Services account. For more information about creating KMS keys with no key material and then importing key material, see Importing Key Material in the Key Management Service Developer Guide. Before using this operation, call GetParametersForImport. Its response includes a public key and an import token. Use the public key to encrypt the key material. Then, submit the import token from the same GetParametersForImport response. When calling this operation, you must specify the following values:
  • The key ID or key ARN of a KMS key with no key material. Its Origin must be EXTERNAL. To create a KMS key with no key material, call CreateKey and set the value of its Origin parameter to EXTERNAL. To get the Origin of a KMS key, call DescribeKey.)
  • The encrypted key material. To get the public key to encrypt the key material, call GetParametersForImport.
  • The import token that GetParametersForImport returned. You must use a public key and token from the same GetParametersForImport response.
  • Whether the key material expires and if so, when. If you set an expiration date, KMS deletes the key material from the KMS key on the specified date, and the KMS key becomes unusable. To use the KMS key again, you must reimport the same key material. The only way to change an expiration date is by reimporting the same key material and specifying a new expiration date.
When this operation is successful, the key state of the KMS key changes from PendingImport to Enabled, and you can use the KMS key. If this operation fails, use the exception to help determine the problem. If the error is related to the key material, the import token, or wrapping key, use GetParametersForImport to get a new public key and import token for the KMS key and repeat the import procedure. For help, see How To Import Key Material in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ImportKeyMaterial (key policy) Related operations:
ListAliases
Show Description Gets a list of aliases in the caller's Amazon Web Services account and region. For more information about aliases, see CreateAlias. By default, the ListAliases operation returns all aliases in the account and region. To get only the aliases associated with a particular KMS key, use the KeyId parameter. The ListAliases response can include aliases that you created and associated with your customer managed keys, and aliases that Amazon Web Services created and associated with Amazon Web Services managed keys in your account. You can recognize Amazon Web Services aliases because their names have the format aws/<service-name>, such as aws/dynamodb. The response might also include aliases that have no TargetKeyId field. These are predefined aliases that Amazon Web Services has created but has not yet associated with a KMS key. Aliases that Amazon Web Services creates in your account, including predefined aliases, do not count against your KMS aliases quota. Cross-account use: No. ListAliases does not return aliases in other Amazon Web Services accounts. Required permissions: kms:ListAliases (IAM policy) For details, see Controlling access to aliases in the Key Management Service Developer Guide. Related operations:
ListGrants
Show Description Gets a list of all grants for the specified KMS key. You must specify the KMS key in all requests. You can filter the grant list by grant ID or grantee principal. For detailed information about grants, including grant terminology, see Using grants in the Key Management Service Developer Guide . For examples of working with grants in several programming languages, see Programming grants. The GranteePrincipal field in the ListGrants response usually contains the user or role designated as the grantee principal in the grant. However, when the grantee principal in the grant is an Amazon Web Services service, the GranteePrincipal field contains the service principal, which might represent several different grantee principals. Cross-account use: Yes. To perform this operation on a KMS key in a different Amazon Web Services account, specify the key ARN in the value of the KeyId parameter. Required permissions: kms:ListGrants (key policy) Related operations:
ListKeyPolicies
Show Description Gets the names of the key policies that are attached to a KMS key. This operation is designed to get policy names that you can use in a GetKeyPolicy operation. However, the only valid policy name is default. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ListKeyPolicies (key policy) Related operations:
ListKeys
Show Description Gets a list of all KMS keys in the caller's Amazon Web Services account and Region. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ListKeys (IAM policy) Related operations:
ListResourceTags
Show Description Returns all tags on the specified KMS key. For general information about tags, including the format and syntax, see Tagging Amazon Web Services resources in the Amazon Web Services General Reference. For information about using tags in KMS, see Tagging keys. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ListResourceTags (key policy) Related operations:
ListRetirableGrants
Show Description Returns information about all grants in the Amazon Web Services account and Region that have the specified retiring principal. You can specify any principal in your Amazon Web Services account. The grants that are returned include grants for KMS keys in your Amazon Web Services account and other Amazon Web Services accounts. You might use this operation to determine which grants you may retire. To retire a grant, use the RetireGrant operation. For detailed information about grants, including grant terminology, see Using grants in the Key Management Service Developer Guide . For examples of working with grants in several programming languages, see Programming grants. Cross-account use: You must specify a principal in your Amazon Web Services account. However, this operation can return grants in any Amazon Web Services account. You do not need kms:ListRetirableGrants permission (or any other additional permission) in any Amazon Web Services account other than your own. Required permissions: kms:ListRetirableGrants (IAM policy) in your Amazon Web Services account. Related operations:
PutKeyPolicy
ReEncrypt
Show Description Decrypts ciphertext and then reencrypts it entirely within KMS. You can use this operation to change the KMS key under which data is encrypted, such as when you manually rotate a KMS key or change the KMS key that protects a ciphertext. You can also use it to reencrypt ciphertext under the same KMS key, such as to change the encryption context of a ciphertext. The ReEncrypt operation can decrypt ciphertext that was encrypted by using an KMS KMS key in an KMS operation, such as Encrypt or GenerateDataKey. It can also decrypt ciphertext that was encrypted by using the public key of an asymmetric KMS key outside of KMS. However, it cannot decrypt ciphertext produced by other libraries, such as the Amazon Web Services Encryption SDK or Amazon S3 client-side encryption. These libraries return a ciphertext format that is incompatible with KMS. When you use the ReEncrypt operation, you need to provide information for the decrypt operation and the subsequent encrypt operation.
  • If your ciphertext was encrypted under an asymmetric KMS key, you must use the SourceKeyId parameter to identify the KMS key that encrypted the ciphertext. You must also supply the encryption algorithm that was used. This information is required to decrypt the data.
  • If your ciphertext was encrypted under a symmetric KMS key, the SourceKeyId parameter is optional. KMS can get this information from metadata that it adds to the symmetric ciphertext blob. This feature adds durability to your implementation by ensuring that authorized users can decrypt ciphertext decades after it was encrypted, even if they've lost track of the key ID. However, specifying the source KMS key is always recommended as a best practice. When you use the SourceKeyId parameter to specify a KMS key, KMS uses only the KMS key you specify. If the ciphertext was encrypted under a different KMS key, the ReEncrypt operation fails. This practice ensures that you use the KMS key that you intend.
  • To reencrypt the data, you must use the DestinationKeyId parameter specify the KMS key that re-encrypts the data after it is decrypted. You can select a symmetric or asymmetric KMS key. If the destination KMS key is an asymmetric KMS key, you must also provide the encryption algorithm. The algorithm that you choose must be compatible with the KMS key. When you use an asymmetric KMS key to encrypt or reencrypt data, be sure to record the KMS key and encryption algorithm that you choose. You will be required to provide the same KMS key and encryption algorithm when you decrypt the data. If the KMS key and algorithm do not match the values used to encrypt the data, the decrypt operation fails. You are not required to supply the key ID and encryption algorithm when you decrypt with symmetric KMS keys because KMS stores this information in the ciphertext blob. KMS cannot store metadata in ciphertext generated with asymmetric keys. The standard format for asymmetric key ciphertext does not include configurable fields.
The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. The source KMS key and destination KMS key can be in different Amazon Web Services accounts. Either or both KMS keys can be in a different account than the caller. To specify a KMS key in a different account, you must use its key ARN or alias ARN. Required permissions: To permit reencryption from or to a KMS key, include the "kms:ReEncrypt*" permission in your key policy. This permission is automatically included in the key policy when you use the console to create a KMS key. But you must include it manually when you create a KMS key programmatically or when you use the PutKeyPolicy operation to set a key policy. Related operations:
ReplicateKey
Show Description Replicates a multi-Region key into the specified Region. This operation creates a multi-Region replica key based on a multi-Region primary key in a different Region of the same Amazon Web Services partition. You can create multiple replicas of a primary key, but each must be in a different Region. To create a multi-Region primary key, use the CreateKey operation. This operation supports multi-Region keys, an KMS feature that lets you create multiple interoperable KMS keys in different Amazon Web Services Regions. Because these KMS keys have the same key ID, key material, and other metadata, you can use them interchangeably to encrypt data in one Amazon Web Services Region and decrypt it in a different Amazon Web Services Region without re-encrypting the data or making a cross-Region call. For more information about multi-Region keys, see Using multi-Region keys in the Key Management Service Developer Guide. A replica key is a fully-functional KMS key that can be used independently of its primary and peer replica keys. A primary key and its replica keys share properties that make them interoperable. They have the same key ID and key material. They also have the same key spec, key usage, key material origin, and automatic key rotation status. KMS automatically synchronizes these shared properties among related multi-Region keys. All other properties of a replica key can differ, including its key policy, tags, aliases, and key state. KMS pricing and quotas for KMS keys apply to each primary key and replica key. When this operation completes, the new replica key has a transient key state of Creating. This key state changes to Enabled (or PendingImport) after a few seconds when the process of creating the new replica key is complete. While the key state is Creating, you can manage key, but you cannot yet use it in cryptographic operations. If you are creating and using the replica key programmatically, retry on KMSInvalidStateException or call DescribeKey to check its KeyState value before using it. For details about the Creating key state, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. The CloudTrail log of a ReplicateKey operation records a ReplicateKey operation in the primary key's Region and a CreateKey operation in the replica key's Region. If you replicate a multi-Region primary key with imported key material, the replica key is created with no key material. You must import the same key material that you imported into the primary key. For details, see Importing key material into multi-Region keys in the Key Management Service Developer Guide. To convert a replica key to a primary key, use the UpdatePrimaryRegion operation. ReplicateKey uses different default values for the KeyPolicy and Tags parameters than those used in the KMS console. For details, see the parameter descriptions. Cross-account use: No. You cannot use this operation to create a replica key in a different Amazon Web Services account. Required permissions:
  • kms:ReplicateKey on the primary key (in the primary key's Region). Include this permission in the primary key's key policy.
  • kms:CreateKey in an IAM policy in the replica Region.
  • To use the Tags parameter, kms:TagResource in an IAM policy in the replica Region.
Related operations
RetireGrant
RevokeGrant
ScheduleKeyDeletion
Show Description Schedules the deletion of a KMS key. By default, KMS applies a waiting period of 30 days, but you can specify a waiting period of 7-30 days. When this operation is successful, the key state of the KMS key changes to PendingDeletion and the key can't be used in any cryptographic operations. It remains in this state for the duration of the waiting period. Before the waiting period ends, you can use CancelKeyDeletion to cancel the deletion of the KMS key. After the waiting period ends, KMS deletes the KMS key, its key material, and all KMS data associated with it, including all aliases that refer to it. Deleting a KMS key is a destructive and potentially dangerous operation. When a KMS key is deleted, all data that was encrypted under the KMS key is unrecoverable. (The only exception is a multi-Region replica key.) To prevent the use of a KMS key without deleting it, use DisableKey. If you schedule deletion of a KMS key from a custom key store, when the waiting period expires, ScheduleKeyDeletion deletes the KMS key from KMS. Then KMS makes a best effort to delete the key material from the associated CloudHSM cluster. However, you might need to manually delete the orphaned key material from the cluster and its backups. You can schedule the deletion of a multi-Region primary key and its replica keys at any time. However, KMS will not delete a multi-Region primary key with existing replica keys. If you schedule the deletion of a primary key with replicas, its key state changes to PendingReplicaDeletion and it cannot be replicated or used in cryptographic operations. This status can continue indefinitely. When the last of its replicas keys is deleted (not just scheduled), the key state of the primary key changes to PendingDeletion and its waiting period (PendingWindowInDays) begins. For details, see Deleting multi-Region keys in the Key Management Service Developer Guide. For more information about scheduling a KMS key for deletion, see Deleting KMS keys in the Key Management Service Developer Guide. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ScheduleKeyDeletion (key policy) Related operations
Sign
Show Description Creates a digital signature for a message or message digest by using the private key in an asymmetric KMS key. To verify the signature, use the Verify operation, or use the public key in the same asymmetric KMS key outside of KMS. For information about symmetric and asymmetric KMS keys, see Using Symmetric and Asymmetric KMS keys in the Key Management Service Developer Guide. Digital signatures are generated and verified by using asymmetric key pair, such as an RSA or ECC pair that is represented by an asymmetric KMS key. The key owner (or an authorized user) uses their private key to sign a message. Anyone with the public key can verify that the message was signed with that particular private key and that the message hasn't changed since it was signed. To use the Sign operation, provide the following information:
  • Use the KeyId parameter to identify an asymmetric KMS key with a KeyUsage value of SIGN_VERIFY. To get the KeyUsage value of a KMS key, use the DescribeKey operation. The caller must have kms:Sign permission on the KMS key.
  • Use the Message parameter to specify the message or message digest to sign. You can submit messages of up to 4096 bytes. To sign a larger message, generate a hash digest of the message, and then provide the hash digest in the Message parameter. To indicate whether the message is a full message or a digest, use the MessageType parameter.
  • Choose a signing algorithm that is compatible with the KMS key.
When signing a message, be sure to record the KMS key and the signing algorithm. This information is required to verify the signature. To verify the signature that this operation generates, use the Verify operation. Or use the GetPublicKey operation to download the public key and then use the public key to verify the signature outside of KMS. The KMS key that you use for this operation must be in a compatible key state. For details, see Key state: Effect on your KMS key in the Key Management Service Developer Guide. Cross-account use: Yes. To perform this operation with a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN in the value of the KeyId parameter. Required permissions: kms:Sign (key policy) Related operations: Verify
TagResource
UntagResource
UpdateAlias
UpdateCustomKeyStore
Show Description Changes the properties of a custom key store. Use the CustomKeyStoreId parameter to identify the custom key store you want to edit. Use the remaining parameters to change the properties of the custom key store. You can only update a custom key store that is disconnected. To disconnect the custom key store, use DisconnectCustomKeyStore. To reconnect the custom key store after the update completes, use ConnectCustomKeyStore. To find the connection state of a custom key store, use the DescribeCustomKeyStores operation. The CustomKeyStoreId parameter is required in all commands. Use the other parameters of UpdateCustomKeyStore to edit your key store settings.
  • Use the NewCustomKeyStoreName parameter to change the friendly name of the custom key store to the value that you specify.
  • Use the KeyStorePassword parameter tell KMS the current password of the kmsuser crypto user (CU) in the associated CloudHSM cluster. You can use this parameter to fix connection failures that occur when KMS cannot log into the associated cluster because the kmsuser password has changed. This value does not change the password in the CloudHSM cluster.
  • Use the CloudHsmClusterId parameter to associate the custom key store with a different, but related, CloudHSM cluster. You can use this parameter to repair a custom key store if its CloudHSM cluster becomes corrupted or is deleted, or when you need to create or restore a cluster from a backup.
If the operation succeeds, it returns a JSON object with no properties. This operation is part of the Custom Key Store feature feature in KMS, which combines the convenience and extensive integration of KMS with the isolation and control of a single-tenant key store. Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account. Required permissions: kms:UpdateCustomKeyStore (IAM policy) Related operations:
UpdateKeyDescription
UpdatePrimaryRegion

Lakeformation Events

Service Event Name Description
lakeformation AddLFTagsToResource
Show Description Attaches one or more tags to an existing resource.
BatchGrantPermissions
Show Description Batch operation to grant permissions to the principal.
BatchRevokePermissions
Show Description Batch operation to revoke permissions from the principal.
CreateLFTag
Show Description Creates a tag with the specified name and values.
DeleteLFTag
Show Description Deletes the specified tag key name. If the attribute key does not exist or the tag does not exist, then the operation will not do anything. If the attribute key exists, then the operation checks if any resources are tagged with this attribute key, if yes, the API throws a 400 Exception with the message "Delete not allowed" as the tag key is still attached with resources. You can consider untagging resources with this tag key.
DeregisterResource
Show Description Deregisters the resource as managed by the Data Catalog. When you deregister a path, Lake Formation removes the path from the inline policy attached to your service-linked role.
DescribeResource
Show Description Retrieves the current data access role for the given resource registered in AWS Lake Formation.
GetDataLakeSettings
Show Description Retrieves the list of the data lake administrators of a Lake Formation-managed data lake.
GetEffectivePermissionsForPath
Show Description Returns the Lake Formation permissions for a specified table or database resource located at a path in Amazon S3. GetEffectivePermissionsForPath will not return databases and tables if the catalog is encrypted.
GetLFTag
Show Description Returns a tag definition.
GetResourceLFTags
Show Description Returns the tags applied to a resource.
GrantPermissions
Show Description Grants permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3. For information about permissions, see Security and Access Control to Metadata and Data.
ListLFTags
Show Description Lists tags that the requester has permission to view.
ListPermissions
Show Description Returns a list of the principal permissions on the resource, filtered by the permissions of the caller. For example, if you are granted an ALTER permission, you are able to see only the principal permissions for ALTER. This operation returns only those permissions that have been explicitly granted. For information about permissions, see Security and Access Control to Metadata and Data.
ListResources
Show Description Lists the resources registered to be managed by the Data Catalog.
PutDataLakeSettings
Show Description Sets the list of data lake administrators who have admin privileges on all resources managed by Lake Formation. For more information on admin privileges, see Granting Lake Formation Permissions. This API replaces the current list of data lake admins with the new list being passed. To add an admin, fetch the current list and add the new admin to that list and pass that list in this API.
RegisterResource
Show Description Registers the resource as managed by the Data Catalog. To add or update data, Lake Formation needs read/write access to the chosen Amazon S3 path. Choose a role that you know has permission to do this, or choose the AWSServiceRoleForLakeFormationDataAccess service-linked role. When you register the first Amazon S3 path, the service-linked role and a new inline policy are created on your behalf. Lake Formation adds the first path to the inline policy and attaches it to the service-linked role. When you register subsequent paths, Lake Formation adds the path to the existing policy. The following request registers a new location and gives AWS Lake Formation permission to use the service-linked role to access that location. ResourceArn = arn:aws:s3:::my-bucket UseServiceLinkedRole = true If UseServiceLinkedRole is not set to true, you must provide or set the RoleArn: arn:aws:iam::12345:role/my-data-access-role
RemoveLFTagsFromResource
Show Description Removes a tag from the resource. Only database, table, or tableWithColumns resource are allowed. To tag columns, use the column inclusion list in tableWithColumns to specify column input.
RevokePermissions
Show Description Revokes permissions to the principal to access metadata in the Data Catalog and data organized in underlying data storage such as Amazon S3.
SearchDatabasesByLFTags
Show Description This operation allows a search on DATABASE resources by TagCondition. This operation is used by admins who want to grant user permissions on certain TagConditions. Before making a grant, the admin can use SearchDatabasesByTags to find all resources where the given TagConditions are valid to verify whether the returned resources can be shared.
SearchTablesByLFTags
Show Description This operation allows a search on TABLE resources by LFTags. This will be used by admins who want to grant user permissions on certain LFTags. Before making a grant, the admin can use SearchTablesByLFTags to find all resources where the given LFTags are valid to verify whether the returned resources can be shared.
UpdateLFTag
Show Description Updates the list of possible values for the specified tag key. If the tag does not exist, the operation throws an EntityNotFoundException. The values in the delete key values will be deleted from list of possible values. If any value in the delete key values is attached to a resource, then API errors out with a 400 Exception - "Update not allowed". Untag the attribute before deleting the tag key's value.

Lambda Events

Service Event Name Description
lambda AddLayerVersionPermission
Show Description Adds permissions to the resource-based policy of a version of an Lambda layer. Use this action to grant layer usage permission to other accounts. You can grant permission to a single account, all accounts in an organization, or all Amazon Web Services accounts. To revoke permission, call RemoveLayerVersionPermission with the statement ID that you specified when you added it.
AddPermission
Show Description Grants an Amazon Web Services service or another account permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies to version $LATEST. To grant permission to another account, specify the account ID as the Principal. For Amazon Web Services services, the principal is a domain-style identifier defined by the service, like s3.amazonaws.com or sns.amazonaws.com. For Amazon Web Services services, you can also specify the ARN of the associated resource as the SourceArn. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. This action adds a statement to a resource-based permissions policy for the function. For more information about function policies, see Lambda Function Policies.
CreateAlias
Show Description Creates an alias for a Lambda function version. Use aliases to provide clients with a function identifier that you can update to invoke a different version. You can also map an alias to split invocation requests between two versions. Use the RoutingConfig parameter to specify a second version and the percentage of invocation requests that it receives.
CreateCodeSigningConfig
Show Description Creates a code signing configuration. A code signing configuration defines a list of allowed signing profiles and defines the code-signing validation policy (action to be taken if deployment validation checks fail).
CreateEventSourceMapping
Show Description Creates a mapping between an event source and an Lambda function. Lambda reads items from the event source and triggers the function. For details about each event source type, see the following topics. The following error handling options are only available for stream sources (DynamoDB and Kinesis):
  • BisectBatchOnFunctionError - If the function returns an error, split the batch in two and retry.
  • DestinationConfig - Send discarded records to an Amazon SQS queue or Amazon SNS topic.
  • MaximumRecordAgeInSeconds - Discard records older than the specified age. The default value is infinite (-1). When set to infinite (-1), failed records are retried until the record expires
  • MaximumRetryAttempts - Discard records after the specified number of retries. The default value is infinite (-1). When set to infinite (-1), failed records are retried until the record expires.
  • ParallelizationFactor - Process multiple batches from each shard concurrently.
CreateFunction
Show Description Creates a Lambda function. To create a function, you need a deployment package and an execution role. The deployment package is a .zip file archive or container image that contains your function code. The execution role grants the function permission to use Amazon Web Services services, such as Amazon CloudWatch Logs for log streaming and X-Ray for request tracing. You set the package type to Image if the deployment package is a container image. For a container image, the code property must include the URI of a container image in the Amazon ECR registry. You do not need to specify the handler and runtime properties. You set the package type to Zip if the deployment package is a .zip file archive. For a .zip file archive, the code property specifies the location of the .zip file. You must also specify the handler and runtime properties. The code in the deployment package must be compatible with the target instruction set architecture of the function (x86-64 or arm64). If you do not specify the architecture, the default value is x86-64. When you create a function, Lambda provisions an instance of the function and its supporting resources. If your function connects to a VPC, this process can take a minute or so. During this time, you can't invoke or modify the function. The State, StateReason, and StateReasonCode fields in the response from GetFunctionConfiguration indicate when the function is ready to invoke. For more information, see Function States. A function has an unpublished version, and can have published versions and aliases. The unpublished version changes when you update your function's code and configuration. A published version is a snapshot of your function code and configuration that can't be changed. An alias is a named resource that maps to a version, and can be changed to map to a different version. Use the Publish parameter to create version 1 of your function from its initial configuration. The other parameters let you configure version-specific and function-level settings. You can modify version-specific settings later with UpdateFunctionConfiguration. Function-level settings apply to both the unpublished and published versions of the function, and include tags (TagResource) and per-function concurrency limits (PutFunctionConcurrency). You can use code signing if your deployment package is a .zip file archive. To enable code signing for this function, specify the ARN of a code-signing configuration. When a user attempts to deploy a code package with UpdateFunctionCode, Lambda checks that the code package has a valid signature from a trusted publisher. The code-signing configuration includes set set of signing profiles, which define the trusted publishers for this function. If another account or an Amazon Web Services service invokes your function, use AddPermission to grant permission by creating a resource-based IAM policy. You can grant permissions at the function level, on a version, or on an alias. To invoke your function directly, use Invoke. To invoke your function in response to events in other Amazon Web Services services, create an event source mapping (CreateEventSourceMapping), or configure a function trigger in the other service. For more information, see Invoking Functions.
DeleteAlias
DeleteCodeSigningConfig
Show Description Deletes the code signing configuration. You can delete the code signing configuration only if no function is using it.
DeleteEventSourceMapping
Show Description Deletes an event source mapping. You can get the identifier of a mapping from the output of ListEventSourceMappings. When you delete an event source mapping, it enters a Deleting state and might not be completely deleted for several seconds.
DeleteFunction
DeleteFunctionCodeSigningConfig
DeleteFunctionConcurrency
DeleteFunctionEventInvokeConfig
DeleteLayerVersion
DeleteProvisionedConcurrencyConfig
GetAccountSettings
Show Description Retrieves details about your account's limits and usage in an Amazon Web Services Region.
GetAlias
Show Description Returns details about a Lambda function alias.
GetCodeSigningConfig
Show Description Returns information about the specified code signing configuration.
GetEventSourceMapping
Show Description Returns details about an event source mapping. You can get the identifier of a mapping from the output of ListEventSourceMappings.
GetFunction
Show Description Returns information about the function or function version, with a link to download the deployment package that's valid for 10 minutes. If you specify a function version, only details that are specific to that version are returned.
GetFunctionCodeSigningConfig
Show Description Returns the code signing configuration for the specified function.
GetFunctionConcurrency
Show Description Returns details about the reserved concurrency configuration for a function. To set a concurrency limit for a function, use PutFunctionConcurrency.
GetFunctionConfiguration
Show Description Returns the version-specific settings of a Lambda function or version. The output includes only options that can vary between versions of a function. To modify these settings, use UpdateFunctionConfiguration. To get all of a function's details, including function-level settings, use GetFunction.
GetFunctionEventInvokeConfig
Show Description Retrieves the configuration for asynchronous invocation for a function, version, or alias. To configure options for asynchronous invocation, use PutFunctionEventInvokeConfig.
GetLayerVersion
Show Description Returns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes.
GetLayerVersionByArn
Show Description Returns information about a version of an Lambda layer, with a link to download the layer archive that's valid for 10 minutes.
GetLayerVersionPolicy
Show Description Returns the permission policy for a version of an Lambda layer. For more information, see AddLayerVersionPermission.
GetPolicy
Show Description Returns the resource-based IAM policy for a function, version, or alias.
GetProvisionedConcurrencyConfig
Show Description Retrieves the provisioned concurrency configuration for a function's alias or version.
Invoke
Show Description Invokes a Lambda function. You can invoke a function synchronously (and wait for the response), or asynchronously. To invoke a function asynchronously, set InvocationType to Event. For synchronous invocation, details about the function response, including errors, are included in the response body and headers. For either invocation type, you can find more information in the execution log and trace. When an error occurs, your function may be invoked multiple times. Retry behavior varies by error type, client, event source, and invocation type. For example, if you invoke a function asynchronously and it returns an error, Lambda executes the function up to two more times. For more information, see Retry Behavior. For asynchronous invocation, Lambda adds events to a queue before sending them to your function. If your function does not have enough capacity to keep up with the queue, events may be lost. Occasionally, your function may receive the same event multiple times, even if no error occurs. To retain events that were not processed, configure your function with a dead-letter queue. The status code in the API response doesn't reflect function errors. Error codes are reserved for errors that prevent your function from executing, such as permissions errors, limit errors, or issues with your function's code and configuration. For example, Lambda returns TooManyRequestsException if executing the function would cause you to exceed a concurrency limit at either the account level (ConcurrentInvocationLimitExceeded) or function level (ReservedFunctionConcurrentInvocationLimitExceeded). For functions with a long timeout, your client might be disconnected during synchronous invocation while it waits for a response. Configure your HTTP client, SDK, firewall, proxy, or operating system to allow for long connections with timeout or keep-alive settings. This operation requires permission for the lambda:InvokeFunction action.
InvokeAsync
Show Description For asynchronous function invocation, use Invoke. Invokes a function asynchronously.
ListAliases
Show Description Returns a list of aliases for a Lambda function.
ListCodeSigningConfigs
Show Description Returns a list of code signing configurations. A request returns up to 10,000 configurations per call. You can use the MaxItems parameter to return fewer configurations per call.
ListEventSourceMappings
Show Description Lists event source mappings. Specify an EventSourceArn to only show event source mappings for a single event source.
ListFunctionEventInvokeConfigs
Show Description Retrieves a list of configurations for asynchronous invocation for a function. To configure options for asynchronous invocation, use PutFunctionEventInvokeConfig.
ListFunctions
Show Description Returns a list of Lambda functions, with the version-specific configuration of each. Lambda returns up to 50 functions per call. Set FunctionVersion to ALL to include all published versions of each function in addition to the unpublished version. The ListFunctions action returns a subset of the FunctionConfiguration fields. To get the additional fields (State, StateReasonCode, StateReason, LastUpdateStatus, LastUpdateStatusReason, LastUpdateStatusReasonCode) for a function or version, use GetFunction.
ListFunctionsByCodeSigningConfig
Show Description List the functions that use the specified code signing configuration. You can use this method prior to deleting a code signing configuration, to verify that no functions are using it.
ListLayerVersions
Show Description Lists the versions of an Lambda layer. Versions that have been deleted aren't listed. Specify a runtime identifier to list only versions that indicate that they're compatible with that runtime. Specify a compatible architecture to include only layer versions that are compatible with that architecture.
ListLayers
Show Description Lists Lambda layers and shows information about the latest version of each. Specify a runtime identifier to list only layers that indicate that they're compatible with that runtime. Specify a compatible architecture to include only layers that are compatible with that instruction set architecture.
ListProvisionedConcurrencyConfigs
Show Description Retrieves a list of provisioned concurrency configurations for a function.
ListTags
Show Description Returns a function's tags. You can also view tags with GetFunction.
ListVersionsByFunction
Show Description Returns a list of versions, with the version-specific configuration of each. Lambda returns up to 50 versions per call.
PublishLayerVersion
Show Description Creates an Lambda layer from a ZIP archive. Each time you call PublishLayerVersion with the same layer name, a new version is created. Add layers to your function with CreateFunction or UpdateFunctionConfiguration.
PublishVersion
Show Description Creates a version from the current code and configuration of a function. Use versions to create a snapshot of your function code and configuration that doesn't change. Lambda doesn't publish a version if the function's configuration and code haven't changed since the last version. Use UpdateFunctionCode or UpdateFunctionConfiguration to update the function before publishing a version. Clients can invoke versions directly or with an alias. To create an alias, use CreateAlias.
PutFunctionCodeSigningConfig
Show Description Update the code signing configuration for the function. Changes to the code signing configuration take effect the next time a user tries to deploy a code package to the function.
PutFunctionConcurrency
Show Description Sets the maximum number of simultaneous executions for a function, and reserves capacity for that concurrency level. Concurrency settings apply to the function as a whole, including all published versions and the unpublished version. Reserving concurrency both ensures that your function has capacity to process the specified number of events simultaneously, and prevents it from scaling beyond that level. Use GetFunction to see the current setting for a function. Use GetAccountSettings to see your Regional concurrency limit. You can reserve concurrency for as many functions as you like, as long as you leave at least 100 simultaneous executions unreserved for functions that aren't configured with a per-function limit. For more information, see Managing Concurrency.
PutFunctionEventInvokeConfig
Show Description Configures options for asynchronous invocation on a function, version, or alias. If a configuration already exists for a function, version, or alias, this operation overwrites it. If you exclude any settings, they are removed. To set one option without affecting existing settings for other options, use UpdateFunctionEventInvokeConfig. By default, Lambda retries an asynchronous invocation twice if the function returns an error. It retains events in a queue for up to six hours. When an event fails all processing attempts or stays in the asynchronous invocation queue for too long, Lambda discards it. To retain discarded events, configure a dead-letter queue with UpdateFunctionConfiguration. To send an invocation record to a queue, topic, function, or event bus, specify a destination. You can configure separate destinations for successful invocations (on-success) and events that fail all processing attempts (on-failure). You can configure destinations in addition to or instead of a dead-letter queue.
PutProvisionedConcurrencyConfig
Show Description Adds a provisioned concurrency configuration to a function's alias or version.
RemoveLayerVersionPermission
RemovePermission
TagResource
UntagResource
UpdateAlias
Show Description Updates the configuration of a Lambda function alias.
UpdateCodeSigningConfig
Show Description Update the code signing configuration. Changes to the code signing configuration take effect the next time a user tries to deploy a code package to the function.
UpdateEventSourceMapping
Show Description Updates an event source mapping. You can change the function that Lambda invokes, or pause invocation and resume later from the same location. The following error handling options are only available for stream sources (DynamoDB and Kinesis):
  • BisectBatchOnFunctionError - If the function returns an error, split the batch in two and retry.
  • DestinationConfig - Send discarded records to an Amazon SQS queue or Amazon SNS topic.
  • MaximumRecordAgeInSeconds - Discard records older than the specified age. The default value is infinite (-1). When set to infinite (-1), failed records are retried until the record expires
  • MaximumRetryAttempts - Discard records after the specified number of retries. The default value is infinite (-1). When set to infinite (-1), failed records are retried until the record expires.
  • ParallelizationFactor - Process multiple batches from each shard concurrently.
UpdateFunctionCode
Show Description Updates a Lambda function's code. If code signing is enabled for the function, the code package must be signed by a trusted publisher. For more information, see Configuring code signing. The function's code is locked when you publish a version. You can't modify the code of a published version, only the unpublished version. For a function defined as a container image, Lambda resolves the image tag to an image digest. In Amazon ECR, if you update the image tag to a new image, Lambda does not automatically update the function.
UpdateFunctionConfiguration
Show Description Modify the version-specific settings of a Lambda function. When you update a function, Lambda provisions an instance of the function and its supporting resources. If your function connects to a VPC, this process can take a minute. During this time, you can't modify the function, but you can still invoke it. The LastUpdateStatus, LastUpdateStatusReason, and LastUpdateStatusReasonCode fields in the response from GetFunctionConfiguration indicate when the update is complete and the function is processing events with the new configuration. For more information, see Function States. These settings can vary between versions of a function and are locked when you publish a version. You can't modify the configuration of a published version, only the unpublished version. To configure function concurrency, use PutFunctionConcurrency. To grant invoke permissions to an account or Amazon Web Services service, use AddPermission.

Lex-models Events

Service Event Name Description
lex-models CreateBotVersion
Show Description Creates a new version of the bot based on the $LATEST version. If the $LATEST version of this resource hasn't changed since you created the last version, Amazon Lex doesn't create a new version. It returns the last created version. You can update only the $LATEST version of the bot. You can't update the numbered versions that you create with the CreateBotVersion operation. When you create the first version of a bot, Amazon Lex sets the version to 1. Subsequent versions increment by 1. For more information, see versioning-intro. This operation requires permission for the lex:CreateBotVersion action.
CreateIntentVersion
Show Description Creates a new version of an intent based on the $LATEST version of the intent. If the $LATEST version of this intent hasn't changed since you last updated it, Amazon Lex doesn't create a new version. It returns the last version you created. You can update only the $LATEST version of the intent. You can't update the numbered versions that you create with the CreateIntentVersion operation. When you create a version of an intent, Amazon Lex sets the version to 1. Subsequent versions increment by 1. For more information, see versioning-intro. This operation requires permissions to perform the lex:CreateIntentVersion action.
CreateSlotTypeVersion
Show Description Creates a new version of a slot type based on the $LATEST version of the specified slot type. If the $LATEST version of this resource has not changed since the last version that you created, Amazon Lex doesn't create a new version. It returns the last version that you created. You can update only the $LATEST version of a slot type. You can't update the numbered versions that you create with the CreateSlotTypeVersion operation. When you create a version of a slot type, Amazon Lex sets the version to 1. Subsequent versions increment by 1. For more information, see versioning-intro. This operation requires permissions for the lex:CreateSlotTypeVersion action.
DeleteBot
DeleteBotAlias
DeleteBotChannelAssociation
DeleteBotVersion
DeleteIntent
DeleteIntentVersion
DeleteSlotType
DeleteSlotTypeVersion
DeleteUtterances
GetBot
Show Description Returns metadata information for a specific bot. You must provide the bot name and the bot version or alias. This operation requires permissions for the lex:GetBot action.
GetBotAlias
Show Description Returns information about an Amazon Lex bot alias. For more information about aliases, see versioning-aliases. This operation requires permissions for the lex:GetBotAlias action.
GetBotAliases
Show Description Returns a list of aliases for a specified Amazon Lex bot. This operation requires permissions for the lex:GetBotAliases action.
GetBotChannelAssociation
Show Description Returns information about the association between an Amazon Lex bot and a messaging platform. This operation requires permissions for the lex:GetBotChannelAssociation action.
GetBotChannelAssociations
Show Description Returns a list of all of the channels associated with the specified bot. The GetBotChannelAssociations operation requires permissions for the lex:GetBotChannelAssociations action.
GetBotVersions
Show Description Gets information about all of the versions of a bot. The GetBotVersions operation returns a BotMetadata object for each version of a bot. For example, if a bot has three numbered versions, the GetBotVersions operation returns four BotMetadata objects in the response, one for each numbered version and one for the $LATEST version. The GetBotVersions operation always returns at least one version, the $LATEST version. This operation requires permissions for the lex:GetBotVersions action.
GetBots
Show Description Returns bot information as follows:
  • If you provide the nameContains field, the response includes information for the $LATEST version of all bots whose name contains the specified string.
  • If you don't specify the nameContains field, the operation returns information about the $LATEST version of all of your bots.
This operation requires permission for the lex:GetBots action.
GetBuiltinIntent
Show Description Returns information about a built-in intent. This operation requires permission for the lex:GetBuiltinIntent action.
GetBuiltinIntents
Show Description Gets a list of built-in intents that meet the specified criteria. This operation requires permission for the lex:GetBuiltinIntents action.
GetBuiltinSlotTypes
Show Description Gets a list of built-in slot types that meet the specified criteria. For a list of built-in slot types, see Slot Type Reference in the Alexa Skills Kit. This operation requires permission for the lex:GetBuiltInSlotTypes action.
GetExport
Show Description Exports the contents of a Amazon Lex resource in a specified format.
GetImport
Show Description Gets information about an import job started with the StartImport operation.
GetIntent
Show Description Returns information about an intent. In addition to the intent name, you must specify the intent version. This operation requires permissions to perform the lex:GetIntent action.
GetIntentVersions
Show Description Gets information about all of the versions of an intent. The GetIntentVersions operation returns an IntentMetadata object for each version of an intent. For example, if an intent has three numbered versions, the GetIntentVersions operation returns four IntentMetadata objects in the response, one for each numbered version and one for the $LATEST version. The GetIntentVersions operation always returns at least one version, the $LATEST version. This operation requires permissions for the lex:GetIntentVersions action.
GetIntents
Show Description Returns intent information as follows:
  • If you specify the nameContains field, returns the $LATEST version of all intents that contain the specified string.
  • If you don't specify the nameContains field, returns information about the $LATEST version of all intents.
The operation requires permission for the lex:GetIntents action.
GetMigration
Show Description Provides details about an ongoing or complete migration from an Amazon Lex V1 bot to an Amazon Lex V2 bot. Use this operation to view the migration alerts and warnings related to the migration.
GetMigrations
Show Description Gets a list of migrations between Amazon Lex V1 and Amazon Lex V2.
GetSlotType
Show Description Returns information about a specific version of a slot type. In addition to specifying the slot type name, you must specify the slot type version. This operation requires permissions for the lex:GetSlotType action.
GetSlotTypeVersions
Show Description Gets information about all versions of a slot type. The GetSlotTypeVersions operation returns a SlotTypeMetadata object for each version of a slot type. For example, if a slot type has three numbered versions, the GetSlotTypeVersions operation returns four SlotTypeMetadata objects in the response, one for each numbered version and one for the $LATEST version. The GetSlotTypeVersions operation always returns at least one version, the $LATEST version. This operation requires permissions for the lex:GetSlotTypeVersions action.
GetSlotTypes
Show Description Returns slot type information as follows:
  • If you specify the nameContains field, returns the $LATEST version of all slot types that contain the specified string.
  • If you don't specify the nameContains field, returns information about the $LATEST version of all slot types.
The operation requires permission for the lex:GetSlotTypes action.
GetUtterancesView
Show Description Use the GetUtterancesView operation to get information about the utterances that your users have made to your bot. You can use this list to tune the utterances that your bot responds to. For example, say that you have created a bot to order flowers. After your users have used your bot for a while, use the GetUtterancesView operation to see the requests that they have made and whether they have been successful. You might find that the utterance "I want flowers" is not being recognized. You could add this utterance to the OrderFlowers intent so that your bot recognizes that utterance. After you publish a new version of a bot, you can get information about the old version and the new so that you can compare the performance across the two versions. Utterance statistics are generated once a day. Data is available for the last 15 days. You can request information for up to 5 versions of your bot in each request. Amazon Lex returns the most frequent utterances received by the bot in the last 15 days. The response contains information about a maximum of 100 utterances for each version. If you set childDirected field to true when you created your bot, if you are using slot obfuscation with one or more slots, or if you opted out of participating in improving Amazon Lex, utterances are not available. This operation requires permissions for the lex:GetUtterancesView action.
ListTagsForResource
Show Description Gets a list of tags associated with the specified resource. Only bots, bot aliases, and bot channels can have tags associated with them.
PutBot
Show Description Creates an Amazon Lex conversational bot or replaces an existing bot. When you create or update a bot you are only required to specify a name, a locale, and whether the bot is directed toward children under age 13. You can use this to add intents later, or to remove intents from an existing bot. When you create a bot with the minimum information, the bot is created or updated but Amazon Lex returns the response FAILED. You can build the bot after you add one or more intents. For more information about Amazon Lex bots, see how-it-works. If you specify the name of an existing bot, the fields in the request replace the existing values in the $LATEST version of the bot. Amazon Lex removes any fields that you don't provide values for in the request, except for the idleTTLInSeconds and privacySettings fields, which are set to their default values. If you don't specify values for required fields, Amazon Lex throws an exception. This operation requires permissions for the lex:PutBot action. For more information, see security-iam.
PutBotAlias
Show Description Creates an alias for the specified version of the bot or replaces an alias for the specified bot. To change the version of the bot that the alias points to, replace the alias. For more information about aliases, see versioning-aliases. This operation requires permissions for the lex:PutBotAlias action.
PutIntent
Show Description Creates an intent or replaces an existing intent. To define the interaction between the user and your bot, you use one or more intents. For a pizza ordering bot, for example, you would create an OrderPizza intent. To create an intent or replace an existing intent, you must provide the following:
  • Intent name. For example, OrderPizza.
  • Sample utterances. For example, "Can I order a pizza, please." and "I want to order a pizza."
  • Information to be gathered. You specify slot types for the information that your bot will request from the user. You can specify standard slot types, such as a date or a time, or custom slot types such as the size and crust of a pizza.
  • How the intent will be fulfilled. You can provide a Lambda function or configure the intent to return the intent information to the client application. If you use a Lambda function, when all of the intent information is available, Amazon Lex invokes your Lambda function. If you configure your intent to return the intent information to the client application.
You can specify other optional information in the request, such as:
  • A confirmation prompt to ask the user to confirm an intent. For example, "Shall I order your pizza?"
  • A conclusion statement to send to the user after the intent has been fulfilled. For example, "I placed your pizza order."
  • A follow-up prompt that asks the user for additional activity. For example, asking "Do you want to order a drink with your pizza?"
If you specify an existing intent name to update the intent, Amazon Lex replaces the values in the $LATEST version of the intent with the values in the request. Amazon Lex removes fields that you don't provide in the request. If you don't specify the required fields, Amazon Lex throws an exception. When you update the $LATEST version of an intent, the status field of any bot that uses the $LATEST version of the intent is set to NOT_BUILT. For more information, see how-it-works. This operation requires permissions for the lex:PutIntent action.
PutSlotType
Show Description Creates a custom slot type or replaces an existing custom slot type. To create a custom slot type, specify a name for the slot type and a set of enumeration values, which are the values that a slot of this type can assume. For more information, see how-it-works. If you specify the name of an existing slot type, the fields in the request replace the existing values in the $LATEST version of the slot type. Amazon Lex removes the fields that you don't provide in the request. If you don't specify required fields, Amazon Lex throws an exception. When you update the $LATEST version of a slot type, if a bot uses the $LATEST version of an intent that contains the slot type, the bot's status field is set to NOT_BUILT. This operation requires permissions for the lex:PutSlotType action.
StartImport
Show Description Starts a job to import a resource to Amazon Lex.
StartMigration
Show Description Starts migrating a bot from Amazon Lex V1 to Amazon Lex V2. Migrate your bot when you want to take advantage of the new features of Amazon Lex V2. For more information, see Migrating a bot in the Amazon Lex developer guide.
TagResource
Show Description Adds the specified tags to the specified resource. If a tag key already exists, the existing value is replaced with the new value.

Lex-runtime Events

Service Event Name Description
lex-runtime DeleteSession
Show Description Removes session information for a specified bot, alias, and user ID.
GetSession
Show Description Returns session information for a specified bot, alias, and user ID.
PostContent
Show Description Sends user input (text or speech) to Amazon Lex. Clients use this API to send text and audio requests to Amazon Lex at runtime. Amazon Lex interprets the user input using the machine learning model that it built for the bot. The PostContent operation supports audio input at 8kHz and 16kHz. You can use 8kHz audio to achieve higher speech recognition accuracy in telephone audio applications. In response, Amazon Lex returns the next message to convey to the user. Consider the following example messages:
  • For a user input "I would like a pizza," Amazon Lex might return a response with a message eliciting slot data (for example, PizzaSize): "What size pizza would you like?".
  • After the user provides all of the pizza order information, Amazon Lex might return a response with a message to get user confirmation: "Order the pizza?".
  • After the user replies "Yes" to the confirmation prompt, Amazon Lex might return a conclusion statement: "Thank you, your cheese pizza has been ordered.".
Not all Amazon Lex messages require a response from the user. For example, conclusion statements do not require a response. Some messages require only a yes or no response. In addition to the message, Amazon Lex provides additional context about the message in the response that you can use to enhance client behavior, such as displaying the appropriate client user interface. Consider the following examples:
  • If the message is to elicit slot data, Amazon Lex returns the following context information:
    • x-amz-lex-dialog-state header set to ElicitSlot
    • x-amz-lex-intent-name header set to the intent name in the current context
    • x-amz-lex-slot-to-elicit header set to the slot name for which the message is eliciting information
    • x-amz-lex-slots header set to a map of slots configured for the intent with their current values
  • If the message is a confirmation prompt, the x-amz-lex-dialog-state header is set to Confirmation and the x-amz-lex-slot-to-elicit header is omitted.
  • If the message is a clarification prompt configured for the intent, indicating that the user intent is not understood, the x-amz-dialog-state header is set to ElicitIntent and the x-amz-slot-to-elicit header is omitted.
In addition, Amazon Lex also returns your application-specific sessionAttributes. For more information, see Managing Conversation Context.
PostText
Show Description Sends user input to Amazon Lex. Client applications can use this API to send requests to Amazon Lex at runtime. Amazon Lex then interprets the user input using the machine learning model it built for the bot. In response, Amazon Lex returns the next message to convey to the user an optional responseCard to display. Consider the following example messages:
  • For a user input "I would like a pizza", Amazon Lex might return a response with a message eliciting slot data (for example, PizzaSize): "What size pizza would you like?"
  • After the user provides all of the pizza order information, Amazon Lex might return a response with a message to obtain user confirmation "Proceed with the pizza order?".
  • After the user replies to a confirmation prompt with a "yes", Amazon Lex might return a conclusion statement: "Thank you, your cheese pizza has been ordered.".
Not all Amazon Lex messages require a user response. For example, a conclusion statement does not require a response. Some messages require only a "yes" or "no" user response. In addition to the message, Amazon Lex provides additional context about the message in the response that you might use to enhance client behavior, for example, to display the appropriate client user interface. These are the slotToElicit, dialogState, intentName, and slots fields in the response. Consider the following examples:
  • If the message is to elicit slot data, Amazon Lex returns the following context information:
    • dialogState set to ElicitSlot
    • intentName set to the intent name in the current context
    • slotToElicit set to the slot name for which the message is eliciting information
    • slots set to a map of slots, configured for the intent, with currently known values
  • If the message is a confirmation prompt, the dialogState is set to ConfirmIntent and SlotToElicit is set to null.
  • If the message is a clarification prompt (configured for the intent) that indicates that user intent is not understood, the dialogState is set to ElicitIntent and slotToElicit is set to null.
In addition, Amazon Lex also returns your application-specific sessionAttributes. For more information, see Managing Conversation Context.

Lexv2-models Events

Service Event Name Description
lexv2-models BuildBotLocale
Show Description Builds a bot, its intents, and its slot types into a specific locale. A bot can be built into multiple locales. At runtime the locale is used to choose a specific build of the bot.
CreateBot
Show Description Creates an Amazon Lex conversational bot.
CreateBotAlias
Show Description Creates an alias for the specified version of a bot. Use an alias to enable you to change the version of a bot without updating applications that use the bot. For example, you can create an alias called "PROD" that your applications use to call the Amazon Lex bot.
CreateBotLocale
Show Description Creates a locale in the bot. The locale contains the intents and slot types that the bot uses in conversations with users in the specified language and locale. You must add a locale to a bot before you can add intents and slot types to the bot.
CreateBotVersion
Show Description Creates a new version of the bot based on the DRAFT version. If the DRAFT version of this resource hasn't changed since you created the last version, Amazon Lex doesn't create a new version, it returns the last created version. When you create the first version of a bot, Amazon Lex sets the version to 1. Subsequent versions increment by 1.
CreateExport
Show Description Creates a zip archive containing the contents of a bot or a bot locale. The archive contains a directory structure that contains JSON files that define the bot. You can create an archive that contains the complete definition of a bot, or you can specify that the archive contain only the definition of a single bot locale. For more information about exporting bots, and about the structure of the export archive, see Importing and exporting bots
CreateIntent
Show Description Creates an intent. To define the interaction between the user and your bot, you define one or more intents. For example, for a pizza ordering bot you would create an OrderPizza intent. When you create an intent, you must provide a name. You can optionally provide the following:
  • Sample utterances. For example, "I want to order a pizza" and "Can I order a pizza." You can't provide utterances for built-in intents.
  • Information to be gathered. You specify slots for the information that you bot requests from the user. You can specify standard slot types, such as date and time, or custom slot types for your application.
  • How the intent is fulfilled. You can provide a Lambda function or configure the intent to return the intent information to your client application. If you use a Lambda function, Amazon Lex invokes the function when all of the intent information is available.
  • A confirmation prompt to send to the user to confirm an intent. For example, "Shall I order your pizza?"
  • A conclusion statement to send to the user after the intent is fulfilled. For example, "I ordered your pizza."
  • A follow-up prompt that asks the user for additional activity. For example, "Do you want a drink with your pizza?"
CreateResourcePolicy
Show Description Creates a new resource policy with the specified policy statements.
CreateResourcePolicyStatement
Show Description Adds a new resource policy statement to a bot or bot alias. If a resource policy exists, the statement is added to the current resource policy. If a policy doesn't exist, a new policy is created. You can't create a resource policy statement that allows cross-account access.
CreateSlot
Show Description Creates a slot in an intent. A slot is a variable needed to fulfill an intent. For example, an OrderPizza intent might need slots for size, crust, and number of pizzas. For each slot, you define one or more utterances that Amazon Lex uses to elicit a response from the user.
CreateSlotType
Show Description Creates a custom slot type To create a custom slot type, specify a name for the slot type and a set of enumeration values, the values that a slot of this type can assume.
CreateUploadUrl
Show Description Gets a pre-signed S3 write URL that you use to upload the zip archive when importing a bot or a bot locale.
DeleteBot
Show Description Deletes all versions of a bot, including the Draft version. To delete a specific version, use the DeleteBotVersion operation. When you delete a bot, all of the resources contained in the bot are also deleted. Deleting a bot removes all locales, intents, slot, and slot types defined for the bot. If a bot has an alias, the DeleteBot operation returns a ResourceInUseException exception. If you want to delete the bot and the alias, set the skipResourceInUseCheck parameter to true.
DeleteBotAlias
Show Description Deletes the specified bot alias.
DeleteBotLocale
Show Description Removes a locale from a bot. When you delete a locale, all intents, slots, and slot types defined for the locale are also deleted.
DeleteBotVersion
Show Description Deletes a specific version of a bot. To delete all version of a bot, use the DeleteBot operation.
DeleteExport
Show Description Removes a previous export and the associated files stored in an S3 bucket.
DeleteImport
Show Description Removes a previous import and the associated file stored in an S3 bucket.
DeleteIntent
DeleteResourcePolicy
Show Description Removes an existing policy from a bot or bot alias. If the resource doesn't have a policy attached, Amazon Lex returns an exception.
DeleteResourcePolicyStatement
Show Description Deletes a policy statement from a resource policy. If you delete the last statement from a policy, the policy is deleted. If you specify a statement ID that doesn't exist in the policy, or if the bot or bot alias doesn't have a policy attached, Amazon Lex returns an exception.
DeleteSlot
DeleteSlotType
DeleteUtterances
Show Description Deletes stored utterances. Amazon Lex stores the utterances that users send to your bot. Utterances are stored for 15 days for use with the operation, and then stored indefinitely for use in improving the ability of your bot to respond to user input.. Use the DeleteUtterances operation to manually delete utterances for a specific session. When you use the DeleteUtterances operation, utterances stored for improving your bot's ability to respond to user input are deleted immediately. Utterances stored for use with the ListAggregatedUtterances operation are deleted after 15 days.
DescribeBot
Show Description Provides metadata information about a bot.
DescribeBotAlias
Show Description Get information about a specific bot alias.
DescribeBotLocale
Show Description Describes the settings that a bot has for a specific locale.
DescribeBotVersion
Show Description Provides metadata about a version of a bot.
DescribeExport
Show Description Gets information about a specific export.
DescribeImport
Show Description Gets information about a specific import.
DescribeIntent
Show Description Returns metadata about an intent.
DescribeResourcePolicy
Show Description Gets the resource policy and policy revision for a bot or bot alias.
DescribeSlot
Show Description Gets metadata information about a slot.
DescribeSlotType
Show Description Gets metadata information about a slot type.
ListAggregatedUtterances
Show Description Provides a list of utterances that users have sent to the bot. Utterances are aggregated by the text of the utterance. For example, all instances where customers used the phrase "I want to order pizza" are aggregated into the same line in the response. You can see both detected utterances and missed utterances. A detected utterance is where the bot properly recognized the utterance and activated the associated intent. A missed utterance was not recognized by the bot and didn't activate an intent. Utterances can be aggregated for a bot alias or for a bot version, but not both at the same time. Utterances statistics are not generated under the following conditions:
  • The childDirected field was set to true when the bot was created.
  • You are using slot obfuscation with one or more slots.
  • You opted out of participating in improving Amazon Lex.
ListBotAliases
Show Description Gets a list of aliases for the specified bot.
ListBotLocales
Show Description Gets a list of locales for the specified bot.
ListBotVersions
Show Description Gets information about all of the versions of a bot. The ListBotVersions operation returns a summary of each version of a bot. For example, if a bot has three numbered versions, the ListBotVersions operation returns for summaries, one for each numbered version and one for the DRAFT version. The ListBotVersions operation always returns at least one version, the DRAFT version.
ListBots
Show Description Gets a list of available bots.
ListBuiltInIntents
Show Description Gets a list of built-in intents provided by Amazon Lex that you can use in your bot. To use a built-in intent as a the base for your own intent, include the built-in intent signature in the parentIntentSignature parameter when you call the CreateIntent operation. For more information, see CreateIntent.
ListBuiltInSlotTypes
Show Description Gets a list of built-in slot types that meet the specified criteria.
ListExports
Show Description Lists the exports for a bot or bot locale. Exports are kept in the list for 7 days.
ListImports
Show Description Lists the imports for a bot or bot locale. Imports are kept in the list for 7 days.
ListIntents
Show Description Get a list of intents that meet the specified criteria.
ListSlotTypes
Show Description Gets a list of slot types that match the specified criteria.
ListSlots
Show Description Gets a list of slots that match the specified criteria.
ListTagsForResource
Show Description Gets a list of tags associated with a resource. Only bots, bot aliases, and bot channels can have tags associated with them.
StartImport
Show Description Starts importing a bot or bot locale from a zip archive that you uploaded to an S3 bucket.
TagResource
Show Description Adds the specified tags to the specified resource. If a tag key already exists, the existing value is replaced with the new value.
UntagResource
Show Description Removes tags from a bot, bot alias, or bot channel.
UpdateBot
Show Description Updates the configuration of an existing bot.
UpdateBotAlias
Show Description Updates the configuration of an existing bot alias.
UpdateBotLocale
Show Description Updates the settings that a bot has for a specific locale.
UpdateExport
Show Description Updates the password used to protect an export zip archive. The password is not required. If you don't supply a password, Amazon Lex generates a zip file that is not protected by a password. This is the archive that is available at the pre-signed S3 URL provided by the operation.
UpdateIntent
Show Description Updates the settings for an intent.
UpdateResourcePolicy
Show Description Replaces the existing resource policy for a bot or bot alias with a new one. If the policy doesn't exist, Amazon Lex returns an exception.
UpdateSlot
Show Description Updates the settings for a slot.

Lexv2-runtime Events

Service Event Name Description
lexv2-runtime DeleteSession
Show Description Removes session information for a specified bot, alias, and user ID. You can use this operation to restart a conversation with a bot. When you remove a session, the entire history of the session is removed so that you can start again. You don't need to delete a session. Sessions have a time limit and will expire. Set the session time limit when you create the bot. The default is 5 minutes, but you can specify anything between 1 minute and 24 hours. If you specify a bot or alias ID that doesn't exist, you receive a BadRequestException. If the locale doesn't exist in the bot, or if the locale hasn't been enables for the alias, you receive a BadRequestException.
GetSession
Show Description Returns session information for a specified bot, alias, and user. For example, you can use this operation to retrieve session information for a user that has left a long-running session in use. If the bot, alias, or session identifier doesn't exist, Amazon Lex V2 returns a BadRequestException. If the locale doesn't exist or is not enabled for the alias, you receive a BadRequestException.
PutSession
Show Description Creates a new session or modifies an existing session with an Amazon Lex V2 bot. Use this operation to enable your application to set the state of the bot.
RecognizeText
Show Description Sends user input to Amazon Lex V2. Client applications use this API to send requests to Amazon Lex V2 at runtime. Amazon Lex V2 then interprets the user input using the machine learning model that it build for the bot. In response, Amazon Lex V2 returns the next message to convey to the user and an optional response card to display. If the optional post-fulfillment response is specified, the messages are returned as follows. For more information, see PostFulfillmentStatusSpecification.
  • Success message - Returned if the Lambda function completes successfully and the intent state is fulfilled or ready fulfillment if the message is present.
  • Failed message - The failed message is returned if the Lambda function throws an exception or if the Lambda function returns a failed intent state without a message.
  • Timeout message - If you don't configure a timeout message and a timeout, and the Lambda function doesn't return within 30 seconds, the timeout message is returned. If you configure a timeout, the timeout message is returned when the period times out.
For more information, see Completion message.
RecognizeUtterance
Show Description Sends user input to Amazon Lex V2. You can send text or speech. Clients use this API to send text and audio requests to Amazon Lex V2 at runtime. Amazon Lex V2 interprets the user input using the machine learning model built for the bot. The following request fields must be compressed with gzip and then base64 encoded before you send them to Amazon Lex V2.
  • requestAttributes
  • sessionState
The following response fields are compressed using gzip and then base64 encoded by Amazon Lex V2. Before you can use these fields, you must decode and decompress them.
  • inputTranscript
  • interpretations
  • messages
  • requestAttributes
  • sessionState
The example contains a Java application that compresses and encodes a Java object to send to Amazon Lex V2, and a second that decodes and decompresses a response from Amazon Lex V2. If the optional post-fulfillment response is specified, the messages are returned as follows. For more information, see PostFulfillmentStatusSpecification.
  • Success message - Returned if the Lambda function completes successfully and the intent state is fulfilled or ready fulfillment if the message is present.
  • Failed message - The failed message is returned if the Lambda function throws an exception or if the Lambda function returns a failed intent state without a message.
  • Timeout message - If you don't configure a timeout message and a timeout, and the Lambda function doesn't return within 30 seconds, the timeout message is returned. If you configure a timeout, the timeout message is returned when the period times out.
For more information, see Completion message.

License-manager Events

Service Event Name Description
license-manager AcceptGrant
Show Description Accepts the specified grant.
CheckInLicense
Show Description Checks in the specified license. Check in a license when it is no longer in use.
CheckoutBorrowLicense
Show Description Checks out the specified license for offline use.
CheckoutLicense
Show Description Checks out the specified license.
CreateGrant
Show Description Creates a grant for the specified license. A grant shares the use of license entitlements with specific Amazon Web Services accounts.
CreateGrantVersion
Show Description Creates a new version of the specified grant.
CreateLicense
Show Description Creates a license.
CreateLicenseConfiguration
Show Description Creates a license configuration. A license configuration is an abstraction of a customer license agreement that can be consumed and enforced by License Manager. Components include specifications for the license type (licensing by instance, socket, CPU, or vCPU), allowed tenancy (shared tenancy, Dedicated Instance, Dedicated Host, or all of these), license affinity to host (how long a license must be associated with a host), and the number of licenses purchased and used.
CreateLicenseConversionTaskForResource
Show Description Creates a new license conversion task.
CreateLicenseManagerReportGenerator
Show Description Creates a report generator.
CreateLicenseVersion
Show Description Creates a new version of the specified license.
CreateToken
Show Description Creates a long-lived token. A refresh token is a JWT token used to get an access token. With an access token, you can call AssumeRoleWithWebIdentity to get role credentials that you can use to call License Manager to manage the specified license.
DeleteGrant
Show Description Deletes the specified grant.
DeleteLicense
Show Description Deletes the specified license.
DeleteLicenseConfiguration
Show Description Deletes the specified license configuration. You cannot delete a license configuration that is in use.
DeleteLicenseManagerReportGenerator
Show Description Deletes the specified report generator. This action deletes the report generator, which stops it from generating future reports. The action cannot be reversed. It has no effect on the previous reports from this generator.
DeleteToken
Show Description Deletes the specified token. Must be called in the license home Region.
ExtendLicenseConsumption
Show Description Extends the expiration date for license consumption.
GetAccessToken
Show Description Gets a temporary access token to use with AssumeRoleWithWebIdentity. Access tokens are valid for one hour.
GetGrant
Show Description Gets detailed information about the specified grant.
GetLicense
Show Description Gets detailed information about the specified license.
GetLicenseConfiguration
Show Description Gets detailed information about the specified license configuration.
GetLicenseConversionTask
Show Description Gets information about the specified license type conversion task.
GetLicenseManagerReportGenerator
Show Description Gets information about the specified report generator.
GetLicenseUsage
Show Description Gets detailed information about the usage of the specified license.
GetServiceSettings
Show Description Gets the License Manager settings for the current Region.
ListAssociationsForLicenseConfiguration
Show Description Lists the resource associations for the specified license configuration. Resource associations need not consume licenses from a license configuration. For example, an AMI or a stopped instance might not consume a license (depending on the license rules).
ListDistributedGrants
Show Description Lists the grants distributed for the specified license.
ListFailuresForLicenseConfigurationOperations
Show Description Lists the license configuration operations that failed.
ListLicenseConfigurations
Show Description Lists the license configurations for your account.
ListLicenseConversionTasks
Show Description Lists the license type conversion tasks for your account.
ListLicenseManagerReportGenerators
Show Description Lists the report generators for your account.
ListLicenseSpecificationsForResource
Show Description Describes the license configurations for the specified resource.
ListLicenseVersions
Show Description Lists all versions of the specified license.
ListLicenses
Show Description Lists the licenses for your account.
ListReceivedGrants
Show Description Lists grants that are received but not accepted.
ListReceivedLicenses
Show Description Lists received licenses.
ListResourceInventory
Show Description Lists resources managed using Systems Manager inventory.
ListTagsForResource
Show Description Lists the tags for the specified license configuration.
ListTokens
Show Description Lists your tokens.
ListUsageForLicenseConfiguration
Show Description Lists all license usage records for a license configuration, displaying license consumption details by resource at a selected point in time. Use this action to audit the current license consumption for any license inventory and configuration.
RejectGrant
Show Description Rejects the specified grant.
TagResource
Show Description Adds the specified tags to the specified license configuration.
UntagResource
Show Description Removes the specified tags from the specified license configuration.
UpdateLicenseConfiguration
Show Description Modifies the attributes of an existing license configuration.
UpdateLicenseManagerReportGenerator
Show Description Updates a report generator. After you make changes to a report generator, it starts generating new reports within 60 minutes of being updated.
UpdateLicenseSpecificationsForResource
Show Description Adds or removes the specified license configurations for the specified Amazon Web Services resource. You can update the license specifications of AMIs, instances, and hosts. You cannot update the license specifications for launch templates and CloudFormation templates, as they send license configurations to the operation that creates the resource.

Lightsail Events

Service Event Name Description
lightsail AllocateStaticIp
Show Description Allocates a static IP address.
AttachCertificateToDistribution
Show Description Attaches an SSL/TLS certificate to your Amazon Lightsail content delivery network (CDN) distribution. After the certificate is attached, your distribution accepts HTTPS traffic for all of the domains that are associated with the certificate. Use the CreateCertificate action to create a certificate that you can attach to your distribution. Only certificates created in the us-east-1 AWS Region can be attached to Lightsail distributions. Lightsail distributions are global resources that can reference an origin in any AWS Region, and distribute its content globally. However, all distributions are located in the us-east-1 Region.
AttachDisk
Show Description Attaches a block storage disk to a running or stopped Lightsail instance and exposes it to the instance with the specified disk name. The attach disk operation supports tag-based access control via resource tags applied to the resource identified by disk name. For more information, see the Amazon Lightsail Developer Guide.
AttachInstancesToLoadBalancer
Show Description Attaches one or more Lightsail instances to a load balancer. After some time, the instances are attached to the load balancer and the health check status is available. The attach instances to load balancer operation supports tag-based access control via resource tags applied to the resource identified by load balancer name. For more information, see the Lightsail Developer Guide.
AttachLoadBalancerTlsCertificate
Show Description Attaches a Transport Layer Security (TLS) certificate to your load balancer. TLS is just an updated, more secure version of Secure Socket Layer (SSL). Once you create and validate your certificate, you can attach it to your load balancer. You can also use this API to rotate the certificates on your account. Use the AttachLoadBalancerTlsCertificate action with the non-attached certificate, and it will replace the existing one and become the attached certificate. The AttachLoadBalancerTlsCertificate operation supports tag-based access control via resource tags applied to the resource identified by load balancer name. For more information, see the Amazon Lightsail Developer Guide.
AttachStaticIp
Show Description Attaches a static IP address to a specific Amazon Lightsail instance.
CloseInstancePublicPorts
Show Description Closes ports for a specific Amazon Lightsail instance. The CloseInstancePublicPorts action supports tag-based access control via resource tags applied to the resource identified by instanceName. For more information, see the Amazon Lightsail Developer Guide.
CopySnapshot
Show Description Copies a manual snapshot of an instance or disk as another manual snapshot, or copies an automatic snapshot of an instance or disk as a manual snapshot. This operation can also be used to copy a manual or automatic snapshot of an instance or a disk from one AWS Region to another in Amazon Lightsail. When copying a manual snapshot, be sure to define the source region, source snapshot name, and target snapshot name parameters. When copying an automatic snapshot, be sure to define the source region, source resource name, target snapshot name, and either the restore date or the use latest restorable auto snapshot parameters.
CreateBucket
Show Description Creates an Amazon Lightsail bucket. A bucket is a cloud storage resource available in the Lightsail object storage service. Use buckets to store objects such as data and its descriptive metadata. For more information about buckets, see Buckets in Amazon Lightsail in the Amazon Lightsail Developer Guide.
CreateBucketAccessKey
Show Description Creates a new access key for the specified Amazon Lightsail bucket. Access keys consist of an access key ID and corresponding secret access key. Access keys grant full programmatic access to the specified bucket and its objects. You can have a maximum of two access keys per bucket. Use the GetBucketAccessKeys action to get a list of current access keys for a specific bucket. For more information about access keys, see Creating access keys for a bucket in Amazon Lightsail in the Amazon Lightsail Developer Guide. The secretAccessKey value is returned only in response to the CreateBucketAccessKey action. You can get a secret access key only when you first create an access key; you cannot get the secret access key later. If you lose the secret access key, you must create a new access key.
CreateCertificate
Show Description Creates an SSL/TLS certificate for an Amazon Lightsail content delivery network (CDN) distribution and a container service. After the certificate is valid, use the AttachCertificateToDistribution action to use the certificate and its domains with your distribution. Or use the UpdateContainerService action to use the certificate and its domains with your container service. Only certificates created in the us-east-1 AWS Region can be attached to Lightsail distributions. Lightsail distributions are global resources that can reference an origin in any AWS Region, and distribute its content globally. However, all distributions are located in the us-east-1 Region.
CreateCloudFormationStack
Show Description Creates an AWS CloudFormation stack, which creates a new Amazon EC2 instance from an exported Amazon Lightsail snapshot. This operation results in a CloudFormation stack record that can be used to track the AWS CloudFormation stack created. Use the get cloud formation stack records operation to get a list of the CloudFormation stacks created. Wait until after your new Amazon EC2 instance is created before running the create cloud formation stack operation again with the same export snapshot record.
CreateContactMethod
Show Description Creates an email or SMS text message contact method. A contact method is used to send you notifications about your Amazon Lightsail resources. You can add one email address and one mobile phone number contact method in each AWS Region. However, SMS text messaging is not supported in some AWS Regions, and SMS text messages cannot be sent to some countries/regions. For more information, see Notifications in Amazon Lightsail.
CreateContainerService
Show Description Creates an Amazon Lightsail container service. A Lightsail container service is a compute resource to which you can deploy containers. For more information, see Container services in Amazon Lightsail in the Lightsail Dev Guide.
CreateContainerServiceDeployment
Show Description Creates a deployment for your Amazon Lightsail container service. A deployment specifies the containers that will be launched on the container service and their settings, such as the ports to open, the environment variables to apply, and the launch command to run. It also specifies the container that will serve as the public endpoint of the deployment and its settings, such as the HTTP or HTTPS port to use, and the health check configuration. You can deploy containers to your container service using container images from a public registry like Docker Hub, or from your local machine. For more information, see Creating container images for your Amazon Lightsail container services in the Amazon Lightsail Developer Guide.
CreateContainerServiceRegistryLogin
Show Description Creates a temporary set of log in credentials that you can use to log in to the Docker process on your local machine. After you're logged in, you can use the native Docker commands to push your local container images to the container image registry of your Amazon Lightsail account so that you can use them with your Lightsail container service. The log in credentials expire 12 hours after they are created, at which point you will need to create a new set of log in credentials. You can only push container images to the container service registry of your Lightsail account. You cannot pull container images or perform any other container image management actions on the container service registry. After you push your container images to the container image registry of your Lightsail account, use the RegisterContainerImage action to register the pushed images to a specific Lightsail container service. This action is not required if you install and use the Lightsail Control (lightsailctl) plugin to push container images to your Lightsail container service. For more information, see Pushing and managing container images on your Amazon Lightsail container services in the Amazon Lightsail Developer Guide.
CreateDisk
Show Description Creates a block storage disk that can be attached to an Amazon Lightsail instance in the same Availability Zone (e.g., us-east-2a). The create disk operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
CreateDiskFromSnapshot
Show Description Creates a block storage disk from a manual or automatic snapshot of a disk. The resulting disk can be attached to an Amazon Lightsail instance in the same Availability Zone (e.g., us-east-2a). The create disk from snapshot operation supports tag-based access control via request tags and resource tags applied to the resource identified by disk snapshot name. For more information, see the Amazon Lightsail Developer Guide.
CreateDiskSnapshot
Show Description Creates a snapshot of a block storage disk. You can use snapshots for backups, to make copies of disks, and to save data before shutting down a Lightsail instance. You can take a snapshot of an attached disk that is in use; however, snapshots only capture data that has been written to your disk at the time the snapshot command is issued. This may exclude any data that has been cached by any applications or the operating system. If you can pause any file systems on the disk long enough to take a snapshot, your snapshot should be complete. Nevertheless, if you cannot pause all file writes to the disk, you should unmount the disk from within the Lightsail instance, issue the create disk snapshot command, and then remount the disk to ensure a consistent and complete snapshot. You may remount and use your disk while the snapshot status is pending. You can also use this operation to create a snapshot of an instance's system volume. You might want to do this, for example, to recover data from the system volume of a botched instance or to create a backup of the system volume like you would for a block storage disk. To create a snapshot of a system volume, just define the instance name parameter when issuing the snapshot command, and a snapshot of the defined instance's system volume will be created. After the snapshot is available, you can create a block storage disk from the snapshot and attach it to a running instance to access the data on the disk. The create disk snapshot operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
CreateDistribution
Show Description Creates an Amazon Lightsail content delivery network (CDN) distribution. A distribution is a globally distributed network of caching servers that improve the performance of your website or web application hosted on a Lightsail instance. For more information, see Content delivery networks in Amazon Lightsail.
CreateDomain
Show Description Creates a domain resource for the specified domain (e.g., example.com). The create domain operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
CreateDomainEntry
Show Description Creates one of the following domain name system (DNS) records in a domain DNS zone: Address (A), canonical name (CNAME), mail exchanger (MX), name server (NS), start of authority (SOA), service locator (SRV), or text (TXT). The create domain entry operation supports tag-based access control via resource tags applied to the resource identified by domain name. For more information, see the Amazon Lightsail Developer Guide.
CreateInstanceSnapshot
Show Description Creates a snapshot of a specific virtual private server, or instance. You can use a snapshot to create a new instance that is based on that snapshot. The create instance snapshot operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
CreateInstances
Show Description Creates one or more Amazon Lightsail instances. The create instances operation supports tag-based access control via request tags. For more information, see the Lightsail Developer Guide.
CreateInstancesFromSnapshot
Show Description Creates one or more new instances from a manual or automatic snapshot of an instance. The create instances from snapshot operation supports tag-based access control via request tags and resource tags applied to the resource identified by instance snapshot name. For more information, see the Amazon Lightsail Developer Guide.
CreateKeyPair
Show Description Creates an SSH key pair. The create key pair operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
CreateLoadBalancer
Show Description Creates a Lightsail load balancer. To learn more about deciding whether to load balance your application, see Configure your Lightsail instances for load balancing. You can create up to 5 load balancers per AWS Region in your account. When you create a load balancer, you can specify a unique name and port settings. To change additional load balancer settings, use the UpdateLoadBalancerAttribute operation. The create load balancer operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
CreateLoadBalancerTlsCertificate
Show Description Creates an SSL/TLS certificate for an Amazon Lightsail load balancer. TLS is just an updated, more secure version of Secure Socket Layer (SSL). The CreateLoadBalancerTlsCertificate operation supports tag-based access control via resource tags applied to the resource identified by load balancer name. For more information, see the Amazon Lightsail Developer Guide.
CreateRelationalDatabase
Show Description Creates a new database in Amazon Lightsail. The create relational database operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
CreateRelationalDatabaseFromSnapshot
Show Description Creates a new database from an existing database snapshot in Amazon Lightsail. You can create a new database from a snapshot in if something goes wrong with your original database, or to change it to a different plan, such as a high availability or standard plan. The create relational database from snapshot operation supports tag-based access control via request tags and resource tags applied to the resource identified by relationalDatabaseSnapshotName. For more information, see the Amazon Lightsail Developer Guide.
CreateRelationalDatabaseSnapshot
Show Description Creates a snapshot of your database in Amazon Lightsail. You can use snapshots for backups, to make copies of a database, and to save data before deleting a database. The create relational database snapshot operation supports tag-based access control via request tags. For more information, see the Amazon Lightsail Developer Guide.
DeleteAlarm
Show Description Deletes an alarm. An alarm is used to monitor a single metric for one of your resources. When a metric condition is met, the alarm can notify you by email, SMS text message, and a banner displayed on the Amazon Lightsail console. For more information, see Alarms in Amazon Lightsail.
DeleteAutoSnapshot
Show Description Deletes an automatic snapshot of an instance or disk. For more information, see the Amazon Lightsail Developer Guide.
DeleteBucket
Show Description Deletes a Amazon Lightsail bucket. When you delete your bucket, the bucket name is released and can be reused for a new bucket in your account or another AWS account.
DeleteBucketAccessKey
Show Description Deletes an access key for the specified Amazon Lightsail bucket. We recommend that you delete an access key if the secret access key is compromised. For more information about access keys, see Creating access keys for a bucket in Amazon Lightsail in the Amazon Lightsail Developer Guide.
DeleteCertificate
Show Description Deletes an SSL/TLS certificate for your Amazon Lightsail content delivery network (CDN) distribution. Certificates that are currently attached to a distribution cannot be deleted. Use the DetachCertificateFromDistribution action to detach a certificate from a distribution.
DeleteContactMethod
Show Description Deletes a contact method. A contact method is used to send you notifications about your Amazon Lightsail resources. You can add one email address and one mobile phone number contact method in each AWS Region. However, SMS text messaging is not supported in some AWS Regions, and SMS text messages cannot be sent to some countries/regions. For more information, see Notifications in Amazon Lightsail.
DeleteContainerImage
Show Description Deletes a container image that is registered to your Amazon Lightsail container service.
DeleteContainerService
Show Description Deletes your Amazon Lightsail container service.
DeleteDisk
Show Description Deletes the specified block storage disk. The disk must be in the available state (not attached to a Lightsail instance). The disk may remain in the deleting state for several minutes. The delete disk operation supports tag-based access control via resource tags applied to the resource identified by disk name. For more information, see the Amazon Lightsail Developer Guide.
DeleteDiskSnapshot
Show Description Deletes the specified disk snapshot. When you make periodic snapshots of a disk, the snapshots are incremental, and only the blocks on the device that have changed since your last snapshot are saved in the new snapshot. When you delete a snapshot, only the data not needed for any other snapshot is removed. So regardless of which prior snapshots have been deleted, all active snapshots will have access to all the information needed to restore the disk. The delete disk snapshot operation supports tag-based access control via resource tags applied to the resource identified by disk snapshot name. For more information, see the Amazon Lightsail Developer Guide.
DeleteDistribution
Show Description Deletes your Amazon Lightsail content delivery network (CDN) distribution.
DeleteDomain
Show Description Deletes the specified domain recordset and all of its domain records. The delete domain operation supports tag-based access control via resource tags applied to the resource identified by domain name. For more information, see the Amazon Lightsail Developer Guide.
DeleteDomainEntry
Show Description Deletes a specific domain entry. The delete domain entry operation supports tag-based access control via resource tags applied to the resource identified by domain name. For more information, see the Amazon Lightsail Developer Guide.
DeleteInstance
Show Description Deletes an Amazon Lightsail instance. The delete instance operation supports tag-based access control via resource tags applied to the resource identified by instance name. For more information, see the Amazon Lightsail Developer Guide.
DeleteInstanceSnapshot
Show Description Deletes a specific snapshot of a virtual private server (or instance). The delete instance snapshot operation supports tag-based access control via resource tags applied to the resource identified by instance snapshot name. For more information, see the Amazon Lightsail Developer Guide.
DeleteKeyPair
Show Description Deletes a specific SSH key pair. The delete key pair operation supports tag-based access control via resource tags applied to the resource identified by key pair name. For more information, see the Amazon Lightsail Developer Guide.
DeleteKnownHostKeys
Show Description Deletes the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance. This operation enables the Lightsail browser-based SSH or RDP clients to connect to the instance after a host key mismatch. Perform this operation only if you were expecting the host key or certificate mismatch or if you are familiar with the new host key or certificate on the instance. For more information, see Troubleshooting connection issues when using the Amazon Lightsail browser-based SSH or RDP client.
DeleteLoadBalancer
Show Description Deletes a Lightsail load balancer and all its associated SSL/TLS certificates. Once the load balancer is deleted, you will need to create a new load balancer, create a new certificate, and verify domain ownership again. The delete load balancer operation supports tag-based access control via resource tags applied to the resource identified by load balancer name. For more information, see the Amazon Lightsail Developer Guide.
DeleteLoadBalancerTlsCertificate
Show Description Deletes an SSL/TLS certificate associated with a Lightsail load balancer. The DeleteLoadBalancerTlsCertificate operation supports tag-based access control via resource tags applied to the resource identified by load balancer name. For more information, see the Amazon Lightsail Developer Guide.
DeleteRelationalDatabase
Show Description Deletes a database in Amazon Lightsail. The delete relational database operation supports tag-based access control via resource tags applied to the resource identified by relationalDatabaseName. For more information, see the Amazon Lightsail Developer Guide.
DeleteRelationalDatabaseSnapshot
Show Description Deletes a database snapshot in Amazon Lightsail. The delete relational database snapshot operation supports tag-based access control via resource tags applied to the resource identified by relationalDatabaseName. For more information, see the Amazon Lightsail Developer Guide.
DetachCertificateFromDistribution
Show Description Detaches an SSL/TLS certificate from your Amazon Lightsail content delivery network (CDN) distribution. After the certificate is detached, your distribution stops accepting traffic for all of the domains that are associated with the certificate.
DetachDisk
Show Description Detaches a stopped block storage disk from a Lightsail instance. Make sure to unmount any file systems on the device within your operating system before stopping the instance and detaching the disk. The detach disk operation supports tag-based access control via resource tags applied to the resource identified by disk name. For more information, see the Amazon Lightsail Developer Guide.
DetachInstancesFromLoadBalancer
Show Description Detaches the specified instances from a Lightsail load balancer. This operation waits until the instances are no longer needed before they are detached from the load balancer. The detach instances from load balancer operation supports tag-based access control via resource tags applied to the resource identified by load balancer name. For more information, see the Amazon Lightsail Developer Guide.
DetachStaticIp
Show Description Detaches a static IP from the Amazon Lightsail instance to which it is attached.
DisableAddOn
Show Description Disables an add-on for an Amazon Lightsail resource. For more information, see the Amazon Lightsail Developer Guide.
DownloadDefaultKeyPair
Show Description Downloads the default SSH key pair from the user's account.
EnableAddOn
Show Description Enables or modifies an add-on for an Amazon Lightsail resource. For more information, see the Amazon Lightsail Developer Guide.
ExportSnapshot
Show Description Exports an Amazon Lightsail instance or block storage disk snapshot to Amazon Elastic Compute Cloud (Amazon EC2). This operation results in an export snapshot record that can be used with the create cloud formation stack operation to create new Amazon EC2 instances. Exported instance snapshots appear in Amazon EC2 as Amazon Machine Images (AMIs), and the instance system disk appears as an Amazon Elastic Block Store (Amazon EBS) volume. Exported disk snapshots appear in Amazon EC2 as Amazon EBS volumes. Snapshots are exported to the same Amazon Web Services Region in Amazon EC2 as the source Lightsail snapshot.

The export snapshot operation supports tag-based access control via resource tags applied to the resource identified by source snapshot name. For more information, see the Amazon Lightsail Developer Guide. Use the get instance snapshots or get disk snapshots operations to get a list of snapshots that you can export to Amazon EC2.

GetActiveNames
Show Description Returns the names of all active (not deleted) resources.
GetAlarms
Show Description Returns information about the configured alarms. Specify an alarm name in your request to return information about a specific alarm, or specify a monitored resource name to return information about all alarms for a specific resource. An alarm is used to monitor a single metric for one of your resources. When a metric condition is met, the alarm can notify you by email, SMS text message, and a banner displayed on the Amazon Lightsail console. For more information, see Alarms in Amazon Lightsail.
GetAutoSnapshots
Show Description Returns the available automatic snapshots for an instance or disk. For more information, see the Amazon Lightsail Developer Guide.
GetBlueprints
Show Description Returns the list of available instance images, or blueprints. You can use a blueprint to create a new instance already running a specific operating system, as well as a preinstalled app or development stack. The software each instance is running depends on the blueprint image you choose. Use active blueprints when creating new instances. Inactive blueprints are listed to support customers with existing instances and are not necessarily available to create new instances. Blueprints are marked inactive when they become outdated due to operating system updates or new application releases.
GetBucketAccessKeys
Show Description Returns the existing access key IDs for the specified Amazon Lightsail bucket. This action does not return the secret access key value of an access key. You can get a secret access key only when you create it from the response of the CreateBucketAccessKey action. If you lose the secret access key, you must create a new access key.
GetBucketBundles
Show Description Returns the bundles that you can apply to a Amazon Lightsail bucket. The bucket bundle specifies the monthly cost, storage quota, and data transfer quota for a bucket. Use the UpdateBucketBundle action to update the bundle for a bucket.
GetBucketMetricData
Show Description Returns the data points of a specific metric for an Amazon Lightsail bucket. Metrics report the utilization of a bucket. View and collect metric data regularly to monitor the number of objects stored in a bucket (including object versions) and the storage space used by those objects.
GetBuckets
Show Description Returns information about one or more Amazon Lightsail buckets. For more information about buckets, see Buckets in Amazon Lightsail in the Amazon Lightsail Developer Guide..
GetBundles
Show Description Returns the list of bundles that are available for purchase. A bundle describes the specs for your virtual private server (or instance).
GetCertificates
Show Description Returns information about one or more Amazon Lightsail SSL/TLS certificates. To get a summary of a certificate, ommit includeCertificateDetails from your request. The response will include only the certificate Amazon Resource Name (ARN), certificate name, domain name, and tags.
GetCloudFormationStackRecords
Show Description Returns the CloudFormation stack record created as a result of the create cloud formation stack operation. An AWS CloudFormation stack is used to create a new Amazon EC2 instance from an exported Lightsail snapshot.
GetContactMethods
Show Description Returns information about the configured contact methods. Specify a protocol in your request to return information about a specific contact method. A contact method is used to send you notifications about your Amazon Lightsail resources. You can add one email address and one mobile phone number contact method in each AWS Region. However, SMS text messaging is not supported in some AWS Regions, and SMS text messages cannot be sent to some countries/regions. For more information, see Notifications in Amazon Lightsail.
GetContainerAPIMetadata
Show Description Returns information about Amazon Lightsail containers, such as the current version of the Lightsail Control (lightsailctl) plugin.
GetContainerImages
Show Description Returns the container images that are registered to your Amazon Lightsail container service. If you created a deployment on your Lightsail container service that uses container images from a public registry like Docker Hub, those images are not returned as part of this action. Those images are not registered to your Lightsail container service.
GetContainerLog
Show Description Returns the log events of a container of your Amazon Lightsail container service. If your container service has more than one node (i.e., a scale greater than 1), then the log events that are returned for the specified container are merged from all nodes on your container service. Container logs are retained for a certain amount of time. For more information, see Amazon Lightsail endpoints and quotas in the AWS General Reference.
GetContainerServiceDeployments
Show Description Returns the deployments for your Amazon Lightsail container service A deployment specifies the settings, such as the ports and launch command, of containers that are deployed to your container service. The deployments are ordered by version in ascending order. The newest version is listed at the top of the response. A set number of deployments are kept before the oldest one is replaced with the newest one. For more information, see Amazon Lightsail endpoints and quotas in the AWS General Reference.
GetContainerServiceMetricData
Show Description Returns the data points of a specific metric of your Amazon Lightsail container service. Metrics report the utilization of your resources. Monitor and collect metric data regularly to maintain the reliability, availability, and performance of your resources.
GetContainerServicePowers
Show Description Returns the list of powers that can be specified for your Amazon Lightsail container services. The power specifies the amount of memory, the number of vCPUs, and the base price of the container service.
GetContainerServices
Show Description Returns information about one or more of your Amazon Lightsail container services.
GetDisk
Show Description Returns information about a specific block storage disk.
GetDiskSnapshot
Show Description Returns information about a specific block storage disk snapshot.
GetDiskSnapshots
Show Description Returns information about all block storage disk snapshots in your AWS account and region.
GetDisks
Show Description Returns information about all block storage disks in your AWS account and region.
GetDistributionBundles
Show Description Returns the bundles that can be applied to your Amazon Lightsail content delivery network (CDN) distributions. A distribution bundle specifies the monthly network transfer quota and monthly cost of your dsitribution.
GetDistributionLatestCacheReset
Show Description Returns the timestamp and status of the last cache reset of a specific Amazon Lightsail content delivery network (CDN) distribution.
GetDistributionMetricData
Show Description Returns the data points of a specific metric for an Amazon Lightsail content delivery network (CDN) distribution. Metrics report the utilization of your resources, and the error counts generated by them. Monitor and collect metric data regularly to maintain the reliability, availability, and performance of your resources.
GetDistributions
Show Description Returns information about one or more of your Amazon Lightsail content delivery network (CDN) distributions.
GetDomain
Show Description Returns information about a specific domain recordset.
GetDomains
Show Description Returns a list of all domains in the user's account.
GetExportSnapshotRecords
Show Description Returns all export snapshot records created as a result of the export snapshot operation. An export snapshot record can be used to create a new Amazon EC2 instance and its related resources with the CreateCloudFormationStack action.
GetInstance
Show Description Returns information about a specific Amazon Lightsail instance, which is a virtual private server.
GetInstanceAccessDetails
Show Description Returns temporary SSH keys you can use to connect to a specific virtual private server, or instance. The get instance access details operation supports tag-based access control via resource tags applied to the resource identified by instance name. For more information, see the Amazon Lightsail Developer Guide.
GetInstanceMetricData
Show Description Returns the data points for the specified Amazon Lightsail instance metric, given an instance name. Metrics report the utilization of your resources, and the error counts generated by them. Monitor and collect metric data regularly to maintain the reliability, availability, and performance of your resources.
GetInstancePortStates
Show Description Returns the firewall port states for a specific Amazon Lightsail instance, the IP addresses allowed to connect to the instance through the ports, and the protocol.
GetInstanceSnapshot
Show Description Returns information about a specific instance snapshot.
GetInstanceSnapshots
Show Description Returns all instance snapshots for the user's account.
GetInstanceState
Show Description Returns the state of a specific instance. Works on one instance at a time.
GetInstances
Show Description Returns information about all Amazon Lightsail virtual private servers, or instances.
GetKeyPair
Show Description Returns information about a specific key pair.
GetKeyPairs
Show Description Returns information about all key pairs in the user's account.
GetLoadBalancer
Show Description Returns information about the specified Lightsail load balancer.
GetLoadBalancerMetricData
Show Description Returns information about health metrics for your Lightsail load balancer. Metrics report the utilization of your resources, and the error counts generated by them. Monitor and collect metric data regularly to maintain the reliability, availability, and performance of your resources.
GetLoadBalancerTlsCertificates
Show Description Returns information about the TLS certificates that are associated with the specified Lightsail load balancer. TLS is just an updated, more secure version of Secure Socket Layer (SSL). You can have a maximum of 2 certificates associated with a Lightsail load balancer. One is active and the other is inactive.
GetLoadBalancers
Show Description Returns information about all load balancers in an account.
GetOperation
Show Description Returns information about a specific operation. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on.
GetOperations
Show Description Returns information about all operations. Results are returned from oldest to newest, up to a maximum of 200. Results can be paged by making each subsequent call to GetOperations use the maximum (last) statusChangedAt value from the previous request.
GetOperationsForResource
Show Description Gets operations for a specific resource (e.g., an instance or a static IP).
GetRegions
Show Description Returns a list of all valid regions for Amazon Lightsail. Use the include availability zones parameter to also return the Availability Zones in a region.
GetRelationalDatabase
Show Description Returns information about a specific database in Amazon Lightsail.
GetRelationalDatabaseBlueprints
Show Description Returns a list of available database blueprints in Amazon Lightsail. A blueprint describes the major engine version of a database. You can use a blueprint ID to create a new database that runs a specific database engine.
GetRelationalDatabaseBundles
Show Description Returns the list of bundles that are available in Amazon Lightsail. A bundle describes the performance specifications for a database. You can use a bundle ID to create a new database with explicit performance specifications.
GetRelationalDatabaseEvents
Show Description Returns a list of events for a specific database in Amazon Lightsail.
GetRelationalDatabaseLogEvents
Show Description Returns a list of log events for a database in Amazon Lightsail.
GetRelationalDatabaseLogStreams
Show Description Returns a list of available log streams for a specific database in Amazon Lightsail.
GetRelationalDatabaseMasterUserPassword
Show Description Returns the current, previous, or pending versions of the master user password for a Lightsail database. The GetRelationalDatabaseMasterUserPassword operation supports tag-based access control via resource tags applied to the resource identified by relationalDatabaseName.
GetRelationalDatabaseMetricData
Show Description Returns the data points of the specified metric for a database in Amazon Lightsail. Metrics report the utilization of your resources, and the error counts generated by them. Monitor and collect metric data regularly to maintain the reliability, availability, and performance of your resources.
GetRelationalDatabaseParameters
Show Description Returns all of the runtime parameters offered by the underlying database software, or engine, for a specific database in Amazon Lightsail. In addition to the parameter names and values, this operation returns other information about each parameter. This information includes whether changes require a reboot, whether the parameter is modifiable, the allowed values, and the data types.
GetRelationalDatabaseSnapshot
Show Description Returns information about a specific database snapshot in Amazon Lightsail.
GetRelationalDatabaseSnapshots
Show Description Returns information about all of your database snapshots in Amazon Lightsail.
GetRelationalDatabases
Show Description Returns information about all of your databases in Amazon Lightsail.
GetStaticIp
Show Description Returns information about an Amazon Lightsail static IP.
GetStaticIps
Show Description Returns information about all static IPs in the user's account.
ImportKeyPair
Show Description Imports a public SSH key from a specific key pair.
IsVpcPeered
Show Description Returns a Boolean value indicating whether your Lightsail VPC is peered.
OpenInstancePublicPorts
Show Description Opens ports for a specific Amazon Lightsail instance, and specifies the IP addresses allowed to connect to the instance through the ports, and the protocol. The OpenInstancePublicPorts action supports tag-based access control via resource tags applied to the resource identified by instanceName. For more information, see the Amazon Lightsail Developer Guide.
PeerVpc
Show Description Peers the Lightsail VPC with the user's default VPC.
PutAlarm
Show Description Creates or updates an alarm, and associates it with the specified metric. An alarm is used to monitor a single metric for one of your resources. When a metric condition is met, the alarm can notify you by email, SMS text message, and a banner displayed on the Amazon Lightsail console. For more information, see Alarms in Amazon Lightsail. When this action creates an alarm, the alarm state is immediately set to INSUFFICIENT_DATA. The alarm is then evaluated and its state is set appropriately. Any actions associated with the new state are then executed. When you update an existing alarm, its state is left unchanged, but the update completely overwrites the previous configuration of the alarm. The alarm is then evaluated with the updated configuration.
PutInstancePublicPorts
Show Description Opens ports for a specific Amazon Lightsail instance, and specifies the IP addresses allowed to connect to the instance through the ports, and the protocol. This action also closes all currently open ports that are not included in the request. Include all of the ports and the protocols you want to open in your PutInstancePublicPortsrequest. Or use the OpenInstancePublicPorts action to open ports without closing currently open ports. The PutInstancePublicPorts action supports tag-based access control via resource tags applied to the resource identified by instanceName. For more information, see the Amazon Lightsail Developer Guide.
RebootInstance
Show Description Restarts a specific instance. The reboot instance operation supports tag-based access control via resource tags applied to the resource identified by instance name. For more information, see the Amazon Lightsail Developer Guide.
RebootRelationalDatabase
Show Description Restarts a specific database in Amazon Lightsail. The reboot relational database operation supports tag-based access control via resource tags applied to the resource identified by relationalDatabaseName. For more information, see the Amazon Lightsail Developer Guide.
RegisterContainerImage
Show Description Registers a container image to your Amazon Lightsail container service. This action is not required if you install and use the Lightsail Control (lightsailctl) plugin to push container images to your Lightsail container service. For more information, see Pushing and managing container images on your Amazon Lightsail container services in the Amazon Lightsail Developer Guide.
ReleaseStaticIp
Show Description Deletes a specific static IP from your account.
ResetDistributionCache
Show Description Deletes currently cached content from your Amazon Lightsail content delivery network (CDN) distribution. After resetting the cache, the next time a content request is made, your distribution pulls, serves, and caches it from the origin.
SendContactMethodVerification
Show Description Sends a verification request to an email contact method to ensure it's owned by the requester. SMS contact methods don't need to be verified. A contact method is used to send you notifications about your Amazon Lightsail resources. You can add one email address and one mobile phone number contact method in each AWS Region. However, SMS text messaging is not supported in some AWS Regions, and SMS text messages cannot be sent to some countries/regions. For more information, see Notifications in Amazon Lightsail. A verification request is sent to the contact method when you initially create it. Use this action to send another verification request if a previous verification request was deleted, or has expired. Notifications are not sent to an email contact method until after it is verified, and confirmed as valid.
SetIpAddressType
Show Description Sets the IP address type for an Amazon Lightsail resource. Use this action to enable dual-stack for a resource, which enables IPv4 and IPv6 for the specified resource. Alternately, you can use this action to disable dual-stack, and enable IPv4 only.
SetResourceAccessForBucket
Show Description Sets the Amazon Lightsail resources that can access the specified Lightsail bucket. Lightsail buckets currently support setting access for Lightsail instances in the same AWS Region.
StartInstance
Show Description Starts a specific Amazon Lightsail instance from a stopped state. To restart an instance, use the reboot instance operation. When you start a stopped instance, Lightsail assigns a new public IP address to the instance. To use the same IP address after stopping and starting an instance, create a static IP address and attach it to the instance. For more information, see the Amazon Lightsail Developer Guide. The start instance operation supports tag-based access control via resource tags applied to the resource identified by instance name. For more information, see the Amazon Lightsail Developer Guide.
StartRelationalDatabase
Show Description Starts a specific database from a stopped state in Amazon Lightsail. To restart a database, use the reboot relational database operation. The start relational database operation supports tag-based access control via resource tags applied to the resource identified by relationalDatabaseName. For more information, see the Amazon Lightsail Developer Guide.
StopInstance
Show Description Stops a specific Amazon Lightsail instance that is currently running. When you start a stopped instance, Lightsail assigns a new public IP address to the instance. To use the same IP address after stopping and starting an instance, create a static IP address and attach it to the instance. For more information, see the Amazon Lightsail Developer Guide. The stop instance operation supports tag-based access control via resource tags applied to the resource identified by instance name. For more information, see the Amazon Lightsail Developer Guide.
StopRelationalDatabase
Show Description Stops a specific database that is currently running in Amazon Lightsail. The stop relational database operation supports tag-based access control via resource tags applied to the resource identified by relationalDatabaseName. For more information, see the Amazon Lightsail Developer Guide.
TagResource
Show Description Adds one or more tags to the specified Amazon Lightsail resource. Each resource can have a maximum of 50 tags. Each tag consists of a key and an optional value. Tag keys must be unique per resource. For more information about tags, see the Amazon Lightsail Developer Guide. The tag resource operation supports tag-based access control via request tags and resource tags applied to the resource identified by resource name. For more information, see the Amazon Lightsail Developer Guide.
TestAlarm
Show Description Tests an alarm by displaying a banner on the Amazon Lightsail console. If a notification trigger is configured for the specified alarm, the test also sends a notification to the notification protocol (Email and/or SMS) configured for the alarm. An alarm is used to monitor a single metric for one of your resources. When a metric condition is met, the alarm can notify you by email, SMS text message, and a banner displayed on the Amazon Lightsail console. For more information, see Alarms in Amazon Lightsail.
UnpeerVpc
Show Description Unpeers the Lightsail VPC from the user's default VPC.
UntagResource
Show Description Deletes the specified set of tag keys and their values from the specified Amazon Lightsail resource. The untag resource operation supports tag-based access control via request tags and resource tags applied to the resource identified by resource name. For more information, see the Amazon Lightsail Developer Guide.
UpdateBucket
Show Description Updates an existing Amazon Lightsail bucket. Use this action to update the configuration of an existing bucket, such as versioning, public accessibility, and the AWS accounts that can access the bucket.
UpdateBucketBundle
Show Description Updates the bundle, or storage plan, of an existing Amazon Lightsail bucket. A bucket bundle specifies the monthly cost, storage space, and data transfer quota for a bucket. You can update a bucket's bundle only one time within a monthly AWS billing cycle. To determine if you can update a bucket's bundle, use the GetBuckets action. The ableToUpdateBundle parameter in the response will indicate whether you can currently update a bucket's bundle. Update a bucket's bundle if it's consistently going over its storage space or data transfer quota, or if a bucket's usage is consistently in the lower range of its storage space or data transfer quota. Due to the unpredictable usage fluctuations that a bucket might experience, we strongly recommend that you update a bucket's bundle only as a long-term strategy, instead of as a short-term, monthly cost-cutting measure. Choose a bucket bundle that will provide the bucket with ample storage space and data transfer for a long time to come.
UpdateContainerService
Show Description Updates the configuration of your Amazon Lightsail container service, such as its power, scale, and public domain names.
UpdateDistribution
Show Description Updates an existing Amazon Lightsail content delivery network (CDN) distribution. Use this action to update the configuration of your existing distribution.
UpdateDistributionBundle
Show Description Updates the bundle of your Amazon Lightsail content delivery network (CDN) distribution. A distribution bundle specifies the monthly network transfer quota and monthly cost of your dsitribution. Update your distribution's bundle if your distribution is going over its monthly network transfer quota and is incurring an overage fee. You can update your distribution's bundle only one time within your monthly AWS billing cycle. To determine if you can update your distribution's bundle, use the GetDistributions action. The ableToUpdateBundle parameter in the result will indicate whether you can currently update your distribution's bundle.
UpdateDomainEntry
Show Description Updates a domain recordset after it is created. The update domain entry operation supports tag-based access control via resource tags applied to the resource identified by domain name. For more information, see the Amazon Lightsail Developer Guide.
UpdateLoadBalancerAttribute
Show Description Updates the specified attribute for a load balancer. You can only update one attribute at a time. The update load balancer attribute operation supports tag-based access control via resource tags applied to the resource identified by load balancer name. For more information, see the Amazon Lightsail Developer Guide.
UpdateRelationalDatabase
Show Description Allows the update of one or more attributes of a database in Amazon Lightsail. Updates are applied immediately, or in cases where the updates could result in an outage, are applied during the database's predefined maintenance window. The update relational database operation supports tag-based access control via resource tags applied to the resource identified by relationalDatabaseName. For more information, see the Amazon Lightsail Developer Guide.

Logs Events

Service Event Name Description
logs AssociateKmsKey
CancelExportTask
CreateExportTask
Show Description Creates an export task, which allows you to efficiently export data from a log group to an Amazon S3 bucket. When you perform a CreateExportTask operation, you must use credentials that have permission to write to the S3 bucket that you specify as the destination. This is an asynchronous call. If all the required information is provided, this operation initiates an export task and responds with the ID of the task. After the task has started, you can use DescribeExportTasks to get the status of the export task. Each account can only have one active (RUNNING or PENDING) export task at a time. To cancel an export task, use CancelExportTask. You can export logs from multiple log groups or multiple time ranges to the same S3 bucket. To separate out log data for each export task, you can specify a prefix to be used as the Amazon S3 key prefix for all exported objects. Exporting to S3 buckets that are encrypted with AES-256 is supported. Exporting to S3 buckets encrypted with SSE-KMS is not supported.
CreateLogGroup
CreateLogStream
DeleteDestination
DeleteLogGroup
DeleteLogStream
DeleteMetricFilter
DeleteQueryDefinition
Show Description Deletes a saved CloudWatch Logs Insights query definition. A query definition contains details about a saved CloudWatch Logs Insights query. Each DeleteQueryDefinition operation can delete one query definition. You must have the logs:DeleteQueryDefinition permission to be able to perform this operation.
DeleteResourcePolicy
DeleteRetentionPolicy
DeleteSubscriptionFilter
DescribeDestinations
Show Description Lists all your destinations. The results are ASCII-sorted by destination name.
DescribeExportTasks
Show Description Lists the specified export tasks. You can list all your export tasks or filter the results based on task ID or task status.
DescribeLogGroups
Show Description Lists the specified log groups. You can list all your log groups or filter the results by prefix. The results are ASCII-sorted by log group name. CloudWatch Logs doesn’t support IAM policies that control access to the DescribeLogGroups action by using the aws:ResourceTag/key-name condition key. Other CloudWatch Logs actions do support the use of the aws:ResourceTag/key-name condition key to control access. For more information about using tags to control access, see Controlling access to Amazon Web Services resources using tags.
DescribeLogStreams
Show Description Lists the log streams for the specified log group. You can list all the log streams or filter the results by prefix. You can also control how the results are ordered. This operation has a limit of five transactions per second, after which transactions are throttled.
DescribeMetricFilters
Show Description Lists the specified metric filters. You can list all of the metric filters or filter the results by log name, prefix, metric name, or metric namespace. The results are ASCII-sorted by filter name.
DescribeQueries
Show Description Returns a list of CloudWatch Logs Insights queries that are scheduled, executing, or have been executed recently in this account. You can request all queries or limit it to queries of a specific log group or queries with a certain status.
DescribeQueryDefinitions
Show Description This operation returns a paginated list of your saved CloudWatch Logs Insights query definitions. You can use the queryDefinitionNamePrefix parameter to limit the results to only the query definitions that have names that start with a certain string.
DescribeResourcePolicies
Show Description Lists the resource policies in this account.
DescribeSubscriptionFilters
Show Description Lists the subscription filters for the specified log group. You can list all the subscription filters or filter the results by prefix. The results are ASCII-sorted by filter name.
DisassociateKmsKey
FilterLogEvents
Show Description Lists log events from the specified log group. You can list all the log events or filter the results using a filter pattern, a time range, and the name of the log stream. By default, this operation returns as many log events as can fit in 1 MB (up to 10,000 log events) or all the events found within the time range that you specify. If the results include a token, then there are more log events available, and you can get additional results by specifying the token in a subsequent call. This operation can return empty results while there are more log events available through the token. The returned log events are sorted by event timestamp, the timestamp when the event was ingested by CloudWatch Logs, and the ID of the PutLogEvents request.
GetLogEvents
Show Description Lists log events from the specified log stream. You can list all of the log events or filter using a time range. By default, this operation returns as many log events as can fit in a response size of 1MB (up to 10,000 log events). You can get additional log events by specifying one of the tokens in a subsequent call. This operation can return empty results while there are more log events available through the token.
GetLogGroupFields
Show Description Returns a list of the fields that are included in log events in the specified log group, along with the percentage of log events that contain each field. The search is limited to a time period that you specify. In the results, fields that start with @ are fields generated by CloudWatch Logs. For example, @timestamp is the timestamp of each log event. For more information about the fields that are generated by CloudWatch logs, see Supported Logs and Discovered Fields. The response results are sorted by the frequency percentage, starting with the highest percentage.
GetLogRecord
Show Description Retrieves all of the fields and values of a single log event. All fields are retrieved, even if the original query that produced the logRecordPointer retrieved only a subset of fields. Fields are returned as field name/field value pairs. The full unparsed log event is returned within @message.
GetQueryResults
Show Description Returns the results from the specified query. Only the fields requested in the query are returned, along with a @ptr field, which is the identifier for the log record. You can use the value of @ptr in a GetLogRecord operation to get the full log record. GetQueryResults does not start a query execution. To run a query, use StartQuery. If the value of the Status field in the output is Running, this operation returns only partial results. If you see a value of Scheduled or Running for the status, you can retry the operation later to see the final results.
ListTagsLogGroup
Show Description Lists the tags for the specified log group.
PutDestination
Show Description Creates or updates a destination. This operation is used only to create destinations for cross-account subscriptions. A destination encapsulates a physical resource (such as an Amazon Kinesis stream) and enables you to subscribe to a real-time stream of log events for a different account, ingested using PutLogEvents. Through an access policy, a destination controls what is written to it. By default, PutDestination does not set any access policy with the destination, which means a cross-account user cannot call PutSubscriptionFilter against this destination. To enable this, the destination owner must call PutDestinationPolicy after PutDestination. To perform a PutDestination operation, you must also have the iam:PassRole permission.
PutDestinationPolicy
PutLogEvents
Show Description Uploads a batch of log events to the specified log stream. You must include the sequence token obtained from the response of the previous call. An upload in a newly created log stream does not require a sequence token. You can also get the sequence token in the expectedSequenceToken field from InvalidSequenceTokenException. If you call PutLogEvents twice within a narrow time period using the same value for sequenceToken, both calls might be successful or one might be rejected. The batch of events must satisfy the following constraints:
  • The maximum batch size is 1,048,576 bytes. This size is calculated as the sum of all event messages in UTF-8, plus 26 bytes for each log event.
  • None of the log events in the batch can be more than 2 hours in the future.
  • None of the log events in the batch can be older than 14 days or older than the retention period of the log group.
  • The log events in the batch must be in chronological order by their timestamp. The timestamp is the time the event occurred, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. (In Amazon Web Services Tools for PowerShell and the Amazon Web Services SDK for .NET, the timestamp is specified in .NET format: yyyy-mm-ddThh:mm:ss. For example, 2017-09-15T13:45:30.)
  • A batch of log events in a single request cannot span more than 24 hours. Otherwise, the operation fails.
  • The maximum number of log events in a batch is 10,000.
  • There is a quota of 5 requests per second per log stream. Additional requests are throttled. This quota can't be changed.
If a call to PutLogEvents returns "UnrecognizedClientException" the most likely cause is an invalid Amazon Web Services access key ID or secret key.
PutMetricFilter
PutQueryDefinition
Show Description Creates or updates a query definition for CloudWatch Logs Insights. For more information, see Analyzing Log Data with CloudWatch Logs Insights. To update a query definition, specify its queryDefinitionId in your request. The values of name, queryString, and logGroupNames are changed to the values that you specify in your update operation. No current values are retained from the current query definition. For example, if you update a current query definition that includes log groups, and you don't specify the logGroupNames parameter in your update operation, the query definition changes to contain no log groups. You must have the logs:PutQueryDefinition permission to be able to perform this operation.
PutResourcePolicy
Show Description Creates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53. An account can have up to 10 resource policies per Amazon Web Services Region.
PutRetentionPolicy
PutSubscriptionFilter
StartQuery
Show Description Schedules a query of a log group using CloudWatch Logs Insights. You specify the log group and time range to query and the query string to use. For more information, see CloudWatch Logs Insights Query Syntax. Queries time out after 15 minutes of execution. If your queries are timing out, reduce the time range being searched or partition your query into a number of queries.
StopQuery
Show Description Stops a CloudWatch Logs Insights query that is in progress. If the query has already ended, the operation returns an error indicating that the specified query is not running.
TagLogGroup
TestMetricFilter
Show Description Tests the filter pattern of a metric filter against a sample of log event messages. You can use this operation to validate the correctness of a metric filter pattern.

Lookoutequipment Events

Service Event Name Description
lookoutequipment CreateDataset
Show Description Creates a container for a collection of data being ingested for analysis. The dataset contains the metadata describing where the data is and what the data actually looks like. In other words, it contains the location of the data source, the data schema, and other information. A dataset also contains any tags associated with the ingested data.
CreateInferenceScheduler
Show Description Creates a scheduled inference. Scheduling an inference is setting up a continuous real-time inference plan to analyze new measurement data. When setting up the schedule, you provide an S3 bucket location for the input data, assign it a delimiter between separate entries in the data, set an offset delay if desired, and set the frequency of inferencing. You must also provide an S3 bucket location for the output data.
CreateModel
Show Description Creates an ML model for data inference. A machine-learning (ML) model is a mathematical model that finds patterns in your data. In Amazon Lookout for Equipment, the model learns the patterns of normal behavior and detects abnormal behavior that could be potential equipment failure (or maintenance events). The models are made by analyzing normal data and abnormalities in machine behavior that have already occurred. Your model is trained using a portion of the data from your dataset and uses that data to learn patterns of normal behavior and abnormal patterns that lead to equipment failure. Another portion of the data is used to evaluate the model's accuracy.
DeleteDataset
DeleteInferenceScheduler
DeleteModel
DescribeDataIngestionJob
Show Description Provides information on a specific data ingestion job such as creation time, dataset ARN, status, and so on.
DescribeDataset
Show Description Provides a JSON description of the data that is in each time series dataset, including names, column names, and data types.
DescribeInferenceScheduler
Show Description Specifies information about the inference scheduler being used, including name, model, status, and associated metadata
DescribeModel
Show Description Provides a JSON containing the overall information about a specific ML model, including model name and ARN, dataset, training and evaluation information, status, and so on.
ListDataIngestionJobs
Show Description Provides a list of all data ingestion jobs, including dataset name and ARN, S3 location of the input data, status, and so on.
ListDatasets
Show Description Lists all datasets currently available in your account, filtering on the dataset name.
ListInferenceExecutions
Show Description Lists all inference executions that have been performed by the specified inference scheduler.
ListInferenceSchedulers
Show Description Retrieves a list of all inference schedulers currently available for your account.
ListModels
Show Description Generates a list of all models in the account, including model name and ARN, dataset, and status.
ListTagsForResource
Show Description Lists all the tags for a specified resource, including key and value.
StartDataIngestionJob
Show Description Starts a data ingestion job. Amazon Lookout for Equipment returns the job status.
StartInferenceScheduler
Show Description Starts an inference scheduler.
StopInferenceScheduler
Show Description Stops an inference scheduler.
TagResource
Show Description Associates a given tag to a resource in your account. A tag is a key-value pair which can be added to an Amazon Lookout for Equipment resource as metadata. Tags can be used for organizing your resources as well as helping you to search and filter by tag. Multiple tags can be added to a resource, either when you create it, or later. Up to 50 tags can be associated with each resource.
UntagResource
Show Description Removes a specific tag from a given resource. The tag is specified by its key.

Lookoutmetrics Events

Service Event Name Description
lookoutmetrics ActivateAnomalyDetector
Show Description Activates an anomaly detector.
BackTestAnomalyDetector
Show Description Runs a backtest for anomaly detection for the specified resource.
CreateAlert
Show Description Creates an alert for an anomaly detector.
CreateAnomalyDetector
Show Description Creates an anomaly detector.
CreateMetricSet
Show Description Creates a dataset.
DeleteAlert
Show Description Deletes an alert.
DeleteAnomalyDetector
Show Description Deletes a detector. Deleting an anomaly detector will delete all of its corresponding resources including any configured datasets and alerts.
DescribeAlert
Show Description Describes an alert. Amazon Lookout for Metrics API actions are eventually consistent. If you do a read operation on a resource immediately after creating or modifying it, use retries to allow time for the write operation to complete.
DescribeAnomalyDetectionExecutions
Show Description Returns information about the status of the specified anomaly detection jobs.
DescribeAnomalyDetector
Show Description Describes a detector. Amazon Lookout for Metrics API actions are eventually consistent. If you do a read operation on a resource immediately after creating or modifying it, use retries to allow time for the write operation to complete.
DescribeMetricSet
Show Description Describes a dataset. Amazon Lookout for Metrics API actions are eventually consistent. If you do a read operation on a resource immediately after creating or modifying it, use retries to allow time for the write operation to complete.
GetAnomalyGroup
Show Description Returns details about a group of anomalous metrics.
GetFeedback
Show Description Get feedback for an anomaly group.
GetSampleData
Show Description Returns a selection of sample records from an Amazon S3 datasource.
ListAlerts
Show Description Lists the alerts attached to a detector. Amazon Lookout for Metrics API actions are eventually consistent. If you do a read operation on a resource immediately after creating or modifying it, use retries to allow time for the write operation to complete.
ListAnomalyDetectors
Show Description Lists the detectors in the current AWS Region. Amazon Lookout for Metrics API actions are eventually consistent. If you do a read operation on a resource immediately after creating or modifying it, use retries to allow time for the write operation to complete.
ListAnomalyGroupSummaries
Show Description Returns a list of anomaly groups.
ListAnomalyGroupTimeSeries
Show Description Gets a list of anomalous metrics for a measure in an anomaly group.
ListMetricSets
Show Description Lists the datasets in the current AWS Region. Amazon Lookout for Metrics API actions are eventually consistent. If you do a read operation on a resource immediately after creating or modifying it, use retries to allow time for the write operation to complete.
ListTagsForResource
Show Description Gets a list of tags for a detector, dataset, or alert.
PutFeedback
Show Description Add feedback for an anomalous metric.
TagResource
Show Description Adds tags to a detector, dataset, or alert.
UntagResource
Show Description Removes tags from a detector, dataset, or alert.
UpdateAnomalyDetector
Show Description Updates a detector. After activation, you can only change a detector's ingestion delay and description.

Lookoutvision Events

Service Event Name Description
lookoutvision CreateDataset
Show Description Creates a new dataset in an Amazon Lookout for Vision project. CreateDataset can create a training or a test dataset from a valid dataset source (DatasetSource). If you want a single dataset project, specify train for the value of DatasetType. To have a project with separate training and test datasets, call CreateDataset twice. On the first call, specify train for the value of DatasetType. On the second call, specify test for the value of DatasetType. This operation requires permissions to perform the lookoutvision:CreateDataset operation.
CreateModel
Show Description Creates a new version of a model within an an Amazon Lookout for Vision project. CreateModel is an asynchronous operation in which Amazon Lookout for Vision trains, tests, and evaluates a new version of a model. To get the current status, check the Status field returned in the response from DescribeModel. If the project has a single dataset, Amazon Lookout for Vision internally splits the dataset to create a training and a test dataset. If the project has a training and a test dataset, Lookout for Vision uses the respective datasets to train and test the model. After training completes, the evaluation metrics are stored at the location specified in OutputConfig. This operation requires permissions to perform the lookoutvision:CreateModel operation. If you want to tag your model, you also require permission to the lookoutvision:TagResource operation.
CreateProject
Show Description Creates an empty Amazon Lookout for Vision project. After you create the project, add a dataset by calling CreateDataset. This operation requires permissions to perform the lookoutvision:CreateProject operation.
DeleteDataset
Show Description Deletes an existing Amazon Lookout for Vision dataset. If your the project has a single dataset, you must create a new dataset before you can create a model. If you project has a training dataset and a test dataset consider the following.
  • If you delete the test dataset, your project reverts to a single dataset project. If you then train the model, Amazon Lookout for Vision internally splits the remaining dataset into a training and test dataset.
  • If you delete the training dataset, you must create a training dataset before you can create a model.
This operation requires permissions to perform the lookoutvision:DeleteDataset operation.
DeleteModel
Show Description Deletes an Amazon Lookout for Vision model. You can't delete a running model. To stop a running model, use the StopModel operation. It might take a few seconds to delete a model. To determine if a model has been deleted, call ListProjects and check if the version of the model (ModelVersion) is in the Models array. This operation requires permissions to perform the lookoutvision:DeleteModel operation.
DeleteProject
Show Description Deletes an Amazon Lookout for Vision project. To delete a project, you must first delete each version of the model associated with the project. To delete a model use the DeleteModel operation. You also have to delete the dataset(s) associated with the model. For more information, see DeleteDataset. The images referenced by the training and test datasets aren't deleted. This operation requires permissions to perform the lookoutvision:DeleteProject operation.
DescribeDataset
Show Description Describe an Amazon Lookout for Vision dataset. This operation requires permissions to perform the lookoutvision:DescribeDataset operation.
DescribeModel
Show Description Describes a version of an Amazon Lookout for Vision model. This operation requires permissions to perform the lookoutvision:DescribeModel operation.
DescribeProject
Show Description Describes an Amazon Lookout for Vision project. This operation requires permissions to perform the lookoutvision:DescribeProject operation.
DetectAnomalies
Show Description Detects anomalies in an image that you supply. The response from DetectAnomalies includes a boolean prediction that the image contains one or more anomalies and a confidence value for the prediction. Before calling DetectAnomalies, you must first start your model with the StartModel operation. You are charged for the amount of time, in minutes, that a model runs and for the number of anomaly detection units that your model uses. If you are not using a model, use the StopModel operation to stop your model. This operation requires permissions to perform the lookoutvision:DetectAnomalies operation.
ListDatasetEntries
Show Description Lists the JSON Lines within a dataset. An Amazon Lookout for Vision JSON Line contains the anomaly information for a single image, including the image location and the assigned label. This operation requires permissions to perform the lookoutvision:ListDatasetEntries operation.
ListModels
Show Description Lists the versions of a model in an Amazon Lookout for Vision project. This operation requires permissions to perform the lookoutvision:ListModels operation.
ListProjects
Show Description Lists the Amazon Lookout for Vision projects in your AWS account. This operation requires permissions to perform the lookoutvision:ListProjects operation.
ListTagsForResource
Show Description Returns a list of tags attached to the specified Amazon Lookout for Vision model. This operation requires permissions to perform the lookoutvision:ListTagsForResource operation.
StartModel
Show Description Starts the running of the version of an Amazon Lookout for Vision model. Starting a model takes a while to complete. To check the current state of the model, use DescribeModel. A model is ready to use when its status is HOSTED. Once the model is running, you can detect custom labels in new images by calling DetectAnomalies. You are charged for the amount of time that the model is running. To stop a running model, call StopModel. This operation requires permissions to perform the lookoutvision:StartModel operation.
StopModel
Show Description Stops the hosting of a running model. The operation might take a while to complete. To check the current status, call DescribeModel. After the model hosting stops, the Status of the model is TRAINED. This operation requires permissions to perform the lookoutvision:StopModel operation.
TagResource
Show Description Adds one or more key-value tags to an Amazon Lookout for Vision model. For more information, see Tagging a model in the Amazon Lookout for Vision Developer Guide. This operation requires permissions to perform the lookoutvision:TagResource operation.
UntagResource
Show Description Removes one or more tags from an Amazon Lookout for Vision model. For more information, see Tagging a model in the Amazon Lookout for Vision Developer Guide. This operation requires permissions to perform the lookoutvision:UntagResource operation.

Machinelearning Events

Service Event Name Description
machinelearning AddTags
Show Description Adds one or more tags to an object, up to a limit of 10. Each tag consists of a key and an optional value. If you add a tag using a key that is already associated with the ML object, AddTags updates the tag's value.
CreateBatchPrediction
Show Description Generates predictions for a group of observations. The observations to process exist in one or more data files referenced by a DataSource. This operation creates a new BatchPrediction, and uses an MLModel and the data files referenced by the DataSource as information sources. CreateBatchPrediction is an asynchronous operation. In response to CreateBatchPrediction, Amazon Machine Learning (Amazon ML) immediately returns and sets the BatchPrediction status to PENDING. After the BatchPrediction completes, Amazon ML sets the status to COMPLETED. You can poll for status updates by using the GetBatchPrediction operation and checking the Status parameter of the result. After the COMPLETED status appears, the results are available in the location specified by the OutputUri parameter.
CreateDataSourceFromRDS
Show Description Creates a DataSource object from an Amazon Relational Database Service (Amazon RDS). A DataSource references data that can be used to perform CreateMLModel, CreateEvaluation, or CreateBatchPrediction operations. CreateDataSourceFromRDS is an asynchronous operation. In response to CreateDataSourceFromRDS, Amazon Machine Learning (Amazon ML) immediately returns and sets the DataSource status to PENDING. After the DataSource is created and ready for use, Amazon ML sets the Status parameter to COMPLETED. DataSource in the COMPLETED or PENDING state can be used only to perform >CreateMLModel>, CreateEvaluation, or CreateBatchPrediction operations. If Amazon ML cannot accept the input source, it sets the Status parameter to FAILED and includes an error message in the Message attribute of the GetDataSource operation response.
CreateDataSourceFromRedshift
Show Description Creates a DataSource from a database hosted on an Amazon Redshift cluster. A DataSource references data that can be used to perform either CreateMLModel, CreateEvaluation, or CreateBatchPrediction operations. CreateDataSourceFromRedshift is an asynchronous operation. In response to CreateDataSourceFromRedshift, Amazon Machine Learning (Amazon ML) immediately returns and sets the DataSource status to PENDING. After the DataSource is created and ready for use, Amazon ML sets the Status parameter to COMPLETED. DataSource in COMPLETED or PENDING states can be used to perform only CreateMLModel, CreateEvaluation, or CreateBatchPrediction operations. If Amazon ML can't accept the input source, it sets the Status parameter to FAILED and includes an error message in the Message attribute of the GetDataSource operation response. The observations should be contained in the database hosted on an Amazon Redshift cluster and should be specified by a SelectSqlQuery query. Amazon ML executes an Unload command in Amazon Redshift to transfer the result set of the SelectSqlQuery query to S3StagingLocation. After the DataSource has been created, it's ready for use in evaluations and batch predictions. If you plan to use the DataSource to train an MLModel, the DataSource also requires a recipe. A recipe describes how each input variable will be used in training an MLModel. Will the variable be included or excluded from training? Will the variable be manipulated; for example, will it be combined with another variable or will it be split apart into word combinations? The recipe provides answers to these questions. You can't change an existing datasource, but you can copy and modify the settings from an existing Amazon Redshift datasource to create a new datasource. To do so, call GetDataSource for an existing datasource and copy the values to a CreateDataSource call. Change the settings that you want to change and make sure that all required fields have the appropriate values.
CreateDataSourceFromS3
Show Description Creates a DataSource object. A DataSource references data that can be used to perform CreateMLModel, CreateEvaluation, or CreateBatchPrediction operations. CreateDataSourceFromS3 is an asynchronous operation. In response to CreateDataSourceFromS3, Amazon Machine Learning (Amazon ML) immediately returns and sets the DataSource status to PENDING. After the DataSource has been created and is ready for use, Amazon ML sets the Status parameter to COMPLETED. DataSource in the COMPLETED or PENDING state can be used to perform only CreateMLModel, CreateEvaluation or CreateBatchPrediction operations. If Amazon ML can't accept the input source, it sets the Status parameter to FAILED and includes an error message in the Message attribute of the GetDataSource operation response. The observation data used in a DataSource should be ready to use; that is, it should have a consistent structure, and missing data values should be kept to a minimum. The observation data must reside in one or more .csv files in an Amazon Simple Storage Service (Amazon S3) location, along with a schema that describes the data items by name and type. The same schema must be used for all of the data files referenced by the DataSource. After the DataSource has been created, it's ready to use in evaluations and batch predictions. If you plan to use the DataSource to train an MLModel, the DataSource also needs a recipe. A recipe describes how each input variable will be used in training an MLModel. Will the variable be included or excluded from training? Will the variable be manipulated; for example, will it be combined with another variable or will it be split apart into word combinations? The recipe provides answers to these questions.
CreateEvaluation
Show Description Creates a new Evaluation of an MLModel. An MLModel is evaluated on a set of observations associated to a DataSource. Like a DataSource for an MLModel, the DataSource for an Evaluation contains values for the Target Variable. The Evaluation compares the predicted result for each observation to the actual outcome and provides a summary so that you know how effective the MLModel functions on the test data. Evaluation generates a relevant performance metric, such as BinaryAUC, RegressionRMSE or MulticlassAvgFScore based on the corresponding MLModelType: BINARY, REGRESSION or MULTICLASS. CreateEvaluation is an asynchronous operation. In response to CreateEvaluation, Amazon Machine Learning (Amazon ML) immediately returns and sets the evaluation status to PENDING. After the Evaluation is created and ready for use, Amazon ML sets the status to COMPLETED. You can use the GetEvaluation operation to check progress of the evaluation during the creation operation.
CreateMLModel
Show Description Creates a new MLModel using the DataSource and the recipe as information sources. An MLModel is nearly immutable. Users can update only the MLModelName and the ScoreThreshold in an MLModel without creating a new MLModel. CreateMLModel is an asynchronous operation. In response to CreateMLModel, Amazon Machine Learning (Amazon ML) immediately returns and sets the MLModel status to PENDING. After the MLModel has been created and ready is for use, Amazon ML sets the status to COMPLETED. You can use the GetMLModel operation to check the progress of the MLModel during the creation operation. CreateMLModel requires a DataSource with computed statistics, which can be created by setting ComputeStatistics to true in CreateDataSourceFromRDS, CreateDataSourceFromS3, or CreateDataSourceFromRedshift operations.
CreateRealtimeEndpoint
Show Description Creates a real-time endpoint for the MLModel. The endpoint contains the URI of the MLModel; that is, the location to send real-time prediction requests for the specified MLModel.
DeleteBatchPrediction
Show Description Assigns the DELETED status to a BatchPrediction, rendering it unusable. After using the DeleteBatchPrediction operation, you can use the GetBatchPrediction operation to verify that the status of the BatchPrediction changed to DELETED. Caution: The result of the DeleteBatchPrediction operation is irreversible.
DeleteDataSource
Show Description Assigns the DELETED status to a DataSource, rendering it unusable. After using the DeleteDataSource operation, you can use the GetDataSource operation to verify that the status of the DataSource changed to DELETED. Caution: The results of the DeleteDataSource operation are irreversible.
DeleteEvaluation
Show Description Assigns the DELETED status to an Evaluation, rendering it unusable. After invoking the DeleteEvaluation operation, you can use the GetEvaluation operation to verify that the status of the Evaluation changed to DELETED. Caution: The results of the DeleteEvaluation operation are irreversible.
DeleteMLModel
Show Description Assigns the DELETED status to an MLModel, rendering it unusable. After using the DeleteMLModel operation, you can use the GetMLModel operation to verify that the status of the MLModel changed to DELETED. Caution: The result of the DeleteMLModel operation is irreversible.
DeleteRealtimeEndpoint
Show Description Deletes a real time endpoint of an MLModel.
DeleteTags
Show Description Deletes the specified tags associated with an ML object. After this operation is complete, you can't recover deleted tags. If you specify a tag that doesn't exist, Amazon ML ignores it.
DescribeBatchPredictions
Show Description Returns a list of BatchPrediction operations that match the search criteria in the request.
DescribeDataSources
Show Description Returns a list of DataSource that match the search criteria in the request.
DescribeEvaluations
Show Description Returns a list of DescribeEvaluations that match the search criteria in the request.
DescribeMLModels
Show Description Returns a list of MLModel that match the search criteria in the request.
DescribeTags
Show Description Describes one or more of the tags for your Amazon ML object.
GetBatchPrediction
Show Description Returns a BatchPrediction that includes detailed metadata, status, and data file information for a Batch Prediction request.
GetDataSource
Show Description Returns a DataSource that includes metadata and data file information, as well as the current status of the DataSource. GetDataSource provides results in normal or verbose format. The verbose format adds the schema description and the list of files pointed to by the DataSource to the normal format.
GetEvaluation
Show Description Returns an Evaluation that includes metadata as well as the current status of the Evaluation.
GetMLModel
Show Description Returns an MLModel that includes detailed metadata, data source information, and the current status of the MLModel. GetMLModel provides results in normal or verbose format.
Predict
Show Description Generates a prediction for the observation using the specified ML Model. Note: Not all response parameters will be populated. Whether a response parameter is populated depends on the type of model requested.
UpdateBatchPrediction
Show Description Updates the BatchPredictionName of a BatchPrediction. You can use the GetBatchPrediction operation to view the contents of the updated data element.
UpdateDataSource
Show Description Updates the DataSourceName of a DataSource. You can use the GetDataSource operation to view the contents of the updated data element.
UpdateEvaluation
Show Description Updates the EvaluationName of an Evaluation. You can use the GetEvaluation operation to view the contents of the updated data element.

Macie Events

Service Event Name Description
macie AssociateMemberAccount
AssociateS3Resources
Show Description Associates specified S3 resources with Amazon Macie Classic for monitoring and data classification. If memberAccountId isn't specified, the action associates specified S3 resources with Macie Classic for the current Macie Classic administrator account. If memberAccountId is specified, the action associates specified S3 resources with Macie Classic for the specified member account.
DisassociateMemberAccount
DisassociateS3Resources
Show Description Removes specified S3 resources from being monitored by Amazon Macie Classic. If memberAccountId isn't specified, the action removes specified S3 resources from Macie Classic for the current Macie Classic administrator account. If memberAccountId is specified, the action removes specified S3 resources from Macie Classic for the specified member account.
ListMemberAccounts
Show Description Lists all Amazon Macie Classic member accounts for the current Macie Classic administrator account.
ListS3Resources
Show Description Lists all the S3 resources associated with Amazon Macie Classic. If memberAccountId isn't specified, the action lists the S3 resources associated with Macie Classic for the current Macie Classic administrator account. If memberAccountId is specified, the action lists the S3 resources associated with Macie Classic for the specified member account.

Macie2 Events

Service Event Name Description
macie2 AcceptInvitation
Show Description Accepts an Amazon Macie membership invitation that was received from a specific account.
BatchGetCustomDataIdentifiers
Show Description Retrieves information about one or more custom data identifiers.
CreateClassificationJob
Show Description Creates and defines the settings for a classification job.
CreateCustomDataIdentifier
Show Description Creates and defines the criteria and other settings for a custom data identifier.
CreateFindingsFilter
Show Description Creates and defines the criteria and other settings for a findings filter.
CreateInvitations
Show Description Sends an Amazon Macie membership invitation to one or more accounts.
CreateMember
Show Description Associates an account with an Amazon Macie administrator account.
CreateSampleFindings
Show Description Creates sample findings.
DeclineInvitations
Show Description Declines Amazon Macie membership invitations that were received from specific accounts.
DeleteCustomDataIdentifier
Show Description Soft deletes a custom data identifier.
DeleteFindingsFilter
Show Description Deletes a findings filter.
DeleteInvitations
Show Description Deletes Amazon Macie membership invitations that were received from specific accounts.
DeleteMember
Show Description Deletes the association between an Amazon Macie administrator account and an account.
DescribeBuckets
Show Description Retrieves (queries) statistical data and other information about one or more S3 buckets that Amazon Macie monitors and analyzes.
DescribeClassificationJob
Show Description Retrieves the status and settings for a classification job.
DescribeOrganizationConfiguration
Show Description Retrieves the Amazon Macie configuration settings for an Amazon Web Services organization.
DisableMacie
Show Description Disables an Amazon Macie account and deletes Macie resources for the account.
DisableOrganizationAdminAccount
Show Description Disables an account as the delegated Amazon Macie administrator account for an Amazon Web Services organization.
DisassociateFromAdministratorAccount
Show Description Disassociates a member account from its Amazon Macie administrator account.
DisassociateFromMasterAccount
Show Description (Deprecated) Disassociates a member account from its Amazon Macie administrator account. This operation has been replaced by the DisassociateFromAdministratorAccount</link> operation.
DisassociateMember
Show Description Disassociates an Amazon Macie administrator account from a member account.
EnableMacie
Show Description Enables Amazon Macie and specifies the configuration settings for a Macie account.
EnableOrganizationAdminAccount
Show Description Designates an account as the delegated Amazon Macie administrator account for an Amazon Web Services organization.
GetAdministratorAccount
Show Description Retrieves information about the Amazon Macie administrator account for an account.
GetBucketStatistics
Show Description Retrieves (queries) aggregated statistical data for all the S3 buckets that Amazon Macie monitors and analyzes.
GetClassificationExportConfiguration
Show Description Retrieves the configuration settings for storing data classification results.
GetCustomDataIdentifier
Show Description Retrieves the criteria and other settings for a custom data identifier.
GetFindingStatistics
Show Description Retrieves (queries) aggregated statistical data about findings.
GetFindings
Show Description Retrieves the details of one or more findings.
GetFindingsFilter
Show Description Retrieves the criteria and other settings for a findings filter.
GetFindingsPublicationConfiguration
Show Description Retrieves the configuration settings for publishing findings to Security Hub.
GetInvitationsCount
Show Description Retrieves the count of Amazon Macie membership invitations that were received by an account.
GetMacieSession
Show Description Retrieves the current status and configuration settings for an Amazon Macie account.
GetMasterAccount
Show Description (Deprecated) Retrieves information about the Amazon Macie administrator account for an account. This operation has been replaced by the GetAdministratorAccount</link> operation.
GetMember
Show Description Retrieves information about an account that's associated with an Amazon Macie administrator account.
GetUsageStatistics
Show Description Retrieves (queries) quotas and aggregated usage data for one or more accounts.
GetUsageTotals
Show Description Retrieves (queries) aggregated usage data for an account.
ListClassificationJobs
Show Description Retrieves a subset of information about one or more classification jobs.
ListCustomDataIdentifiers
Show Description Retrieves a subset of information about all the custom data identifiers for an account.
ListFindings
Show Description Retrieves a subset of information about one or more findings.
ListFindingsFilters
Show Description Retrieves a subset of information about all the findings filters for an account.
ListInvitations
Show Description Retrieves information about the Amazon Macie membership invitations that were received by an account.
ListManagedDataIdentifiers
Show Description Retrieves information about all the managed data identifiers that Amazon Macie currently provides.
ListMembers
Show Description Retrieves information about the accounts that are associated with an Amazon Macie administrator account.
ListOrganizationAdminAccounts
Show Description Retrieves information about the delegated Amazon Macie administrator account for an Amazon Web Services organization.
ListTagsForResource
Show Description Retrieves the tags (keys and values) that are associated with a classification job, custom data identifier, findings filter, or member account.
PutClassificationExportConfiguration
Show Description Creates or updates the configuration settings for storing data classification results.
PutFindingsPublicationConfiguration
Show Description Updates the configuration settings for publishing findings to Security Hub.
SearchResources
Show Description Retrieves (queries) statistical data and other information about Amazon Web Services resources that Amazon Macie monitors and analyzes.
TagResource
Show Description Adds or updates one or more tags (keys and values) that are associated with a classification job, custom data identifier, findings filter, or member account.
TestCustomDataIdentifier
Show Description Tests a custom data identifier.
UntagResource
Show Description Removes one or more tags (keys and values) from a classification job, custom data identifier, findings filter, or member account.
UpdateClassificationJob
Show Description Changes the status of a classification job.
UpdateFindingsFilter
Show Description Updates the criteria and other settings for a findings filter.
UpdateMacieSession
Show Description Suspends or re-enables an Amazon Macie account, or updates the configuration settings for a Macie account.
UpdateMemberSession
Show Description Enables an Amazon Macie administrator to suspend or re-enable Macie for a member account.

Managedblockchain Events

Service Event Name Description
managedblockchain CreateMember
Show Description Creates a member within a Managed Blockchain network. Applies only to Hyperledger Fabric.
CreateNetwork
Show Description Creates a new blockchain network using Amazon Managed Blockchain. Applies only to Hyperledger Fabric.
CreateNode
Show Description Creates a node on the specified blockchain network. Applies to Hyperledger Fabric and Ethereum.
CreateProposal
Show Description Creates a proposal for a change to the network that other members of the network can vote on, for example, a proposal to add a new member to the network. Any member can create a proposal. Applies only to Hyperledger Fabric.
DeleteMember
Show Description Deletes a member. Deleting a member removes the member and all associated resources from the network. DeleteMember can only be called for a specified MemberId if the principal performing the action is associated with the AWS account that owns the member. In all other cases, the DeleteMember action is carried out as the result of an approved proposal to remove a member. If MemberId is the last member in a network specified by the last AWS account, the network is deleted also. Applies only to Hyperledger Fabric.
DeleteNode
Show Description Deletes a node that your AWS account owns. All data on the node is lost and cannot be recovered. Applies to Hyperledger Fabric and Ethereum.
GetMember
Show Description Returns detailed information about a member. Applies only to Hyperledger Fabric.
GetNetwork
Show Description Returns detailed information about a network. Applies to Hyperledger Fabric and Ethereum.
GetNode
Show Description Returns detailed information about a node. Applies to Hyperledger Fabric and Ethereum.
GetProposal
Show Description Returns detailed information about a proposal. Applies only to Hyperledger Fabric.
ListInvitations
Show Description Returns a list of all invitations for the current AWS account. Applies only to Hyperledger Fabric.
ListMembers
Show Description Returns a list of the members in a network and properties of their configurations. Applies only to Hyperledger Fabric.
ListNetworks
Show Description Returns information about the networks in which the current AWS account participates. Applies to Hyperledger Fabric and Ethereum.
ListNodes
Show Description Returns information about the nodes within a network. Applies to Hyperledger Fabric and Ethereum.
ListProposalVotes
Show Description Returns the list of votes for a specified proposal, including the value of each vote and the unique identifier of the member that cast the vote. Applies only to Hyperledger Fabric.
ListProposals
Show Description Returns a list of proposals for the network. Applies only to Hyperledger Fabric.
ListTagsForResource
Show Description Returns a list of tags for the specified resource. Each tag consists of a key and optional value. For more information about tags, see Tagging Resources in the Amazon Managed Blockchain Ethereum Developer Guide, or Tagging Resources in the Amazon Managed Blockchain Hyperledger Fabric Developer Guide.
RejectInvitation
Show Description Rejects an invitation to join a network. This action can be called by a principal in an AWS account that has received an invitation to create a member and join a network. Applies only to Hyperledger Fabric.
TagResource
Show Description Adds or overwrites the specified tags for the specified Amazon Managed Blockchain resource. Each tag consists of a key and optional value. When you specify a tag key that already exists, the tag value is overwritten with the new value. Use UntagResource to remove tag keys. A resource can have up to 50 tags. If you try to create more than 50 tags for a resource, your request fails and returns an error. For more information about tags, see Tagging Resources in the Amazon Managed Blockchain Ethereum Developer Guide, or Tagging Resources in the Amazon Managed Blockchain Hyperledger Fabric Developer Guide.
UntagResource
Show Description Removes the specified tags from the Amazon Managed Blockchain resource. For more information about tags, see Tagging Resources in the Amazon Managed Blockchain Ethereum Developer Guide, or Tagging Resources in the Amazon Managed Blockchain Hyperledger Fabric Developer Guide.
UpdateMember
Show Description Updates a member configuration with new parameters. Applies only to Hyperledger Fabric.
UpdateNode
Show Description Updates a node configuration with new parameters. Applies only to Hyperledger Fabric.

Marketplace-catalog Events

Service Event Name Description
marketplace-catalog CancelChangeSet
Show Description Used to cancel an open change request. Must be sent before the status of the request changes to APPLYING, the final stage of completing your change request. You can describe a change during the 60-day request history retention period for API calls.
DescribeChangeSet
Show Description Provides information about a given change set.
DescribeEntity
Show Description Returns the metadata and content of the entity.
ListChangeSets
Show Description Returns the list of change sets owned by the account being used to make the call. You can filter this list by providing any combination of entityId, ChangeSetName, and status. If you provide more than one filter, the API operation applies a logical AND between the filters. You can describe a change during the 60-day request history retention period for API calls.
ListEntities
Show Description Provides the list of entities of a given type.

Marketplace-entitlement Events

Service Event Name Description
marketplace-entitlement GetEntitlements
Show Description GetEntitlements retrieves entitlement values for a given product. The results can be filtered based on customer identifier or product dimensions.

Marketplacecommerceanalytics Events

Service Event Name Description
marketplacecommerceanalytics GenerateDataSet
Show Description Given a data set type and data set publication date, asynchronously publishes the requested data set to the specified S3 bucket and notifies the specified SNS topic once the data is available. Returns a unique request identifier that can be used to correlate requests with notifications from the SNS topic. Data sets will be published in comma-separated values (CSV) format with the file name {data_set_type}_YYYY-MM-DD.csv. If a file with the same name already exists (e.g. if the same data set is requested twice), the original file will be overwritten by the new file. Requires a Role with an attached permissions policy providing Allow permissions for the following actions: s3:PutObject, s3:GetBucketLocation, sns:GetTopicAttributes, sns:Publish, iam:GetRolePolicy.

Mediaconnect Events

Service Event Name Description
mediaconnect AddFlowMediaStreams
Show Description Adds media streams to an existing flow. After you add a media stream to a flow, you can associate it with a source and/or an output that uses the ST 2110 JPEG XS or CDI protocol.
AddFlowOutputs
Show Description Adds outputs to an existing flow. You can create up to 50 outputs per flow.
AddFlowSources
Show Description Adds Sources to flow
AddFlowVpcInterfaces
Show Description Adds VPC interfaces to flow
CreateFlow
Show Description Creates a new flow. The request must include one source. The request optionally can include outputs (up to 50) and entitlements (up to 50).
DeleteFlow
Show Description Deletes a flow. Before you can delete a flow, you must stop the flow.
DescribeFlow
Show Description Displays the details of a flow. The response includes the flow ARN, name, and Availability Zone, as well as details about the source, outputs, and entitlements.
DescribeOffering
Show Description Displays the details of an offering. The response includes the offering description, duration, outbound bandwidth, price, and Amazon Resource Name (ARN).
DescribeReservation
Show Description Displays the details of a reservation. The response includes the reservation name, state, start date and time, and the details of the offering that make up the rest of the reservation (such as price, duration, and outbound bandwidth).
GrantFlowEntitlements
Show Description Grants entitlements to an existing flow.
ListEntitlements
Show Description Displays a list of all entitlements that have been granted to this account. This request returns 20 results per page.
ListFlows
Show Description Displays a list of flows that are associated with this account. This request returns a paginated result.
ListOfferings
Show Description Displays a list of all offerings that are available to this account in the current AWS Region. If you have an active reservation (which means you've purchased an offering that has already started and hasn't expired yet), your account isn't eligible for other offerings.
ListReservations
Show Description Displays a list of all reservations that have been purchased by this account in the current AWS Region. This list includes all reservations in all states (such as active and expired).
ListTagsForResource
Show Description List all tags on an AWS Elemental MediaConnect resource
PurchaseOffering
Show Description Submits a request to purchase an offering. If you already have an active reservation, you can't purchase another offering.
RemoveFlowMediaStream
Show Description Removes a media stream from a flow. This action is only available if the media stream is not associated with a source or output.
RemoveFlowOutput
Show Description Removes an output from an existing flow. This request can be made only on an output that does not have an entitlement associated with it. If the output has an entitlement, you must revoke the entitlement instead. When an entitlement is revoked from a flow, the service automatically removes the associated output.
RemoveFlowSource
Show Description Removes a source from an existing flow. This request can be made only if there is more than one source on the flow.
RemoveFlowVpcInterface
Show Description Removes a VPC Interface from an existing flow. This request can be made only on a VPC interface that does not have a Source or Output associated with it. If the VPC interface is referenced by a Source or Output, you must first delete or update the Source or Output to no longer reference the VPC interface.
RevokeFlowEntitlement
Show Description Revokes an entitlement from a flow. Once an entitlement is revoked, the content becomes unavailable to the subscriber and the associated output is removed.
StartFlow
Show Description Starts a flow.
StopFlow
Show Description Stops a flow.
TagResource
UntagResource
UpdateFlow
Show Description Updates flow
UpdateFlowEntitlement
Show Description You can change an entitlement's description, subscribers, and encryption. If you change the subscribers, the service will remove the outputs that are are used by the subscribers that are removed.
UpdateFlowMediaStream
Show Description Updates an existing media stream.
UpdateFlowOutput
Show Description Updates an existing flow output.

Mediaconvert Events

Service Event Name Description
mediaconvert AssociateCertificate
Show Description Associates an AWS Certificate Manager (ACM) Amazon Resource Name (ARN) with AWS Elemental MediaConvert.
CancelJob
Show Description Permanently cancel a job. Once you have canceled a job, you can't start it again.
CreateJob
Show Description Create a new transcoding job. For information about jobs and job settings, see the User Guide at http://docs.aws.amazon.com/mediaconvert/latest/ug/what-is.html
CreateJobTemplate
Show Description Create a new job template. For information about job templates see the User Guide at http://docs.aws.amazon.com/mediaconvert/latest/ug/what-is.html
CreatePreset
Show Description Create a new preset. For information about job templates see the User Guide at http://docs.aws.amazon.com/mediaconvert/latest/ug/what-is.html
CreateQueue
Show Description Create a new transcoding queue. For information about queues, see Working With Queues in the User Guide at https://docs.aws.amazon.com/mediaconvert/latest/ug/working-with-queues.html
DeleteJobTemplate
Show Description Permanently delete a job template you have created.
DeletePolicy
Show Description Permanently delete a policy that you created.
DeletePreset
Show Description Permanently delete a preset you have created.
DeleteQueue
Show Description Permanently delete a queue you have created.
DescribeEndpoints
Show Description Send an request with an empty body to the regional API endpoint to get your account API endpoint.
DisassociateCertificate
Show Description Removes an association between the Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate and an AWS Elemental MediaConvert resource.
GetJob
Show Description Retrieve the JSON for a specific completed transcoding job.
GetJobTemplate
Show Description Retrieve the JSON for a specific job template.
GetPolicy
Show Description Retrieve the JSON for your policy.
GetPreset
Show Description Retrieve the JSON for a specific preset.
GetQueue
Show Description Retrieve the JSON for a specific queue.
ListJobTemplates
Show Description Retrieve a JSON array of up to twenty of your job templates. This will return the templates themselves, not just a list of them. To retrieve the next twenty templates, use the nextToken string returned with the array
ListJobs
Show Description Retrieve a JSON array of up to twenty of your most recently created jobs. This array includes in-process, completed, and errored jobs. This will return the jobs themselves, not just a list of the jobs. To retrieve the twenty next most recent jobs, use the nextToken string returned with the array.
ListPresets
Show Description Retrieve a JSON array of up to twenty of your presets. This will return the presets themselves, not just a list of them. To retrieve the next twenty presets, use the nextToken string returned with the array.
ListQueues
Show Description Retrieve a JSON array of up to twenty of your queues. This will return the queues themselves, not just a list of them. To retrieve the next twenty queues, use the nextToken string returned with the array.
ListTagsForResource
Show Description Retrieve the tags for a MediaConvert resource.
PutPolicy
Show Description Create or change your policy. For more information about policies, see the user guide at http://docs.aws.amazon.com/mediaconvert/latest/ug/what-is.html
TagResource
Show Description Add tags to a MediaConvert queue, preset, or job template. For information about tagging, see the User Guide at https://docs.aws.amazon.com/mediaconvert/latest/ug/tagging-resources.html
UntagResource
Show Description Remove tags from a MediaConvert queue, preset, or job template. For information about tagging, see the User Guide at https://docs.aws.amazon.com/mediaconvert/latest/ug/tagging-resources.html
UpdateJobTemplate
Show Description Modify one of your existing job templates.
UpdatePreset
Show Description Modify one of your existing presets.

Medialive Events

Service Event Name Description
medialive AcceptInputDeviceTransfer
Show Description Accept an incoming input device transfer. The ownership of the device will transfer to your AWS account.
BatchDelete
Show Description Starts delete of resources.
BatchStart
Show Description Starts existing resources
BatchStop
Show Description Stops running resources
BatchUpdateSchedule
Show Description Update a channel schedule
CancelInputDeviceTransfer
Show Description Cancel an input device transfer that you have requested.
ClaimDevice
Show Description Send a request to claim an AWS Elemental device that you have purchased from a third-party vendor. After the request succeeds, you will own the device.
CreateChannel
Show Description Creates a new channel
CreateInput
Show Description Create an input
CreateInputSecurityGroup
Show Description Creates a Input Security Group
CreateMultiplex
Show Description Create a new multiplex.
CreateMultiplexProgram
Show Description Create a new program in the multiplex.
CreatePartnerInput
Show Description Create a partner input
CreateTags
DeleteChannel
Show Description Starts deletion of channel. The associated outputs are also deleted.
DeleteInput
Show Description Deletes the input end point
DeleteInputSecurityGroup
Show Description Deletes an Input Security Group
DeleteMultiplex
Show Description Delete a multiplex. The multiplex must be idle.
DeleteMultiplexProgram
Show Description Delete a program from a multiplex.
DeleteReservation
Show Description Delete an expired reservation.
DeleteSchedule
Show Description Delete all schedule actions on a channel.
DeleteTags
DescribeChannel
Show Description Gets details about a channel
DescribeInput
Show Description Produces details about an input
DescribeInputDevice
Show Description Gets the details for the input device
DescribeInputDeviceThumbnail
Show Description Get the latest thumbnail data for the input device.
DescribeInputSecurityGroup
Show Description Produces a summary of an Input Security Group
DescribeMultiplex
Show Description Gets details about a multiplex.
DescribeMultiplexProgram
Show Description Get the details for a program in a multiplex.
DescribeOffering
Show Description Get details for an offering.
DescribeReservation
Show Description Get details for a reservation.
DescribeSchedule
Show Description Get a channel schedule
ListChannels
Show Description Produces list of channels that have been created
ListInputDeviceTransfers
Show Description List input devices that are currently being transferred. List input devices that you are transferring from your AWS account or input devices that another AWS account is transferring to you.
ListInputDevices
Show Description List input devices
ListInputSecurityGroups
Show Description Produces a list of Input Security Groups for an account
ListInputs
Show Description Produces list of inputs that have been created
ListMultiplexPrograms
Show Description List the programs that currently exist for a specific multiplex.
ListMultiplexes
Show Description Retrieve a list of the existing multiplexes.
ListOfferings
Show Description List offerings available for purchase.
ListReservations
Show Description List purchased reservations.
ListTagsForResource
Show Description Produces list of tags that have been created for a resource
PurchaseOffering
Show Description Purchase an offering and create a reservation.
RejectInputDeviceTransfer
Show Description Reject the transfer of the specified input device to your AWS account.
StartChannel
Show Description Starts an existing channel
StartMultiplex
Show Description Start (run) the multiplex. Starting the multiplex does not start the channels. You must explicitly start each channel.
StopChannel
Show Description Stops a running channel
StopMultiplex
Show Description Stops a running multiplex. If the multiplex isn't running, this action has no effect.
TransferInputDevice
Show Description Start an input device transfer to another AWS account. After you make the request, the other account must accept or reject the transfer.
UpdateChannel
Show Description Updates a channel.
UpdateChannelClass
Show Description Changes the class of the channel.
UpdateInput
Show Description Updates an input.
UpdateInputDevice
Show Description Updates the parameters for the input device.
UpdateInputSecurityGroup
Show Description Update an Input Security Group's Whilelists.
UpdateMultiplex
Show Description Updates a multiplex.
UpdateMultiplexProgram
Show Description Update a program in a multiplex.

Mediapackage-vod Events

Service Event Name Description
mediapackage-vod ConfigureLogs
Show Description Changes the packaging group's properities to configure log subscription
CreateAsset
Show Description Creates a new MediaPackage VOD Asset resource.
CreatePackagingConfiguration
Show Description Creates a new MediaPackage VOD PackagingConfiguration resource.
CreatePackagingGroup
Show Description Creates a new MediaPackage VOD PackagingGroup resource.
DeleteAsset
Show Description Deletes an existing MediaPackage VOD Asset resource.
DeletePackagingConfiguration
Show Description Deletes a MediaPackage VOD PackagingConfiguration resource.
DeletePackagingGroup
Show Description Deletes a MediaPackage VOD PackagingGroup resource.
DescribeAsset
Show Description Returns a description of a MediaPackage VOD Asset resource.
DescribePackagingConfiguration
Show Description Returns a description of a MediaPackage VOD PackagingConfiguration resource.
DescribePackagingGroup
Show Description Returns a description of a MediaPackage VOD PackagingGroup resource.
ListAssets
Show Description Returns a collection of MediaPackage VOD Asset resources.
ListPackagingConfigurations
Show Description Returns a collection of MediaPackage VOD PackagingConfiguration resources.
ListPackagingGroups
Show Description Returns a collection of MediaPackage VOD PackagingGroup resources.
ListTagsForResource
Show Description Returns a list of the tags assigned to the specified resource.
TagResource
UntagResource

Mediapackage Events

Service Event Name Description
mediapackage ConfigureLogs
Show Description Changes the Channel's properities to configure log subscription
CreateChannel
Show Description Creates a new Channel.
CreateHarvestJob
Show Description Creates a new HarvestJob record.
CreateOriginEndpoint
Show Description Creates a new OriginEndpoint record.
DeleteChannel
Show Description Deletes an existing Channel.
DeleteOriginEndpoint
Show Description Deletes an existing OriginEndpoint.
DescribeChannel
Show Description Gets details about a Channel.
DescribeHarvestJob
Show Description Gets details about an existing HarvestJob.
DescribeOriginEndpoint
Show Description Gets details about an existing OriginEndpoint.
ListChannels
Show Description Returns a collection of Channels.
ListHarvestJobs
Show Description Returns a collection of HarvestJob records.
ListOriginEndpoints
Show Description Returns a collection of OriginEndpoint records.
ListTagsForResource
Show Description None
RotateChannelCredentials
Show Description Changes the Channel's first IngestEndpoint's username and password. WARNING - This API is deprecated. Please use RotateIngestEndpointCredentials instead
RotateIngestEndpointCredentials
Show Description Rotate the IngestEndpoint's username and password, as specified by the IngestEndpoint's id.
TagResource
UntagResource
UpdateChannel
Show Description Updates an existing Channel.

Mediastore Events

Service Event Name Description
mediastore CreateContainer
Show Description Creates a storage container to hold objects. A container is similar to a bucket in the Amazon S3 service.
DeleteContainer
Show Description Deletes the specified container. Before you make a DeleteContainer request, delete any objects in the container or in any folders in the container. You can delete only empty containers.
DeleteContainerPolicy
Show Description Deletes the access policy that is associated with the specified container.
DeleteCorsPolicy
Show Description Deletes the cross-origin resource sharing (CORS) configuration information that is set for the container. To use this operation, you must have permission to perform the MediaStore:DeleteCorsPolicy action. The container owner has this permission by default and can grant this permission to others.
DeleteLifecyclePolicy
Show Description Removes an object lifecycle policy from a container. It takes up to 20 minutes for the change to take effect.
DeleteMetricPolicy
Show Description Deletes the metric policy that is associated with the specified container. If there is no metric policy associated with the container, MediaStore doesn't send metrics to CloudWatch.
DescribeContainer
Show Description Retrieves the properties of the requested container. This request is commonly used to retrieve the endpoint of a container. An endpoint is a value assigned by the service when a new container is created. A container's endpoint does not change after it has been assigned. The DescribeContainer request returns a single Container object based on ContainerName. To return all Container objects that are associated with a specified AWS account, use ListContainers.
GetContainerPolicy
Show Description Retrieves the access policy for the specified container. For information about the data that is included in an access policy, see the AWS Identity and Access Management User Guide.
GetCorsPolicy
Show Description Returns the cross-origin resource sharing (CORS) configuration information that is set for the container. To use this operation, you must have permission to perform the MediaStore:GetCorsPolicy action. By default, the container owner has this permission and can grant it to others.
GetLifecyclePolicy
Show Description Retrieves the object lifecycle policy that is assigned to a container.
GetMetricPolicy
Show Description Returns the metric policy for the specified container.
ListContainers
Show Description Lists the properties of all containers in AWS Elemental MediaStore. You can query to receive all the containers in one response. Or you can include the MaxResults parameter to receive a limited number of containers in each response. In this case, the response includes a token. To get the next set of containers, send the command again, this time with the NextToken parameter (with the returned token as its value). The next set of responses appears, with a token if there are still more containers to receive. See also DescribeContainer, which gets the properties of one container.
ListTagsForResource
Show Description Returns a list of the tags assigned to the specified container.
PutContainerPolicy
Show Description Creates an access policy for the specified container to restrict the users and clients that can access it. For information about the data that is included in an access policy, see the AWS Identity and Access Management User Guide. For this release of the REST API, you can create only one policy for a container. If you enter PutContainerPolicy twice, the second command modifies the existing policy.
PutCorsPolicy
Show Description Sets the cross-origin resource sharing (CORS) configuration on a container so that the container can service cross-origin requests. For example, you might want to enable a request whose origin is http://www.example.com to access your AWS Elemental MediaStore container at my.example.container.com by using the browser's XMLHttpRequest capability. To enable CORS on a container, you attach a CORS policy to the container. In the CORS policy, you configure rules that identify origins and the HTTP methods that can be executed on your container. The policy can contain up to 398,000 characters. You can add up to 100 rules to a CORS policy. If more than one rule applies, the service uses the first applicable rule listed. To learn more about CORS, see Cross-Origin Resource Sharing (CORS) in AWS Elemental MediaStore.
PutLifecyclePolicy
Show Description Writes an object lifecycle policy to a container. If the container already has an object lifecycle policy, the service replaces the existing policy with the new policy. It takes up to 20 minutes for the change to take effect. For information about how to construct an object lifecycle policy, see Components of an Object Lifecycle Policy.
PutMetricPolicy
Show Description The metric policy that you want to add to the container. A metric policy allows AWS Elemental MediaStore to send metrics to Amazon CloudWatch. It takes up to 20 minutes for the new policy to take effect.
StartAccessLogging
Show Description Starts access logging on the specified container. When you enable access logging on a container, MediaStore delivers access logs for objects stored in that container to Amazon CloudWatch Logs.
StopAccessLogging
Show Description Stops access logging on the specified container. When you stop access logging on a container, MediaStore stops sending access logs to Amazon CloudWatch Logs. These access logs are not saved and are not retrievable.
TagResource
Show Description Adds tags to the specified AWS Elemental MediaStore container. Tags are key:value pairs that you can associate with AWS resources. For example, the tag key might be "customer" and the tag value might be "companyA." You can specify one or more tags to add to each container. You can add up to 50 tags to each container. For more information about tagging, including naming and usage conventions, see Tagging Resources in MediaStore.

Mediatailor Events

Service Event Name Description
mediatailor ConfigureLogsForPlaybackConfiguration
Show Description Configures Amazon CloudWatch log settings for a playback configuration.
CreateChannel
Show Description Creates a channel.
CreatePrefetchSchedule
Show Description Creates a new prefetch schedule for the specified playback configuration.
CreateProgram
Show Description Creates a program.
CreateSourceLocation
Show Description Creates a source location on a specific channel.
CreateVodSource
Show Description Creates name for a specific VOD source in a source location.
DeleteChannel
Show Description Deletes a channel. You must stop the channel before it can be deleted.
DeleteChannelPolicy
Show Description Deletes a channel's IAM policy.
DeletePlaybackConfiguration
Show Description Deletes the playback configuration for the specified name.
DeletePrefetchSchedule
Show Description Deletes a prefetch schedule for a specific playback configuration. If you call DeletePrefetchSchedule on an expired prefetch schedule, MediaTailor returns an HTTP 404 status code.
DeleteProgram
Show Description Deletes a specific program on a specific channel.
DeleteSourceLocation
Show Description Deletes a source location on a specific channel.
DeleteVodSource
Show Description Deletes a specific VOD source in a specific source location.
DescribeChannel
Show Description Describes the properties of a specific channel.
DescribeProgram
Show Description Retrieves the properties of the requested program.
DescribeSourceLocation
Show Description Retrieves the properties of the requested source location.
DescribeVodSource
Show Description Provides details about a specific VOD source in a specific source location.
GetChannelPolicy
Show Description Retrieves information about a channel's IAM policy.
GetChannelSchedule
Show Description Retrieves information about your channel's schedule.
GetPlaybackConfiguration
Show Description Returns the playback configuration for the specified name.
GetPrefetchSchedule
Show Description Returns information about the prefetch schedule for a specific playback configuration. If you call GetPrefetchSchedule on an expired prefetch schedule, MediaTailor returns an HTTP 404 status code.
ListAlerts
Show Description Returns a list of alerts for the given resource.
ListChannels
Show Description Retrieves a list of channels that are associated with this account.
ListPlaybackConfigurations
Show Description Returns a list of the playback configurations defined in AWS Elemental MediaTailor. You can specify a maximum number of configurations to return at a time. The default maximum is 50. Results are returned in pagefuls. If MediaTailor has more configurations than the specified maximum, it provides parameters in the response that you can use to retrieve the next pageful.
ListPrefetchSchedules
Show Description Creates a new prefetch schedule.
ListSourceLocations
Show Description Retrieves a list of source locations.
ListTagsForResource
Show Description Returns a list of the tags assigned to the specified playback configuration resource.
ListVodSources
Show Description Lists all the VOD sources in a source location.
PutChannelPolicy
Show Description Creates an IAM policy for the channel.
PutPlaybackConfiguration
Show Description Adds a new playback configuration to AWS Elemental MediaTailor.
StartChannel
Show Description Starts a specific channel.
StopChannel
Show Description Stops a specific channel.
TagResource
UntagResource
UpdateChannel
Show Description Updates an existing channel.
UpdateSourceLocation
Show Description Updates a source location on a specific channel.

Memorydb Events

Service Event Name Description
memorydb BatchUpdateCluster
Show Description Apply the service update to a list of clusters supplied. For more information on service updates and applying them, see Applying the service updates.
CopySnapshot
Show Description Makes a copy of an existing snapshot.
CreateACL
Show Description Creates an Access Control List. For more information, see Authenticating users with Access Contol Lists (ACLs).
CreateCluster
Show Description Creates a cluster. All nodes in the cluster run the same protocol-compliant engine software.
CreateParameterGroup
Show Description Creates a new MemoryDB parameter group. A parameter group is a collection of parameters and their values that are applied to all of the nodes in any cluster. For more information, see Configuring engine parameters using parameter groups.
CreateSnapshot
Show Description Creates a copy of an entire cluster at a specific moment in time.
CreateSubnetGroup
Show Description Creates a subnet group. A subnet group is a collection of subnets (typically private) that you can designate for your clusters running in an Amazon Virtual Private Cloud (VPC) environment. When you create a cluster in an Amazon VPC, you must specify a subnet group. MemoryDB uses that subnet group to choose a subnet and IP addresses within that subnet to associate with your nodes. For more information, see Subnets and subnet groups.
CreateUser
Show Description Creates a MemoryDB user. For more information, see Authenticating users with Access Contol Lists (ACLs).
DeleteACL
Show Description Deletes an Access Control List. The ACL must first be disassociated from the cluster before it can be deleted. For more information, see Authenticating users with Access Contol Lists (ACLs).
DeleteCluster
Show Description Deletes a cluster. It also deletes all associated nodes and node endpoints
DeleteParameterGroup
Show Description Deletes the specified parameter group. You cannot delete a parameter group if it is associated with any clusters. You cannot delete the default parameter groups in your account.
DeleteSnapshot
Show Description Deletes an existing snapshot. When you receive a successful response from this operation, MemoryDB immediately begins deleting the snapshot; you cannot cancel or revert this operation.
DeleteSubnetGroup
Show Description Deletes a subnet group. You cannot delete a default subnet group or one that is associated with any clusters.
DeleteUser
Show Description Deletes a user. The user will be removed from all ACLs and in turn removed from all clusters.
DescribeACLs
Show Description Returns a list of ACLs
DescribeClusters
Show Description Returns information about all provisioned clusters if no cluster identifier is specified, or about a specific cluster if a cluster name is supplied.
DescribeEngineVersions
Show Description Returns a list of the available Redis engine versions.
DescribeEvents
Show Description Returns events related to clusters, security groups, and parameter groups. You can obtain events specific to a particular cluster, security group, or parameter group by providing the name as a parameter. By default, only the events occurring within the last hour are returned; however, you can retrieve up to 14 days' worth of events if necessary.
DescribeParameterGroups
Show Description Returns a list of parameter group descriptions. If a parameter group name is specified, the list contains only the descriptions for that group.
DescribeParameters
Show Description Returns the detailed parameter list for a particular parameter group.
DescribeServiceUpdates
Show Description Returns details of the service updates
DescribeSnapshots
Show Description Returns information about cluster snapshots. By default, DescribeSnapshots lists all of your snapshots; it can optionally describe a single snapshot, or just the snapshots associated with a particular cluster.
DescribeSubnetGroups
Show Description Returns a list of subnet group descriptions. If a subnet group name is specified, the list contains only the description of that group.
DescribeUsers
Show Description Returns a list of users.
FailoverShard
Show Description Used to failover a shard
ListAllowedNodeTypeUpdates
Show Description Lists all available node types that you can scale to from your cluster's current node type. When you use the UpdateCluster operation to scale your cluster, the value of the NodeType parameter must be one of the node types returned by this operation.
ListTags
Show Description Lists all tags currently on a named resource. A tag is a key-value pair where the key and value are case-sensitive. You can use tags to categorize and track your MemoryDB resources. For more information, see Tagging your MemoryDB resources
ResetParameterGroup
Show Description Modifies the parameters of a parameter group to the engine or system default value. You can reset specific parameters by submitting a list of parameter names. To reset the entire parameter group, specify the AllParameters and ParameterGroupName parameters.
TagResource
Show Description A tag is a key-value pair where the key and value are case-sensitive. You can use tags to categorize and track all your MemoryDB resources. When you add or remove tags on clusters, those actions will be replicated to all nodes in the cluster. For more information, see Resource-level permissions. For example, you can use cost-allocation tags to your MemoryDB resources, Amazon generates a cost allocation report as a comma-separated value (CSV) file with your usage and costs aggregated by your tags. You can apply tags that represent business categories (such as cost centers, application names, or owners) to organize your costs across multiple services. For more information, see Using Cost Allocation Tags.
UntagResource
Show Description Use this operation to remove tags on a resource
UpdateACL
Show Description Changes the list of users that belong to the Access Control List.
UpdateCluster
Show Description Modifies the settings for a cluster. You can use this operation to change one or more cluster configuration settings by specifying the settings and the new values.
UpdateParameterGroup
Show Description Updates the parameters of a parameter group. You can modify up to 20 parameters in a single request by submitting a list parameter name and value pairs.
UpdateSubnetGroup
Show Description Updates a subnet group. For more information, see Updating a subnet group

Mgn Events

Service Event Name Description
mgn ChangeServerLifeCycleState
Show Description Allows the user to set the SourceServer.LifeCycle.state property for specific Source Server IDs to one of the following: READY_FOR_TEST or READY_FOR_CUTOVER. This command only works if the Source Server is already launchable (dataReplicationInfo.lagDuration is not null.)
CreateReplicationConfigurationTemplate
Show Description Creates a new ReplicationConfigurationTemplate.
DeleteJob
Show Description Deletes a single Job by ID.
DeleteReplicationConfigurationTemplate
Show Description Deletes a single Replication Configuration Template by ID
DeleteSourceServer
Show Description Deletes a single source server by ID.
DescribeJobLogItems
Show Description Retrieves detailed Job log with paging.
DescribeJobs
Show Description Returns a list of Jobs. Use the JobsID and fromDate and toData filters to limit which jobs are returned. The response is sorted by creationDataTime - latest date first. Jobs are normaly created by the StartTest, StartCutover, and TerminateTargetInstances APIs. Jobs are also created by DiagnosticLaunch and TerminateDiagnosticInstances, which are APIs available only to *Support* and only used in response to relevant support tickets.
DescribeReplicationConfigurationTemplates
Show Description Lists all ReplicationConfigurationTemplates, filtered by Source Server IDs.
DescribeSourceServers
Show Description Retrieves all SourceServers or multiple SourceServers by ID.
DisconnectFromService
Show Description Disconnects specific Source Servers from Application Migration Service. Data replication is stopped immediately. All AWS resources created by Application Migration Service for enabling the replication of these source servers will be terminated / deleted within 90 minutes. Launched Test or Cutover instances will NOT be terminated. If the agent on the source server has not been prevented from communciating with the Application Migration Service service, then it will receive a command to uninstall itself (within approximately 10 minutes). The following properties of the SourceServer will be changed immediately: dataReplicationInfo.dataReplicationState will be set to DISCONNECTED; The totalStorageBytes property for each of dataReplicationInfo.replicatedDisks will be set to zero; dataReplicationInfo.lagDuration and dataReplicationInfo.lagDurationwill be nullified.
FinalizeCutover
Show Description Finalizes the cutover immediately for specific Source Servers. All AWS resources created by Application Migration Service for enabling the replication of these source servers will be terminated / deleted within 90 minutes. Launched Test or Cutover instances will NOT be terminated. The AWS Replication Agent will receive a command to uninstall itself (within 10 minutes). The following properties of the SourceServer will be changed immediately: dataReplicationInfo.dataReplicationState will be to DISCONNECTED; The SourceServer.lifeCycle.state will be changed to CUTOVER; The totalStorageBytes property fo each of dataReplicationInfo.replicatedDisks will be set to zero; dataReplicationInfo.lagDuration and dataReplicationInfo.lagDurationwill be nullified.
GetLaunchConfiguration
Show Description Lists all LaunchConfigurations available, filtered by Source Server IDs.
GetReplicationConfiguration
Show Description Lists all ReplicationConfigurations, filtered by Source Server ID.
InitializeService
Show Description Initialize Application Migration Service.
ListTagsForResource
Show Description List all tags for your Application Migration Service resources.
MarkAsArchived
Show Description Archives specific Source Servers by setting the SourceServer.isArchived property to true for specified SourceServers by ID. This command only works for SourceServers with a lifecycle.state which equals DISCONNECTED or CUTOVER.
RetryDataReplication
Show Description Causes the data replication initiation sequence to begin immediately upon next Handshake for specified SourceServer IDs, regardless of when the previous initiation started. This command will not work if the SourceServer is not stalled or is in a DISCONNECTED or STOPPED state.
StartCutover
Show Description Launches a Cutover Instance for specific Source Servers. This command starts a LAUNCH job whose initiatedBy property is StartCutover and changes the SourceServer.lifeCycle.state property to CUTTING_OVER.
StartTest
Show Description Lauches a Test Instance for specific Source Servers. This command starts a LAUNCH job whose initiatedBy property is StartTest and changes the SourceServer.lifeCycle.state property to TESTING.
TagResource
TerminateTargetInstances
Show Description Starts a job that terminates specific launched EC2 Test and Cutover instances. This command will not work for any Source Server with a lifecycle.state of TESTING, CUTTING_OVER, or CUTOVER.
UntagResource
UpdateLaunchConfiguration
Show Description Updates multiple LaunchConfigurations by Source Server ID.
UpdateReplicationConfiguration
Show Description Allows you to update multiple ReplicationConfigurations by Source Server ID.

Migrationhub-config Events

Service Event Name Description
migrationhub-config CreateHomeRegionControl
Show Description This API sets up the home region for the calling account only.
DescribeHomeRegionControls
Show Description This API permits filtering on the ControlId and HomeRegion fields.

Mobile Events

Service Event Name Description
mobile CreateProject
Show Description Creates an AWS Mobile Hub project.
DeleteProject
Show Description Delets a project in AWS Mobile Hub.
DescribeBundle
Show Description Get the bundle details for the requested bundle id.
DescribeProject
Show Description Gets details about a project in AWS Mobile Hub.
ExportBundle
Show Description Generates customized software development kit (SDK) and or tool packages used to integrate mobile web or mobile app clients with backend AWS resources.
ExportProject
Show Description Exports project configuration to a snapshot which can be downloaded and shared. Note that mobile app push credentials are encrypted in exported projects, so they can only be shared successfully within the same AWS account.
ListBundles
Show Description List all available bundles.
ListProjects
Show Description Lists projects in AWS Mobile Hub.

Mq Events

Service Event Name Description
mq CreateBroker
Show Description Creates a broker. Note: This API is asynchronous. To create a broker, you must either use the AmazonMQFullAccess IAM policy or include the following EC2 permissions in your IAM policy.
  • ec2:CreateNetworkInterface This permission is required to allow Amazon MQ to create an elastic network interface (ENI) on behalf of your account.
  • ec2:CreateNetworkInterfacePermission This permission is required to attach the ENI to the broker instance.
  • ec2:DeleteNetworkInterface
  • ec2:DeleteNetworkInterfacePermission
  • ec2:DetachNetworkInterface
  • ec2:DescribeInternetGateways
  • ec2:DescribeNetworkInterfaces
  • ec2:DescribeNetworkInterfacePermissions
  • ec2:DescribeRouteTables
  • ec2:DescribeSecurityGroups
  • ec2:DescribeSubnets
  • ec2:DescribeVpcs
For more information, see Create an IAM User and Get Your AWS Credentials and Never Modify or Delete the Amazon MQ Elastic Network Interface in the Amazon MQ Developer Guide.
CreateConfiguration
Show Description Creates a new configuration for the specified configuration name. Amazon MQ uses the default configuration (the engine type and version).
CreateTags
CreateUser
Show Description Creates an ActiveMQ user.
DeleteBroker
Show Description Deletes a broker. Note: This API is asynchronous.
DeleteTags
DeleteUser
Show Description Deletes an ActiveMQ user.
DescribeBroker
Show Description Returns information about the specified broker.
DescribeBrokerEngineTypes
Show Description Describe available engine types and versions.
DescribeBrokerInstanceOptions
Show Description Describe available broker instance options.
DescribeConfiguration
Show Description Returns information about the specified configuration.
DescribeConfigurationRevision
Show Description Returns the specified configuration revision for the specified configuration.
DescribeUser
Show Description Returns information about an ActiveMQ user.
ListBrokers
Show Description Returns a list of all brokers.
ListConfigurationRevisions
Show Description Returns a list of all revisions for the specified configuration.
ListConfigurations
Show Description Returns a list of all configurations.
ListTags
Show Description Lists tags for a resource.
ListUsers
Show Description Returns a list of all ActiveMQ users.
RebootBroker
Show Description Reboots a broker. Note: This API is asynchronous.
UpdateBroker
Show Description Adds a pending configuration change to a broker.
UpdateConfiguration
Show Description Updates the specified configuration.

Mwaa Events

Service Event Name Description
mwaa CreateCliToken
Show Description Create a CLI token to use Airflow CLI.
CreateEnvironment
Show Description Creates an Amazon Managed Workflows for Apache Airflow (MWAA) environment.
CreateWebLoginToken
Show Description Create a JWT token to be used to login to Airflow Web UI with claims based Authentication.
DeleteEnvironment
Show Description Deletes an Amazon Managed Workflows for Apache Airflow (MWAA) environment.
GetEnvironment
Show Description Retrieves the details of an Amazon Managed Workflows for Apache Airflow (MWAA) environment.
ListEnvironments
Show Description Lists the Amazon Managed Workflows for Apache Airflow (MWAA) environments.
ListTagsForResource
Show Description Lists the key-value tag pairs associated to the Amazon Managed Workflows for Apache Airflow (MWAA) environment. For example, "Environment": "Staging".
PublishMetrics
Show Description An operation for publishing metrics from the customers to the Ops plane.
TagResource
Show Description Associates key-value tag pairs to your Amazon Managed Workflows for Apache Airflow (MWAA) environment.
UntagResource
Show Description Removes key-value tag pairs associated to your Amazon Managed Workflows for Apache Airflow (MWAA) environment. For example, "Environment": "Staging".

Neptune Events

Service Event Name Description
neptune AddRoleToDBCluster
AddSourceIdentifierToSubscription
Show Description Adds a source identifier to an existing event notification subscription.
AddTagsToResource
ApplyPendingMaintenanceAction
Show Description Applies a pending maintenance action to a resource (for example, to a DB instance).
CopyDBClusterParameterGroup
Show Description Copies the specified DB cluster parameter group.
CopyDBClusterSnapshot
Show Description Copies a snapshot of a DB cluster. To copy a DB cluster snapshot from a shared manual DB cluster snapshot, SourceDBClusterSnapshotIdentifier must be the Amazon Resource Name (ARN) of the shared DB cluster snapshot.
CopyDBParameterGroup
Show Description Copies the specified DB parameter group.
CreateDBCluster
Show Description Creates a new Amazon Neptune DB cluster. You can use the ReplicationSourceIdentifier parameter to create the DB cluster as a Read Replica of another DB cluster or Amazon Neptune DB instance. Note that when you create a new cluster using CreateDBCluster directly, deletion protection is disabled by default (when you create a new production cluster in the console, deletion protection is enabled by default). You can only delete a DB cluster if its DeletionProtection field is set to false.
CreateDBClusterEndpoint
Show Description Creates a new custom endpoint and associates it with an Amazon Neptune DB cluster.
CreateDBClusterParameterGroup
Show Description Creates a new DB cluster parameter group. Parameters in a DB cluster parameter group apply to all of the instances in a DB cluster. A DB cluster parameter group is initially created with the default parameters for the database engine used by instances in the DB cluster. To provide custom values for any of the parameters, you must modify the group after creating it using ModifyDBClusterParameterGroup. Once you've created a DB cluster parameter group, you need to associate it with your DB cluster using ModifyDBCluster. When you associate a new DB cluster parameter group with a running DB cluster, you need to reboot the DB instances in the DB cluster without failover for the new DB cluster parameter group and associated settings to take effect. After you create a DB cluster parameter group, you should wait at least 5 minutes before creating your first DB cluster that uses that DB cluster parameter group as the default parameter group. This allows Amazon Neptune to fully complete the create action before the DB cluster parameter group is used as the default for a new DB cluster. This is especially important for parameters that are critical when creating the default database for a DB cluster, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon Neptune console or the DescribeDBClusterParameters command to verify that your DB cluster parameter group has been created or modified.
CreateDBClusterSnapshot
Show Description Creates a snapshot of a DB cluster.
CreateDBInstance
Show Description Creates a new DB instance.
CreateDBParameterGroup
Show Description Creates a new DB parameter group. A DB parameter group is initially created with the default parameters for the database engine used by the DB instance. To provide custom values for any of the parameters, you must modify the group after creating it using ModifyDBParameterGroup. Once you've created a DB parameter group, you need to associate it with your DB instance using ModifyDBInstance. When you associate a new DB parameter group with a running DB instance, you need to reboot the DB instance without failover for the new DB parameter group and associated settings to take effect. After you create a DB parameter group, you should wait at least 5 minutes before creating your first DB instance that uses that DB parameter group as the default parameter group. This allows Amazon Neptune to fully complete the create action before the parameter group is used as the default for a new DB instance. This is especially important for parameters that are critical when creating the default database for a DB instance, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon Neptune console or the DescribeDBParameters command to verify that your DB parameter group has been created or modified.
CreateDBSubnetGroup
Show Description Creates a new DB subnet group. DB subnet groups must contain at least one subnet in at least two AZs in the Amazon Region.
CreateEventSubscription
Show Description Creates an event notification subscription. This action requires a topic ARN (Amazon Resource Name) created by either the Neptune console, the SNS console, or the SNS API. To obtain an ARN with SNS, you must create a topic in Amazon SNS and subscribe to the topic. The ARN is displayed in the SNS console. You can specify the type of source (SourceType) you want to be notified of, provide a list of Neptune sources (SourceIds) that triggers the events, and provide a list of event categories (EventCategories) for events you want to be notified of. For example, you can specify SourceType = db-instance, SourceIds = mydbinstance1, mydbinstance2 and EventCategories = Availability, Backup. If you specify both the SourceType and SourceIds, such as SourceType = db-instance and SourceIdentifier = myDBInstance1, you are notified of all the db-instance events for the specified source. If you specify a SourceType but do not specify a SourceIdentifier, you receive notice of the events for that source type for all your Neptune sources. If you do not specify either the SourceType nor the SourceIdentifier, you are notified of events generated from all Neptune sources belonging to your customer account.
DeleteDBCluster
Show Description The DeleteDBCluster action deletes a previously provisioned DB cluster. When you delete a DB cluster, all automated backups for that DB cluster are deleted and can't be recovered. Manual DB cluster snapshots of the specified DB cluster are not deleted. Note that the DB Cluster cannot be deleted if deletion protection is enabled. To delete it, you must first set its DeletionProtection field to False.
DeleteDBClusterEndpoint
Show Description Deletes a custom endpoint and removes it from an Amazon Neptune DB cluster.
DeleteDBClusterParameterGroup
DeleteDBClusterSnapshot
Show Description Deletes a DB cluster snapshot. If the snapshot is being copied, the copy operation is terminated. The DB cluster snapshot must be in the available state to be deleted.
DeleteDBInstance
Show Description The DeleteDBInstance action deletes a previously provisioned DB instance. When you delete a DB instance, all automated backups for that instance are deleted and can't be recovered. Manual DB snapshots of the DB instance to be deleted by DeleteDBInstance are not deleted. If you request a final DB snapshot the status of the Amazon Neptune DB instance is deleting until the DB snapshot is created. The API action DescribeDBInstance is used to monitor the status of this operation. The action can't be canceled or reverted once submitted. Note that when a DB instance is in a failure state and has a status of failed, incompatible-restore, or incompatible-network, you can only delete it when the SkipFinalSnapshot parameter is set to true. You can't delete a DB instance if it is the only instance in the DB cluster, or if it has deletion protection enabled.
DeleteDBParameterGroup
DeleteDBSubnetGroup
DeleteEventSubscription
Show Description Deletes an event notification subscription.
DescribeDBClusterEndpoints
Show Description Returns information about endpoints for an Amazon Neptune DB cluster. This operation can also return information for Amazon RDS clusters and Amazon DocDB clusters.
DescribeDBClusterParameterGroups
Show Description Returns a list of DBClusterParameterGroup descriptions. If a DBClusterParameterGroupName parameter is specified, the list will contain only the description of the specified DB cluster parameter group.
DescribeDBClusterParameters
Show Description Returns the detailed parameter list for a particular DB cluster parameter group.
DescribeDBClusterSnapshotAttributes
Show Description Returns a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot. When sharing snapshots with other Amazon accounts, DescribeDBClusterSnapshotAttributes returns the restore attribute and a list of IDs for the Amazon accounts that are authorized to copy or restore the manual DB cluster snapshot. If all is included in the list of values for the restore attribute, then the manual DB cluster snapshot is public and can be copied or restored by all Amazon accounts. To add or remove access for an Amazon account to copy or restore a manual DB cluster snapshot, or to make the manual DB cluster snapshot public or private, use the ModifyDBClusterSnapshotAttribute API action.
DescribeDBClusterSnapshots
Show Description Returns information about DB cluster snapshots. This API action supports pagination.
DescribeDBClusters
Show Description Returns information about provisioned DB clusters, and supports pagination. This operation can also return information for Amazon RDS clusters and Amazon DocDB clusters.
DescribeDBEngineVersions
Show Description Returns a list of the available DB engines.
DescribeDBInstances
Show Description Returns information about provisioned instances, and supports pagination. This operation can also return information for Amazon RDS instances and Amazon DocDB instances.
DescribeDBParameterGroups
Show Description Returns a list of DBParameterGroup descriptions. If a DBParameterGroupName is specified, the list will contain only the description of the specified DB parameter group.
DescribeDBParameters
Show Description Returns the detailed parameter list for a particular DB parameter group.
DescribeDBSubnetGroups
Show Description Returns a list of DBSubnetGroup descriptions. If a DBSubnetGroupName is specified, the list will contain only the descriptions of the specified DBSubnetGroup. For an overview of CIDR ranges, go to the Wikipedia Tutorial.
DescribeEngineDefaultClusterParameters
Show Description Returns the default engine and system parameter information for the cluster database engine.
DescribeEngineDefaultParameters
Show Description Returns the default engine and system parameter information for the specified database engine.
DescribeEventCategories
Show Description Displays a list of categories for all event source types, or, if specified, for a specified source type.
DescribeEventSubscriptions
Show Description Lists all the subscription descriptions for a customer account. The description for a subscription includes SubscriptionName, SNSTopicARN, CustomerID, SourceType, SourceID, CreationTime, and Status. If you specify a SubscriptionName, lists the description for that subscription.
DescribeEvents
Show Description Returns events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days. Events specific to a particular DB instance, DB security group, database snapshot, or DB parameter group can be obtained by providing the name as a parameter. By default, the past hour of events are returned.
DescribeOrderableDBInstanceOptions
Show Description Returns a list of orderable DB instance options for the specified engine.
DescribePendingMaintenanceActions
Show Description Returns a list of resources (for example, DB instances) that have at least one pending maintenance action.
DescribeValidDBInstanceModifications
Show Description You can call DescribeValidDBInstanceModifications to learn what modifications you can make to your DB instance. You can use this information when you call ModifyDBInstance.
FailoverDBCluster
Show Description Forces a failover for a DB cluster. A failover for a DB cluster promotes one of the Read Replicas (read-only instances) in the DB cluster to be the primary instance (the cluster writer). Amazon Neptune will automatically fail over to a Read Replica, if one exists, when the primary instance fails. You can force a failover when you want to simulate a failure of a primary instance for testing. Because each instance in a DB cluster has its own endpoint address, you will need to clean up and re-establish any existing connections that use those endpoint addresses when the failover is complete.
ListTagsForResource
Show Description Lists all tags on an Amazon Neptune resource.
ModifyDBCluster
Show Description Modify a setting for a DB cluster. You can change one or more database configuration parameters by specifying these parameters and the new values in the request.
ModifyDBClusterEndpoint
Show Description Modifies the properties of an endpoint in an Amazon Neptune DB cluster.
ModifyDBClusterParameterGroup
Show Description Modifies the parameters of a DB cluster parameter group. To modify more than one parameter, submit a list of the following: ParameterName, ParameterValue, and ApplyMethod. A maximum of 20 parameters can be modified in a single request. Changes to dynamic parameters are applied immediately. Changes to static parameters require a reboot without failover to the DB cluster associated with the parameter group before the change can take effect. After you create a DB cluster parameter group, you should wait at least 5 minutes before creating your first DB cluster that uses that DB cluster parameter group as the default parameter group. This allows Amazon Neptune to fully complete the create action before the parameter group is used as the default for a new DB cluster. This is especially important for parameters that are critical when creating the default database for a DB cluster, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon Neptune console or the DescribeDBClusterParameters command to verify that your DB cluster parameter group has been created or modified.
ModifyDBClusterSnapshotAttribute
Show Description Adds an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot. To share a manual DB cluster snapshot with other Amazon accounts, specify restore as the AttributeName and use the ValuesToAdd parameter to add a list of IDs of the Amazon accounts that are authorized to restore the manual DB cluster snapshot. Use the value all to make the manual DB cluster snapshot public, which means that it can be copied or restored by all Amazon accounts. Do not add the all value for any manual DB cluster snapshots that contain private information that you don't want available to all Amazon accounts. If a manual DB cluster snapshot is encrypted, it can be shared, but only by specifying a list of authorized Amazon account IDs for the ValuesToAdd parameter. You can't use all as a value for that parameter in this case. To view which Amazon accounts have access to copy or restore a manual DB cluster snapshot, or whether a manual DB cluster snapshot public or private, use the DescribeDBClusterSnapshotAttributes API action.
ModifyDBInstance
Show Description Modifies settings for a DB instance. You can change one or more database configuration parameters by specifying these parameters and the new values in the request. To learn what modifications you can make to your DB instance, call DescribeValidDBInstanceModifications before you call ModifyDBInstance.
ModifyDBParameterGroup
Show Description Modifies the parameters of a DB parameter group. To modify more than one parameter, submit a list of the following: ParameterName, ParameterValue, and ApplyMethod. A maximum of 20 parameters can be modified in a single request. Changes to dynamic parameters are applied immediately. Changes to static parameters require a reboot without failover to the DB instance associated with the parameter group before the change can take effect. After you modify a DB parameter group, you should wait at least 5 minutes before creating your first DB instance that uses that DB parameter group as the default parameter group. This allows Amazon Neptune to fully complete the modify action before the parameter group is used as the default for a new DB instance. This is especially important for parameters that are critical when creating the default database for a DB instance, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon Neptune console or the DescribeDBParameters command to verify that your DB parameter group has been created or modified.
ModifyDBSubnetGroup
Show Description Modifies an existing DB subnet group. DB subnet groups must contain at least one subnet in at least two AZs in the Amazon Region.
ModifyEventSubscription
Show Description Modifies an existing event notification subscription. Note that you can't modify the source identifiers using this call; to change source identifiers for a subscription, use the AddSourceIdentifierToSubscription and RemoveSourceIdentifierFromSubscription calls. You can see a list of the event categories for a given SourceType by using the DescribeEventCategories action.
PromoteReadReplicaDBCluster
Show Description Not supported.
RebootDBInstance
Show Description You might need to reboot your DB instance, usually for maintenance reasons. For example, if you make certain modifications, or if you change the DB parameter group associated with the DB instance, you must reboot the instance for the changes to take effect. Rebooting a DB instance restarts the database engine service. Rebooting a DB instance results in a momentary outage, during which the DB instance status is set to rebooting.
RemoveRoleFromDBCluster
RemoveSourceIdentifierFromSubscription
Show Description Removes a source identifier from an existing event notification subscription.
RemoveTagsFromResource
ResetDBClusterParameterGroup
Show Description Modifies the parameters of a DB cluster parameter group to the default value. To reset specific parameters submit a list of the following: ParameterName and ApplyMethod. To reset the entire DB cluster parameter group, specify the DBClusterParameterGroupName and ResetAllParameters parameters. When resetting the entire group, dynamic parameters are updated immediately and static parameters are set to pending-reboot to take effect on the next DB instance restart or RebootDBInstance request. You must call RebootDBInstance for every DB instance in your DB cluster that you want the updated static parameter to apply to.
ResetDBParameterGroup
Show Description Modifies the parameters of a DB parameter group to the engine/system default value. To reset specific parameters, provide a list of the following: ParameterName and ApplyMethod. To reset the entire DB parameter group, specify the DBParameterGroup name and ResetAllParameters parameters. When resetting the entire group, dynamic parameters are updated immediately and static parameters are set to pending-reboot to take effect on the next DB instance restart or RebootDBInstance request.
RestoreDBClusterFromSnapshot
Show Description Creates a new DB cluster from a DB snapshot or DB cluster snapshot. If a DB snapshot is specified, the target DB cluster is created from the source DB snapshot with a default configuration and default security group. If a DB cluster snapshot is specified, the target DB cluster is created from the source DB cluster restore point with the same configuration as the original source DB cluster, except that the new DB cluster is created with the default security group.
RestoreDBClusterToPointInTime
Show Description Restores a DB cluster to an arbitrary point in time. Users can restore to any point in time before LatestRestorableTime for up to BackupRetentionPeriod days. The target DB cluster is created from the source DB cluster with the same configuration as the original DB cluster, except that the new DB cluster is created with the default DB security group. This action only restores the DB cluster, not the DB instances for that DB cluster. You must invoke the CreateDBInstance action to create DB instances for the restored DB cluster, specifying the identifier of the restored DB cluster in DBClusterIdentifier. You can create DB instances only after the RestoreDBClusterToPointInTime action has completed and the DB cluster is available.
StartDBCluster
Show Description Starts an Amazon Neptune DB cluster that was stopped using the Amazon console, the Amazon CLI stop-db-cluster command, or the StopDBCluster API.

Networkmanager Events

Service Event Name Description
networkmanager AssociateCustomerGateway
Show Description Associates a customer gateway with a device and optionally, with a link. If you specify a link, it must be associated with the specified device. You can only associate customer gateways that are connected to a VPN attachment on a transit gateway. The transit gateway must be registered in your global network. When you register a transit gateway, customer gateways that are connected to the transit gateway are automatically included in the global network. To list customer gateways that are connected to a transit gateway, use the DescribeVpnConnections EC2 API and filter by transit-gateway-id. You cannot associate a customer gateway with more than one device and link.
AssociateLink
Show Description Associates a link to a device. A device can be associated to multiple links and a link can be associated to multiple devices. The device and link must be in the same global network and the same site.
AssociateTransitGatewayConnectPeer
Show Description Associates a transit gateway Connect peer with a device, and optionally, with a link. If you specify a link, it must be associated with the specified device. You can only associate transit gateway Connect peers that have been created on a transit gateway that's registered in your global network. You cannot associate a transit gateway Connect peer with more than one device and link.
CreateConnection
Show Description Creates a connection between two devices. The devices can be a physical or virtual appliance that connects to a third-party appliance in a VPC, or a physical appliance that connects to another physical appliance in an on-premises network.
CreateDevice
Show Description Creates a new device in a global network. If you specify both a site ID and a location, the location of the site is used for visualization in the Network Manager console.
CreateGlobalNetwork
Show Description Creates a new, empty global network.
CreateLink
Show Description Creates a new link for a specified site.
CreateSite
Show Description Creates a new site in a global network.
DeleteConnection
Show Description Deletes the specified connection in your global network.
DeleteDevice
Show Description Deletes an existing device. You must first disassociate the device from any links and customer gateways.
DeleteGlobalNetwork
Show Description Deletes an existing global network. You must first delete all global network objects (devices, links, and sites) and deregister all transit gateways.
DeleteLink
Show Description Deletes an existing link. You must first disassociate the link from any devices and customer gateways.
DeleteSite
Show Description Deletes an existing site. The site cannot be associated with any device or link.
DeregisterTransitGateway
Show Description Deregisters a transit gateway from your global network. This action does not delete your transit gateway, or modify any of its attachments. This action removes any customer gateway associations.
DescribeGlobalNetworks
Show Description Describes one or more global networks. By default, all global networks are described. To describe the objects in your global network, you must use the appropriate Get* action. For example, to list the transit gateways in your global network, use GetTransitGatewayRegistrations.
DisassociateCustomerGateway
Show Description Disassociates a customer gateway from a device and a link.
DisassociateLink
Show Description Disassociates an existing device from a link. You must first disassociate any customer gateways that are associated with the link.
DisassociateTransitGatewayConnectPeer
Show Description Disassociates a transit gateway Connect peer from a device and link.
GetConnections
Show Description Gets information about one or more of your connections in a global network.
GetCustomerGatewayAssociations
Show Description Gets the association information for customer gateways that are associated with devices and links in your global network.
GetDevices
Show Description Gets information about one or more of your devices in a global network.
GetLinkAssociations
Show Description Gets the link associations for a device or a link. Either the device ID or the link ID must be specified.
GetLinks
Show Description Gets information about one or more links in a specified global network. If you specify the site ID, you cannot specify the type or provider in the same request. You can specify the type and provider in the same request.
GetNetworkResourceCounts
Show Description Gets the count of network resources, by resource type, for the specified global network.
GetNetworkResourceRelationships
Show Description Gets the network resource relationships for the specified global network.
GetNetworkResources
Show Description Describes the network resources for the specified global network. The results include information from the corresponding Describe call for the resource, minus any sensitive information such as pre-shared keys.
GetNetworkRoutes
Show Description Gets the network routes of the specified global network.
GetNetworkTelemetry
Show Description Gets the network telemetry of the specified global network.
GetRouteAnalysis
Show Description Gets information about the specified route analysis.
GetSites
Show Description Gets information about one or more of your sites in a global network.
GetTransitGatewayConnectPeerAssociations
Show Description Gets information about one or more of your transit gateway Connect peer associations in a global network.
GetTransitGatewayRegistrations
Show Description Gets information about the transit gateway registrations in a specified global network.
ListTagsForResource
Show Description Lists the tags for a specified resource.
RegisterTransitGateway
Show Description Registers a transit gateway in your global network. The transit gateway can be in any Amazon Web Services Region, but it must be owned by the same Amazon Web Services account that owns the global network. You cannot register a transit gateway in more than one global network.
StartRouteAnalysis
Show Description Starts analyzing the routing path between the specified source and destination. For more information, see Route Analyzer.
TagResource
Show Description Tags a specified resource.
UntagResource
Show Description Removes tags from a specified resource.
UpdateConnection
Show Description Updates the information for an existing connection. To remove information for any of the parameters, specify an empty string.
UpdateDevice
Show Description Updates the details for an existing device. To remove information for any of the parameters, specify an empty string.
UpdateGlobalNetwork
Show Description Updates an existing global network. To remove information for any of the parameters, specify an empty string.
UpdateLink
Show Description Updates the details for an existing link. To remove information for any of the parameters, specify an empty string.
UpdateNetworkResourceMetadata
Show Description Updates the resource metadata for the specified global network.

Nimble Events

Service Event Name Description
nimble AcceptEulas
Show Description Accept EULAs.
CreateLaunchProfile
Show Description Create a launch profile.
CreateStreamingImage
Show Description Creates a streaming image resource in a studio.
CreateStreamingSession
Show Description Creates a streaming session in a studio. After invoking this operation, you must poll GetStreamingSession until the streaming session is in state READY.
CreateStreamingSessionStream
Show Description Creates a streaming session stream for a streaming session. After invoking this API, invoke GetStreamingSessionStream with the returned streamId to poll the resource until it is in state READY.
CreateStudio
Show Description Create a new Studio. When creating a Studio, two IAM roles must be provided: the admin role and the user Role. These roles are assumed by your users when they log in to the Nimble Studio portal. The user role must have the AmazonNimbleStudio-StudioUser managed policy attached for the portal to function properly. The Admin Role must have the AmazonNimbleStudio-StudioAdmin managed policy attached for the portal to function properly. You may optionally specify a KMS key in the StudioEncryptionConfiguration. In Nimble Studio, resource names, descriptions, initialization scripts, and other data you provide are always encrypted at rest using an KMS key. By default, this key is owned by Amazon Web Services and managed on your behalf. You may provide your own KMS key when calling CreateStudio to encrypt this data using a key you own and manage. When providing an KMS key during studio creation, Nimble Studio creates KMS grants in your account to provide your studio user and admin roles access to these KMS keys. If you delete this grant, the studio will no longer be accessible to your portal users. If you delete the studio KMS key, your studio will no longer be accessible.
CreateStudioComponent
Show Description Creates a studio component resource.
DeleteLaunchProfile
Show Description Permanently delete a launch profile.
DeleteLaunchProfileMember
Show Description Delete a user from launch profile membership.
DeleteStreamingImage
Show Description Delete streaming image.
DeleteStreamingSession
Show Description Deletes streaming session resource. After invoking this operation, use GetStreamingSession to poll the resource until it transitions to a DELETED state. A streaming session will count against your streaming session quota until it is marked DELETED.
DeleteStudio
Show Description Delete a studio resource.
DeleteStudioComponent
Show Description Deletes a studio component resource.
DeleteStudioMember
Show Description Delete a user from studio membership.
GetEula
Show Description Get Eula.
GetLaunchProfile
Show Description Get a launch profile.
GetLaunchProfileDetails
Show Description Launch profile details include the launch profile resource and summary information of resources that are used by, or available to, the launch profile. This includes the name and description of all studio components used by the launch profiles, and the name and description of streaming images that can be used with this launch profile.
GetLaunchProfileInitialization
Show Description Get a launch profile initialization.
GetLaunchProfileMember
Show Description Get a user persona in launch profile membership.
GetStreamingImage
Show Description Get streaming image.
GetStreamingSession
Show Description Gets StreamingSession resource. anvoke this operation to poll for a streaming session state while creating or deleting a session.
GetStreamingSessionStream
Show Description Gets a StreamingSessionStream for a streaming session. Invoke this operation to poll the resource after invoking CreateStreamingSessionStream. After the StreamingSessionStream changes to the state READY, the url property will contain a stream to be used with the DCV streaming client.
GetStudio
Show Description Get a Studio resource.
GetStudioComponent
Show Description Gets a studio component resource.
GetStudioMember
Show Description Get a user's membership in a studio.
ListEulaAcceptances
Show Description List Eula Acceptances.
ListEulas
Show Description List Eulas.
ListLaunchProfileMembers
Show Description Get all users in a given launch profile membership.
ListLaunchProfiles
Show Description List all the launch profiles a studio.
ListStreamingImages
Show Description List the streaming image resources available to this studio. This list will contain both images provided by Amazon Web Services, as well as streaming images that you have created in your studio.
ListStreamingSessions
Show Description Lists the streaming image resources in a studio.
ListStudioComponents
Show Description Lists the StudioComponents in a studio.
ListStudioMembers
Show Description Get all users in a given studio membership.
ListStudios
Show Description List studios in your Amazon Web Services account in the requested Amazon Web Services Region.
ListTagsForResource
Show Description Gets the tags for a resource, given its Amazon Resource Names (ARN). This operation supports ARNs for all resource types in Nimble Studio that support tags, including studio, studio component, launch profile, streaming image, and streaming session. All resources that can be tagged will contain an ARN property, so you do not have to create this ARN yourself.
PutLaunchProfileMembers
Show Description Add/update users with given persona to launch profile membership.
PutStudioMembers
Show Description Add/update users with given persona to studio membership.
StartStreamingSession
Show Description Transitions sessions from the STOPPED state into the READY state. The START_IN_PROGRESS state is the intermediate state between the STOPPED and READY states.
StartStudioSSOConfigurationRepair
Show Description Repairs the Amazon Web Services SSO configuration for a given studio. If the studio has a valid Amazon Web Services SSO configuration currently associated with it, this operation will fail with a validation error. If the studio does not have a valid Amazon Web Services SSO configuration currently associated with it, then a new Amazon Web Services SSO application is created for the studio and the studio is changed to the READY state. After the Amazon Web Services SSO application is repaired, you must use the Amazon Nimble Studio console to add administrators and users to your studio.
StopStreamingSession
Show Description Transitions sessions from the READY state into the STOPPED state. The STOP_IN_PROGRESS state is the intermediate state between the READY and STOPPED states.
TagResource
Show Description Creates tags for a resource, given its ARN.
UntagResource
Show Description Deletes the tags for a resource.
UpdateLaunchProfile
Show Description Update a launch profile.
UpdateLaunchProfileMember
Show Description Update a user persona in launch profile membership.
UpdateStreamingImage
Show Description Update streaming image.
UpdateStudio
Show Description Update a Studio resource. Currently, this operation only supports updating the displayName of your studio.

Opensearch Events

Service Event Name Description
opensearch AcceptInboundConnection
Show Description Allows the remote domain owner to accept an inbound cross-cluster connection request.
AddTags
AssociatePackage
Show Description Associates a package with an Amazon OpenSearch Service domain.
CancelServiceSoftwareUpdate
Show Description Cancels a scheduled service software update for an Amazon OpenSearch Service domain. You can only perform this operation before the AutomatedUpdateDate and when the UpdateStatus is in the PENDING_UPDATE state.
CreateDomain
Show Description Creates a new Amazon OpenSearch Service domain. For more information, see Creating and managing Amazon OpenSearch Service domains in the Amazon OpenSearch Service Developer Guide.
CreateOutboundConnection
Show Description Creates a new cross-cluster connection from a local OpenSearch domain to a remote OpenSearch domain.
CreatePackage
Show Description Create a package for use with Amazon OpenSearch Service domains.
DeleteDomain
Show Description Permanently deletes the specified domain and all of its data. Once a domain is deleted, it cannot be recovered.
DeleteInboundConnection
Show Description Allows the remote domain owner to delete an existing inbound cross-cluster connection.
DeleteOutboundConnection
Show Description Allows the local domain owner to delete an existing outbound cross-cluster connection.
DeletePackage
Show Description Deletes the package.
DescribeDomain
Show Description Returns domain configuration information about the specified domain, including the domain ID, domain endpoint, and domain ARN.
DescribeDomainAutoTunes
Show Description Provides scheduled Auto-Tune action details for the domain, such as Auto-Tune action type, description, severity, and scheduled date.
DescribeDomainConfig
Show Description Provides cluster configuration information about the specified domain, such as the state, creation date, update version, and update date for cluster options.
DescribeDomains
Show Description Returns domain configuration information about the specified domains, including the domain ID, domain endpoint, and domain ARN.
DescribeInboundConnections
Show Description Lists all the inbound cross-cluster connections for a remote domain.
DescribeInstanceTypeLimits
Show Description Describe the limits for a given instance type and OpenSearch or Elasticsearch version. When modifying an existing domain, specify the DomainName to see which limits you can modify.
DescribeOutboundConnections
Show Description Lists all the outbound cross-cluster connections for a local domain.
DescribePackages
Show Description Describes all packages available to Amazon OpenSearch Service domains. Includes options for filtering, limiting the number of results, and pagination.
DescribeReservedInstanceOfferings
Show Description Lists available reserved OpenSearch instance offerings.
DescribeReservedInstances
Show Description Returns information about reserved OpenSearch instances for this account.
DissociatePackage
Show Description Dissociates a package from the Amazon OpenSearch Service domain.
GetCompatibleVersions
Show Description Returns a list of upgrade-compatible versions of OpenSearch/Elasticsearch. You can optionally pass a DomainName to get all upgrade-compatible versions of OpenSearch/Elasticsearch for that specific domain.
GetPackageVersionHistory
Show Description Returns a list of package versions, along with their creation time and commit message.
GetUpgradeHistory
Show Description Retrieves the complete history of the last 10 upgrades performed on the domain.
GetUpgradeStatus
Show Description Retrieves the latest status of the last upgrade or upgrade eligibility check performed on the domain.
ListDomainNames
Show Description Returns the names of all domains owned by the current user's account.
ListDomainsForPackage
Show Description Lists all Amazon OpenSearch Service domains associated with the package.
ListInstanceTypeDetails
Show Description None
ListPackagesForDomain
Show Description Lists all packages associated with the Amazon OpenSearch Service domain.
ListTags
Show Description Returns all tags for the given domain.
ListVersions
Show Description List all supported versions of OpenSearch and Elasticsearch.
PurchaseReservedInstanceOffering
Show Description Allows you to purchase reserved OpenSearch instances.
RejectInboundConnection
Show Description Allows the remote domain owner to reject an inbound cross-cluster connection request.
RemoveTags
StartServiceSoftwareUpdate
Show Description Schedules a service software update for an Amazon OpenSearch Service domain.
UpdateDomainConfig
Show Description Modifies the cluster configuration of the specified domain, such as setting the instance type and the number of instances.
UpdatePackage
Show Description Updates a package for use with Amazon OpenSearch Service domains.

Opsworks Events

Service Event Name Description
opsworks AssignInstance
AssignVolume
AssociateElasticIp
AttachElasticLoadBalancer
CloneStack
Show Description Creates a clone of a specified stack. For more information, see Clone a Stack. By default, all parameters are set to the values used by the parent stack. Required Permissions: To use this action, an IAM user must have an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
CreateApp
Show Description Creates an app for a specified stack. For more information, see Creating Apps. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
CreateDeployment
Show Description Runs deployment or stack commands. For more information, see Deploying Apps and Run Stack Commands. Required Permissions: To use this action, an IAM user must have a Deploy or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
CreateInstance
Show Description Creates an instance in a specified stack. For more information, see Adding an Instance to a Layer. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
CreateLayer
Show Description Creates a layer. For more information, see How to Create a Layer. You should use CreateLayer for noncustom layer types such as PHP App Server only if the stack does not have an existing layer of that type. A stack can have at most one instance of each noncustom layer; if you attempt to create a second instance, CreateLayer fails. A stack can have an arbitrary number of custom layers, so you can call CreateLayer as many times as you like for that layer type. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
CreateStack
Show Description Creates a new stack. For more information, see Create a New Stack. Required Permissions: To use this action, an IAM user must have an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
CreateUserProfile
Show Description Creates a new user profile. Required Permissions: To use this action, an IAM user must have an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DeleteApp
DeleteInstance
DeleteLayer
DeleteStack
DeleteUserProfile
DeregisterEcsCluster
DeregisterElasticIp
DeregisterInstance
DeregisterRdsDbInstance
DeregisterVolume
DescribeAgentVersions
Show Description Describes the available AWS OpsWorks Stacks agent versions. You must specify a stack ID or a configuration manager. DescribeAgentVersions returns a list of available agent versions for the specified stack or configuration manager.
DescribeApps
Show Description Requests a description of a specified set of apps. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeCommands
Show Description Describes the results of specified commands. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeDeployments
Show Description Requests a description of a specified set of deployments. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeEcsClusters
Show Description Describes Amazon ECS clusters that are registered with a stack. If you specify only a stack ID, you can use the MaxResults and NextToken parameters to paginate the response. However, AWS OpsWorks Stacks currently supports only one cluster per layer, so the result set has a maximum of one element. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack or an attached policy that explicitly grants permission. For more information about user permissions, see Managing User Permissions. This call accepts only one resource-identifying parameter.
DescribeElasticIps
Show Description Describes Elastic IP addresses. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeElasticLoadBalancers
Show Description Describes a stack's Elastic Load Balancing instances. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeInstances
Show Description Requests a description of a set of instances. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeLayers
Show Description Requests a description of one or more layers in a specified stack. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeLoadBasedAutoScaling
Show Description Describes load-based auto scaling configurations for specified layers. You must specify at least one of the parameters. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeMyUserProfile
Show Description Describes a user's SSH information. Required Permissions: To use this action, an IAM user must have self-management enabled or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeOperatingSystems
Show Description Describes the operating systems that are supported by AWS OpsWorks Stacks.
DescribePermissions
Show Description Describes the permissions for a specified stack. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
DescribeRaidArrays
Show Description Describe an instance's RAID arrays. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeRdsDbInstances
Show Description Describes Amazon RDS instances. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions. This call accepts only one resource-identifying parameter.
DescribeServiceErrors
Show Description Describes AWS OpsWorks Stacks service errors. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions. This call accepts only one resource-identifying parameter.
DescribeStackProvisioningParameters
Show Description Requests a description of a stack's provisioning parameters. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeStackSummary
Show Description Describes the number of layers and apps in a specified stack, and the number of instances in each state, such as running_setup or online. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeStacks
Show Description Requests a description of one or more stacks. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeTimeBasedAutoScaling
Show Description Describes time-based auto scaling configurations for specified instances. You must specify at least one of the parameters. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeUserProfiles
Show Description Describe specified users. Required Permissions: To use this action, an IAM user must have an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DescribeVolumes
Show Description Describes an instance's Amazon EBS volumes. This call accepts only one resource-identifying parameter. Required Permissions: To use this action, an IAM user must have a Show, Deploy, or Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information about user permissions, see Managing User Permissions.
DetachElasticLoadBalancer
DisassociateElasticIp
GetHostnameSuggestion
Show Description Gets a generated host name for the specified layer, based on the current host name theme. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
GrantAccess
Show Description This action can be used only with Windows stacks. Grants RDP access to a Windows instance for a specified time period.
ListTags
Show Description Returns a list of tags that are applied to the specified stack or layer.
RebootInstance
RegisterEcsCluster
Show Description Registers a specified Amazon ECS cluster with a stack. You can register only one cluster with a stack. A cluster can be registered with only one stack. For more information, see Resource Management. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
RegisterElasticIp
Show Description Registers an Elastic IP address with a specified stack. An address can be registered with only one stack at a time. If the address is already registered, you must first deregister it by calling DeregisterElasticIp. For more information, see Resource Management. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
RegisterInstance
Show Description Registers instances that were created outside of AWS OpsWorks Stacks with a specified stack. We do not recommend using this action to register instances. The complete registration operation includes two tasks: installing the AWS OpsWorks Stacks agent on the instance, and registering the instance with the stack. RegisterInstance handles only the second step. You should instead use the AWS CLI register command, which performs the entire registration operation. For more information, see Registering an Instance with an AWS OpsWorks Stacks Stack. Registered instances have the same requirements as instances that are created by using the CreateInstance API. For example, registered instances must be running a supported Linux-based operating system, and they must have a supported instance type. For more information about requirements for instances that you want to register, see Preparing the Instance. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
RegisterRdsDbInstance
RegisterVolume
Show Description Registers an Amazon EBS volume with a specified stack. A volume can be registered with only one stack at a time. If the volume is already registered, you must first deregister it by calling DeregisterVolume. For more information, see Resource Management. Required Permissions: To use this action, an IAM user must have a Manage permissions level for the stack, or an attached policy that explicitly grants permissions. For more information on user permissions, see Managing User Permissions.
SetLoadBasedAutoScaling
SetPermission
SetTimeBasedAutoScaling
StartInstance
StartStack
StopInstance
StopStack
TagResource
UnassignInstance
UnassignVolume
UntagResource
UpdateApp
UpdateElasticIp
UpdateInstance
UpdateLayer
UpdateMyUserProfile
UpdateRdsDbInstance
UpdateStack
UpdateUserProfile

Opsworkscm Events

Service Event Name Description
opsworkscm AssociateNode
Show Description Associates a new node with the server. For more information about how to disassociate a node, see DisassociateNode. On a Chef server: This command is an alternative to knife bootstrap. Example (Chef): aws opsworks-cm associate-node --server-name MyServer --node-name MyManagedNode --engine-attributes "Name=CHEF_ORGANIZATION,Value=default" "Name=CHEF_NODE_PUBLIC_KEY,Value=public-key-pem" On a Puppet server, this command is an alternative to the puppet cert sign command that signs a Puppet node CSR. Example (Puppet): aws opsworks-cm associate-node --server-name MyServer --node-name MyManagedNode --engine-attributes "Name=PUPPET_NODE_CSR,Value=csr-pem" A node can can only be associated with servers that are in a HEALTHY state. Otherwise, an InvalidStateException is thrown. A ResourceNotFoundException is thrown when the server does not exist. A ValidationException is raised when parameters of the request are not valid. The AssociateNode API call can be integrated into Auto Scaling configurations, AWS Cloudformation templates, or the user data of a server's instance.
CreateBackup
Show Description Creates an application-level backup of a server. While the server is in the BACKING_UP state, the server cannot be changed, and no additional backup can be created. Backups can be created for servers in RUNNING, HEALTHY, and UNHEALTHY states. By default, you can create a maximum of 50 manual backups. This operation is asynchronous. A LimitExceededException is thrown when the maximum number of manual backups is reached. An InvalidStateException is thrown when the server is not in any of the following states: RUNNING, HEALTHY, or UNHEALTHY. A ResourceNotFoundException is thrown when the server is not found. A ValidationException is thrown when parameters of the request are not valid.
CreateServer
Show Description Creates and immedately starts a new server. The server is ready to use when it is in the HEALTHY state. By default, you can create a maximum of 10 servers. This operation is asynchronous. A LimitExceededException is thrown when you have created the maximum number of servers (10). A ResourceAlreadyExistsException is thrown when a server with the same name already exists in the account. A ResourceNotFoundException is thrown when you specify a backup ID that is not valid or is for a backup that does not exist. A ValidationException is thrown when parameters of the request are not valid. If you do not specify a security group by adding the SecurityGroupIds parameter, AWS OpsWorks creates a new security group. Chef Automate: The default security group opens the Chef server to the world on TCP port 443. If a KeyName is present, AWS OpsWorks enables SSH access. SSH is also open to the world on TCP port 22. Puppet Enterprise: The default security group opens TCP ports 22, 443, 4433, 8140, 8142, 8143, and 8170. If a KeyName is present, AWS OpsWorks enables SSH access. SSH is also open to the world on TCP port 22. By default, your server is accessible from any IP address. We recommend that you update your security group rules to allow access from known IP addresses and address ranges only. To edit security group rules, open Security Groups in the navigation pane of the EC2 management console. To specify your own domain for a server, and provide your own self-signed or CA-signed certificate and private key, specify values for CustomDomain, CustomCertificate, and CustomPrivateKey.
DeleteBackup
Show Description Deletes a backup. You can delete both manual and automated backups. This operation is asynchronous. An InvalidStateException is thrown when a backup deletion is already in progress. A ResourceNotFoundException is thrown when the backup does not exist. A ValidationException is thrown when parameters of the request are not valid.
DeleteServer
Show Description Deletes the server and the underlying AWS CloudFormation stacks (including the server's EC2 instance). When you run this command, the server state is updated to DELETING. After the server is deleted, it is no longer returned by DescribeServer requests. If the AWS CloudFormation stack cannot be deleted, the server cannot be deleted. This operation is asynchronous. An InvalidStateException is thrown when a server deletion is already in progress. A ResourceNotFoundException is thrown when the server does not exist. A ValidationException is raised when parameters of the request are not valid.
DescribeAccountAttributes
Show Description Describes your OpsWorks-CM account attributes. This operation is synchronous.
DescribeBackups
Show Description Describes backups. The results are ordered by time, with newest backups first. If you do not specify a BackupId or ServerName, the command returns all backups. This operation is synchronous. A ResourceNotFoundException is thrown when the backup does not exist. A ValidationException is raised when parameters of the request are not valid.
DescribeEvents
Show Description Describes events for a specified server. Results are ordered by time, with newest events first. This operation is synchronous. A ResourceNotFoundException is thrown when the server does not exist. A ValidationException is raised when parameters of the request are not valid.
DescribeNodeAssociationStatus
Show Description Returns the current status of an existing association or disassociation request. A ResourceNotFoundException is thrown when no recent association or disassociation request with the specified token is found, or when the server does not exist. A ValidationException is raised when parameters of the request are not valid.
DescribeServers
Show Description Lists all configuration management servers that are identified with your account. Only the stored results from Amazon DynamoDB are returned. AWS OpsWorks CM does not query other services. This operation is synchronous. A ResourceNotFoundException is thrown when the server does not exist. A ValidationException is raised when parameters of the request are not valid.
DisassociateNode
Show Description Disassociates a node from an AWS OpsWorks CM server, and removes the node from the server's managed nodes. After a node is disassociated, the node key pair is no longer valid for accessing the configuration manager's API. For more information about how to associate a node, see AssociateNode. A node can can only be disassociated from a server that is in a HEALTHY state. Otherwise, an InvalidStateException is thrown. A ResourceNotFoundException is thrown when the server does not exist. A ValidationException is raised when parameters of the request are not valid.
ExportServerEngineAttribute
Show Description Exports a specified server engine attribute as a base64-encoded string. For example, you can export user data that you can use in EC2 to associate nodes with a server. This operation is synchronous. A ValidationException is raised when parameters of the request are not valid. A ResourceNotFoundException is thrown when the server does not exist. An InvalidStateException is thrown when the server is in any of the following states: CREATING, TERMINATED, FAILED or DELETING.
ListTagsForResource
Show Description Returns a list of tags that are applied to the specified AWS OpsWorks for Chef Automate or AWS OpsWorks for Puppet Enterprise servers or backups.
RestoreServer
Show Description Restores a backup to a server that is in a CONNECTION_LOST, HEALTHY, RUNNING, UNHEALTHY, or TERMINATED state. When you run RestoreServer, the server's EC2 instance is deleted, and a new EC2 instance is configured. RestoreServer maintains the existing server endpoint, so configuration management of the server's client devices (nodes) should continue to work. Restoring from a backup is performed by creating a new EC2 instance. If restoration is successful, and the server is in a HEALTHY state, AWS OpsWorks CM switches traffic over to the new instance. After restoration is finished, the old EC2 instance is maintained in a Running or Stopped state, but is eventually terminated. This operation is asynchronous. An InvalidStateException is thrown when the server is not in a valid state. A ResourceNotFoundException is thrown when the server does not exist. A ValidationException is raised when parameters of the request are not valid.
StartMaintenance
Show Description Manually starts server maintenance. This command can be useful if an earlier maintenance attempt failed, and the underlying cause of maintenance failure has been resolved. The server is in an UNDER_MAINTENANCE state while maintenance is in progress. Maintenance can only be started on servers in HEALTHY and UNHEALTHY states. Otherwise, an InvalidStateException is thrown. A ResourceNotFoundException is thrown when the server does not exist. A ValidationException is raised when parameters of the request are not valid.
TagResource
Show Description Applies tags to an AWS OpsWorks for Chef Automate or AWS OpsWorks for Puppet Enterprise server, or to server backups.
UntagResource
Show Description Removes specified tags from an AWS OpsWorks-CM server or backup.
UpdateServer
Show Description Updates settings for a server. This operation is synchronous.

Organizations Events

Service Event Name Description
organizations AcceptHandshake
Show Description Sends a response to the originator of a handshake agreeing to the action proposed by the handshake request. This operation can be called only by the following principals when they also have the relevant IAM permissions:
  • Invitation to join or Approve all features request handshakes: only a principal from the member account. The user who calls the API for an invitation to join must have the organizations:AcceptHandshake permission. If you enabled all features in the organization, the user must also have the iam:CreateServiceLinkedRole permission so that AWS Organizations can create the required service-linked role named AWSServiceRoleForOrganizations. For more information, see AWS Organizations and Service-Linked Roles in the AWS Organizations User Guide.
  • Enable all features final confirmation handshake: only a principal from the management account. For more information about invitations, see Inviting an AWS Account to Join Your Organization in the AWS Organizations User Guide. For more information about requests to enable all features in the organization, see Enabling All Features in Your Organization in the AWS Organizations User Guide.
After you accept a handshake, it continues to appear in the results of relevant APIs for only 30 days. After that, it's deleted.
AttachPolicy
CancelHandshake
Show Description Cancels a handshake. Canceling a handshake sets the handshake state to CANCELED. This operation can be called only from the account that originated the handshake. The recipient of the handshake can't cancel it, but can use DeclineHandshake instead. After a handshake is canceled, the recipient can no longer respond to that handshake. After you cancel a handshake, it continues to appear in the results of relevant APIs for only 30 days. After that, it's deleted.
CreateAccount
Show Description Creates an AWS account that is automatically a member of the organization whose credentials made the request. This is an asynchronous request that AWS performs in the background. Because CreateAccount operates asynchronously, it can return a successful completion message even though account initialization might still be in progress. You might need to wait a few minutes before you can successfully access the account. To check the status of the request, do one of the following:
  • Use the Id member of the CreateAccountStatus response element from this operation to provide as a parameter to the DescribeCreateAccountStatus operation.
  • Check the AWS CloudTrail log for the CreateAccountResult event. For information on using AWS CloudTrail with AWS Organizations, see Logging and monitoring in AWS Organizations in the AWS Organizations User Guide.
The user who calls the API to create an account must have the organizations:CreateAccount permission. If you enabled all features in the organization, AWS Organizations creates the required service-linked role named AWSServiceRoleForOrganizations. For more information, see AWS Organizations and Service-Linked Roles in the AWS Organizations User Guide. If the request includes tags, then the requester must have the organizations:TagResource permission. AWS Organizations preconfigures the new member account with a role (named OrganizationAccountAccessRole by default) that grants users in the management account administrator permissions in the new member account. Principals in the management account can assume the role. AWS Organizations clones the company name and address information for the new account from the organization's management account. This operation can be called only from the organization's management account. For more information about creating accounts, see Creating an AWS Account in Your Organization in the AWS Organizations User Guide.
  • When you create an account in an organization using the AWS Organizations console, API, or CLI commands, the information required for the account to operate as a standalone account, such as a payment method and signing the end user license agreement (EULA) is not automatically collected. If you must remove an account from your organization later, you can do so only after you provide the missing information. Follow the steps at To leave an organization as a member account in the AWS Organizations User Guide.
  • If you get an exception that indicates that you exceeded your account limits for the organization, contact AWS Support.
  • If you get an exception that indicates that the operation failed because your organization is still initializing, wait one hour and then try again. If the error persists, contact AWS Support.
  • Using CreateAccount to create multiple temporary accounts isn't recommended. You can only close an account from the Billing and Cost Management Console, and you must be signed in as the root user. For information on the requirements and process for closing an account, see Closing an AWS Account in the AWS Organizations User Guide.
When you create a member account with this operation, you can choose whether to create the account with the IAM User and Role Access to Billing Information switch enabled. If you enable it, IAM users and roles that have appropriate permissions can view billing information for the account. If you disable it, only the account root user can access billing information. For information about how to disable this switch for an account, see Granting Access to Your Billing Information and Tools.
CreateGovCloudAccount
Show Description This action is available if all of the following are true:
  • You're authorized to create accounts in the AWS GovCloud (US) Region. For more information on the AWS GovCloud (US) Region, see the AWS GovCloud User Guide.
  • You already have an account in the AWS GovCloud (US) Region that is paired with a management account of an organization in the commercial Region.
  • You call this action from the management account of your organization in the commercial Region.
  • You have the organizations:CreateGovCloudAccount permission.
AWS Organizations automatically creates the required service-linked role named AWSServiceRoleForOrganizations. For more information, see AWS Organizations and Service-Linked Roles in the AWS Organizations User Guide. AWS automatically enables AWS CloudTrail for AWS GovCloud (US) accounts, but you should also do the following:
  • Verify that AWS CloudTrail is enabled to store logs.
  • Create an S3 bucket for AWS CloudTrail log storage. For more information, see Verifying AWS CloudTrail Is Enabled in the AWS GovCloud User Guide.
If the request includes tags, then the requester must have the organizations:TagResource permission. The tags are attached to the commercial account associated with the GovCloud account, rather than the GovCloud account itself. To add tags to the GovCloud account, call the TagResource operation in the GovCloud Region after the new GovCloud account exists. You call this action from the management account of your organization in the commercial Region to create a standalone AWS account in the AWS GovCloud (US) Region. After the account is created, the management account of an organization in the AWS GovCloud (US) Region can invite it to that organization. For more information on inviting standalone accounts in the AWS GovCloud (US) to join an organization, see AWS Organizations in the AWS GovCloud User Guide. Calling CreateGovCloudAccount is an asynchronous request that AWS performs in the background. Because CreateGovCloudAccount operates asynchronously, it can return a successful completion message even though account initialization might still be in progress. You might need to wait a few minutes before you can successfully access the account. To check the status of the request, do one of the following:

When you call the CreateGovCloudAccount action, you create two accounts: a standalone account in the AWS GovCloud (US) Region and an associated account in the commercial Region for billing and support purposes. The account in the commercial Region is automatically a member of the organization whose credentials made the request. Both accounts are associated with the same email address. A role is created in the new account in the commercial Region that allows the management account in the organization in the commercial Region to assume it. An AWS GovCloud (US) account is then created and associated with the commercial account that you just created. A role is also created in the new AWS GovCloud (US) account that can be assumed by the AWS GovCloud (US) account that is associated with the management account of the commercial organization. For more information and to view a diagram that explains how account access works, see AWS Organizations in the AWS GovCloud User Guide. For more information about creating accounts, see Creating an AWS Account in Your Organization in the AWS Organizations User Guide.

  • When you create an account in an organization using the AWS Organizations console, API, or CLI commands, the information required for the account to operate as a standalone account is not automatically collected. This includes a payment method and signing the end user license agreement (EULA). If you must remove an account from your organization later, you can do so only after you provide the missing information. Follow the steps at To leave an organization as a member account in the AWS Organizations User Guide.
  • If you get an exception that indicates that you exceeded your account limits for the organization, contact AWS Support.
  • If you get an exception that indicates that the operation failed because your organization is still initializing, wait one hour and then try again. If the error persists, contact AWS Support.
  • Using CreateGovCloudAccount to create multiple temporary accounts isn't recommended. You can only close an account from the AWS Billing and Cost Management console, and you must be signed in as the root user. For information on the requirements and process for closing an account, see Closing an AWS Account in the AWS Organizations User Guide.
When you create a member account with this operation, you can choose whether to create the account with the IAM User and Role Access to Billing Information switch enabled. If you enable it, IAM users and roles that have appropriate permissions can view billing information for the account. If you disable it, only the account root user can access billing information. For information about how to disable this switch for an account, see Granting Access to Your Billing Information and Tools.
CreateOrganization
Show Description Creates an AWS organization. The account whose user is calling the CreateOrganization operation automatically becomes the management account of the new organization. This operation must be called using credentials from the account that is to become the new organization's management account. The principal must also have the relevant IAM permissions. By default (or if you set the FeatureSet parameter to ALL), the new organization is created with all features enabled and service control policies automatically enabled in the root. If you instead choose to create the organization supporting only the consolidated billing features by setting the FeatureSet parameter to CONSOLIDATED_BILLING", no policy types are enabled by default, and you can't use organization policies
CreateOrganizationalUnit
Show Description Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables you to organize your accounts to apply policies according to your business requirements. The number of levels deep that you can nest OUs is dependent upon the policy types enabled for that root. For service control policies, the limit is five. For more information about OUs, see Managing Organizational Units in the AWS Organizations User Guide. If the request includes tags, then the requester must have the organizations:TagResource permission. This operation can be called only from the organization's management account.
CreatePolicy
Show Description Creates a policy of a specified type that you can attach to a root, an organizational unit (OU), or an individual AWS account. For more information about policies and their use, see Managing Organization Policies. If the request includes tags, then the requester must have the organizations:TagResource permission. This operation can be called only from the organization's management account.
DeclineHandshake
Show Description Declines a handshake request. This sets the handshake state to DECLINED and effectively deactivates the request. This operation can be called only from the account that received the handshake. The originator of the handshake can use CancelHandshake instead. The originator can't reactivate a declined request, but can reinitiate the process with a new handshake request. After you decline a handshake, it continues to appear in the results of relevant APIs for only 30 days. After that, it's deleted.
DeleteOrganization
DeleteOrganizationalUnit
DeletePolicy
DeregisterDelegatedAdministrator
DescribeAccount
Show Description Retrieves AWS Organizations-related information about the specified account. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
DescribeCreateAccountStatus
Show Description Retrieves the current status of an asynchronous request to create an account. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
DescribeEffectivePolicy
Show Description Returns the contents of the effective policy for specified policy type and account. The effective policy is the aggregation of any policies of the specified type that the account inherits, plus any policy of that type that is directly attached to the account. This operation applies only to policy types other than service control policies (SCPs). For more information about policy inheritance, see How Policy Inheritance Works in the AWS Organizations User Guide. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
DescribeHandshake
Show Description Retrieves information about a previously requested handshake. The handshake ID comes from the response to the original InviteAccountToOrganization operation that generated the handshake. You can access handshakes that are ACCEPTED, DECLINED, or CANCELED for only 30 days after they change to that state. They're then deleted and no longer accessible. This operation can be called from any account in the organization.
DescribeOrganization
Show Description Retrieves information about the organization that the user's account belongs to. This operation can be called from any account in the organization. Even if a policy type is shown as available in the organization, you can disable it separately at the root level with DisablePolicyType. Use ListRoots to see the status of policy types for a specified root.
DescribeOrganizationalUnit
Show Description Retrieves information about an organizational unit (OU). This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
DescribePolicy
Show Description Retrieves information about a policy. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
DetachPolicy
DisableAWSServiceAccess
DisablePolicyType
Show Description Disables an organizational policy type in a root. A policy of a certain type can be attached to entities in a root only if that type is enabled in the root. After you perform this operation, you no longer can attach policies of the specified type to that root or to any organizational unit (OU) or account in that root. You can undo this by using the EnablePolicyType operation. This is an asynchronous request that AWS performs in the background. If you disable a policy type for a root, it still appears enabled for the organization if all features are enabled for the organization. AWS recommends that you first use ListRoots to see the status of policy types for a specified root, and then use this operation. This operation can be called only from the organization's management account. To view the status of available policy types in the organization, use DescribeOrganization.
EnableAWSServiceAccess
EnableAllFeatures
Show Description Enables all features in an organization. This enables the use of organization policies that can restrict the services and actions that can be called in each account. Until you enable all features, you have access only to consolidated billing, and you can't use any of the advanced account administration features that AWS Organizations supports. For more information, see Enabling All Features in Your Organization in the AWS Organizations User Guide. This operation is required only for organizations that were created explicitly with only the consolidated billing features enabled. Calling this operation sends a handshake to every invited account in the organization. The feature set change can be finalized and the additional features enabled only after all administrators in the invited accounts approve the change by accepting the handshake. After you enable all features, you can separately enable or disable individual policy types in a root using EnablePolicyType and DisablePolicyType. To see the status of policy types in a root, use ListRoots. After all invited member accounts accept the handshake, you finalize the feature set change by accepting the handshake that contains "Action": "ENABLE_ALL_FEATURES". This completes the change. After you enable all features in your organization, the management account in the organization can apply policies on all member accounts. These policies can restrict what users and even administrators in those accounts can do. The management account can apply policies that prevent accounts from leaving the organization. Ensure that your account administrators are aware of this. This operation can be called only from the organization's management account.
EnablePolicyType
Show Description Enables a policy type in a root. After you enable a policy type in a root, you can attach policies of that type to the root, any organizational unit (OU), or account in that root. You can undo this by using the DisablePolicyType operation. This is an asynchronous request that AWS performs in the background. AWS recommends that you first use ListRoots to see the status of policy types for a specified root, and then use this operation. This operation can be called only from the organization's management account. You can enable a policy type in a root only if that policy type is available in the organization. To view the status of available policy types in the organization, use DescribeOrganization.
InviteAccountToOrganization
Show Description Sends an invitation to another account to join your organization as a member account. AWS Organizations sends email on your behalf to the email address that is associated with the other account's owner. The invitation is implemented as a Handshake whose details are in the response.
  • You can invite AWS accounts only from the same seller as the management account. For example, if your organization's management account was created by Amazon Internet Services Pvt. Ltd (AISPL), an AWS seller in India, you can invite only other AISPL accounts to your organization. You can't combine accounts from AISPL and AWS or from any other AWS seller. For more information, see Consolidated Billing in India.
  • If you receive an exception that indicates that you exceeded your account limits for the organization or that the operation failed because your organization is still initializing, wait one hour and then try again. If the error persists after an hour, contact AWS Support.
If the request includes tags, then the requester must have the organizations:TagResource permission. This operation can be called only from the organization's management account.
LeaveOrganization
ListAWSServiceAccessForOrganization
Show Description Returns a list of the AWS services that you enabled to integrate with your organization. After a service on this list creates the resources that it requires for the integration, it can perform operations on your organization and its accounts. For more information about integrating other services with AWS Organizations, including the list of services that currently work with Organizations, see Integrating AWS Organizations with Other AWS Services in the AWS Organizations User Guide. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListAccounts
Show Description Lists all the accounts in the organization. To request only the accounts in a specified root or organizational unit (OU), use the ListAccountsForParent operation instead. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListAccountsForParent
Show Description Lists the accounts in an organization that are contained by the specified target root or organizational unit (OU). If you specify the root, you get a list of all the accounts that aren't in any OU. If you specify an OU, you get a list of all the accounts in only that OU and not in any child OUs. To get a list of all accounts in the organization, use the ListAccounts operation. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListChildren
Show Description Lists all of the organizational units (OUs) or accounts that are contained in the specified parent OU or root. This operation, along with ListParents enables you to traverse the tree structure that makes up this root. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListCreateAccountStatus
Show Description Lists the account creation requests that match the specified status that is currently being tracked for the organization. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListDelegatedAdministrators
Show Description Lists the AWS accounts that are designated as delegated administrators in this organization. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListDelegatedServicesForAccount
Show Description List the AWS services for which the specified account is a delegated administrator. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListHandshakesForAccount
Show Description Lists the current handshakes that are associated with the account of the requesting user. Handshakes that are ACCEPTED, DECLINED, or CANCELED appear in the results of this API for only 30 days after changing to that state. After that, they're deleted and no longer accessible. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called from any account in the organization.
ListHandshakesForOrganization
Show Description Lists the handshakes that are associated with the organization that the requesting user is part of. The ListHandshakesForOrganization operation returns a list of handshake structures. Each structure contains details and status about a handshake. Handshakes that are ACCEPTED, DECLINED, or CANCELED appear in the results of this API for only 30 days after changing to that state. After that, they're deleted and no longer accessible. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListOrganizationalUnitsForParent
Show Description Lists the organizational units (OUs) in a parent organizational unit or root. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListParents
Show Description Lists the root or organizational units (OUs) that serve as the immediate parent of the specified child OU or account. This operation, along with ListChildren enables you to traverse the tree structure that makes up this root. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service. In the current release, a child can have only a single parent.
ListPolicies
Show Description Retrieves the list of all policies in an organization of a specified type. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListPoliciesForTarget
Show Description Lists the policies that are directly attached to the specified target root, organizational unit (OU), or account. You must specify the policy type that you want included in the returned list. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListRoots
Show Description Lists the roots that are defined in the current organization. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service. Policy types can be enabled and disabled in roots. This is distinct from whether they're available in the organization. When you enable all features, you make policy types available for use in that organization. Individual policy types can then be enabled and disabled in a root. To see the availability of a policy type in an organization, use DescribeOrganization.
ListTagsForResource
Show Description Lists tags that are attached to the specified resource. You can attach tags to the following resources in AWS Organizations.
  • AWS account
  • Organization root
  • Organizational unit (OU)
  • Policy (any type)
This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
ListTargetsForPolicy
Show Description Lists all the roots, organizational units (OUs), and accounts that the specified policy is attached to. Always check the NextToken response parameter for a null value when calling a List* operation. These operations can occasionally return an empty set of results even when there are more results available. The NextToken response parameter value is null only when there are no more results to display. This operation can be called only from the organization's management account or by a member account that is a delegated administrator for an AWS service.
MoveAccount
RegisterDelegatedAdministrator
RemoveAccountFromOrganization
TagResource
UntagResource
UpdateOrganizationalUnit
Show Description Renames the specified organizational unit (OU). The ID and ARN don't change. The child OUs and accounts remain in place, and any attached policies of the OU remain attached. This operation can be called only from the organization's management account.

Outposts Events

Service Event Name Description
outposts CreateOrder
Show Description Creates an order for an Outpost.
CreateOutpost
Show Description Creates an Outpost. You can specify AvailabilityZone or AvailabilityZoneId.
DeleteOutpost
Show Description Deletes the Outpost.
DeleteSite
Show Description Deletes the site.
GetOutpost
Show Description Gets information about the specified Outpost.
GetOutpostInstanceTypes
Show Description Lists the instance types for the specified Outpost.
ListOutposts
Show Description Create a list of the Outposts for your AWS account. Add filters to your request to return a more specific list of results. Use filters to match an Outpost lifecycle status, Availibility Zone (us-east-1a), and AZ ID (use1-az1). If you specify multiple filters, the filters are joined with an AND, and the request returns only results that match all of the specified filters.
ListSites
Show Description Lists the sites for the specified AWS account.
ListTagsForResource
Show Description Lists the tags for the specified resource.
TagResource
Show Description Adds tags to the specified resource.

Panorama Events

Service Event Name Description
panorama CreateApplicationInstance
Show Description Creates an application instance and deploys it to a device.
CreateJobForDevices
Show Description Creates a job to run on one or more devices.
CreateNodeFromTemplateJob
Show Description Creates a camera stream node.
CreatePackage
Show Description Creates a package and storage location in an Amazon S3 access point.
CreatePackageImportJob
Show Description Imports a node package.
DeleteDevice
Show Description Deletes a device.
DeletePackage
Show Description Deletes a package.
DeregisterPackageVersion
Show Description Deregisters a package version.
DescribeApplicationInstance
Show Description Returns information about an application instance on a device.
DescribeApplicationInstanceDetails
Show Description Returns information about an application instance's configuration manifest.
DescribeDevice
Show Description Returns information about a device.
DescribeDeviceJob
Show Description Returns information about a device job.
DescribeNode
Show Description Returns information about a node.
DescribeNodeFromTemplateJob
Show Description Returns information about a job to create a camera stream node.
DescribePackage
Show Description Returns information about a package.
DescribePackageImportJob
Show Description Returns information about a package import job.
DescribePackageVersion
Show Description Returns information about a package version.
ListApplicationInstanceDependencies
Show Description Returns a list of application instance dependencies.
ListApplicationInstanceNodeInstances
Show Description Returns a list of application node instances.
ListApplicationInstances
Show Description Returns a list of application instances.
ListDevices
Show Description Returns a list of devices.
ListDevicesJobs
Show Description Returns a list of jobs.
ListNodeFromTemplateJobs
Show Description Returns a list of camera stream node jobs.
ListNodes
Show Description Returns a list of nodes.
ListPackageImportJobs
Show Description Returns a list of package import jobs.
ListPackages
Show Description Returns a list of packages.
ListTagsForResource
Show Description Returns a list of tags for a resource.
ProvisionDevice
Show Description Creates a device and returns a configuration archive. The configuration archive is a ZIP file that contains a provisioning certificate that is valid for 5 minutes. Transfer the configuration archive to the device with the included USB storage device within 5 minutes.
RegisterPackageVersion
Show Description Registers a package version.
RemoveApplicationInstance
Show Description Removes an application instance.
TagResource
Show Description Tags a resource.
UntagResource
Show Description Removes tags from a resource.

Personalize-runtime Events

Service Event Name Description
personalize-runtime GetPersonalizedRanking
Show Description Re-ranks a list of recommended items for the given user. The first item in the list is deemed the most likely item to be of interest to the user. The solution backing the campaign must have been created using a recipe of type PERSONALIZED_RANKING.

Pi Events

Service Event Name Description
pi DescribeDimensionKeys
Show Description For a specific time period, retrieve the top N dimension keys for a metric. Each response element returns a maximum of 500 bytes. For larger elements, such as SQL statements, only the first 500 bytes are returned.
GetDimensionKeyDetails
Show Description Get the attributes of the specified dimension group for a DB instance or data source. For example, if you specify a SQL ID, GetDimensionKeyDetails retrieves the full text of the dimension db.sql.statement associated with this ID. This operation is useful because GetResourceMetrics and DescribeDimensionKeys don't support retrieval of large SQL statement text.

Pinpoint-email Events

Service Event Name Description
pinpoint-email CreateConfigurationSet
Show Description Create a configuration set. Configuration sets are groups of rules that you can apply to the emails you send using Amazon Pinpoint. You apply a configuration set to an email by including a reference to the configuration set in the headers of the email. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
CreateConfigurationSetEventDestination
Show Description Create an event destination. In Amazon Pinpoint, events include message sends, deliveries, opens, clicks, bounces, and complaints. Event destinations are places that you can send information about these events to. For example, you can send event data to Amazon SNS to receive notifications when you receive bounces or complaints, or you can use Amazon Kinesis Data Firehose to stream data to Amazon S3 for long-term storage. A single configuration set can include more than one event destination.
CreateDedicatedIpPool
Show Description Create a new pool of dedicated IP addresses. A pool can include one or more dedicated IP addresses that are associated with your Amazon Pinpoint account. You can associate a pool with a configuration set. When you send an email that uses that configuration set, Amazon Pinpoint sends it using only the IP addresses in the associated pool.
CreateDeliverabilityTestReport
Show Description Create a new predictive inbox placement test. Predictive inbox placement tests can help you predict how your messages will be handled by various email providers around the world. When you perform a predictive inbox placement test, you provide a sample message that contains the content that you plan to send to your customers. Amazon Pinpoint then sends that message to special email addresses spread across several major email providers. After about 24 hours, the test is complete, and you can use the GetDeliverabilityTestReport operation to view the results of the test.
CreateEmailIdentity
Show Description Verifies an email identity for use with Amazon Pinpoint. In Amazon Pinpoint, an identity is an email address or domain that you use when you send email. Before you can use an identity to send email with Amazon Pinpoint, you first have to verify it. By verifying an address, you demonstrate that you're the owner of the address, and that you've given Amazon Pinpoint permission to send email from the address. When you verify an email address, Amazon Pinpoint sends an email to the address. Your email address is verified as soon as you follow the link in the verification email. When you verify a domain, this operation provides a set of DKIM tokens, which you can convert into CNAME tokens. You add these CNAME tokens to the DNS configuration for your domain. Your domain is verified when Amazon Pinpoint detects these records in the DNS configuration for your domain. It usually takes around 72 hours to complete the domain verification process.
DeleteConfigurationSet
Show Description Delete an existing configuration set. In Amazon Pinpoint, configuration sets are groups of rules that you can apply to the emails you send. You apply a configuration set to an email by including a reference to the configuration set in the headers of the email. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
DeleteConfigurationSetEventDestination
Show Description Delete an event destination. In Amazon Pinpoint, events include message sends, deliveries, opens, clicks, bounces, and complaints. Event destinations are places that you can send information about these events to. For example, you can send event data to Amazon SNS to receive notifications when you receive bounces or complaints, or you can use Amazon Kinesis Data Firehose to stream data to Amazon S3 for long-term storage.
DeleteDedicatedIpPool
Show Description Delete a dedicated IP pool.
DeleteEmailIdentity
Show Description Deletes an email identity that you previously verified for use with Amazon Pinpoint. An identity can be either an email address or a domain name.
GetAccount
Show Description Obtain information about the email-sending status and capabilities of your Amazon Pinpoint account in the current AWS Region.
GetBlacklistReports
Show Description Retrieve a list of the blacklists that your dedicated IP addresses appear on.
GetConfigurationSet
Show Description Get information about an existing configuration set, including the dedicated IP pool that it's associated with, whether or not it's enabled for sending email, and more. In Amazon Pinpoint, configuration sets are groups of rules that you can apply to the emails you send. You apply a configuration set to an email by including a reference to the configuration set in the headers of the email. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
GetConfigurationSetEventDestinations
Show Description Retrieve a list of event destinations that are associated with a configuration set. In Amazon Pinpoint, events include message sends, deliveries, opens, clicks, bounces, and complaints. Event destinations are places that you can send information about these events to. For example, you can send event data to Amazon SNS to receive notifications when you receive bounces or complaints, or you can use Amazon Kinesis Data Firehose to stream data to Amazon S3 for long-term storage.
GetDedicatedIp
Show Description Get information about a dedicated IP address, including the name of the dedicated IP pool that it's associated with, as well information about the automatic warm-up process for the address.
GetDedicatedIps
Show Description List the dedicated IP addresses that are associated with your Amazon Pinpoint account.
GetDeliverabilityDashboardOptions
Show Description Retrieve information about the status of the Deliverability dashboard for your Amazon Pinpoint account. When the Deliverability dashboard is enabled, you gain access to reputation, deliverability, and other metrics for the domains that you use to send email using Amazon Pinpoint. You also gain the ability to perform predictive inbox placement tests. When you use the Deliverability dashboard, you pay a monthly subscription charge, in addition to any other fees that you accrue by using Amazon Pinpoint. For more information about the features and cost of a Deliverability dashboard subscription, see Amazon Pinpoint Pricing.
GetDeliverabilityTestReport
Show Description Retrieve the results of a predictive inbox placement test.
GetDomainDeliverabilityCampaign
Show Description Retrieve all the deliverability data for a specific campaign. This data is available for a campaign only if the campaign sent email by using a domain that the Deliverability dashboard is enabled for (PutDeliverabilityDashboardOption operation).
GetDomainStatisticsReport
Show Description Retrieve inbox placement and engagement rates for the domains that you use to send email.
GetEmailIdentity
Show Description Provides information about a specific identity associated with your Amazon Pinpoint account, including the identity's verification status, its DKIM authentication status, and its custom Mail-From settings.
ListConfigurationSets
Show Description List all of the configuration sets associated with your Amazon Pinpoint account in the current region. In Amazon Pinpoint, configuration sets are groups of rules that you can apply to the emails you send. You apply a configuration set to an email by including a reference to the configuration set in the headers of the email. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
ListDedicatedIpPools
Show Description List all of the dedicated IP pools that exist in your Amazon Pinpoint account in the current AWS Region.
ListDeliverabilityTestReports
Show Description Show a list of the predictive inbox placement tests that you've performed, regardless of their statuses. For predictive inbox placement tests that are complete, you can use the GetDeliverabilityTestReport operation to view the results.
ListDomainDeliverabilityCampaigns
Show Description Retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range. This data is available for a domain only if you enabled the Deliverability dashboard (PutDeliverabilityDashboardOption operation) for the domain.
ListEmailIdentities
Show Description Returns a list of all of the email identities that are associated with your Amazon Pinpoint account. An identity can be either an email address or a domain. This operation returns identities that are verified as well as those that aren't.
ListTagsForResource
Show Description Retrieve a list of the tags (keys and values) that are associated with a specified resource. A tag is a label that you optionally define and associate with a resource in Amazon Pinpoint. Each tag consists of a required tag key and an optional associated tag value. A tag key is a general label that acts as a category for more specific tag values. A tag value acts as a descriptor within a tag key.
PutAccountDedicatedIpWarmupAttributes
Show Description Enable or disable the automatic warm-up feature for dedicated IP addresses.
PutAccountSendingAttributes
Show Description Enable or disable the ability of your account to send email.
PutConfigurationSetDeliveryOptions
Show Description Associate a configuration set with a dedicated IP pool. You can use dedicated IP pools to create groups of dedicated IP addresses for sending specific types of email.
PutConfigurationSetReputationOptions
Show Description Enable or disable collection of reputation metrics for emails that you send using a particular configuration set in a specific AWS Region.
PutConfigurationSetSendingOptions
Show Description Enable or disable email sending for messages that use a particular configuration set in a specific AWS Region.
PutConfigurationSetTrackingOptions
Show Description Specify a custom domain to use for open and click tracking elements in email that you send using Amazon Pinpoint.
PutDedicatedIpInPool
Show Description Move a dedicated IP address to an existing dedicated IP pool. The dedicated IP address that you specify must already exist, and must be associated with your Amazon Pinpoint account. The dedicated IP pool you specify must already exist. You can create a new pool by using the CreateDedicatedIpPool operation.
PutDedicatedIpWarmupAttributes
Show Description

PutDeliverabilityDashboardOption
Show Description Enable or disable the Deliverability dashboard for your Amazon Pinpoint account. When you enable the Deliverability dashboard, you gain access to reputation, deliverability, and other metrics for the domains that you use to send email using Amazon Pinpoint. You also gain the ability to perform predictive inbox placement tests. When you use the Deliverability dashboard, you pay a monthly subscription charge, in addition to any other fees that you accrue by using Amazon Pinpoint. For more information about the features and cost of a Deliverability dashboard subscription, see Amazon Pinpoint Pricing.
PutEmailIdentityDkimAttributes
Show Description Used to enable or disable DKIM authentication for an email identity.
PutEmailIdentityFeedbackAttributes
Show Description Used to enable or disable feedback forwarding for an identity. This setting determines what happens when an identity is used to send an email that results in a bounce or complaint event. When you enable feedback forwarding, Amazon Pinpoint sends you email notifications when bounce or complaint events occur. Amazon Pinpoint sends this notification to the address that you specified in the Return-Path header of the original email. When you disable feedback forwarding, Amazon Pinpoint sends notifications through other mechanisms, such as by notifying an Amazon SNS topic. You're required to have a method of tracking bounces and complaints. If you haven't set up another mechanism for receiving bounce or complaint notifications, Amazon Pinpoint sends an email notification when these events occur (even if this setting is disabled).
PutEmailIdentityMailFromAttributes
Show Description Used to enable or disable the custom Mail-From domain configuration for an email identity.
SendEmail
Show Description Sends an email message. You can use the Amazon Pinpoint Email API to send two types of messages:
  • Simple – A standard email message. When you create this type of message, you specify the sender, the recipient, and the message body, and Amazon Pinpoint assembles the message for you.
  • Raw – A raw, MIME-formatted email message. When you send this type of email, you have to specify all of the message headers, as well as the message body. You can use this message type to send messages that contain attachments. The message that you specify has to be a valid MIME message.
TagResource
Show Description Add one or more tags (keys and values) to a specified resource. A tag is a label that you optionally define and associate with a resource in Amazon Pinpoint. Tags can help you categorize and manage resources in different ways, such as by purpose, owner, environment, or other criteria. A resource can have as many as 50 tags. Each tag consists of a required tag key and an associated tag value, both of which you define. A tag key is a general label that acts as a category for more specific tag values. A tag value acts as a descriptor within a tag key.
UntagResource
Show Description Remove one or more tags (keys and values) from a specified resource.

Pinpoint-sms-voice Events

Service Event Name Description
pinpoint-sms-voice CreateConfigurationSet
Show Description Create a new configuration set. After you create the configuration set, you can add one or more event destinations to it.
CreateConfigurationSetEventDestination
Show Description Create a new event destination in a configuration set.
DeleteConfigurationSet
Show Description Deletes an existing configuration set.
DeleteConfigurationSetEventDestination
Show Description Deletes an event destination in a configuration set.
GetConfigurationSetEventDestinations
Show Description Obtain information about an event destination, including the types of events it reports, the Amazon Resource Name (ARN) of the destination, and the name of the event destination.
SendVoiceMessage
Show Description Create a new voice message and send it to a recipient's phone number.

Polly Events

Service Event Name Description
polly DeleteLexicon
Show Description Deletes the specified pronunciation lexicon stored in an Amazon Web Services Region. A lexicon which has been deleted is not available for speech synthesis, nor is it possible to retrieve it using either the GetLexicon or ListLexicon APIs. For more information, see Managing Lexicons.
DescribeVoices
Show Description Returns the list of voices that are available for use when requesting speech synthesis. Each voice speaks a specified language, is either male or female, and is identified by an ID, which is the ASCII version of the voice name. When synthesizing speech ( SynthesizeSpeech ), you provide the voice ID for the voice you want from the list of voices returned by DescribeVoices. For example, you want your news reader application to read news in a specific language, but giving a user the option to choose the voice. Using the DescribeVoices operation you can provide the user with a list of available voices to select from. You can optionally specify a language code to filter the available voices. For example, if you specify en-US, the operation returns a list of all available US English voices. This operation requires permissions to perform the polly:DescribeVoices action.
GetLexicon
Show Description Returns the content of the specified pronunciation lexicon stored in an Amazon Web Services Region. For more information, see Managing Lexicons.
GetSpeechSynthesisTask
Show Description Retrieves a specific SpeechSynthesisTask object based on its TaskID. This object contains information about the given speech synthesis task, including the status of the task, and a link to the S3 bucket containing the output of the task.
ListLexicons
Show Description Returns a list of pronunciation lexicons stored in an Amazon Web Services Region. For more information, see Managing Lexicons.
ListSpeechSynthesisTasks
Show Description Returns a list of SpeechSynthesisTask objects ordered by their creation date. This operation can filter the tasks by their status, for example, allowing users to list only tasks that are completed.
PutLexicon
Show Description Stores a pronunciation lexicon in an Amazon Web Services Region. If a lexicon with the same name already exists in the region, it is overwritten by the new lexicon. Lexicon operations have eventual consistency, therefore, it might take some time before the lexicon is available to the SynthesizeSpeech operation. For more information, see Managing Lexicons.
StartSpeechSynthesisTask
Show Description Allows the creation of an asynchronous synthesis task, by starting a new SpeechSynthesisTask. This operation requires all the standard information needed for speech synthesis, plus the name of an Amazon S3 bucket for the service to store the output of the synthesis task and two optional parameters (OutputS3KeyPrefix and SnsTopicArn). Once the synthesis task is created, this operation will return a SpeechSynthesisTask object, which will include an identifier of this task as well as the current status. The SpeechSynthesisTask object is available for 72 hours after starting the asynchronous synthesis task.

Pricing Events

Service Event Name Description
pricing DescribeServices
Show Description Returns the metadata for one service or a list of the metadata for all services. Use this without a service code to get the service codes for all services. Use it with a service code, such as AmazonEC2, to get information specific to that service, such as the attribute names available for that service. For example, some of the attribute names available for EC2 are volumeType, maxIopsVolume, operation, locationType, and instanceCapacity10xlarge.
GetAttributeValues
Show Description Returns a list of attribute values. Attibutes are similar to the details in a Price List API offer file. For a list of available attributes, see Offer File Definitions in the Amazon Web Services Billing and Cost Management User Guide.

Proton Events

Service Event Name Description
proton AcceptEnvironmentAccountConnection
Show Description In a management account, an environment account connection request is accepted. When the environment account connection request is accepted, AWS Proton can use the associated IAM role to provision environment infrastructure resources in the associated environment account. For more information, see Environment account connections in the AWS Proton Administrator guide.
CancelEnvironmentDeployment
Show Description Attempts to cancel an environment deployment on an UpdateEnvironment action, if the deployment is IN_PROGRESS. For more information, see Update an environment in the AWS Proton Administrator guide. The following list includes potential cancellation scenarios.
  • If the cancellation attempt succeeds, the resulting deployment state is CANCELLED.
  • If the cancellation attempt fails, the resulting deployment state is FAILED.
  • If the current UpdateEnvironment action succeeds before the cancellation attempt starts, the resulting deployment state is SUCCEEDED and the cancellation attempt has no effect.
CancelServiceInstanceDeployment
Show Description Attempts to cancel a service instance deployment on an UpdateServiceInstance action, if the deployment is IN_PROGRESS. For more information, see Update a service instance in the AWS Proton Administrator guide or the AWS Proton User guide. The following list includes potential cancellation scenarios.
  • If the cancellation attempt succeeds, the resulting deployment state is CANCELLED.
  • If the cancellation attempt fails, the resulting deployment state is FAILED.
  • If the current UpdateServiceInstance action succeeds before the cancellation attempt starts, the resulting deployment state is SUCCEEDED and the cancellation attempt has no effect.
CancelServicePipelineDeployment
Show Description Attempts to cancel a service pipeline deployment on an UpdateServicePipeline action, if the deployment is IN_PROGRESS. For more information, see Update a service pipeline in the AWS Proton Administrator guide or the AWS Proton User guide. The following list includes potential cancellation scenarios.
  • If the cancellation attempt succeeds, the resulting deployment state is CANCELLED.
  • If the cancellation attempt fails, the resulting deployment state is FAILED.
  • If the current UpdateServicePipeline action succeeds before the cancellation attempt starts, the resulting deployment state is SUCCEEDED and the cancellation attempt has no effect.
CreateEnvironment
Show Description Deploy a new environment. An AWS Proton environment is created from an environment template that defines infrastructure and resources that can be shared across services. For more information, see the Environments in the AWS Proton Administrator Guide.
CreateEnvironmentAccountConnection
Show Description Create an environment account connection in an environment account so that environment infrastructure resources can be provisioned in the environment account from a management account. An environment account connection is a secure bi-directional connection between a management account and an environment account that maintains authorization and permissions. For more information, see Environment account connections in the AWS Proton Administrator guide.
CreateEnvironmentTemplate
Show Description Create an environment template for AWS Proton. For more information, see Environment Templates in the AWS Proton Administrator Guide. You can create an environment template in one of the two following ways:
  • Register and publish a standard environment template that instructs AWS Proton to deploy and manage environment infrastructure.
  • Register and publish a customer managed environment template that connects AWS Proton to your existing provisioned infrastructure that you manage. AWS Proton doesn't manage your existing provisioned infrastructure. To create an environment template for customer provisioned and managed infrastructure, include the provisioning parameter and set the value to CUSTOMER_MANAGED. For more information, see Register and publish an environment template in the AWS Proton Administrator Guide.
CreateEnvironmentTemplateVersion
Show Description Create a new major or minor version of an environment template. A major version of an environment template is a version that isn't backwards compatible. A minor version of an environment template is a version that's backwards compatible within its major version.
CreateService
Show Description Create an AWS Proton service. An AWS Proton service is an instantiation of a service template and often includes several service instances and pipeline. For more information, see Services in the AWS Proton Administrator Guide and Services in the AWS Proton User Guide.
CreateServiceTemplate
Show Description Create a service template. The administrator creates a service template to define standardized infrastructure and an optional CICD service pipeline. Developers, in turn, select the service template from AWS Proton. If the selected service template includes a service pipeline definition, they provide a link to their source code repository. AWS Proton then deploys and manages the infrastructure defined by the selected service template. For more information, see Service Templates in the AWS Proton Administrator Guide.
CreateServiceTemplateVersion
Show Description Create a new major or minor version of a service template. A major version of a service template is a version that isn't backwards compatible. A minor version of a service template is a version that's backwards compatible within its major version.
DeleteEnvironment
Show Description Delete an environment.
DeleteEnvironmentAccountConnection
Show Description In an environment account, delete an environment account connection. After you delete an environment account connection that’s in use by an AWS Proton environment, AWS Proton can’t manage the environment infrastructure resources until a new environment account connection is accepted for the environment account and associated environment. You're responsible for cleaning up provisioned resources that remain without an environment connection. For more information, see Environment account connections in the AWS Proton Administrator guide.
DeleteEnvironmentTemplate
Show Description If no other major or minor versions of an environment template exist, delete the environment template.
DeleteEnvironmentTemplateVersion
Show Description If no other minor versions of an environment template exist, delete a major version of the environment template if it's not the Recommended version. Delete the Recommended version of the environment template if no other major versions or minor versions of the environment template exist. A major version of an environment template is a version that's not backwards compatible. Delete a minor version of an environment template if it isn't the Recommended version. Delete a Recommended minor version of the environment template if no other minor versions of the environment template exist. A minor version of an environment template is a version that's backwards compatible.
DeleteService
Show Description Delete a service.
DeleteServiceTemplate
Show Description If no other major or minor versions of the service template exist, delete the service template.
DeleteServiceTemplateVersion
Show Description If no other minor versions of a service template exist, delete a major version of the service template if it's not the Recommended version. Delete the Recommended version of the service template if no other major versions or minor versions of the service template exist. A major version of a service template is a version that isn't backwards compatible. Delete a minor version of a service template if it's not the Recommended version. Delete a Recommended minor version of the service template if no other minor versions of the service template exist. A minor version of a service template is a version that's backwards compatible.
GetAccountSettings
Show Description Get detail data for the AWS Proton pipeline service role.
GetEnvironment
Show Description Get detail data for an environment.
GetEnvironmentAccountConnection
Show Description In an environment account, view the detail data for an environment account connection. For more information, see Environment account connections in the AWS Proton Administrator guide.
GetEnvironmentTemplate
Show Description Get detail data for an environment template.
GetEnvironmentTemplateVersion
Show Description View detail data for a major or minor version of an environment template.
GetService
Show Description Get detail data for a service.
GetServiceInstance
Show Description Get detail data for a service instance. A service instance is an instantiation of service template, which is running in a specific environment.
GetServiceTemplate
Show Description Get detail data for a service template.
GetServiceTemplateVersion
Show Description View detail data for a major or minor version of a service template.
ListEnvironmentAccountConnections
Show Description View a list of environment account connections. For more information, see Environment account connections in the AWS Proton Administrator guide.
ListEnvironmentTemplateVersions
Show Description List major or minor versions of an environment template with detail data.
ListEnvironmentTemplates
Show Description List environment templates.
ListEnvironments
Show Description List environments with detail data summaries.
ListServiceInstances
Show Description List service instances with summaries of detail data.
ListServiceTemplateVersions
Show Description List major or minor versions of a service template with detail data.
ListServiceTemplates
Show Description List service templates with detail data.
ListServices
Show Description List services with summaries of detail data.
ListTagsForResource
Show Description List tags for a resource. For more information, see AWS Proton resources and tagging in the AWS Proton Administrator Guide or AWS Proton User Guide.
RejectEnvironmentAccountConnection
Show Description In a management account, reject an environment account connection from another environment account. After you reject an environment account connection request, you won’t be able to accept or use the rejected environment account connection. You can’t reject an environment account connection that is connected to an environment. For more information, see Environment account connections in the AWS Proton Administrator guide.
TagResource
Show Description Tag a resource. For more information, see AWS Proton resources and tagging in the AWS Proton Administrator Guide or AWS Proton User Guide.
UntagResource
Show Description Remove a tag from a resource. For more information, see AWS Proton resources and tagging in the AWS Proton Administrator Guide or AWS Proton User Guide.
UpdateAccountSettings
Show Description Update the AWS Proton pipeline service account settings.
UpdateEnvironment
Show Description Update an environment. If the environment is associated with an environment account connection, don't update or include the protonServiceRoleArn parameter to update or connect to an environment account connection. You can only update to a new environment account connection if it was created in the same environment account that the current environment account connection was created in and is associated with the current environment. If the environment isn't associated with an environment account connection, don't update or include the environmentAccountConnectionId parameter to update or connect to an environment account connection. You can update either the environmentAccountConnectionId or protonServiceRoleArn parameter and value. You can’t update both. There are four modes for updating an environment as described in the following. The deploymentType field defines the mode.
NONE In this mode, a deployment doesn't occur. Only the requested metadata parameters are updated.
CURRENT_VERSION In this mode, the environment is deployed and updated with the new spec that you provide. Only requested parameters are updated. Don’t include minor or major version parameters when you use this deployment-type.
MINOR_VERSION In this mode, the environment is deployed and updated with the published, recommended (latest) minor version of the current major version in use, by default. You can also specify a different minor version of the current major version in use.
MAJOR_VERSION In this mode, the environment is deployed and updated with the published, recommended (latest) major and minor version of the current template, by default. You can also specify a different major version that's higher than the major version in use and a minor version (optional).
UpdateEnvironmentAccountConnection
Show Description In an environment account, update an environment account connection to use a new IAM role. For more information, see Environment account connections in the AWS Proton Administrator guide.
UpdateEnvironmentTemplate
Show Description Update an environment template.
UpdateEnvironmentTemplateVersion
Show Description Update a major or minor version of an environment template.
UpdateService
Show Description Edit a service description or use a spec to add and delete service instances. Existing service instances and the service pipeline can't be edited using this API. They can only be deleted. Use the description parameter to modify the description. Edit the spec parameter to add or delete instances.
UpdateServiceInstance
Show Description Update a service instance. There are four modes for updating a service instance as described in the following. The deploymentType field defines the mode.
NONE In this mode, a deployment doesn't occur. Only the requested metadata parameters are updated.
CURRENT_VERSION In this mode, the service instance is deployed and updated with the new spec that you provide. Only requested parameters are updated. Don’t include minor or major version parameters when you use this deployment-type.
MINOR_VERSION In this mode, the service instance is deployed and updated with the published, recommended (latest) minor version of the current major version in use, by default. You can also specify a different minor version of the current major version in use.
MAJOR_VERSION In this mode, the service instance is deployed and updated with the published, recommended (latest) major and minor version of the current template, by default. You can also specify a different major version that is higher than the major version in use and a minor version (optional).
UpdateServicePipeline
Show Description Update the service pipeline. There are four modes for updating a service pipeline as described in the following. The deploymentType field defines the mode.
NONE In this mode, a deployment doesn't occur. Only the requested metadata parameters are updated.
CURRENT_VERSION In this mode, the service pipeline is deployed and updated with the new spec that you provide. Only requested parameters are updated. Don’t include minor or major version parameters when you use this deployment-type.
MINOR_VERSION In this mode, the service pipeline is deployed and updated with the published, recommended (latest) minor version of the current major version in use, by default. You can also specify a different minor version of the current major version in use.
MAJOR_VERSION In this mode, the service pipeline is deployed and updated with the published, recommended (latest) major and minor version of the current template by default. You can also specify a different major version that is higher than the major version in use and a minor version (optional).
UpdateServiceTemplate
Show Description Update a service template.

Qldb-session Events

Service Event Name Description
qldb-session SendCommand
Show Description Sends a command to an Amazon QLDB ledger. Instead of interacting directly with this API, we recommend using the QLDB driver or the QLDB shell to execute data transactions on a ledger.
  • If you are working with an AWS SDK, use the QLDB driver. The driver provides a high-level abstraction layer above this QLDB Session data plane and manages SendCommand API calls for you. For information and a list of supported programming languages, see Getting started with the driver in the Amazon QLDB Developer Guide.
  • If you are working with the AWS Command Line Interface (AWS CLI), use the QLDB shell. The shell is a command line interface that uses the QLDB driver to interact with a ledger. For information, see Accessing Amazon QLDB using the QLDB shell.

Qldb Events

Service Event Name Description
qldb CancelJournalKinesisStream
Show Description Ends a given Amazon QLDB journal stream. Before a stream can be canceled, its current status must be ACTIVE. You can't restart a stream after you cancel it. Canceled QLDB stream resources are subject to a 7-day retention period, so they are automatically deleted after this limit expires.
CreateLedger
Show Description Creates a new ledger in your account in the current Region.
DeleteLedger
DescribeJournalKinesisStream
Show Description Returns detailed information about a given Amazon QLDB journal stream. The output includes the Amazon Resource Name (ARN), stream name, current status, creation time, and the parameters of the original stream creation request. This action does not return any expired journal streams. For more information, see Expiration for terminal streams in the Amazon QLDB Developer Guide.
DescribeJournalS3Export
Show Description Returns information about a journal export job, including the ledger name, export ID, creation time, current status, and the parameters of the original export creation request. This action does not return any expired export jobs. For more information, see Export job expiration in the Amazon QLDB Developer Guide. If the export job with the given ExportId doesn't exist, then throws ResourceNotFoundException. If the ledger with the given Name doesn't exist, then throws ResourceNotFoundException.
DescribeLedger
Show Description Returns information about a ledger, including its state, permissions mode, encryption at rest settings, and when it was created.
ExportJournalToS3
Show Description Exports journal contents within a date and time range from a ledger into a specified Amazon Simple Storage Service (Amazon S3) bucket. The data is written as files in Amazon Ion format. If the ledger with the given Name doesn't exist, then throws ResourceNotFoundException. If the ledger with the given Name is in CREATING status, then throws ResourcePreconditionNotMetException. You can initiate up to two concurrent journal export requests for each ledger. Beyond this limit, journal export requests throw LimitExceededException.
GetBlock
Show Description Returns a block object at a specified address in a journal. Also returns a proof of the specified block for verification if DigestTipAddress is provided. For information about the data contents in a block, see Journal contents in the Amazon QLDB Developer Guide. If the specified ledger doesn't exist or is in DELETING status, then throws ResourceNotFoundException. If the specified ledger is in CREATING status, then throws ResourcePreconditionNotMetException. If no block exists with the specified address, then throws InvalidParameterException.
GetDigest
Show Description Returns the digest of a ledger at the latest committed block in the journal. The response includes a 256-bit hash value and a block address.
GetRevision
Show Description Returns a revision data object for a specified document ID and block address. Also returns a proof of the specified revision for verification if DigestTipAddress is provided.
ListJournalKinesisStreamsForLedger
Show Description Returns an array of all Amazon QLDB journal stream descriptors for a given ledger. The output of each stream descriptor includes the same details that are returned by DescribeJournalKinesisStream. This action does not return any expired journal streams. For more information, see Expiration for terminal streams in the Amazon QLDB Developer Guide. This action returns a maximum of MaxResults items. It is paginated so that you can retrieve all the items by calling ListJournalKinesisStreamsForLedger multiple times.
ListJournalS3Exports
Show Description Returns an array of journal export job descriptions for all ledgers that are associated with the current account and Region. This action returns a maximum of MaxResults items, and is paginated so that you can retrieve all the items by calling ListJournalS3Exports multiple times. This action does not return any expired export jobs. For more information, see Export job expiration in the Amazon QLDB Developer Guide.
ListJournalS3ExportsForLedger
Show Description Returns an array of journal export job descriptions for a specified ledger. This action returns a maximum of MaxResults items, and is paginated so that you can retrieve all the items by calling ListJournalS3ExportsForLedger multiple times. This action does not return any expired export jobs. For more information, see Export job expiration in the Amazon QLDB Developer Guide.
ListLedgers
Show Description Returns an array of ledger summaries that are associated with the current account and Region. This action returns a maximum of 100 items and is paginated so that you can retrieve all the items by calling ListLedgers multiple times.
ListTagsForResource
Show Description Returns all tags for a specified Amazon QLDB resource.
StreamJournalToKinesis
Show Description Creates a journal stream for a given Amazon QLDB ledger. The stream captures every document revision that is committed to the ledger's journal and delivers the data to a specified Amazon Kinesis Data Streams resource.
TagResource
Show Description Adds one or more tags to a specified Amazon QLDB resource. A resource can have up to 50 tags. If you try to create more than 50 tags for a resource, your request fails and returns an error.
UntagResource
Show Description Removes one or more tags from a specified Amazon QLDB resource. You can specify up to 50 tag keys to remove.
UpdateLedger
Show Description Updates properties on a ledger.

Quicksight Events

Service Event Name Description
quicksight CancelIngestion
Show Description Cancels an ongoing ingestion of data into SPICE.
CreateAccountCustomization
Show Description Creates Amazon QuickSight customizations the current Amazon Web Services Region. Currently, you can add a custom default theme by using the CreateAccountCustomization or UpdateAccountCustomization API operation. To further customize Amazon QuickSight by removing Amazon QuickSight sample assets and videos for all new users, see Customizing Amazon QuickSight in the Amazon QuickSight User Guide. You can create customizations for your Amazon Web Services account or, if you specify a namespace, for a Amazon QuickSight namespace instead. Customizations that apply to a namespace always override customizations that apply to an Amazon Web Services account. To find out which customizations apply, use the DescribeAccountCustomization API operation. Before you use the CreateAccountCustomization API operation to add a theme as the namespace default, make sure that you first share the theme with the namespace. If you don't share it with the namespace, the theme isn't visible to your users even if you make it the default theme. To check if the theme is shared, view the current permissions by using the DescribeThemePermissions API operation. To share the theme, grant permissions by using the UpdateThemePermissions API operation.
CreateAnalysis
Show Description Creates an analysis in Amazon QuickSight.
CreateDashboard
Show Description Creates a dashboard from a template. To first create a template, see the CreateTemplate API operation. A dashboard is an entity in Amazon QuickSight that identifies Amazon QuickSight reports, created from analyses. You can share Amazon QuickSight dashboards. With the right permissions, you can create scheduled email reports from them. If you have the correct permissions, you can create a dashboard from a template that exists in a different Amazon Web Services account.
CreateDataSet
Show Description Creates a dataset.
CreateDataSource
Show Description Creates a data source.
CreateFolder
Show Description Creates an empty shared folder.
CreateFolderMembership
Show Description Adds an asset, such as a dashboard, analysis, or dataset into a folder.
CreateGroup
Show Description Creates an Amazon QuickSight group. The permissions resource is arn:aws:quicksight:us-east-1:<relevant-aws-account-id>:group/default/<group-name> . The response is a group object.
CreateGroupMembership
Show Description Adds an Amazon QuickSight user to an Amazon QuickSight group.
CreateIAMPolicyAssignment
Show Description Creates an assignment with one specified IAMpolicy, identified by its Amazon Resource Name (ARN). This policy assignment is attached to the specified groups or users of Amazon QuickSight. Assignment names are unique per Amazon Web Services account. To avoid overwriting rules in other namespaces, use assignment names that are unique.
CreateIngestion
Show Description Creates and starts a new SPICE ingestion on a dataset Any ingestions operating on tagged datasets inherit the same tags automatically for use in access control. For an example, see How do I create an IAM policy to control access to Amazon EC2 resources using tags? in the Amazon Web Services Knowledge Center. Tags are visible on the tagged dataset, but not on the ingestion resource.
CreateNamespace
Show Description (Enterprise edition only) Creates a new namespace for you to use with Amazon QuickSight. A namespace allows you to isolate the Amazon QuickSight users and groups that are registered for that namespace. Users that access the namespace can share assets only with other users or groups in the same namespace. They can't see users and groups in other namespaces. You can create a namespace after your Amazon Web Services account is subscribed to Amazon QuickSight. The namespace must be unique within the Amazon Web Services account. By default, there is a limit of 100 namespaces per Amazon Web Services account. To increase your limit, create a ticket with Amazon Web Services Support.
CreateTemplate
Show Description Creates a template from an existing Amazon QuickSight analysis or template. You can use the resulting template to create a dashboard. A template is an entity in Amazon QuickSight that encapsulates the metadata required to create an analysis and that you can use to create s dashboard. A template adds a layer of abstraction by using placeholders to replace the dataset associated with the analysis. You can use templates to create dashboards by replacing dataset placeholders with datasets that follow the same schema that was used to create the source analysis and template.
CreateTemplateAlias
Show Description Creates a template alias for a template.
CreateTheme
Show Description Creates a theme. A theme is set of configuration options for color and layout. Themes apply to analyses and dashboards. For more information, see Using Themes in Amazon QuickSight in the Amazon QuickSight User Guide.
CreateThemeAlias
Show Description Creates a theme alias for a theme.
DeleteAccountCustomization
Show Description Deletes all Amazon QuickSight customizations in this Amazon Web Services Region for the specified Amazon Web Services account and Amazon QuickSight namespace.
DeleteAnalysis
Show Description Deletes an analysis from Amazon QuickSight. You can optionally include a recovery window during which you can restore the analysis. If you don't specify a recovery window value, the operation defaults to 30 days. Amazon QuickSight attaches a DeletionTime stamp to the response that specifies the end of the recovery window. At the end of the recovery window, Amazon QuickSight deletes the analysis permanently. At any time before recovery window ends, you can use the RestoreAnalysis API operation to remove the DeletionTime stamp and cancel the deletion of the analysis. The analysis remains visible in the API until it's deleted, so you can describe it but you can't make a template from it. An analysis that's scheduled for deletion isn't accessible in the Amazon QuickSight console. To access it in the console, restore it. Deleting an analysis doesn't delete the dashboards that you publish from it.
DeleteDashboard
Show Description Deletes a dashboard.
DeleteDataSet
Show Description Deletes a dataset.
DeleteDataSource
Show Description Deletes the data source permanently. This operation breaks all the datasets that reference the deleted data source.
DeleteFolder
Show Description Deletes an empty folder.
DeleteFolderMembership
Show Description Removes an asset, such as a dashboard, analysis, or dataset, from a folder.
DeleteGroup
Show Description Removes a user group from Amazon QuickSight.
DeleteGroupMembership
Show Description Removes a user from a group so that the user is no longer a member of the group.
DeleteIAMPolicyAssignment
Show Description Deletes an existing IAMpolicy assignment.
DeleteNamespace
Show Description Deletes a namespace and the users and groups that are associated with the namespace. This is an asynchronous process. Assets including dashboards, analyses, datasets and data sources are not deleted. To delete these assets, you use the API operations for the relevant asset.
DeleteTemplate
Show Description Deletes a template.
DeleteTemplateAlias
Show Description Deletes the item that the specified template alias points to. If you provide a specific alias, you delete the version of the template that the alias points to.
DeleteTheme
Show Description Deletes a theme.
DeleteThemeAlias
Show Description Deletes the version of the theme that the specified theme alias points to. If you provide a specific alias, you delete the version of the theme that the alias points to.
DeleteUser
Show Description Deletes the Amazon QuickSight user that is associated with the identity of the Identity and Access Management (IAM) user or role that's making the call. The IAM user isn't deleted as a result of this call.
DeleteUserByPrincipalId
Show Description Deletes a user identified by its principal ID.
DescribeAccountCustomization
Show Description Describes the customizations associated with the provided Amazon Web Services account and Amazon Amazon QuickSight namespace in an Amazon Web Services Region. The Amazon QuickSight console evaluates which customizations to apply by running this API operation with the Resolved flag included. To determine what customizations display when you run this command, it can help to visualize the relationship of the entities involved.
  • Amazon Web Services account - The Amazon Web Services account exists at the top of the hierarchy. It has the potential to use all of the Amazon Web Services Regions and AWS Services. When you subscribe to Amazon QuickSight, you choose one Amazon Web Services Region to use as your home Region. That's where your free SPICE capacity is located. You can use Amazon QuickSight in any supported Amazon Web Services Region.
  • Amazon Web Services Region - In each Amazon Web Services Region where you sign in to Amazon QuickSight at least once, Amazon QuickSight acts as a separate instance of the same service. If you have a user directory, it resides in us-east-1, which is the US East (N. Virginia). Generally speaking, these users have access to Amazon QuickSight in any Amazon Web Services Region, unless they are constrained to a namespace. To run the command in a different Amazon Web Services Region, you change your Region settings. If you're using the AWS CLI, you can use one of the following options:
  • Namespace - A Amazon QuickSight namespace is a partition that contains users and assets (data sources, datasets, dashboards, and so on). To access assets that are in a specific namespace, users and groups must also be part of the same namespace. People who share a namespace are completely isolated from users and assets in other namespaces, even if they are in the same Amazon Web Services account and Amazon Web Services Region.
  • Applied customizations - Within an Amazon Web Services Region, a set of Amazon QuickSight customizations can apply to an Amazon Web Services account or to a namespace. Settings that you apply to a namespace override settings that you apply to an Amazon Web Services account. All settings are isolated to a single Amazon Web Services Region. To apply them in other Amazon Web Services Regions, run the CreateAccountCustomization command in each Amazon Web Services Region where you want to apply the same customizations.
DescribeAccountSettings
Show Description Describes the settings that were used when your Amazon QuickSight subscription was first created in this Amazon Web Services account.
DescribeAnalysis
Show Description Provides a summary of the metadata for an analysis.
DescribeAnalysisPermissions
Show Description Provides the read and write permissions for an analysis.
DescribeDashboard
Show Description Provides a summary for a dashboard.
DescribeDashboardPermissions
Show Description Describes read and write permissions for a dashboard.
DescribeDataSet
Show Description Describes a dataset.
DescribeDataSetPermissions
Show Description Describes the permissions on a dataset. The permissions resource is arn:aws:quicksight:region:aws-account-id:dataset/data-set-id.
DescribeDataSource
Show Description Describes a data source.
DescribeDataSourcePermissions
Show Description Describes the resource permissions for a data source.
DescribeFolder
Show Description Describes a folder.
DescribeFolderPermissions
Show Description Describes permissions for a folder.
DescribeFolderResolvedPermissions
Show Description Describes the folder resolved permissions. Permissions consists of both folder direct permissions and the inherited permissions from the ancestor folders.
DescribeGroup
Show Description Returns an Amazon QuickSight group's description and Amazon Resource Name (ARN).
DescribeIAMPolicyAssignment
Show Description Describes an existing IAMpolicy assignment, as specified by the assignment name.
DescribeIngestion
Show Description Describes a SPICE ingestion.
DescribeIpRestriction
Show Description Provides a summary and status of IP Rules.
DescribeNamespace
Show Description Describes the current namespace.
DescribeTemplate
Show Description Describes a template's metadata.
DescribeTemplateAlias
Show Description Describes the template alias for a template.
DescribeTemplatePermissions
Show Description Describes read and write permissions on a template.
DescribeTheme
Show Description Describes a theme.
DescribeThemeAlias
Show Description Describes the alias for a theme.
DescribeThemePermissions
Show Description Describes the read and write permissions for a theme.
DescribeUser
Show Description Returns information about a user, given the user name.
GenerateEmbedUrlForAnonymousUser
Show Description Generates an embed URL that you can use to embed an Amazon QuickSight dashboard in your website, without having to register any reader users. Before you use this action, make sure that you have configured the dashboards and permissions. The following rules apply to the generated URL:
  • It contains a temporary bearer token. It is valid for 5 minutes after it is generated. Once redeemed within this period, it cannot be re-used again.
  • The URL validity period should not be confused with the actual session lifetime that can be customized using the SessionLifetimeInMinutes parameter. The resulting user session is valid for 15 minutes (default) to 10 hours (maximum).
  • You are charged only when the URL is used or there is interaction with Amazon QuickSight.
For more information, see Embedded Analytics in the Amazon QuickSight User Guide. For more information about the high-level steps for embedding and for an interactive demo of the ways you can customize embedding, visit the Amazon QuickSight Developer Portal.
GenerateEmbedUrlForRegisteredUser
Show Description Generates an embed URL that you can use to embed an Amazon QuickSight experience in your website. This action can be used for any type of user registered in an Amazon QuickSight account. Before you use this action, make sure that you have configured the relevant Amazon QuickSight resource and permissions. The following rules apply to the generated URL:
  • It contains a temporary bearer token. It is valid for 5 minutes after it is generated. Once redeemed within this period, it cannot be re-used again.
  • The URL validity period should not be confused with the actual session lifetime that can be customized using the SessionLifetimeInMinutes parameter. The resulting user session is valid for 15 minutes (default) to 10 hours (maximum).
  • You are charged only when the URL is used or there is interaction with Amazon QuickSight.
For more information, see Embedded Analytics in the Amazon QuickSight User Guide. For more information about the high-level steps for embedding and for an interactive demo of the ways you can customize embedding, visit the Amazon QuickSight Developer Portal.
GetDashboardEmbedUrl
Show Description Generates a session URL and authorization code that you can use to embed an Amazon Amazon QuickSight read-only dashboard in your web server code. Before you use this command, make sure that you have configured the dashboards and permissions. Currently, you can use GetDashboardEmbedURL only from the server, not from the user's browser. The following rules apply to the combination of URL and authorization code:
  • They must be used together.
  • They can be used one time only.
  • They are valid for 5 minutes after you run this command.
  • The resulting user session is valid for 10 hours.
For more information, see Embedding Analytics Using GetDashboardEmbedUrl in the Amazon QuickSight User Guide. For more information about the high-level steps for embedding and for an interactive demo of the ways you can customize embedding, visit the Amazon QuickSight Developer Portal.
GetSessionEmbedUrl
Show Description Generates a session URL and authorization code that you can use to embed the Amazon Amazon QuickSight console in your web server code. Use GetSessionEmbedUrl where you want to provide an authoring portal that allows users to create data sources, datasets, analyses, and dashboards. The users who access an embedded Amazon QuickSight console need belong to the author or admin security cohort. If you want to restrict permissions to some of these features, add a custom permissions profile to the user with the UpdateUser API operation. Use RegisterUser API operation to add a new user with a custom permission profile attached. For more information, see the following sections in the Amazon QuickSight User Guide:
ListAnalyses
Show Description Lists Amazon QuickSight analyses that exist in the specified Amazon Web Services account.
ListDashboardVersions
Show Description Lists all the versions of the dashboards in the Amazon QuickSight subscription.
ListDashboards
Show Description Lists dashboards in an Amazon Web Services account.
ListDataSets
Show Description Lists all of the datasets belonging to the current Amazon Web Services account in an Amazon Web Services Region. The permissions resource is arn:aws:quicksight:region:aws-account-id:dataset/*.
ListDataSources
Show Description Lists data sources in current Amazon Web Services Region that belong to this Amazon Web Services account.
ListFolderMembers
Show Description List all assets (DASHBOARD, ANALYSIS, and DATASET) in a folder.
ListFolders
Show Description Lists all folders in an account.
ListGroupMemberships
Show Description Lists member users in a group.
ListGroups
Show Description Lists all user groups in Amazon QuickSight.
ListIAMPolicyAssignments
Show Description Lists IAMpolicy assignments in the current Amazon QuickSight account.
ListIAMPolicyAssignmentsForUser
Show Description Lists all the IAMpolicy assignments, including the Amazon Resource Names (ARNs) for the IAM policies assigned to the specified user and group or groups that the user belongs to.
ListIngestions
Show Description Lists the history of SPICE ingestions for a dataset.
ListNamespaces
Show Description Lists the namespaces for the specified Amazon Web Services account.
ListTagsForResource
Show Description Lists the tags assigned to a resource.
ListTemplateAliases
Show Description Lists all the aliases of a template.
ListTemplateVersions
Show Description Lists all the versions of the templates in the current Amazon QuickSight account.
ListTemplates
Show Description Lists all the templates in the current Amazon QuickSight account.
ListThemeAliases
Show Description Lists all the aliases of a theme.
ListThemeVersions
Show Description Lists all the versions of the themes in the current Amazon Web Services account.
ListThemes
Show Description Lists all the themes in the current Amazon Web Services account.
ListUserGroups
Show Description Lists the Amazon QuickSight groups that an Amazon QuickSight user is a member of.
ListUsers
Show Description Returns a list of all of the Amazon QuickSight users belonging to this account.
RegisterUser
Show Description Creates an Amazon QuickSight user, whose identity is associated with the AWS Identity and Access Management (IAM) identity or role specified in the request.
RestoreAnalysis
Show Description Restores an analysis.
SearchAnalyses
Show Description Searches for analyses that belong to the user specified in the filter. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.
SearchDashboards
Show Description Searches for dashboards that belong to a user. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.
SearchFolders
Show Description Searches the subfolders in a folder.
TagResource
Show Description Assigns one or more tags (key-value pairs) to the specified Amazon QuickSight resource. Tags can help you organize and categorize your resources. You can also use them to scope user permissions, by granting a user permission to access or change only resources with certain tag values. You can use the TagResource operation with a resource that already has tags. If you specify a new tag key for the resource, this tag is appended to the list of tags associated with the resource. If you specify a tag key that is already associated with the resource, the new tag value that you specify replaces the previous value for that tag. You can associate as many as 50 tags with a resource. Amazon QuickSight supports tagging on data set, data source, dashboard, and template. Tagging for Amazon QuickSight works in a similar way to tagging for other AWS services, except for the following:
  • You can't use tags to track AWS costs for Amazon QuickSight. This restriction is because Amazon QuickSight costs are based on users and SPICE capacity, which aren't taggable resources.
  • Amazon QuickSight doesn't currently support the Tag Editor for Resource Groups.
UntagResource
Show Description Removes a tag or tags from a resource.
UpdateAccountCustomization
Show Description Updates Amazon QuickSight customizations the current Amazon Web Services Region. Currently, the only customization you can use is a theme. You can use customizations for your Amazon Web Services account or, if you specify a namespace, for a Amazon QuickSight namespace instead. Customizations that apply to a namespace override customizations that apply to an Amazon Web Services account. To find out which customizations apply, use the DescribeAccountCustomization API operation.
UpdateAccountSettings
Show Description Updates the Amazon QuickSight settings in your Amazon Web Services account.
UpdateAnalysis
Show Description Updates an analysis in Amazon QuickSight
UpdateAnalysisPermissions
Show Description Updates the read and write permissions for an analysis.
UpdateDashboard
Show Description Updates a dashboard in an Amazon Web Services account. Updating a Dashboard creates a new dashboard version but does not immediately publish the new version. You can update the published version of a dashboard by using the UpdateDashboardPublishedVersion API operation.
UpdateDashboardPermissions
Show Description Updates read and write permissions on a dashboard.
UpdateDashboardPublishedVersion
Show Description Updates the published version of a dashboard.
UpdateDataSet
Show Description Updates a dataset.
UpdateDataSetPermissions
Show Description Updates the permissions on a dataset. The permissions resource is arn:aws:quicksight:region:aws-account-id:dataset/data-set-id.
UpdateDataSource
Show Description Updates a data source.
UpdateDataSourcePermissions
Show Description Updates the permissions to a data source.
UpdateFolder
Show Description Updates the name of a folder.
UpdateFolderPermissions
Show Description Updates permissions of a folder.
UpdateGroup
Show Description Changes a group description.
UpdateIAMPolicyAssignment
Show Description Updates an existing IAMpolicy assignment. This operation updates only the optional parameter or parameters that are specified in the request. This overwrites all of the users included in Identities.
UpdateIpRestriction
Show Description Updates content and status of IP Rules.
UpdateTemplate
Show Description Updates a template from an existing Amazon QuickSight analysis or another template.
UpdateTemplateAlias
Show Description Updates the template alias of a template.
UpdateTemplatePermissions
Show Description Updates the resource permissions for a template.
UpdateTheme
Show Description Updates a theme.
UpdateThemeAlias
Show Description Updates an alias of a theme.
UpdateThemePermissions
Show Description Updates the resource permissions for a theme. Permissions apply to the action to grant or revoke permissions on, for example "quicksight:DescribeTheme". Theme permissions apply in groupings. Valid groupings include the following for the three levels of permissions, which are user, owner, or no permissions:
  • User
    • "quicksight:DescribeTheme"
    • "quicksight:DescribeThemeAlias"
    • "quicksight:ListThemeAliases"
    • "quicksight:ListThemeVersions"
  • Owner
    • "quicksight:DescribeTheme"
    • "quicksight:DescribeThemeAlias"
    • "quicksight:ListThemeAliases"
    • "quicksight:ListThemeVersions"
    • "quicksight:DeleteTheme"
    • "quicksight:UpdateTheme"
    • "quicksight:CreateThemeAlias"
    • "quicksight:DeleteThemeAlias"
    • "quicksight:UpdateThemeAlias"
    • "quicksight:UpdateThemePermissions"
    • "quicksight:DescribeThemePermissions"
  • To specify no permissions, omit the permissions list.

Ram Events

Service Event Name Description
ram AcceptResourceShareInvitation
Show Description Accepts an invitation to a resource share from another Amazon Web Services account.
AssociateResourceShare
Show Description Associates the specified resource share with the specified principals and resources.
AssociateResourceSharePermission
Show Description Associates a permission with a resource share.
CreateResourceShare
Show Description Creates a resource share. You must provide a list of the Amazon Resource Names (ARNs) for the resources you want to share. You must also specify who you want to share the resources with, and the permissions that you grant them. Sharing a resource makes it available for use by principals outside of the Amazon Web Services account that created the resource. Sharing doesn't change any permissions or quotas that apply to the resource in the account that created it.
DeleteResourceShare
Show Description Deletes the specified resource share.
DisassociateResourceShare
Show Description Disassociates the specified principals or resources from the specified resource share.
DisassociateResourceSharePermission
Show Description Disassociates an RAM permission from a resource share.
EnableSharingWithAwsOrganization
Show Description Enables resource sharing within your organization in Organizations. The caller must be the master account for the organization.
GetPermission
Show Description Gets the contents of an RAM permission in JSON format.
GetResourcePolicies
Show Description Gets the policies for the specified resources that you own and have shared.
GetResourceShareAssociations
Show Description Gets the resources or principals for the resource shares that you own.
GetResourceShareInvitations
Show Description Gets the invitations that you have received for resource shares.
GetResourceShares
Show Description Gets the resource shares that you own or the resource shares that are shared with you.
ListPendingInvitationResources
Show Description Lists the resources in a resource share that is shared with you but that the invitation is still pending for.
ListPermissions
Show Description Lists the RAM permissions.
ListPrincipals
Show Description Lists the principals that you have shared resources with or that have shared resources with you.
ListResourceSharePermissions
Show Description Lists the RAM permissions that are associated with a resource share.
ListResourceTypes
Show Description Lists the shareable resource types supported by RAM.
ListResources
Show Description Lists the resources that you added to a resource shares or the resources that are shared with you.
PromoteResourceShareCreatedFromPolicy
Show Description Resource shares that were created by attaching a policy to a resource are visible only to the resource share owner, and the resource share cannot be modified in RAM. Use this API action to promote the resource share. When you promote the resource share, it becomes:
  • Visible to all principals that it is shared with.
  • Modifiable in RAM.
RejectResourceShareInvitation
Show Description Rejects an invitation to a resource share from another Amazon Web Services account.
TagResource
Show Description Adds the specified tags to the specified resource share that you own.
UntagResource
Show Description Removes the specified tags from the specified resource share that you own.

Rds-data Events

Service Event Name Description
rds-data BatchExecuteStatement
Show Description Runs a batch SQL statement over an array of data. You can run bulk update and insert operations for multiple records using a DML statement with different parameter sets. Bulk operations can provide a significant performance improvement over individual insert and update operations. If a call isn't part of a transaction because it doesn't include the transactionID parameter, changes that result from the call are committed automatically.
BeginTransaction
Show Description Starts a SQL transaction. 
 <important> <p>A transaction can run for a maximum of 24 hours. A transaction is terminated and rolled back automatically after 24 hours.</p> <p>A transaction times out if no calls use its transaction ID in three minutes. If a transaction times out before it's committed, it's rolled back automatically.</p> <p>DDL statements inside a transaction cause an implicit commit. We recommend that you run each DDL statement in a separate <code>ExecuteStatement</code> call with <code>continueAfterTimeout</code> enabled.</p> </important>
CommitTransaction
Show Description Ends a SQL transaction started with the BeginTransaction operation and commits the changes.
ExecuteSql
Show Description Runs one or more SQL statements. This operation is deprecated. Use the BatchExecuteStatement or ExecuteStatement operation.
ExecuteStatement
Show Description Runs a SQL statement against a database. If a call isn't part of a transaction because it doesn't include the transactionID parameter, changes that result from the call are committed automatically. The response size limit is 1 MB. If the call returns more than 1 MB of response data, the call is terminated.

Rds Events

Service Event Name Description
rds AddRoleToDBCluster
AddRoleToDBInstance
AddSourceIdentifierToSubscription
Show Description Adds a source identifier to an existing RDS event notification subscription.
AddTagsToResource
ApplyPendingMaintenanceAction
Show Description Applies a pending maintenance action to a resource (for example, to a DB instance).
AuthorizeDBSecurityGroupIngress
Show Description Enables ingress to a DBSecurityGroup using one of two forms of authorization. First, EC2 or VPC security groups can be added to the DBSecurityGroup if the application using the database is running on EC2 or VPC instances. Second, IP ranges are available if the application accessing your database is running on the Internet. Required parameters for this API are one of CIDR range, EC2SecurityGroupId for VPC, or (EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId for non-VPC). You can't authorize ingress from an EC2 security group in one Amazon Web Services Region to an Amazon RDS DB instance in another. You can't authorize ingress from a VPC security group in one VPC to an Amazon RDS DB instance in another. For an overview of CIDR ranges, go to the Wikipedia Tutorial.
BacktrackDBCluster
Show Description Backtracks a DB cluster to a specific time, without creating a new DB cluster. For more information on backtracking, see Backtracking an Aurora DB Cluster in the Amazon Aurora User Guide. This action only applies to Aurora MySQL DB clusters.
CancelExportTask
Show Description Cancels an export task in progress that is exporting a snapshot to Amazon S3. Any data that has already been written to the S3 bucket isn't removed.
CopyDBClusterParameterGroup
Show Description Copies the specified DB cluster parameter group. This action only applies to Aurora DB clusters.
CopyDBClusterSnapshot
Show Description Copies a snapshot of a DB cluster. To copy a DB cluster snapshot from a shared manual DB cluster snapshot, SourceDBClusterSnapshotIdentifier must be the Amazon Resource Name (ARN) of the shared DB cluster snapshot. You can copy an encrypted DB cluster snapshot from another Amazon Web Services Region. In that case, the Amazon Web Services Region where you call the CopyDBClusterSnapshot action is the destination Amazon Web Services Region for the encrypted DB cluster snapshot to be copied to. To copy an encrypted DB cluster snapshot from another Amazon Web Services Region, you must provide the following values:
  • KmsKeyId - The Amazon Web Services Key Management System (Amazon Web Services KMS) key identifier for the key to use to encrypt the copy of the DB cluster snapshot in the destination Amazon Web Services Region.
  • PreSignedUrl - A URL that contains a Signature Version 4 signed request for the CopyDBClusterSnapshot action to be called in the source Amazon Web Services Region where the DB cluster snapshot is copied from. The pre-signed URL must be a valid request for the CopyDBClusterSnapshot API action that can be executed in the source Amazon Web Services Region that contains the encrypted DB cluster snapshot to be copied. The pre-signed URL request must contain the following parameter values:
    • KmsKeyId - The Amazon Web Services KMS key identifier for the KMS key to use to encrypt the copy of the DB cluster snapshot in the destination Amazon Web Services Region. This is the same identifier for both the CopyDBClusterSnapshot action that is called in the destination Amazon Web Services Region, and the action contained in the pre-signed URL.
    • DestinationRegion - The name of the Amazon Web Services Region that the DB cluster snapshot is to be created in.
    • SourceDBClusterSnapshotIdentifier - The DB cluster snapshot identifier for the encrypted DB cluster snapshot to be copied. This identifier must be in the Amazon Resource Name (ARN) format for the source Amazon Web Services Region. For example, if you are copying an encrypted DB cluster snapshot from the us-west-2 Amazon Web Services Region, then your SourceDBClusterSnapshotIdentifier looks like the following example: arn:aws:rds:us-west-2:123456789012:cluster-snapshot:aurora-cluster1-snapshot-20161115.
    To learn how to generate a Signature Version 4 signed request, see Authenticating Requests: Using Query Parameters (Amazon Web Services Signature Version 4) and Signature Version 4 Signing Process. If you are using an Amazon Web Services SDK tool or the CLI, you can specify SourceRegion (or --source-region for the CLI) instead of specifying PreSignedUrl manually. Specifying SourceRegion autogenerates a pre-signed URL that is a valid request for the operation that can be executed in the source Amazon Web Services Region.
  • TargetDBClusterSnapshotIdentifier - The identifier for the new copy of the DB cluster snapshot in the destination Amazon Web Services Region.
  • SourceDBClusterSnapshotIdentifier - The DB cluster snapshot identifier for the encrypted DB cluster snapshot to be copied. This identifier must be in the ARN format for the source Amazon Web Services Region and is the same value as the SourceDBClusterSnapshotIdentifier in the pre-signed URL.
To cancel the copy operation once it is in progress, delete the target DB cluster snapshot identified by TargetDBClusterSnapshotIdentifier while that DB cluster snapshot is in "copying" status. For more information on copying encrypted DB cluster snapshots from one Amazon Web Services Region to another, see Copying a Snapshot in the Amazon Aurora User Guide. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
CopyDBParameterGroup
Show Description Copies the specified DB parameter group.
CopyDBSnapshot
Show Description Copies the specified DB snapshot. The source DB snapshot must be in the available state. You can copy a snapshot from one Amazon Web Services Region to another. In that case, the Amazon Web Services Region where you call the CopyDBSnapshot action is the destination Amazon Web Services Region for the DB snapshot copy. This command doesn't apply to RDS Custom. For more information about copying snapshots, see Copying a DB Snapshot in the Amazon RDS User Guide.
CopyOptionGroup
Show Description Copies the specified option group.
CreateCustomAvailabilityZone
Show Description Creates a custom Availability Zone (AZ). A custom AZ is an on-premises AZ that is integrated with a VMware vSphere cluster. For more information about RDS on VMware, see the RDS on VMware User Guide.
CreateCustomDBEngineVersion
Show Description Creates a custom DB engine version (CEV). A CEV is a binary volume snapshot of a database engine and specific AMI. The only supported engine is Oracle Database 19c Enterprise Edition with the January 2021 or later RU/RUR. For more information, see Amazon RDS Custom requirements and limitations in the Amazon RDS User Guide. Amazon RDS, which is a fully managed service, supplies the Amazon Machine Image (AMI) and database software. The Amazon RDS database software is preinstalled, so you need only select a DB engine and version, and create your database. With Amazon RDS Custom, you upload your database installation files in Amazon S3. For more information, see Preparing to create a CEV in the Amazon RDS User Guide. When you create a custom engine version, you specify the files in a JSON document called a CEV manifest. This document describes installation .zip files stored in Amazon S3. RDS Custom creates your CEV from the installation files that you provided. This service model is called Bring Your Own Media (BYOM). Creation takes approximately two hours. If creation fails, RDS Custom issues RDS-EVENT-0196 with the message Creation failed for custom engine version, and includes details about the failure. For example, the event prints missing files. After you create the CEV, it is available for use. You can create multiple CEVs, and create multiple RDS Custom instances from any CEV. You can also change the status of a CEV to make it available or inactive. The MediaImport service that imports files from Amazon S3 to create CEVs isn't integrated with Amazon Web Services CloudTrail. If you turn on data logging for Amazon RDS in CloudTrail, calls to the CreateCustomDbEngineVersion event aren't logged. However, you might see calls from the API gateway that accesses your Amazon S3 bucket. These calls originate from the MediaImport service for the CreateCustomDbEngineVersion event. For more information, see Creating a CEV in the Amazon RDS User Guide.
CreateDBCluster
Show Description Creates a new Amazon Aurora DB cluster. You can use the ReplicationSourceIdentifier parameter to create the DB cluster as a read replica of another DB cluster or Amazon RDS MySQL or PostgreSQL DB instance. For cross-region replication where the DB cluster identified by ReplicationSourceIdentifier is encrypted, you must also specify the PreSignedUrl parameter. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
CreateDBClusterEndpoint
Show Description Creates a new custom endpoint and associates it with an Amazon Aurora DB cluster. This action only applies to Aurora DB clusters.
CreateDBClusterParameterGroup
Show Description Creates a new DB cluster parameter group. Parameters in a DB cluster parameter group apply to all of the instances in a DB cluster. A DB cluster parameter group is initially created with the default parameters for the database engine used by instances in the DB cluster. To provide custom values for any of the parameters, you must modify the group after creating it using ModifyDBClusterParameterGroup. Once you've created a DB cluster parameter group, you need to associate it with your DB cluster using ModifyDBCluster. When you associate a new DB cluster parameter group with a running DB cluster, you need to reboot the DB instances in the DB cluster without failover for the new DB cluster parameter group and associated settings to take effect. After you create a DB cluster parameter group, you should wait at least 5 minutes before creating your first DB cluster that uses that DB cluster parameter group as the default parameter group. This allows Amazon RDS to fully complete the create action before the DB cluster parameter group is used as the default for a new DB cluster. This is especially important for parameters that are critical when creating the default database for a DB cluster, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon RDS console or the DescribeDBClusterParameters action to verify that your DB cluster parameter group has been created or modified. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
CreateDBClusterSnapshot
Show Description Creates a snapshot of a DB cluster. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
CreateDBInstance
Show Description Creates a new DB instance.
CreateDBInstanceReadReplica
Show Description Creates a new DB instance that acts as a read replica for an existing source DB instance. You can create a read replica for a DB instance running MySQL, MariaDB, Oracle, PostgreSQL, or SQL Server. For more information, see Working with Read Replicas in the Amazon RDS User Guide. Amazon Aurora doesn't support this action. Call the CreateDBInstance action to create a DB instance for an Aurora DB cluster. All read replica DB instances are created with backups disabled. All other DB instance attributes (including DB security groups and DB parameter groups) are inherited from the source DB instance, except as specified. Your source DB instance must have backup retention enabled.
CreateDBParameterGroup
Show Description Creates a new DB parameter group. A DB parameter group is initially created with the default parameters for the database engine used by the DB instance. To provide custom values for any of the parameters, you must modify the group after creating it using ModifyDBParameterGroup. Once you've created a DB parameter group, you need to associate it with your DB instance using ModifyDBInstance. When you associate a new DB parameter group with a running DB instance, you need to reboot the DB instance without failover for the new DB parameter group and associated settings to take effect. This command doesn't apply to RDS Custom. After you create a DB parameter group, you should wait at least 5 minutes before creating your first DB instance that uses that DB parameter group as the default parameter group. This allows Amazon RDS to fully complete the create action before the parameter group is used as the default for a new DB instance. This is especially important for parameters that are critical when creating the default database for a DB instance, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon RDS console or the DescribeDBParameters command to verify that your DB parameter group has been created or modified.
CreateDBProxy
Show Description Creates a new DB proxy.
CreateDBProxyEndpoint
Show Description Creates a DBProxyEndpoint. Only applies to proxies that are associated with Aurora DB clusters. You can use DB proxy endpoints to specify read/write or read-only access to the DB cluster. You can also use DB proxy endpoints to access a DB proxy through a different VPC than the proxy's default VPC.
CreateDBSecurityGroup
Show Description Creates a new DB security group. DB security groups control access to a DB instance. A DB security group controls access to EC2-Classic DB instances that are not in a VPC.
CreateDBSnapshot
Show Description Creates a snapshot of a DB instance. The source DB instance must be in the available or storage-optimization state.
CreateDBSubnetGroup
Show Description Creates a new DB subnet group. DB subnet groups must contain at least one subnet in at least two AZs in the Amazon Web Services Region.
CreateEventSubscription
Show Description Creates an RDS event notification subscription. This action requires a topic Amazon Resource Name (ARN) created by either the RDS console, the SNS console, or the SNS API. To obtain an ARN with SNS, you must create a topic in Amazon SNS and subscribe to the topic. The ARN is displayed in the SNS console. You can specify the type of source (SourceType) that you want to be notified of and provide a list of RDS sources (SourceIds) that triggers the events. You can also provide a list of event categories (EventCategories) for events that you want to be notified of. For example, you can specify SourceType = db-instance, SourceIds = mydbinstance1, mydbinstance2 and EventCategories = Availability, Backup. If you specify both the SourceType and SourceIds, such as SourceType = db-instance and SourceIdentifier = myDBInstance1, you are notified of all the db-instance events for the specified source. If you specify a SourceType but do not specify a SourceIdentifier, you receive notice of the events for that source type for all your RDS sources. If you don't specify either the SourceType or the SourceIdentifier, you are notified of events generated from all RDS sources belonging to your customer account. RDS event notification is only available for unencrypted SNS topics. If you specify an encrypted SNS topic, event notifications aren't sent for the topic.
CreateGlobalCluster
Show Description Creates an Aurora global database spread across multiple Amazon Web Services Regions. The global database contains a single primary cluster with read-write capability, and a read-only secondary cluster that receives data from the primary cluster through high-speed replication performed by the Aurora storage subsystem. You can create a global database that is initially empty, and then add a primary cluster and a secondary cluster to it. Or you can specify an existing Aurora cluster during the create operation, and this cluster becomes the primary cluster of the global database. This action only applies to Aurora DB clusters.
CreateOptionGroup
Show Description Creates a new option group. You can create up to 20 option groups. This command doesn't apply to RDS Custom.
DeleteCustomAvailabilityZone
Show Description Deletes a custom Availability Zone (AZ). A custom AZ is an on-premises AZ that is integrated with a VMware vSphere cluster. For more information about RDS on VMware, see the RDS on VMware User Guide.
DeleteCustomDBEngineVersion
Show Description Deletes a custom engine version. To run this command, make sure you meet the following prerequisites:
  • The CEV must not be the default for RDS Custom. If it is, change the default before running this command.
  • The CEV must not be associated with an RDS Custom DB instance, RDS Custom instance snapshot, or automated backup of your RDS Custom instance.
Typically, deletion takes a few minutes. The MediaImport service that imports files from Amazon S3 to create CEVs isn't integrated with Amazon Web Services CloudTrail. If you turn on data logging for Amazon RDS in CloudTrail, calls to the DeleteCustomDbEngineVersion event aren't logged. However, you might see calls from the API gateway that accesses your Amazon S3 bucket. These calls originate from the MediaImport service for the DeleteCustomDbEngineVersion event. For more information, see Deleting a CEV in the Amazon RDS User Guide.
DeleteDBCluster
Show Description The DeleteDBCluster action deletes a previously provisioned DB cluster. When you delete a DB cluster, all automated backups for that DB cluster are deleted and can't be recovered. Manual DB cluster snapshots of the specified DB cluster are not deleted.

For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.

DeleteDBClusterEndpoint
Show Description Deletes a custom endpoint and removes it from an Amazon Aurora DB cluster. This action only applies to Aurora DB clusters.
DeleteDBClusterParameterGroup
DeleteDBClusterSnapshot
Show Description Deletes a DB cluster snapshot. If the snapshot is being copied, the copy operation is terminated. The DB cluster snapshot must be in the available state to be deleted. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
DeleteDBInstance
Show Description The DeleteDBInstance action deletes a previously provisioned DB instance. When you delete a DB instance, all automated backups for that instance are deleted and can't be recovered. Manual DB snapshots of the DB instance to be deleted by DeleteDBInstance are not deleted. If you request a final DB snapshot the status of the Amazon RDS DB instance is deleting until the DB snapshot is created. The API action DescribeDBInstance is used to monitor the status of this operation. The action can't be canceled or reverted once submitted. When a DB instance is in a failure state and has a status of failed, incompatible-restore, or incompatible-network, you can only delete it when you skip creation of the final snapshot with the SkipFinalSnapshot parameter. If the specified DB instance is part of an Amazon Aurora DB cluster, you can't delete the DB instance if both of the following conditions are true:
  • The DB cluster is a read replica of another Amazon Aurora DB cluster.
  • The DB instance is the only instance in the DB cluster.
To delete a DB instance in this case, first call the PromoteReadReplicaDBCluster API action to promote the DB cluster so it's no longer a read replica. After the promotion completes, then call the DeleteDBInstance API action to delete the final instance in the DB cluster.
DeleteDBInstanceAutomatedBackup
Show Description Deletes automated backups using the DbiResourceId value of the source DB instance or the Amazon Resource Name (ARN) of the automated backups.
DeleteDBParameterGroup
DeleteDBProxy
Show Description Deletes an existing DB proxy.
DeleteDBProxyEndpoint
Show Description Deletes a DBProxyEndpoint. Doing so removes the ability to access the DB proxy using the endpoint that you defined. The endpoint that you delete might have provided capabilities such as read/write or read-only operations, or using a different VPC than the DB proxy's default VPC.
DeleteDBSecurityGroup
DeleteDBSnapshot
Show Description Deletes a DB snapshot. If the snapshot is being copied, the copy operation is terminated. The DB snapshot must be in the available state to be deleted.
DeleteDBSubnetGroup
DeleteEventSubscription
Show Description Deletes an RDS event notification subscription.
DeleteGlobalCluster
Show Description Deletes a global database cluster. The primary and secondary clusters must already be detached or destroyed first. This action only applies to Aurora DB clusters.
DeleteInstallationMedia
Show Description Deletes the installation medium for a DB engine that requires an on-premises customer provided license, such as Microsoft SQL Server.
DeleteOptionGroup
DeregisterDBProxyTargets
Show Description Remove the association between one or more DBProxyTarget data structures and a DBProxyTargetGroup.
DescribeAccountAttributes
Show Description Lists all of the attributes for a customer account. The attributes include Amazon RDS quotas for the account, such as the number of DB instances allowed. The description for a quota includes the quota name, current usage toward that quota, and the quota's maximum value. This command doesn't take any parameters.
DescribeCertificates
Show Description Lists the set of CA certificates provided by Amazon RDS for this Amazon Web Services account.
DescribeCustomAvailabilityZones
Show Description Returns information about custom Availability Zones (AZs). A custom AZ is an on-premises AZ that is integrated with a VMware vSphere cluster. For more information about RDS on VMware, see the RDS on VMware User Guide.
DescribeDBClusterBacktracks
Show Description Returns information about backtracks for a DB cluster. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora MySQL DB clusters.
DescribeDBClusterEndpoints
Show Description Returns information about endpoints for an Amazon Aurora DB cluster. This action only applies to Aurora DB clusters.
DescribeDBClusterParameterGroups
Show Description Returns a list of DBClusterParameterGroup descriptions. If a DBClusterParameterGroupName parameter is specified, the list will contain only the description of the specified DB cluster parameter group. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
DescribeDBClusterParameters
Show Description Returns the detailed parameter list for a particular DB cluster parameter group. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
DescribeDBClusterSnapshotAttributes
Show Description Returns a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot. When sharing snapshots with other Amazon Web Services accounts, DescribeDBClusterSnapshotAttributes returns the restore attribute and a list of IDs for the Amazon Web Services accounts that are authorized to copy or restore the manual DB cluster snapshot. If all is included in the list of values for the restore attribute, then the manual DB cluster snapshot is public and can be copied or restored by all Amazon Web Services accounts. To add or remove access for an Amazon Web Services account to copy or restore a manual DB cluster snapshot, or to make the manual DB cluster snapshot public or private, use the ModifyDBClusterSnapshotAttribute API action. This action only applies to Aurora DB clusters.
DescribeDBClusterSnapshots
Show Description Returns information about DB cluster snapshots. This API action supports pagination. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
DescribeDBClusters
Show Description Returns information about provisioned Aurora DB clusters. This API supports pagination. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This operation can also return information for Amazon Neptune DB instances and Amazon DocumentDB instances.
DescribeDBEngineVersions
Show Description Returns a list of the available DB engines.
DescribeDBInstanceAutomatedBackups
Show Description Displays backups for both current and deleted instances. For example, use this operation to find details about automated backups for previously deleted instances. Current instances with retention periods greater than zero (0) are returned for both the DescribeDBInstanceAutomatedBackups and DescribeDBInstances operations. All parameters are optional.
DescribeDBInstances
Show Description Returns information about provisioned RDS instances. This API supports pagination. This operation can also return information for Amazon Neptune DB instances and Amazon DocumentDB instances.
DescribeDBLogFiles
Show Description Returns a list of DB log files for the DB instance. This command doesn't apply to RDS Custom.
DescribeDBParameterGroups
Show Description Returns a list of DBParameterGroup descriptions. If a DBParameterGroupName is specified, the list will contain only the description of the specified DB parameter group.
DescribeDBParameters
Show Description Returns the detailed parameter list for a particular DB parameter group.
DescribeDBProxies
Show Description Returns information about DB proxies.
DescribeDBProxyEndpoints
Show Description Returns information about DB proxy endpoints.
DescribeDBProxyTargetGroups
Show Description Returns information about DB proxy target groups, represented by DBProxyTargetGroup data structures.
DescribeDBProxyTargets
Show Description Returns information about DBProxyTarget objects. This API supports pagination.
DescribeDBSecurityGroups
Show Description Returns a list of DBSecurityGroup descriptions. If a DBSecurityGroupName is specified, the list will contain only the descriptions of the specified DB security group.
DescribeDBSnapshotAttributes
Show Description Returns a list of DB snapshot attribute names and values for a manual DB snapshot. When sharing snapshots with other Amazon Web Services accounts, DescribeDBSnapshotAttributes returns the restore attribute and a list of IDs for the Amazon Web Services accounts that are authorized to copy or restore the manual DB snapshot. If all is included in the list of values for the restore attribute, then the manual DB snapshot is public and can be copied or restored by all Amazon Web Services accounts. To add or remove access for an Amazon Web Services account to copy or restore a manual DB snapshot, or to make the manual DB snapshot public or private, use the ModifyDBSnapshotAttribute API action.
DescribeDBSnapshots
Show Description Returns information about DB snapshots. This API action supports pagination.
DescribeDBSubnetGroups
Show Description Returns a list of DBSubnetGroup descriptions. If a DBSubnetGroupName is specified, the list will contain only the descriptions of the specified DBSubnetGroup. For an overview of CIDR ranges, go to the Wikipedia Tutorial.
DescribeEngineDefaultClusterParameters
Show Description Returns the default engine and system parameter information for the cluster database engine. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide.
DescribeEngineDefaultParameters
Show Description Returns the default engine and system parameter information for the specified database engine.
DescribeEventCategories
Show Description Displays a list of categories for all event source types, or, if specified, for a specified source type. You can see a list of the event categories and source types in Events in the Amazon RDS User Guide.
DescribeEventSubscriptions
Show Description Lists all the subscription descriptions for a customer account. The description for a subscription includes SubscriptionName, SNSTopicARN, CustomerID, SourceType, SourceID, CreationTime, and Status. If you specify a SubscriptionName, lists the description for that subscription.
DescribeEvents
Show Description Returns events related to DB instances, DB clusters, DB parameter groups, DB security groups, DB snapshots, and DB cluster snapshots for the past 14 days. Events specific to a particular DB instances, DB clusters, DB parameter groups, DB security groups, DB snapshots, and DB cluster snapshots group can be obtained by providing the name as a parameter. By default, the past hour of events are returned.
DescribeExportTasks
Show Description Returns information about a snapshot export to Amazon S3. This API operation supports pagination.
DescribeGlobalClusters
Show Description Returns information about Aurora global database clusters. This API supports pagination. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
DescribeInstallationMedia
Show Description Describes the available installation media for a DB engine that requires an on-premises customer provided license, such as Microsoft SQL Server.
DescribeOptionGroupOptions
Show Description Describes all available options.
DescribeOptionGroups
Show Description Describes the available option groups.
DescribeOrderableDBInstanceOptions
Show Description Returns a list of orderable DB instance options for the specified engine.
DescribePendingMaintenanceActions
Show Description Returns a list of resources (for example, DB instances) that have at least one pending maintenance action.
DescribeReservedDBInstances
Show Description Returns information about reserved DB instances for this account, or about a specified reserved DB instance.
DescribeReservedDBInstancesOfferings
Show Description Lists available reserved DB instance offerings.
DescribeSourceRegions
Show Description Returns a list of the source Amazon Web Services Regions where the current Amazon Web Services Region can create a read replica, copy a DB snapshot from, or replicate automated backups from. This API action supports pagination.
DescribeValidDBInstanceModifications
Show Description You can call DescribeValidDBInstanceModifications to learn what modifications you can make to your DB instance. You can use this information when you call ModifyDBInstance. This command doesn't apply to RDS Custom.
DownloadDBLogFilePortion
Show Description Downloads all or a portion of the specified log file, up to 1 MB in size. This command doesn't apply to RDS Custom.
FailoverDBCluster
Show Description Forces a failover for a DB cluster. A failover for a DB cluster promotes one of the Aurora Replicas (read-only instances) in the DB cluster to be the primary instance (the cluster writer). Amazon Aurora will automatically fail over to an Aurora Replica, if one exists, when the primary instance fails. You can force a failover when you want to simulate a failure of a primary instance for testing. Because each instance in a DB cluster has its own endpoint address, you will need to clean up and re-establish any existing connections that use those endpoint addresses when the failover is complete. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
FailoverGlobalCluster
Show Description Initiates the failover process for an Aurora global database (GlobalCluster). A failover for an Aurora global database promotes one of secondary read-only DB clusters to be the primary DB cluster and demotes the primary DB cluster to being a secondary (read-only) DB cluster. In other words, the role of the current primary DB cluster and the selected (target) DB cluster are switched. The selected secondary DB cluster assumes full read/write capabilities for the Aurora global database. For more information about failing over an Amazon Aurora global database, see Managed planned failover for Amazon Aurora global databases in the Amazon Aurora User Guide. This action applies to GlobalCluster (Aurora global databases) only. Use this action only on healthy Aurora global databases with running Aurora DB clusters and no Region-wide outages, to test disaster recovery scenarios or to reconfigure your Aurora global database topology.
ImportInstallationMedia
Show Description Imports the installation media for a DB engine that requires an on-premises customer provided license, such as SQL Server.
ListTagsForResource
Show Description Lists all tags on an Amazon RDS resource. For an overview on tagging an Amazon RDS resource, see Tagging Amazon RDS Resources in the Amazon RDS User Guide.
ModifyCertificates
Show Description Override the system-default Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for Amazon RDS for new DB instances temporarily, or remove the override. By using this operation, you can specify an RDS-approved SSL/TLS certificate for new DB instances that is different from the default certificate provided by RDS. You can also use this operation to remove the override, so that new DB instances use the default certificate provided by RDS. You might need to override the default certificate in the following situations:
  • You already migrated your applications to support the latest certificate authority (CA) certificate, but the new CA certificate is not yet the RDS default CA certificate for the specified Amazon Web Services Region.
  • RDS has already moved to a new default CA certificate for the specified Amazon Web Services Region, but you are still in the process of supporting the new CA certificate. In this case, you temporarily need additional time to finish your application changes.
For more information about rotating your SSL/TLS certificate for RDS DB engines, see Rotating Your SSL/TLS Certificate in the Amazon RDS User Guide. For more information about rotating your SSL/TLS certificate for Aurora DB engines, see Rotating Your SSL/TLS Certificate in the Amazon Aurora User Guide.
ModifyCurrentDBClusterCapacity
Show Description Set the capacity of an Aurora Serverless DB cluster to a specific value. Aurora Serverless scales seamlessly based on the workload on the DB cluster. In some cases, the capacity might not scale fast enough to meet a sudden change in workload, such as a large number of new transactions. Call ModifyCurrentDBClusterCapacity to set the capacity explicitly. After this call sets the DB cluster capacity, Aurora Serverless can automatically scale the DB cluster based on the cooldown period for scaling up and the cooldown period for scaling down. For more information about Aurora Serverless, see Using Amazon Aurora Serverless in the Amazon Aurora User Guide. If you call ModifyCurrentDBClusterCapacity with the default TimeoutAction, connections that prevent Aurora Serverless from finding a scaling point might be dropped. For more information about scaling points, see Autoscaling for Aurora Serverless in the Amazon Aurora User Guide. This action only applies to Aurora Serverless DB clusters.
ModifyCustomDBEngineVersion
Show Description Modifies the status of a custom engine version (CEV). You can find CEVs to modify by calling DescribeDBEngineVersions. The MediaImport service that imports files from Amazon S3 to create CEVs isn't integrated with Amazon Web Services CloudTrail. If you turn on data logging for Amazon RDS in CloudTrail, calls to the ModifyCustomDbEngineVersion event aren't logged. However, you might see calls from the API gateway that accesses your Amazon S3 bucket. These calls originate from the MediaImport service for the ModifyCustomDbEngineVersion event. For more information, see Modifying CEV status in the Amazon RDS User Guide.
ModifyDBCluster
Show Description Modify a setting for an Amazon Aurora DB cluster. You can change one or more database configuration parameters by specifying these parameters and the new values in the request. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
ModifyDBClusterEndpoint
Show Description Modifies the properties of an endpoint in an Amazon Aurora DB cluster. This action only applies to Aurora DB clusters.
ModifyDBClusterParameterGroup
Show Description Modifies the parameters of a DB cluster parameter group. To modify more than one parameter, submit a list of the following: ParameterName, ParameterValue, and ApplyMethod. A maximum of 20 parameters can be modified in a single request. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. After you create a DB cluster parameter group, you should wait at least 5 minutes before creating your first DB cluster that uses that DB cluster parameter group as the default parameter group. This allows Amazon RDS to fully complete the create action before the parameter group is used as the default for a new DB cluster. This is especially important for parameters that are critical when creating the default database for a DB cluster, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon RDS console or the DescribeDBClusterParameters action to verify that your DB cluster parameter group has been created or modified. If the modified DB cluster parameter group is used by an Aurora Serverless cluster, Aurora applies the update immediately. The cluster restart might interrupt your workload. In that case, your application must reopen any connections and retry any transactions that were active when the parameter changes took effect. This action only applies to Aurora DB clusters.
ModifyDBClusterSnapshotAttribute
Show Description Adds an attribute and values to, or removes an attribute and values from, a manual DB cluster snapshot. To share a manual DB cluster snapshot with other Amazon Web Services accounts, specify restore as the AttributeName and use the ValuesToAdd parameter to add a list of IDs of the Amazon Web Services accounts that are authorized to restore the manual DB cluster snapshot. Use the value all to make the manual DB cluster snapshot public, which means that it can be copied or restored by all Amazon Web Services accounts. Don't add the all value for any manual DB cluster snapshots that contain private information that you don't want available to all Amazon Web Services accounts. If a manual DB cluster snapshot is encrypted, it can be shared, but only by specifying a list of authorized Amazon Web Services account IDs for the ValuesToAdd parameter. You can't use all as a value for that parameter in this case. To view which Amazon Web Services accounts have access to copy or restore a manual DB cluster snapshot, or whether a manual DB cluster snapshot is public or private, use the DescribeDBClusterSnapshotAttributes API action. The accounts are returned as values for the restore attribute. This action only applies to Aurora DB clusters.
ModifyDBInstance
Show Description Modifies settings for a DB instance. You can change one or more database configuration parameters by specifying these parameters and the new values in the request. To learn what modifications you can make to your DB instance, call DescribeValidDBInstanceModifications before you call ModifyDBInstance.
ModifyDBParameterGroup
Show Description Modifies the parameters of a DB parameter group. To modify more than one parameter, submit a list of the following: ParameterName, ParameterValue, and ApplyMethod. A maximum of 20 parameters can be modified in a single request. After you modify a DB parameter group, you should wait at least 5 minutes before creating your first DB instance that uses that DB parameter group as the default parameter group. This allows Amazon RDS to fully complete the modify action before the parameter group is used as the default for a new DB instance. This is especially important for parameters that are critical when creating the default database for a DB instance, such as the character set for the default database defined by the character_set_database parameter. You can use the Parameter Groups option of the Amazon RDS console or the DescribeDBParameters command to verify that your DB parameter group has been created or modified.
ModifyDBProxy
Show Description Changes the settings for an existing DB proxy.
ModifyDBProxyEndpoint
Show Description Changes the settings for an existing DB proxy endpoint.
ModifyDBProxyTargetGroup
Show Description Modifies the properties of a DBProxyTargetGroup.
ModifyDBSnapshot
Show Description Updates a manual DB snapshot with a new engine version. The snapshot can be encrypted or unencrypted, but not shared or public. Amazon RDS supports upgrading DB snapshots for MySQL, PostgreSQL, and Oracle. This command doesn't apply to RDS Custom.
ModifyDBSnapshotAttribute
Show Description Adds an attribute and values to, or removes an attribute and values from, a manual DB snapshot. To share a manual DB snapshot with other Amazon Web Services accounts, specify restore as the AttributeName and use the ValuesToAdd parameter to add a list of IDs of the Amazon Web Services accounts that are authorized to restore the manual DB snapshot. Uses the value all to make the manual DB snapshot public, which means it can be copied or restored by all Amazon Web Services accounts. Don't add the all value for any manual DB snapshots that contain private information that you don't want available to all Amazon Web Services accounts. If the manual DB snapshot is encrypted, it can be shared, but only by specifying a list of authorized Amazon Web Services account IDs for the ValuesToAdd parameter. You can't use all as a value for that parameter in this case. To view which Amazon Web Services accounts have access to copy or restore a manual DB snapshot, or whether a manual DB snapshot public or private, use the DescribeDBSnapshotAttributes API action. The accounts are returned as values for the restore attribute.
ModifyDBSubnetGroup
Show Description Modifies an existing DB subnet group. DB subnet groups must contain at least one subnet in at least two AZs in the Amazon Web Services Region.
ModifyEventSubscription
Show Description Modifies an existing RDS event notification subscription. You can't modify the source identifiers using this call. To change source identifiers for a subscription, use the AddSourceIdentifierToSubscription and RemoveSourceIdentifierFromSubscription calls. You can see a list of the event categories for a given source type (SourceType) in Events in the Amazon RDS User Guide or by using the DescribeEventCategories operation.
ModifyGlobalCluster
Show Description Modify a setting for an Amazon Aurora global cluster. You can change one or more database configuration parameters by specifying these parameters and the new values in the request. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
ModifyOptionGroup
Show Description Modifies an existing option group.
PromoteReadReplica
Show Description Promotes a read replica DB instance to a standalone DB instance.
  • Backup duration is a function of the amount of changes to the database since the previous backup. If you plan to promote a read replica to a standalone instance, we recommend that you enable backups and complete at least one backup prior to promotion. In addition, a read replica cannot be promoted to a standalone instance when it is in the backing-up status. If you have enabled backups on your read replica, configure the automated backup window so that daily backups do not interfere with read replica promotion.
  • This command doesn't apply to Aurora MySQL, Aurora PostgreSQL, or RDS Custom.
PromoteReadReplicaDBCluster
Show Description Promotes a read replica DB cluster to a standalone DB cluster. This action only applies to Aurora DB clusters.
PurchaseReservedDBInstancesOffering
Show Description Purchases a reserved DB instance offering.
RebootDBInstance
Show Description You might need to reboot your DB instance, usually for maintenance reasons. For example, if you make certain modifications, or if you change the DB parameter group associated with the DB instance, you must reboot the instance for the changes to take effect. Rebooting a DB instance restarts the database engine service. Rebooting a DB instance results in a momentary outage, during which the DB instance status is set to rebooting. For more information about rebooting, see Rebooting a DB Instance in the Amazon RDS User Guide. This command doesn't apply to RDS Custom.
RegisterDBProxyTargets
Show Description Associate one or more DBProxyTarget data structures with a DBProxyTargetGroup.
RemoveFromGlobalCluster
Show Description Detaches an Aurora secondary cluster from an Aurora global database cluster. The cluster becomes a standalone cluster with read-write capability instead of being read-only and receiving data from a primary cluster in a different region. This action only applies to Aurora DB clusters.
RemoveRoleFromDBCluster
RemoveRoleFromDBInstance
RemoveSourceIdentifierFromSubscription
Show Description Removes a source identifier from an existing RDS event notification subscription.
RemoveTagsFromResource
ResetDBClusterParameterGroup
Show Description Modifies the parameters of a DB cluster parameter group to the default value. To reset specific parameters submit a list of the following: ParameterName and ApplyMethod. To reset the entire DB cluster parameter group, specify the DBClusterParameterGroupName and ResetAllParameters parameters. When resetting the entire group, dynamic parameters are updated immediately and static parameters are set to pending-reboot to take effect on the next DB instance restart or RebootDBInstance request. You must call RebootDBInstance for every DB instance in your DB cluster that you want the updated static parameter to apply to. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
ResetDBParameterGroup
Show Description Modifies the parameters of a DB parameter group to the engine/system default value. To reset specific parameters, provide a list of the following: ParameterName and ApplyMethod. To reset the entire DB parameter group, specify the DBParameterGroup name and ResetAllParameters parameters. When resetting the entire group, dynamic parameters are updated immediately and static parameters are set to pending-reboot to take effect on the next DB instance restart or RebootDBInstance request.
RestoreDBClusterFromS3
Show Description Creates an Amazon Aurora DB cluster from MySQL data stored in an Amazon S3 bucket. Amazon RDS must be authorized to access the Amazon S3 bucket and the data must be created using the Percona XtraBackup utility as described in Migrating Data from MySQL by Using an Amazon S3 Bucket in the Amazon Aurora User Guide. This action only restores the DB cluster, not the DB instances for that DB cluster. You must invoke the CreateDBInstance action to create DB instances for the restored DB cluster, specifying the identifier of the restored DB cluster in DBClusterIdentifier. You can create DB instances only after the RestoreDBClusterFromS3 action has completed and the DB cluster is available. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters. The source DB engine must be MySQL.
RestoreDBClusterFromSnapshot
Show Description Creates a new DB cluster from a DB snapshot or DB cluster snapshot. This action only applies to Aurora DB clusters. The target DB cluster is created from the source snapshot with a default configuration. If you don't specify a security group, the new DB cluster is associated with the default security group. This action only restores the DB cluster, not the DB instances for that DB cluster. You must invoke the CreateDBInstance action to create DB instances for the restored DB cluster, specifying the identifier of the restored DB cluster in DBClusterIdentifier. You can create DB instances only after the RestoreDBClusterFromSnapshot action has completed and the DB cluster is available. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
RestoreDBClusterToPointInTime
Show Description Restores a DB cluster to an arbitrary point in time. Users can restore to any point in time before LatestRestorableTime for up to BackupRetentionPeriod days. The target DB cluster is created from the source DB cluster with the same configuration as the original DB cluster, except that the new DB cluster is created with the default DB security group. This action only restores the DB cluster, not the DB instances for that DB cluster. You must invoke the CreateDBInstance action to create DB instances for the restored DB cluster, specifying the identifier of the restored DB cluster in DBClusterIdentifier. You can create DB instances only after the RestoreDBClusterToPointInTime action has completed and the DB cluster is available. For more information on Amazon Aurora, see What Is Amazon Aurora? in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
RestoreDBInstanceFromDBSnapshot
Show Description Creates a new DB instance from a DB snapshot. The target database is created from the source database restore point with most of the source's original configuration, including the default security group and DB parameter group. By default, the new DB instance is created as a Single-AZ deployment, except when the instance is a SQL Server instance that has an option group associated with mirroring. In this case, the instance becomes a Multi-AZ deployment, not a Single-AZ deployment. If you want to replace your original DB instance with the new, restored DB instance, then rename your original DB instance before you call the RestoreDBInstanceFromDBSnapshot action. RDS doesn't allow two DB instances with the same name. After you have renamed your original DB instance with a different identifier, then you can pass the original name of the DB instance as the DBInstanceIdentifier in the call to the RestoreDBInstanceFromDBSnapshot action. The result is that you replace the original DB instance with the DB instance created from the snapshot. If you are restoring from a shared manual DB snapshot, the DBSnapshotIdentifier must be the ARN of the shared DB snapshot. This command doesn't apply to Aurora MySQL and Aurora PostgreSQL. For Aurora, use RestoreDBClusterFromSnapshot.
RestoreDBInstanceFromS3
Show Description Amazon Relational Database Service (Amazon RDS) supports importing MySQL databases by using backup files. You can create a backup of your on-premises database, store it on Amazon Simple Storage Service (Amazon S3), and then restore the backup file onto a new Amazon RDS DB instance running MySQL. For more information, see Importing Data into an Amazon RDS MySQL DB Instance in the Amazon RDS User Guide. This command doesn't apply to RDS Custom.
RestoreDBInstanceToPointInTime
Show Description Restores a DB instance to an arbitrary point in time. You can restore to any point in time before the time identified by the LatestRestorableTime property. You can restore to a point up to the number of days specified by the BackupRetentionPeriod property. The target database is created with most of the original configuration, but in a system-selected Availability Zone, with the default security group, the default subnet group, and the default DB parameter group. By default, the new DB instance is created as a single-AZ deployment except when the instance is a SQL Server instance that has an option group that is associated with mirroring; in this case, the instance becomes a mirrored deployment and not a single-AZ deployment. This command doesn't apply to Aurora MySQL and Aurora PostgreSQL. For Aurora, use RestoreDBClusterToPointInTime.
RevokeDBSecurityGroupIngress
Show Description Revokes ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC security groups. Required parameters for this API are one of CIDRIP, EC2SecurityGroupId for VPC, or (EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId).
StartActivityStream
Show Description Starts a database activity stream to monitor activity on the database. For more information, see Database Activity Streams in the Amazon Aurora User Guide.
StartDBCluster
Show Description Starts an Amazon Aurora DB cluster that was stopped using the Amazon Web Services console, the stop-db-cluster CLI command, or the StopDBCluster action. For more information, see Stopping and Starting an Aurora Cluster in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
StartDBInstance
Show Description Starts an Amazon RDS DB instance that was stopped using the Amazon Web Services console, the stop-db-instance CLI command, or the StopDBInstance action. For more information, see Starting an Amazon RDS DB instance That Was Previously Stopped in the Amazon RDS User Guide. This command doesn't apply to RDS Custom, Aurora MySQL, and Aurora PostgreSQL. For Aurora DB clusters, use StartDBCluster instead.
StartDBInstanceAutomatedBackupsReplication
Show Description Enables replication of automated backups to a different Amazon Web Services Region. This command doesn't apply to RDS Custom. For more information, see Replicating Automated Backups to Another Amazon Web Services Region in the Amazon RDS User Guide.
StartExportTask
Show Description Starts an export of a snapshot to Amazon S3. The provided IAM role must have access to the S3 bucket. This command doesn't apply to RDS Custom.
StopActivityStream
Show Description Stops a database activity stream that was started using the Amazon Web Services console, the start-activity-stream CLI command, or the StartActivityStream action. For more information, see Database Activity Streams in the Amazon Aurora User Guide.
StopDBCluster
Show Description Stops an Amazon Aurora DB cluster. When you stop a DB cluster, Aurora retains the DB cluster's metadata, including its endpoints and DB parameter groups. Aurora also retains the transaction logs so you can do a point-in-time restore if necessary. For more information, see Stopping and Starting an Aurora Cluster in the Amazon Aurora User Guide. This action only applies to Aurora DB clusters.
StopDBInstance
Show Description Stops an Amazon RDS DB instance. When you stop a DB instance, Amazon RDS retains the DB instance's metadata, including its endpoint, DB parameter group, and option group membership. Amazon RDS also retains the transaction logs so you can do a point-in-time restore if necessary. For more information, see Stopping an Amazon RDS DB Instance Temporarily in the Amazon RDS User Guide. This command doesn't apply to RDS Custom, Aurora MySQL, and Aurora PostgreSQL. For Aurora clusters, use StopDBCluster instead.

Redshift-data Events

Service Event Name Description
redshift-data BatchExecuteStatement
Show Description Runs one or more SQL statements, which can be data manipulation language (DML) or data definition language (DDL). Depending on the authorization method, use one of the following combinations of request parameters:
  • Secrets Manager - specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret.
  • Temporary credentials - specify the cluster identifier, the database name, and the database user name. Permission to call the redshift:GetClusterCredentials operation is required to use this method.
CancelStatement
Show Description Cancels a running query. To be canceled, a query must be running.
DescribeStatement
Show Description Describes the details about a specific instance when a query was run by the Amazon Redshift Data API. The information includes when the query started, when it finished, the query status, the number of rows returned, and the SQL statement.
DescribeTable
Show Description Describes the detailed information about a table from metadata in the cluster. The information includes its columns. A token is returned to page through the column list. Depending on the authorization method, use one of the following combinations of request parameters:
  • Secrets Manager - specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret.
  • Temporary credentials - specify the cluster identifier, the database name, and the database user name. Permission to call the redshift:GetClusterCredentials operation is required to use this method.
ExecuteStatement
Show Description Runs an SQL statement, which can be data manipulation language (DML) or data definition language (DDL). This statement must be a single SQL statement. Depending on the authorization method, use one of the following combinations of request parameters:
  • Secrets Manager - specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret.
  • Temporary credentials - specify the cluster identifier, the database name, and the database user name. Permission to call the redshift:GetClusterCredentials operation is required to use this method.
GetStatementResult
Show Description Fetches the temporarily cached result of an SQL statement. A token is returned to page through the statement results.
ListDatabases
Show Description List the databases in a cluster. A token is returned to page through the database list. Depending on the authorization method, use one of the following combinations of request parameters:
  • Secrets Manager - specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret.
  • Temporary credentials - specify the cluster identifier, the database name, and the database user name. Permission to call the redshift:GetClusterCredentials operation is required to use this method.
ListSchemas
Show Description Lists the schemas in a database. A token is returned to page through the schema list. Depending on the authorization method, use one of the following combinations of request parameters:
  • Secrets Manager - specify the Amazon Resource Name (ARN) of the secret, the database name, and the cluster identifier that matches the cluster in the secret.
  • Temporary credentials - specify the cluster identifier, the database name, and the database user name. Permission to call the redshift:GetClusterCredentials operation is required to use this method.
ListStatements
Show Description List of SQL statements. By default, only finished statements are shown. A token is returned to page through the statement list.

Redshift Events

Service Event Name Description
redshift AcceptReservedNodeExchange
Show Description Exchanges a DC1 Reserved Node for a DC2 Reserved Node with no changes to the configuration (term, payment type, or number of nodes) and no additional costs.
AddPartner
Show Description Adds a partner integration to a cluster. This operation authorizes a partner to push status updates for the specified database. To complete the integration, you also set up the integration on the partner website.
AssociateDataShareConsumer
Show Description From a datashare consumer account, associates a datashare with the account (AssociateEntireAccount) or the specified namespace (ConsumerArn). If you make this association, the consumer can consume the datashare.
AuthorizeClusterSecurityGroupIngress
Show Description Adds an inbound (ingress) rule to an Amazon Redshift security group. Depending on whether the application accessing your cluster is running on the Internet or an Amazon EC2 instance, you can authorize inbound access to either a Classless Interdomain Routing (CIDR)/Internet Protocol (IP) range or to an Amazon EC2 security group. You can add as many as 20 ingress rules to an Amazon Redshift security group. If you authorize access to an Amazon EC2 security group, specify EC2SecurityGroupName and EC2SecurityGroupOwnerId. The Amazon EC2 security group and Amazon Redshift cluster must be in the same Amazon Web Services Region. If you authorize access to a CIDR/IP address range, specify CIDRIP. For an overview of CIDR blocks, see the Wikipedia article on Classless Inter-Domain Routing. You must also associate the security group with a cluster so that clients running on these IP addresses or the EC2 instance are authorized to connect to the cluster. For information about managing security groups, go to Working with Security Groups in the Amazon Redshift Cluster Management Guide.
AuthorizeDataShare
Show Description From a data producer account, authorizes the sharing of a datashare with one or more consumer accounts. To authorize a datashare for a data consumer, the producer account must have the correct access privileges.
AuthorizeEndpointAccess
Show Description Grants access to a cluster.
AuthorizeSnapshotAccess
Show Description Authorizes the specified Amazon Web Services account to restore the specified snapshot. For more information about working with snapshots, go to Amazon Redshift Snapshots in the Amazon Redshift Cluster Management Guide.
BatchDeleteClusterSnapshots
Show Description Deletes a set of cluster snapshots.
BatchModifyClusterSnapshots
Show Description Modifies the settings for a set of cluster snapshots.
CancelResize
Show Description Cancels a resize operation for a cluster.
CopyClusterSnapshot
Show Description Copies the specified automated cluster snapshot to a new manual cluster snapshot. The source must be an automated snapshot and it must be in the available state. When you delete a cluster, Amazon Redshift deletes any automated snapshots of the cluster. Also, when the retention period of the snapshot expires, Amazon Redshift automatically deletes it. If you want to keep an automated snapshot for a longer period, you can make a manual copy of the snapshot. Manual snapshots are retained until you delete them. For more information about working with snapshots, go to Amazon Redshift Snapshots in the Amazon Redshift Cluster Management Guide.
CreateAuthenticationProfile
Show Description Creates an authentication profile with the specified parameters.
CreateCluster
Show Description Creates a new cluster with the specified parameters. To create a cluster in Virtual Private Cloud (VPC), you must provide a cluster subnet group name. The cluster subnet group identifies the subnets of your VPC that Amazon Redshift uses when creating the cluster. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide.
CreateClusterParameterGroup
Show Description Creates an Amazon Redshift parameter group. Creating parameter groups is independent of creating clusters. You can associate a cluster with a parameter group when you create the cluster. You can also associate an existing cluster with a parameter group after the cluster is created by using ModifyCluster. Parameters in the parameter group define specific behavior that applies to the databases you create on the cluster. For more information about parameters and parameter groups, go to Amazon Redshift Parameter Groups in the Amazon Redshift Cluster Management Guide.
CreateClusterSecurityGroup
Show Description Creates a new Amazon Redshift security group. You use security groups to control access to non-VPC clusters. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.
CreateClusterSnapshot
Show Description Creates a manual snapshot of the specified cluster. The cluster must be in the available state. For more information about working with snapshots, go to Amazon Redshift Snapshots in the Amazon Redshift Cluster Management Guide.
CreateClusterSubnetGroup
Show Description Creates a new Amazon Redshift subnet group. You must provide a list of one or more subnets in your existing Amazon Virtual Private Cloud (Amazon VPC) when creating Amazon Redshift subnet group. For information about subnet groups, go to Amazon Redshift Cluster Subnet Groups in the Amazon Redshift Cluster Management Guide.
CreateEndpointAccess
Show Description Creates a Redshift-managed VPC endpoint.
CreateEventSubscription
Show Description Creates an Amazon Redshift event notification subscription. This action requires an ARN (Amazon Resource Name) of an Amazon SNS topic created by either the Amazon Redshift console, the Amazon SNS console, or the Amazon SNS API. To obtain an ARN with Amazon SNS, you must create a topic in Amazon SNS and subscribe to the topic. The ARN is displayed in the SNS console. You can specify the source type, and lists of Amazon Redshift source IDs, event categories, and event severities. Notifications will be sent for all events you want that match those criteria. For example, you can specify source type = cluster, source ID = my-cluster-1 and mycluster2, event categories = Availability, Backup, and severity = ERROR. The subscription will only send notifications for those ERROR events in the Availability and Backup categories for the specified clusters. If you specify both the source type and source IDs, such as source type = cluster and source identifier = my-cluster-1, notifications will be sent for all the cluster events for my-cluster-1. If you specify a source type but do not specify a source identifier, you will receive notice of the events for the objects of that type in your Amazon Web Services account. If you do not specify either the SourceType nor the SourceIdentifier, you will be notified of events generated from all Amazon Redshift sources belonging to your Amazon Web Services account. You must specify a source type if you specify a source ID.
CreateHsmClientCertificate
Show Description Creates an HSM client certificate that an Amazon Redshift cluster will use to connect to the client's HSM in order to store and retrieve the keys used to encrypt the cluster databases. The command returns a public key, which you must store in the HSM. In addition to creating the HSM certificate, you must create an Amazon Redshift HSM configuration that provides a cluster the information needed to store and use encryption keys in the HSM. For more information, go to Hardware Security Modules in the Amazon Redshift Cluster Management Guide.
CreateHsmConfiguration
Show Description Creates an HSM configuration that contains the information required by an Amazon Redshift cluster to store and use database encryption keys in a Hardware Security Module (HSM). After creating the HSM configuration, you can specify it as a parameter when creating a cluster. The cluster will then store its encryption keys in the HSM. In addition to creating an HSM configuration, you must also create an HSM client certificate. For more information, go to Hardware Security Modules in the Amazon Redshift Cluster Management Guide.
CreateScheduledAction
Show Description Creates a scheduled action. A scheduled action contains a schedule and an Amazon Redshift API action. For example, you can create a schedule of when to run the ResizeCluster API operation.
CreateSnapshotCopyGrant
Show Description Creates a snapshot copy grant that permits Amazon Redshift to use a customer master key (CMK) from Key Management Service (KMS) to encrypt copied snapshots in a destination region. For more information about managing snapshot copy grants, go to Amazon Redshift Database Encryption in the Amazon Redshift Cluster Management Guide.
CreateSnapshotSchedule
Show Description Create a snapshot schedule that can be associated to a cluster and which overrides the default system backup schedule.
CreateTags
CreateUsageLimit
Show Description Creates a usage limit for a specified Amazon Redshift feature on a cluster. The usage limit is identified by the returned usage limit identifier.
DeauthorizeDataShare
Show Description From the producer account, removes authorization from the specified datashare.
DeleteAuthenticationProfile
Show Description Deletes an authentication profile.
DeleteCluster
Show Description Deletes a previously provisioned cluster without its final snapshot being created. A successful response from the web service indicates that the request was received correctly. Use DescribeClusters to monitor the status of the deletion. The delete operation cannot be canceled or reverted once submitted. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide. If you want to shut down the cluster and retain it for future use, set SkipFinalClusterSnapshot to false and specify a name for FinalClusterSnapshotIdentifier. You can later restore this snapshot to resume using the cluster. If a final cluster snapshot is requested, the status of the cluster will be "final-snapshot" while the snapshot is being taken, then it's "deleting" once Amazon Redshift begins deleting the cluster. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide.
DeleteClusterParameterGroup
DeleteClusterSecurityGroup
DeleteClusterSnapshot
Show Description Deletes the specified manual snapshot. The snapshot must be in the available state, with no other users authorized to access the snapshot. Unlike automated snapshots, manual snapshots are retained even after you delete your cluster. Amazon Redshift does not delete your manual snapshots. You must delete manual snapshot explicitly to avoid getting charged. If other accounts are authorized to access the snapshot, you must revoke all of the authorizations before you can delete the snapshot.
DeleteClusterSubnetGroup
DeleteEndpointAccess
Show Description Deletes a Redshift-managed VPC endpoint.
DeleteEventSubscription
DeleteHsmClientCertificate
DeleteHsmConfiguration
DeletePartner
Show Description Deletes a partner integration from a cluster. Data can still flow to the cluster until the integration is deleted at the partner's website.
DeleteScheduledAction
DeleteSnapshotCopyGrant
DeleteSnapshotSchedule
DeleteTags
DeleteUsageLimit
DescribeAccountAttributes
Show Description Returns a list of attributes attached to an account
DescribeAuthenticationProfiles
Show Description Describes an authentication profile.
DescribeClusterDbRevisions
Show Description Returns an array of ClusterDbRevision objects.
DescribeClusterParameterGroups
Show Description Returns a list of Amazon Redshift parameter groups, including parameter groups you created and the default parameter group. For each parameter group, the response includes the parameter group name, description, and parameter group family name. You can optionally specify a name to retrieve the description of a specific parameter group. For more information about parameters and parameter groups, go to Amazon Redshift Parameter Groups in the Amazon Redshift Cluster Management Guide. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all parameter groups that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all parameter groups that have any combination of those values are returned. If both tag keys and values are omitted from the request, parameter groups are returned regardless of whether they have tag keys or values associated with them.
DescribeClusterParameters
Show Description Returns a detailed list of parameters contained within the specified Amazon Redshift parameter group. For each parameter the response includes information such as parameter name, description, data type, value, whether the parameter value is modifiable, and so on. You can specify source filter to retrieve parameters of only specific type. For example, to retrieve parameters that were modified by a user action such as from ModifyClusterParameterGroup, you can specify source equal to user. For more information about parameters and parameter groups, go to Amazon Redshift Parameter Groups in the Amazon Redshift Cluster Management Guide.
DescribeClusterSecurityGroups
Show Description Returns information about Amazon Redshift security groups. If the name of a security group is specified, the response will contain only information about only that security group. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all security groups that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all security groups that have any combination of those values are returned. If both tag keys and values are omitted from the request, security groups are returned regardless of whether they have tag keys or values associated with them.
DescribeClusterSnapshots
Show Description Returns one or more snapshot objects, which contain metadata about your cluster snapshots. By default, this operation returns information about all snapshots of all clusters that are owned by your Amazon Web Services account. No information is returned for snapshots owned by inactive Amazon Web Services accounts. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all snapshots that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all snapshots that have any combination of those values are returned. Only snapshots that you own are returned in the response; shared snapshots are not returned with the tag key and tag value request parameters. If both tag keys and values are omitted from the request, snapshots are returned regardless of whether they have tag keys or values associated with them.
DescribeClusterSubnetGroups
Show Description Returns one or more cluster subnet group objects, which contain metadata about your cluster subnet groups. By default, this operation returns information about all cluster subnet groups that are defined in your Amazon Web Services account. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all subnet groups that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all subnet groups that have any combination of those values are returned. If both tag keys and values are omitted from the request, subnet groups are returned regardless of whether they have tag keys or values associated with them.
DescribeClusterTracks
Show Description Returns a list of all the available maintenance tracks.
DescribeClusterVersions
Show Description Returns descriptions of the available Amazon Redshift cluster versions. You can call this operation even before creating any clusters to learn more about the Amazon Redshift versions. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide.
DescribeClusters
Show Description Returns properties of provisioned clusters including general cluster properties, cluster database properties, maintenance and backup properties, and security and access properties. This operation supports pagination. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all clusters that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all clusters that have any combination of those values are returned. If both tag keys and values are omitted from the request, clusters are returned regardless of whether they have tag keys or values associated with them.
DescribeDataShares
Show Description Shows the status of any inbound or outbound datashares available in the specified account.
DescribeDataSharesForConsumer
Show Description Returns a list of datashares where the account identifier being called is a consumer account identifier.
DescribeDataSharesForProducer
Show Description Returns a list of datashares when the account identifier being called is a producer account identifier.
DescribeDefaultClusterParameters
Show Description Returns a list of parameter settings for the specified parameter group family. For more information about parameters and parameter groups, go to Amazon Redshift Parameter Groups in the Amazon Redshift Cluster Management Guide.
DescribeEndpointAccess
Show Description Describes a Redshift-managed VPC endpoint.
DescribeEndpointAuthorization
Show Description Describes an endpoint authorization.
DescribeEventCategories
Show Description Displays a list of event categories for all event source types, or for a specified source type. For a list of the event categories and source types, go to Amazon Redshift Event Notifications.
DescribeEventSubscriptions
Show Description Lists descriptions of all the Amazon Redshift event notification subscriptions for a customer account. If you specify a subscription name, lists the description for that subscription. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all event notification subscriptions that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all subscriptions that have any combination of those values are returned. If both tag keys and values are omitted from the request, subscriptions are returned regardless of whether they have tag keys or values associated with them.
DescribeEvents
Show Description Returns events related to clusters, security groups, snapshots, and parameter groups for the past 14 days. Events specific to a particular cluster, security group, snapshot or parameter group can be obtained by providing the name as a parameter. By default, the past hour of events are returned.
DescribeHsmClientCertificates
Show Description Returns information about the specified HSM client certificate. If no certificate ID is specified, returns information about all the HSM certificates owned by your Amazon Web Services account. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all HSM client certificates that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all HSM client certificates that have any combination of those values are returned. If both tag keys and values are omitted from the request, HSM client certificates are returned regardless of whether they have tag keys or values associated with them.
DescribeHsmConfigurations
Show Description Returns information about the specified Amazon Redshift HSM configuration. If no configuration ID is specified, returns information about all the HSM configurations owned by your Amazon Web Services account. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all HSM connections that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all HSM connections that have any combination of those values are returned. If both tag keys and values are omitted from the request, HSM connections are returned regardless of whether they have tag keys or values associated with them.
DescribeLoggingStatus
Show Description Describes whether information, such as queries and connection attempts, is being logged for the specified Amazon Redshift cluster.
DescribeNodeConfigurationOptions
Show Description Returns properties of possible node configurations such as node type, number of nodes, and disk usage for the specified action type.
DescribeOrderableClusterOptions
Show Description Returns a list of orderable cluster options. Before you create a new cluster you can use this operation to find what options are available, such as the EC2 Availability Zones (AZ) in the specific Amazon Web Services Region that you can specify, and the node types you can request. The node types differ by available storage, memory, CPU and price. With the cost involved you might want to obtain a list of cluster options in the specific region and specify values when creating a cluster. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide.
DescribePartners
Show Description Returns information about the partner integrations defined for a cluster.
DescribeReservedNodeOfferings
Show Description Returns a list of the available reserved node offerings by Amazon Redshift with their descriptions including the node type, the fixed and recurring costs of reserving the node and duration the node will be reserved for you. These descriptions help you determine which reserve node offering you want to purchase. You then use the unique offering ID in you call to PurchaseReservedNodeOffering to reserve one or more nodes for your Amazon Redshift cluster. For more information about reserved node offerings, go to Purchasing Reserved Nodes in the Amazon Redshift Cluster Management Guide.
DescribeReservedNodes
Show Description Returns the descriptions of the reserved nodes.
DescribeResize
Show Description Returns information about the last resize operation for the specified cluster. If no resize operation has ever been initiated for the specified cluster, a HTTP 404 error is returned. If a resize operation was initiated and completed, the status of the resize remains as SUCCEEDED until the next resize. A resize operation can be requested using ModifyCluster and specifying a different number or type of nodes for the cluster.
DescribeScheduledActions
Show Description Describes properties of scheduled actions.
DescribeSnapshotCopyGrants
Show Description Returns a list of snapshot copy grants owned by the Amazon Web Services account in the destination region. For more information about managing snapshot copy grants, go to Amazon Redshift Database Encryption in the Amazon Redshift Cluster Management Guide.
DescribeSnapshotSchedules
Show Description Returns a list of snapshot schedules.
DescribeStorage
Show Description Returns account level backups storage size and provisional storage.
DescribeTableRestoreStatus
Show Description Lists the status of one or more table restore requests made using the RestoreTableFromClusterSnapshot API action. If you don't specify a value for the TableRestoreRequestId parameter, then DescribeTableRestoreStatus returns the status of all table restore requests ordered by the date and time of the request in ascending order. Otherwise DescribeTableRestoreStatus returns the status of the table specified by TableRestoreRequestId.
DescribeTags
Show Description Returns a list of tags. You can return tags from a specific resource by specifying an ARN, or you can return all tags for a given type of resource, such as clusters, snapshots, and so on. The following are limitations for DescribeTags:
  • You cannot specify an ARN and a resource-type value together in the same request.
  • You cannot use the MaxRecords and Marker parameters together with the ARN parameter.
  • The MaxRecords parameter can be a range from 10 to 50 results to return in a request.
If you specify both tag keys and tag values in the same request, Amazon Redshift returns all resources that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all resources that have any combination of those values are returned. If both tag keys and values are omitted from the request, resources are returned regardless of whether they have tag keys or values associated with them.
DescribeUsageLimits
Show Description Shows usage limits on a cluster. Results are filtered based on the combination of input usage limit identifier, cluster identifier, and feature type parameters:
  • If usage limit identifier, cluster identifier, and feature type are not provided, then all usage limit objects for the current account in the current region are returned.
  • If usage limit identifier is provided, then the corresponding usage limit object is returned.
  • If cluster identifier is provided, then all usage limit objects for the specified cluster are returned.
  • If cluster identifier and feature type are provided, then all usage limit objects for the combination of cluster and feature are returned.
DisableLogging
Show Description Stops logging information, such as queries and connection attempts, for the specified Amazon Redshift cluster.
DisableSnapshotCopy
Show Description Disables the automatic copying of snapshots from one region to another region for a specified cluster. If your cluster and its snapshots are encrypted using a customer master key (CMK) from Key Management Service, use DeleteSnapshotCopyGrant to delete the grant that grants Amazon Redshift permission to the CMK in the destination region.
DisassociateDataShareConsumer
Show Description From a consumer account, remove association for the specified datashare.
EnableLogging
Show Description Starts logging information, such as queries and connection attempts, for the specified Amazon Redshift cluster.
EnableSnapshotCopy
Show Description Enables the automatic copy of snapshots from one region to another region for a specified cluster.
GetClusterCredentials
Show Description Returns a database user name and temporary password with temporary authorization to log on to an Amazon Redshift database. The action returns the database user name prefixed with IAM: if AutoCreate is False or IAMA: if AutoCreate is True. You can optionally specify one or more database user groups that the user will join at log on. By default, the temporary credentials expire in 900 seconds. You can optionally specify a duration between 900 seconds (15 minutes) and 3600 seconds (60 minutes). For more information, see Using IAM Authentication to Generate Database User Credentials in the Amazon Redshift Cluster Management Guide. The Identity and Access Management (IAM) user or role that runs GetClusterCredentials must have an IAM policy attached that allows access to all necessary actions and resources. For more information about permissions, see Resource Policies for GetClusterCredentials in the Amazon Redshift Cluster Management Guide. If the DbGroups parameter is specified, the IAM policy must allow the redshift:JoinGroup action with access to the listed dbgroups. In addition, if the AutoCreate parameter is set to True, then the policy must include the redshift:CreateClusterUser privilege. If the DbName parameter is specified, the IAM policy must allow access to the resource dbname for the specified database name.
GetReservedNodeExchangeOfferings
Show Description Returns an array of DC2 ReservedNodeOfferings that matches the payment type, term, and usage price of the given DC1 reserved node.
ModifyAquaConfiguration
Show Description Modifies whether a cluster can use AQUA (Advanced Query Accelerator).
ModifyAuthenticationProfile
Show Description Modifies an authentication profile.
ModifyCluster
Show Description Modifies the settings for a cluster. You can also change node type and the number of nodes to scale up or down the cluster. When resizing a cluster, you must specify both the number of nodes and the node type even if one of the parameters does not change. You can add another security or parameter group, or change the admin user password. Resetting a cluster password or modifying the security groups associated with a cluster do not need a reboot. However, modifying a parameter group requires a reboot for parameters to take effect. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide.
ModifyClusterDbRevision
Show Description Modifies the database revision of a cluster. The database revision is a unique revision of the database running in a cluster.
ModifyClusterIamRoles
Show Description Modifies the list of Identity and Access Management (IAM) roles that can be used by the cluster to access other Amazon Web Services services. A cluster can have up to 10 IAM roles associated at any time.
ModifyClusterMaintenance
Show Description Modifies the maintenance settings of a cluster.
ModifyClusterParameterGroup
Show Description Modifies the parameters of a parameter group. For the parameters parameter, it can't contain ASCII characters. For more information about parameters and parameter groups, go to Amazon Redshift Parameter Groups in the Amazon Redshift Cluster Management Guide.
ModifyClusterSnapshot
Show Description Modifies the settings for a snapshot. This exanmple modifies the manual retention period setting for a cluster snapshot.
ModifyClusterSnapshotSchedule
ModifyClusterSubnetGroup
Show Description Modifies a cluster subnet group to include the specified list of VPC subnets. The operation replaces the existing list of subnets with the new list of subnets.
ModifyEndpointAccess
Show Description Modifies a Redshift-managed VPC endpoint.
ModifyEventSubscription
Show Description Modifies an existing Amazon Redshift event notification subscription.
ModifyScheduledAction
Show Description Modifies a scheduled action.
ModifySnapshotCopyRetentionPeriod
Show Description Modifies the number of days to retain snapshots in the destination Amazon Web Services Region after they are copied from the source Amazon Web Services Region. By default, this operation only changes the retention period of copied automated snapshots. The retention periods for both new and existing copied automated snapshots are updated with the new retention period. You can set the manual option to change only the retention periods of copied manual snapshots. If you set this option, only newly copied manual snapshots have the new retention period.
ModifySnapshotSchedule
Show Description Modifies a snapshot schedule. Any schedule associated with a cluster is modified asynchronously.
ModifyUsageLimit
Show Description Modifies a usage limit in a cluster. You can't modify the feature type or period of a usage limit.
PauseCluster
Show Description Pauses a cluster.
PurchaseReservedNodeOffering
Show Description Allows you to purchase reserved nodes. Amazon Redshift offers a predefined set of reserved node offerings. You can purchase one or more of the offerings. You can call the DescribeReservedNodeOfferings API to obtain the available reserved node offerings. You can call this API by providing a specific reserved node offering and the number of nodes you want to reserve. For more information about reserved node offerings, go to Purchasing Reserved Nodes in the Amazon Redshift Cluster Management Guide.
RebootCluster
Show Description Reboots a cluster. This action is taken as soon as possible. It results in a momentary outage to the cluster, during which the cluster status is set to rebooting. A cluster event is created when the reboot is completed. Any pending cluster modifications (see ModifyCluster) are applied at this reboot. For more information about managing clusters, go to Amazon Redshift Clusters in the Amazon Redshift Cluster Management Guide.
RejectDataShare
Show Description From the consumer account, rejects the specified datashare.
ResetClusterParameterGroup
Show Description Sets one or more parameters of the specified parameter group to their default values and sets the source values of the parameters to "engine-default". To reset the entire parameter group specify the ResetAllParameters parameter. For parameter changes to take effect you must reboot any associated clusters.
ResizeCluster
Show Description Changes the size of the cluster. You can change the cluster's type, or change the number or type of nodes. The default behavior is to use the elastic resize method. With an elastic resize, your cluster is available for read and write operations more quickly than with the classic resize method. Elastic resize operations have the following restrictions:
  • You can only resize clusters of the following types:
    • dc1.large (if your cluster is in a VPC)
    • dc1.8xlarge (if your cluster is in a VPC)
    • dc2.large
    • dc2.8xlarge
    • ds2.xlarge
    • ds2.8xlarge
    • ra3.xlplus
    • ra3.4xlarge
    • ra3.16xlarge
  • The type of nodes that you add must match the node type for the cluster.
RestoreFromClusterSnapshot
Show Description Creates a new cluster from a snapshot. By default, Amazon Redshift creates the resulting cluster with the same configuration as the original cluster from which the snapshot was created, except that the new cluster is created with the default cluster security and parameter groups. After Amazon Redshift creates the cluster, you can use the ModifyCluster API to associate a different security group and different parameter group with the restored cluster. If you are using a DS node type, you can also choose to change to another DS node type of the same size during restore. If you restore a cluster into a VPC, you must provide a cluster subnet group where you want the cluster restored. For more information about working with snapshots, go to Amazon Redshift Snapshots in the Amazon Redshift Cluster Management Guide.
RestoreTableFromClusterSnapshot
Show Description Creates a new table from a table in an Amazon Redshift cluster snapshot. You must create the new table within the Amazon Redshift cluster that the snapshot was taken from. You cannot use RestoreTableFromClusterSnapshot to restore a table with the same name as an existing table in an Amazon Redshift cluster. That is, you cannot overwrite an existing table in a cluster with a restored table. If you want to replace your original table with a new, restored table, then rename or drop your original table before you call RestoreTableFromClusterSnapshot. When you have renamed your original table, then you can pass the original name of the table as the NewTableName parameter value in the call to RestoreTableFromClusterSnapshot. This way, you can replace the original table with the table created from the snapshot.
ResumeCluster
Show Description Resumes a paused cluster.
RevokeClusterSecurityGroupIngress
Show Description Revokes an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group. To add an ingress rule, see AuthorizeClusterSecurityGroupIngress. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.
RevokeEndpointAccess
Show Description Revokes access to a cluster.
RevokeSnapshotAccess
Show Description Removes the ability of the specified Amazon Web Services account to restore the specified snapshot. If the account is currently restoring the snapshot, the restore will run to completion. For more information about working with snapshots, go to Amazon Redshift Snapshots in the Amazon Redshift Cluster Management Guide.
RotateEncryptionKey
Show Description Rotates the encryption keys for a cluster.

Rekognition Events

Service Event Name Description
rekognition CompareFaces
Show Description Compares a face in the source input image with each of the 100 largest faces detected in the target input image. If the source image contains multiple faces, the service detects the largest face and compares it with each face detected in the target image. CompareFaces uses machine learning algorithms, which are probabilistic. A false negative is an incorrect prediction that a face in the target image has a low similarity confidence score when compared to the face in the source image. To reduce the probability of false negatives, we recommend that you compare the target image against multiple source images. If you plan to use CompareFaces to make a decision that impacts an individual's rights, privacy, or access to services, we recommend that you pass the result to a human for review and further validation before taking action. You pass the input and target images either as base64-encoded image bytes or as references to images in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes isn't supported. The image must be formatted as a PNG or JPEG file. In response, the operation returns an array of face matches ordered by similarity score in descending order. For each face match, the response provides a bounding box of the face, facial landmarks, pose details (pitch, role, and yaw), quality (brightness and sharpness), and confidence value (indicating the level of confidence that the bounding box contains a face). The response also provides a similarity score, which indicates how closely the faces match. By default, only faces with a similarity score of greater than or equal to 80% are returned in the response. You can change this value by specifying the SimilarityThreshold parameter. CompareFaces also returns an array of faces that don't match the source image. For each face, it returns a bounding box, confidence value, landmarks, pose details, and quality. The response also returns information about the face in the source image, including the bounding box of the face and confidence value. The QualityFilter input parameter allows you to filter out detected faces that don’t meet a required quality bar. The quality bar is based on a variety of common use cases. Use QualityFilter to set the quality bar by specifying LOW, MEDIUM, or HIGH. If you do not want to filter detected faces, specify NONE. The default value is NONE. If the image doesn't contain Exif metadata, CompareFaces returns orientation information for the source and target images. Use these values to display the images with the correct image orientation. If no faces are detected in the source or target images, CompareFaces returns an InvalidParameterException error. This is a stateless API operation. That is, data returned by this operation doesn't persist. For an example, see Comparing Faces in Images in the Amazon Rekognition Developer Guide. This operation requires permissions to perform the rekognition:CompareFaces action.
CreateCollection
Show Description Creates a collection in an AWS Region. You can add faces to the collection using the IndexFaces operation. For example, you might create collections, one for each of your application users. A user can then index faces using the IndexFaces operation and persist results in a specific collection. Then, a user can search the collection for faces in the user-specific container. When you create a collection, it is associated with the latest version of the face model version. Collection names are case-sensitive. This operation requires permissions to perform the rekognition:CreateCollection action. If you want to tag your collection, you also require permission to perform the rekognition:TagResource operation.
CreateDataset
Show Description Creates a new Amazon Rekognition Custom Labels dataset. You can create a dataset by using an Amazon Sagemaker format manifest file or by copying an existing Amazon Rekognition Custom Labels dataset. To create a training dataset for a project, specify train for the value of DatasetType. To create the test dataset for a project, specify test for the value of DatasetType. The response from CreateDataset is the Amazon Resource Name (ARN) for the dataset. Creating a dataset takes a while to complete. Use DescribeDataset to check the current status. The dataset created successfully if the value of Status is CREATE_COMPLETE. To check if any non-terminal errors occurred, call ListDatasetEntries and check for the presence of errors lists in the JSON Lines. Dataset creation fails if a terminal error occurs (Status = CREATE_FAILED). Currently, you can't access the terminal error information. For more information, see Creating dataset in the Amazon Rekognition Custom Labels Developer Guide. This operation requires permissions to perform the rekognition:CreateDataset action. If you want to copy an existing dataset, you also require permission to perform the rekognition:ListDatasetEntries action.
CreateProject
Show Description Creates a new Amazon Rekognition Custom Labels project. A project is a group of resources (datasets, model versions) that you use to create and manage Amazon Rekognition Custom Labels models. This operation requires permissions to perform the rekognition:CreateProject action.
CreateProjectVersion
Show Description Creates a new version of a model and begins training. Models are managed as part of an Amazon Rekognition Custom Labels project. The response from CreateProjectVersion is an Amazon Resource Name (ARN) for the version of the model. Training uses the training and test datasets associated with the project. For more information, see Creating training and test dataset in the Amazon Rekognition Custom Labels Developer Guide. You can train a modelin a project that doesn't have associated datasets by specifying manifest files in the TrainingData and TestingData fields. If you open the console after training a model with manifest files, Amazon Rekognition Custom Labels creates the datasets for you using the most recent manifest files. You can no longer train a model version for the project by specifying manifest files. Instead of training with a project without associated datasets, we recommend that you use the manifest files to create training and test datasets for the project. Training takes a while to complete. You can get the current status by calling DescribeProjectVersions. Training completed successfully if the value of the Status field is TRAINING_COMPLETED. If training fails, see Debugging a failed model training in the Amazon Rekognition Custom Labels developer guide. Once training has successfully completed, call DescribeProjectVersions to get the training results and evaluate the model. For more information, see Improving a trained Amazon Rekognition Custom Labels model in the Amazon Rekognition Custom Labels developers guide. After evaluating the model, you start the model by calling StartProjectVersion. This operation requires permissions to perform the rekognition:CreateProjectVersion action.
CreateStreamProcessor
Show Description Creates an Amazon Rekognition stream processor that you can use to detect and recognize faces in a streaming video. Amazon Rekognition Video is a consumer of live video from Amazon Kinesis Video Streams. Amazon Rekognition Video sends analysis results to Amazon Kinesis Data Streams. You provide as input a Kinesis video stream (Input) and a Kinesis data stream (Output) stream. You also specify the face recognition criteria in Settings. For example, the collection containing faces that you want to recognize. Use Name to assign an identifier for the stream processor. You use Name to manage the stream processor. For example, you can start processing the source video by calling StartStreamProcessor with the Name field. After you have finished analyzing a streaming video, use StopStreamProcessor to stop processing. You can delete the stream processor by calling DeleteStreamProcessor. This operation requires permissions to perform the rekognition:CreateStreamProcessor action. If you want to tag your stream processor, you also require permission to perform the rekognition:TagResource operation.
DeleteCollection
Show Description Deletes the specified collection. Note that this operation removes all faces in the collection. For an example, see delete-collection-procedure. This operation requires permissions to perform the rekognition:DeleteCollection action.
DeleteDataset
Show Description Deletes an existing Amazon Rekognition Custom Labels dataset. Deleting a dataset might take while. Use DescribeDataset to check the current status. The dataset is still deleting if the value of Status is DELETE_IN_PROGRESS. If you try to access the dataset after it is deleted, you get a ResourceNotFoundException exception. You can't delete a dataset while it is creating (Status = CREATE_IN_PROGRESS) or if the dataset is updating (Status = UPDATE_IN_PROGRESS). This operation requires permissions to perform the rekognition:DeleteDataset action.
DeleteFaces
Show Description Deletes faces from a collection. You specify a collection ID and an array of face IDs to remove from the collection. This operation requires permissions to perform the rekognition:DeleteFaces action.
DeleteProject
Show Description Deletes an Amazon Rekognition Custom Labels project. To delete a project you must first delete all models associated with the project. To delete a model, see DeleteProjectVersion. DeleteProject is an asynchronous operation. To check if the project is deleted, call DescribeProjects. The project is deleted when the project no longer appears in the response. This operation requires permissions to perform the rekognition:DeleteProject action.
DeleteProjectVersion
Show Description Deletes an Amazon Rekognition Custom Labels model. You can't delete a model if it is running or if it is training. To check the status of a model, use the Status field returned from DescribeProjectVersions. To stop a running model call StopProjectVersion. If the model is training, wait until it finishes. This operation requires permissions to perform the rekognition:DeleteProjectVersion action.
DeleteStreamProcessor
Show Description Deletes the stream processor identified by Name. You assign the value for Name when you create the stream processor with CreateStreamProcessor. You might not be able to use the same name for a stream processor for a few seconds after calling DeleteStreamProcessor.
DescribeCollection
Show Description Describes the specified collection. You can use DescribeCollection to get information, such as the number of faces indexed into a collection and the version of the model used by the collection for face detection. For more information, see Describing a Collection in the Amazon Rekognition Developer Guide.
DescribeDataset
Show Description Describes an Amazon Rekognition Custom Labels dataset. You can get information such as the current status of a dataset and statistics about the images and labels in a dataset. This operation requires permissions to perform the rekognition:DescribeDataset action.
DescribeProjectVersions
Show Description Lists and describes the versions of a model in an Amazon Rekognition Custom Labels project. You can specify up to 10 model versions in ProjectVersionArns. If you don't specify a value, descriptions for all model versions in the project are returned. This operation requires permissions to perform the rekognition:DescribeProjectVersions action.
DescribeProjects
Show Description Gets information about your Amazon Rekognition Custom Labels projects. This operation requires permissions to perform the rekognition:DescribeProjects action.
DescribeStreamProcessor
Show Description Provides information about a stream processor created by CreateStreamProcessor. You can get information about the input and output streams, the input parameters for the face recognition being performed, and the current status of the stream processor.
DetectCustomLabels
Show Description Detects custom labels in a supplied image by using an Amazon Rekognition Custom Labels model. You specify which version of a model version to use by using the ProjectVersionArn input parameter. You pass the input image as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file. For each object that the model version detects on an image, the API returns a (CustomLabel) object in an array (CustomLabels). Each CustomLabel object provides the label name (Name), the level of confidence that the image contains the object (Confidence), and object location information, if it exists, for the label on the image (Geometry). To filter labels that are returned, specify a value for MinConfidence. DetectCustomLabelsLabels only returns labels with a confidence that's higher than the specified value. The value of MinConfidence maps to the assumed threshold values created during training. For more information, see Assumed threshold in the Amazon Rekognition Custom Labels Developer Guide. Amazon Rekognition Custom Labels metrics expresses an assumed threshold as a floating point value between 0-1. The range of MinConfidence normalizes the threshold value to a percentage value (0-100). Confidence responses from DetectCustomLabels are also returned as a percentage. You can use MinConfidence to change the precision and recall or your model. For more information, see Analyzing an image in the Amazon Rekognition Custom Labels Developer Guide. If you don't specify a value for MinConfidence, DetectCustomLabels returns labels based on the assumed threshold of each label. This is a stateless API operation. That is, the operation does not persist any data. This operation requires permissions to perform the rekognition:DetectCustomLabels action. For more information, see Analyzing an image in the Amazon Rekognition Custom Labels Developer Guide.
DetectFaces
Show Description Detects faces within an image that is provided as input. DetectFaces detects the 100 largest faces in the image. For each face detected, the operation returns face details. These details include a bounding box of the face, a confidence value (that the bounding box contains a face), and a fixed set of attributes such as facial landmarks (for example, coordinates of eye and mouth), presence of beard, sunglasses, and so on. The face-detection algorithm is most effective on frontal faces. For non-frontal or obscured faces, the algorithm might not detect the faces or might detect faces with lower confidence. You pass the input image either as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file. This is a stateless API operation. That is, the operation does not persist any data. This operation requires permissions to perform the rekognition:DetectFaces action.
DetectLabels
Show Description Detects instances of real-world entities within an image (JPEG or PNG) provided as input. This includes objects like flower, tree, and table; events like wedding, graduation, and birthday party; and concepts like landscape, evening, and nature. For an example, see Analyzing Images Stored in an Amazon S3 Bucket in the Amazon Rekognition Developer Guide. DetectLabels does not support the detection of activities. However, activity detection is supported for label detection in videos. For more information, see StartLabelDetection in the Amazon Rekognition Developer Guide. You pass the input image as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file. For each object, scene, and concept the API returns one or more labels. Each label provides the object name, and the level of confidence that the image contains the object. For example, suppose the input image has a lighthouse, the sea, and a rock. The response includes all three labels, one for each object. {Name: lighthouse, Confidence: 98.4629} {Name: rock,Confidence: 79.2097} {Name: sea,Confidence: 75.061} In the preceding example, the operation returns one label for each of the three objects. The operation can also return multiple labels for the same object in the image. For example, if the input image shows a flower (for example, a tulip), the operation might return the following three labels. {Name: flower,Confidence: 99.0562} {Name: plant,Confidence: 99.0562} {Name: tulip,Confidence: 99.0562} In this example, the detection algorithm more precisely identifies the flower as a tulip. In response, the API returns an array of labels. In addition, the response also includes the orientation correction. Optionally, you can specify MinConfidence to control the confidence threshold for the labels returned. The default is 55%. You can also add the MaxLabels parameter to limit the number of labels returned. If the object detected is a person, the operation doesn't provide the same facial details that the DetectFaces operation provides. DetectLabels returns bounding boxes for instances of common object labels in an array of Instance objects. An Instance object contains a BoundingBox object, for the location of the label on the image. It also includes the confidence by which the bounding box was detected. DetectLabels also returns a hierarchical taxonomy of detected labels. For example, a detected car might be assigned the label car. The label car has two parent labels: Vehicle (its parent) and Transportation (its grandparent). The response returns the entire list of ancestors for a label. Each ancestor is a unique label in the response. In the previous example, Car, Vehicle, and Transportation are returned as unique labels in the response. This is a stateless API operation. That is, the operation does not persist any data. This operation requires permissions to perform the rekognition:DetectLabels action.
DetectModerationLabels
Show Description Detects unsafe content in a specified JPEG or PNG format image. Use DetectModerationLabels to moderate images depending on your requirements. For example, you might want to filter images that contain nudity, but not images containing suggestive content. To filter images, use the labels returned by DetectModerationLabels to determine which types of content are appropriate. For information about moderation labels, see Detecting Unsafe Content in the Amazon Rekognition Developer Guide. You pass the input image either as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file.
DetectProtectiveEquipment
Show Description Detects Personal Protective Equipment (PPE) worn by people detected in an image. Amazon Rekognition can detect the following types of PPE.
  • Face cover
  • Hand cover
  • Head cover
You pass the input image as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. The image must be either a PNG or JPG formatted file. DetectProtectiveEquipment detects PPE worn by up to 15 persons detected in an image. For each person detected in the image the API returns an array of body parts (face, head, left-hand, right-hand). For each body part, an array of detected items of PPE is returned, including an indicator of whether or not the PPE covers the body part. The API returns the confidence it has in each detection (person, PPE, body part and body part coverage). It also returns a bounding box (BoundingBox) for each detected person and each detected item of PPE. You can optionally request a summary of detected PPE items with the SummarizationAttributes input parameter. The summary provides the following information.
  • The persons detected as wearing all of the types of PPE that you specify.
  • The persons detected as not wearing all of the types PPE that you specify.
  • The persons detected where PPE adornment could not be determined.
This is a stateless API operation. That is, the operation does not persist any data. This operation requires permissions to perform the rekognition:DetectProtectiveEquipment action.
DetectText
Show Description Detects text in the input image and converts it into machine-readable text. Pass the input image as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, you must pass it as a reference to an image in an Amazon S3 bucket. For the AWS CLI, passing image bytes is not supported. The image must be either a .png or .jpeg formatted file. The DetectText operation returns text in an array of TextDetection elements, TextDetections. Each TextDetection element provides information about a single word or line of text that was detected in the image. A word is one or more ISO basic latin script characters that are not separated by spaces. DetectText can detect up to 100 words in an image. A line is a string of equally spaced words. A line isn't necessarily a complete sentence. For example, a driver's license number is detected as a line. A line ends when there is no aligned text after it. Also, a line ends when there is a large gap between words, relative to the length of the words. This means, depending on the gap between words, Amazon Rekognition may detect multiple lines in text aligned in the same direction. Periods don't represent the end of a line. If a sentence spans multiple lines, the DetectText operation returns multiple lines. To determine whether a TextDetection element is a line of text or a word, use the TextDetection object Type field. To be detected, text must be within +/- 90 degrees orientation of the horizontal axis. For more information, see DetectText in the Amazon Rekognition Developer Guide.
DistributeDatasetEntries
Show Description Distributes the entries (images) in a training dataset across the training dataset and the test dataset for a project. DistributeDatasetEntries moves 20% of the training dataset images to the test dataset. An entry is a JSON Line that describes an image. You supply the Amazon Resource Names (ARN) of a project's training dataset and test dataset. The training dataset must contain the images that you want to split. The test dataset must be empty. The datasets must belong to the same project. To create training and test datasets for a project, call CreateDataset. Distributing a dataset takes a while to complete. To check the status call DescribeDataset. The operation is complete when the Status field for the training dataset and the test dataset is UPDATE_COMPLETE. If the dataset split fails, the value of Status is UPDATE_FAILED. This operation requires permissions to perform the rekognition:DistributeDatasetEntries action.
GetCelebrityInfo
Show Description Gets the name and additional information about a celebrity based on their Amazon Rekognition ID. The additional information is returned as an array of URLs. If there is no additional information about the celebrity, this list is empty. For more information, see Recognizing Celebrities in an Image in the Amazon Rekognition Developer Guide. This operation requires permissions to perform the rekognition:GetCelebrityInfo action.
GetCelebrityRecognition
Show Description Gets the celebrity recognition results for a Amazon Rekognition Video analysis started by StartCelebrityRecognition. Celebrity recognition in a video is an asynchronous operation. Analysis is started by a call to StartCelebrityRecognition which returns a job identifier (JobId). When the celebrity recognition operation finishes, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartCelebrityRecognition. To get the results of the celebrity recognition analysis, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetCelebrityDetection and pass the job identifier (JobId) from the initial call to StartCelebrityDetection. For more information, see Working With Stored Videos in the Amazon Rekognition Developer Guide. GetCelebrityRecognition returns detected celebrities and the time(s) they are detected in an array (Celebrities) of CelebrityRecognition objects. Each CelebrityRecognition contains information about the celebrity in a CelebrityDetail object and the time, Timestamp, the celebrity was detected. This CelebrityDetail object stores information about the detected celebrity's face attributes, a face bounding box, known gender, the celebrity's name, and a confidence estimate. GetCelebrityRecognition only returns the default facial attributes (BoundingBox, Confidence, Landmarks, Pose, and Quality). The BoundingBox field only applies to the detected face instance. The other facial attributes listed in the Face object of the following response syntax are not returned. For more information, see FaceDetail in the Amazon Rekognition Developer Guide. By default, the Celebrities array is sorted by time (milliseconds from the start of the video). You can also sort the array by celebrity by specifying the value ID in the SortBy input parameter. The CelebrityDetail object includes the celebrity identifer and additional information urls. If you don't store the additional information urls, you can get them later by calling GetCelebrityInfo with the celebrity identifer. No information is returned for faces not recognized as celebrities. Use MaxResults parameter to limit the number of labels returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetCelebrityDetection and populate the NextToken request parameter with the token value returned from the previous call to GetCelebrityRecognition.
GetContentModeration
Show Description Gets the inappropriate, unwanted, or offensive content analysis results for a Amazon Rekognition Video analysis started by StartContentModeration. For a list of moderation labels in Amazon Rekognition, see Using the image and video moderation APIs. Amazon Rekognition Video inappropriate or offensive content detection in a stored video is an asynchronous operation. You start analysis by calling StartContentModeration which returns a job identifier (JobId). When analysis finishes, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartContentModeration. To get the results of the content analysis, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetContentModeration and pass the job identifier (JobId) from the initial call to StartContentModeration. For more information, see Working with Stored Videos in the Amazon Rekognition Devlopers Guide. GetContentModeration returns detected inappropriate, unwanted, or offensive content moderation labels, and the time they are detected, in an array, ModerationLabels, of ContentModerationDetection objects. By default, the moderated labels are returned sorted by time, in milliseconds from the start of the video. You can also sort them by moderated label by specifying NAME for the SortBy input parameter. Since video analysis can return a large number of results, use the MaxResults parameter to limit the number of labels returned in a single call to GetContentModeration. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetContentModeration and populate the NextToken request parameter with the value of NextToken returned from the previous call to GetContentModeration. For more information, see Content moderation in the Amazon Rekognition Developer Guide.
GetFaceDetection
Show Description Gets face detection results for a Amazon Rekognition Video analysis started by StartFaceDetection. Face detection with Amazon Rekognition Video is an asynchronous operation. You start face detection by calling StartFaceDetection which returns a job identifier (JobId). When the face detection operation finishes, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartFaceDetection. To get the results of the face detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetFaceDetection and pass the job identifier (JobId) from the initial call to StartFaceDetection. GetFaceDetection returns an array of detected faces (Faces) sorted by the time the faces were detected. Use MaxResults parameter to limit the number of labels returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetFaceDetection and populate the NextToken request parameter with the token value returned from the previous call to GetFaceDetection.
GetFaceSearch
Show Description Gets the face search results for Amazon Rekognition Video face search started by StartFaceSearch. The search returns faces in a collection that match the faces of persons detected in a video. It also includes the time(s) that faces are matched in the video. Face search in a video is an asynchronous operation. You start face search by calling to StartFaceSearch which returns a job identifier (JobId). When the search operation finishes, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartFaceSearch. To get the search results, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetFaceSearch and pass the job identifier (JobId) from the initial call to StartFaceSearch. For more information, see Searching Faces in a Collection in the Amazon Rekognition Developer Guide. The search results are retured in an array, Persons, of PersonMatch objects. EachPersonMatch element contains details about the matching faces in the input collection, person information (facial attributes, bounding boxes, and person identifer) for the matched person, and the time the person was matched in the video. GetFaceSearch only returns the default facial attributes (BoundingBox, Confidence, Landmarks, Pose, and Quality). The other facial attributes listed in the Face object of the following response syntax are not returned. For more information, see FaceDetail in the Amazon Rekognition Developer Guide. By default, the Persons array is sorted by the time, in milliseconds from the start of the video, persons are matched. You can also sort by persons by specifying INDEX for the SORTBY input parameter.
GetLabelDetection
Show Description Gets the label detection results of a Amazon Rekognition Video analysis started by StartLabelDetection. The label detection operation is started by a call to StartLabelDetection which returns a job identifier (JobId). When the label detection operation finishes, Amazon Rekognition publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartlabelDetection. To get the results of the label detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetLabelDetection and pass the job identifier (JobId) from the initial call to StartLabelDetection. GetLabelDetection returns an array of detected labels (Labels) sorted by the time the labels were detected. You can also sort by the label name by specifying NAME for the SortBy input parameter. The labels returned include the label name, the percentage confidence in the accuracy of the detected label, and the time the label was detected in the video. The returned labels also include bounding box information for common objects, a hierarchical taxonomy of detected labels, and the version of the label model used for detection. Use MaxResults parameter to limit the number of labels returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetlabelDetection and populate the NextToken request parameter with the token value returned from the previous call to GetLabelDetection.
GetPersonTracking
Show Description Gets the path tracking results of a Amazon Rekognition Video analysis started by StartPersonTracking. The person path tracking operation is started by a call to StartPersonTracking which returns a job identifier (JobId). When the operation finishes, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartPersonTracking. To get the results of the person path tracking operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetPersonTracking and pass the job identifier (JobId) from the initial call to StartPersonTracking. GetPersonTracking returns an array, Persons, of tracked persons and the time(s) their paths were tracked in the video. GetPersonTracking only returns the default facial attributes (BoundingBox, Confidence, Landmarks, Pose, and Quality). The other facial attributes listed in the Face object of the following response syntax are not returned. For more information, see FaceDetail in the Amazon Rekognition Developer Guide. By default, the array is sorted by the time(s) a person's path is tracked in the video. You can sort by tracked persons by specifying INDEX for the SortBy input parameter. Use the MaxResults parameter to limit the number of items returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetPersonTracking and populate the NextToken request parameter with the token value returned from the previous call to GetPersonTracking.
GetSegmentDetection
Show Description Gets the segment detection results of a Amazon Rekognition Video analysis started by StartSegmentDetection. Segment detection with Amazon Rekognition Video is an asynchronous operation. You start segment detection by calling StartSegmentDetection which returns a job identifier (JobId). When the segment detection operation finishes, Amazon Rekognition publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartSegmentDetection. To get the results of the segment detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. if so, call GetSegmentDetection and pass the job identifier (JobId) from the initial call of StartSegmentDetection. GetSegmentDetection returns detected segments in an array (Segments) of SegmentDetection objects. Segments is sorted by the segment types specified in the SegmentTypes input parameter of StartSegmentDetection. Each element of the array includes the detected segment, the precentage confidence in the acuracy of the detected segment, the type of the segment, and the frame in which the segment was detected. Use SelectedSegmentTypes to find out the type of segment detection requested in the call to StartSegmentDetection. Use the MaxResults parameter to limit the number of segment detections returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetSegmentDetection and populate the NextToken request parameter with the token value returned from the previous call to GetSegmentDetection. For more information, see Detecting Video Segments in Stored Video in the Amazon Rekognition Developer Guide.
GetTextDetection
Show Description Gets the text detection results of a Amazon Rekognition Video analysis started by StartTextDetection. Text detection with Amazon Rekognition Video is an asynchronous operation. You start text detection by calling StartTextDetection which returns a job identifier (JobId) When the text detection operation finishes, Amazon Rekognition publishes a completion status to the Amazon Simple Notification Service topic registered in the initial call to StartTextDetection. To get the results of the text detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. if so, call GetTextDetection and pass the job identifier (JobId) from the initial call of StartLabelDetection. GetTextDetection returns an array of detected text (TextDetections) sorted by the time the text was detected, up to 50 words per frame of video. Each element of the array includes the detected text, the precentage confidence in the acuracy of the detected text, the time the text was detected, bounding box information for where the text was located, and unique identifiers for words and their lines. Use MaxResults parameter to limit the number of text detections returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetTextDetection and populate the NextToken request parameter with the token value returned from the previous call to GetTextDetection.
IndexFaces
Show Description Detects faces in the input image and adds them to the specified collection. Amazon Rekognition doesn't save the actual faces that are detected. Instead, the underlying detection algorithm first detects the faces in the input image. For each face, the algorithm extracts facial features into a feature vector, and stores it in the backend database. Amazon Rekognition uses feature vectors when it performs face match and search operations using the SearchFaces and SearchFacesByImage operations. For more information, see Adding Faces to a Collection in the Amazon Rekognition Developer Guide. To get the number of faces in a collection, call DescribeCollection. If you're using version 1.0 of the face detection model, IndexFaces indexes the 15 largest faces in the input image. Later versions of the face detection model index the 100 largest faces in the input image. If you're using version 4 or later of the face model, image orientation information is not returned in the OrientationCorrection field. To determine which version of the model you're using, call DescribeCollection and supply the collection ID. You can also get the model version from the value of FaceModelVersion in the response from IndexFaces For more information, see Model Versioning in the Amazon Rekognition Developer Guide. If you provide the optional ExternalImageId for the input image you provided, Amazon Rekognition associates this ID with all faces that it detects. When you call the ListFaces operation, the response returns the external ID. You can use this external image ID to create a client-side index to associate the faces with each image. You can then use the index to find all faces in an image. You can specify the maximum number of faces to index with the MaxFaces input parameter. This is useful when you want to index the largest faces in an image and don't want to index smaller faces, such as those belonging to people standing in the background. The QualityFilter input parameter allows you to filter out detected faces that don’t meet a required quality bar. The quality bar is based on a variety of common use cases. By default, IndexFaces chooses the quality bar that's used to filter faces. You can also explicitly choose the quality bar. Use QualityFilter, to set the quality bar by specifying LOW, MEDIUM, or HIGH. If you do not want to filter detected faces, specify NONE. To use quality filtering, you need a collection associated with version 3 of the face model or higher. To get the version of the face model associated with a collection, call DescribeCollection. Information about faces detected in an image, but not indexed, is returned in an array of UnindexedFace objects, UnindexedFaces. Faces aren't indexed for reasons such as:
  • The number of faces detected exceeds the value of the MaxFaces request parameter.
  • The face is too small compared to the image dimensions.
  • The face is too blurry.
  • The image is too dark.
  • The face has an extreme pose.
  • The face doesn’t have enough detail to be suitable for face search.
In response, the IndexFaces operation returns an array of metadata for all detected faces, FaceRecords. This includes:
  • The bounding box, BoundingBox, of the detected face.
  • A confidence value, Confidence, which indicates the confidence that the bounding box contains a face.
  • A face ID, FaceId, assigned by the service for each face that's detected and stored.
  • An image ID, ImageId, assigned by the service for the input image.
If you request all facial attributes (by using the detectionAttributes parameter), Amazon Rekognition returns detailed facial attributes, such as facial landmarks (for example, location of eye and mouth) and other facial attributes. If you provide the same image, specify the same collection, and use the same external ID in the IndexFaces operation, Amazon Rekognition doesn't save duplicate face metadata.

The input image is passed either as base64-encoded image bytes, or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes isn't supported. The image must be formatted as a PNG or JPEG file. This operation requires permissions to perform the rekognition:IndexFaces action.

ListCollections
Show Description Returns list of collection IDs in your account. If the result is truncated, the response also provides a NextToken that you can use in the subsequent request to fetch the next set of collection IDs. For an example, see Listing Collections in the Amazon Rekognition Developer Guide. This operation requires permissions to perform the rekognition:ListCollections action.
ListDatasetEntries
Show Description Lists the entries (images) within a dataset. An entry is a JSON Line that contains the information for a single image, including the image location, assigned labels, and object location bounding boxes. For more information, see Creating a manifest file. JSON Lines in the response include information about non-terminal errors found in the dataset. Non terminal errors are reported in errors lists within each JSON Line. The same information is reported in the training and testing validation result manifests that Amazon Rekognition Custom Labels creates during model training. You can filter the response in variety of ways, such as choosing which labels to return and returning JSON Lines created after a specific date. This operation requires permissions to perform the rekognition:ListDatasetEntries action.
ListDatasetLabels
Show Description Lists the labels in a dataset. Amazon Rekognition Custom Labels uses labels to describe images. For more information, see Labeling images. Lists the labels in a dataset. Amazon Rekognition Custom Labels uses labels to describe images. For more information, see Labeling images in the Amazon Rekognition Custom Labels Developer Guide.
ListFaces
Show Description Returns metadata for faces in the specified collection. This metadata includes information such as the bounding box coordinates, the confidence (that the bounding box contains a face), and face ID. For an example, see Listing Faces in a Collection in the Amazon Rekognition Developer Guide. This operation requires permissions to perform the rekognition:ListFaces action.
ListStreamProcessors
Show Description Gets a list of stream processors that you have created with CreateStreamProcessor.
ListTagsForResource
Show Description Returns a list of tags in an Amazon Rekognition collection, stream processor, or Custom Labels model. This operation requires permissions to perform the rekognition:ListTagsForResource action.
RecognizeCelebrities
Show Description Returns an array of celebrities recognized in the input image. For more information, see Recognizing Celebrities in the Amazon Rekognition Developer Guide. RecognizeCelebrities returns the 64 largest faces in the image. It lists the recognized celebrities in the CelebrityFaces array and any unrecognized faces in the UnrecognizedFaces array. RecognizeCelebrities doesn't return celebrities whose faces aren't among the largest 64 faces in the image. For each celebrity recognized, RecognizeCelebrities returns a Celebrity object. The Celebrity object contains the celebrity name, ID, URL links to additional information, match confidence, and a ComparedFace object that you can use to locate the celebrity's face on the image. Amazon Rekognition doesn't retain information about which images a celebrity has been recognized in. Your application must store this information and use the Celebrity ID property as a unique identifier for the celebrity. If you don't store the celebrity name or additional information URLs returned by RecognizeCelebrities, you will need the ID to identify the celebrity in a call to the GetCelebrityInfo operation. You pass the input image either as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file. For an example, see Recognizing Celebrities in an Image in the Amazon Rekognition Developer Guide. This operation requires permissions to perform the rekognition:RecognizeCelebrities operation.
SearchFaces
Show Description For a given input face ID, searches for matching faces in the collection the face belongs to. You get a face ID when you add a face to the collection using the IndexFaces operation. The operation compares the features of the input face with faces in the specified collection. You can also search faces without indexing faces by using the SearchFacesByImage operation. The operation response returns an array of faces that match, ordered by similarity score with the highest similarity first. More specifically, it is an array of metadata for each face match that is found. Along with the metadata, the response also includes a confidence value for each face match, indicating the confidence that the specific face matches the input face. For an example, see Searching for a Face Using Its Face ID in the Amazon Rekognition Developer Guide. This operation requires permissions to perform the rekognition:SearchFaces action.
SearchFacesByImage
Show Description For a given input image, first detects the largest face in the image, and then searches the specified collection for matching faces. The operation compares the features of the input face with faces in the specified collection. To search for all faces in an input image, you might first call the IndexFaces operation, and then use the face IDs returned in subsequent calls to the SearchFaces operation. You can also call the DetectFaces operation and use the bounding boxes in the response to make face crops, which then you can pass in to the SearchFacesByImage operation. You pass the input image either as base64-encoded image bytes or as a reference to an image in an Amazon S3 bucket. If you use the AWS CLI to call Amazon Rekognition operations, passing image bytes is not supported. The image must be either a PNG or JPEG formatted file. The response returns an array of faces that match, ordered by similarity score with the highest similarity first. More specifically, it is an array of metadata for each face match found. Along with the metadata, the response also includes a similarity indicating how similar the face is to the input face. In the response, the operation also returns the bounding box (and a confidence level that the bounding box contains a face) of the face that Amazon Rekognition used for the input image. If no faces are detected in the input image, SearchFacesByImage returns an InvalidParameterException error. For an example, Searching for a Face Using an Image in the Amazon Rekognition Developer Guide. The QualityFilter input parameter allows you to filter out detected faces that don’t meet a required quality bar. The quality bar is based on a variety of common use cases. Use QualityFilter to set the quality bar for filtering by specifying LOW, MEDIUM, or HIGH. If you do not want to filter detected faces, specify NONE. The default value is NONE. To use quality filtering, you need a collection associated with version 3 of the face model or higher. To get the version of the face model associated with a collection, call DescribeCollection. This operation requires permissions to perform the rekognition:SearchFacesByImage action.
StartCelebrityRecognition
Show Description Starts asynchronous recognition of celebrities in a stored video. Amazon Rekognition Video can detect celebrities in a video must be stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartCelebrityRecognition returns a job identifier (JobId) which you use to get the results of the analysis. When celebrity recognition analysis is finished, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. To get the results of the celebrity recognition analysis, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetCelebrityRecognition and pass the job identifier (JobId) from the initial call to StartCelebrityRecognition. For more information, see Recognizing Celebrities in the Amazon Rekognition Developer Guide.
StartContentModeration
Show Description Starts asynchronous detection of inappropriate, unwanted, or offensive content in a stored video. For a list of moderation labels in Amazon Rekognition, see Using the image and video moderation APIs. Amazon Rekognition Video can moderate content in a video stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartContentModeration returns a job identifier (JobId) which you use to get the results of the analysis. When content analysis is finished, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. To get the results of the content analysis, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetContentModeration and pass the job identifier (JobId) from the initial call to StartContentModeration. For more information, see Content moderation in the Amazon Rekognition Developer Guide.
StartFaceDetection
Show Description Starts asynchronous detection of faces in a stored video. Amazon Rekognition Video can detect faces in a video stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartFaceDetection returns a job identifier (JobId) that you use to get the results of the operation. When face detection is finished, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. To get the results of the face detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetFaceDetection and pass the job identifier (JobId) from the initial call to StartFaceDetection. For more information, see Detecting Faces in a Stored Video in the Amazon Rekognition Developer Guide.
StartFaceSearch
Show Description Starts the asynchronous search for faces in a collection that match the faces of persons detected in a stored video. The video must be stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartFaceSearch returns a job identifier (JobId) which you use to get the search results once the search has completed. When searching is finished, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. To get the search results, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetFaceSearch and pass the job identifier (JobId) from the initial call to StartFaceSearch. For more information, see procedure-person-search-videos.
StartLabelDetection
Show Description Starts asynchronous detection of labels in a stored video. Amazon Rekognition Video can detect labels in a video. Labels are instances of real-world entities. This includes objects like flower, tree, and table; events like wedding, graduation, and birthday party; concepts like landscape, evening, and nature; and activities like a person getting out of a car or a person skiing. The video must be stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartLabelDetection returns a job identifier (JobId) which you use to get the results of the operation. When label detection is finished, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. To get the results of the label detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetLabelDetection and pass the job identifier (JobId) from the initial call to StartLabelDetection.

StartPersonTracking
Show Description Starts the asynchronous tracking of a person's path in a stored video. Amazon Rekognition Video can track the path of people in a video stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartPersonTracking returns a job identifier (JobId) which you use to get the results of the operation. When label detection is finished, Amazon Rekognition publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. To get the results of the person detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetPersonTracking and pass the job identifier (JobId) from the initial call to StartPersonTracking.
StartProjectVersion
Show Description Starts the running of the version of a model. Starting a model takes a while to complete. To check the current state of the model, use DescribeProjectVersions. Once the model is running, you can detect custom labels in new images by calling DetectCustomLabels. You are charged for the amount of time that the model is running. To stop a running model, call StopProjectVersion. This operation requires permissions to perform the rekognition:StartProjectVersion action.
StartSegmentDetection
Show Description Starts asynchronous detection of segment detection in a stored video. Amazon Rekognition Video can detect segments in a video stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartSegmentDetection returns a job identifier (JobId) which you use to get the results of the operation. When segment detection is finished, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. You can use the Filters (StartSegmentDetectionFilters) input parameter to specify the minimum detection confidence returned in the response. Within Filters, use ShotFilter (StartShotDetectionFilter) to filter detected shots. Use TechnicalCueFilter (StartTechnicalCueDetectionFilter) to filter technical cues. To get the results of the segment detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. if so, call GetSegmentDetection and pass the job identifier (JobId) from the initial call to StartSegmentDetection. For more information, see Detecting Video Segments in Stored Video in the Amazon Rekognition Developer Guide.
StartStreamProcessor
Show Description Starts processing a stream processor. You create a stream processor by calling CreateStreamProcessor. To tell StartStreamProcessor which stream processor to start, use the value of the Name field specified in the call to CreateStreamProcessor.
StartTextDetection
Show Description Starts asynchronous detection of text in a stored video. Amazon Rekognition Video can detect text in a video stored in an Amazon S3 bucket. Use Video to specify the bucket name and the filename of the video. StartTextDetection returns a job identifier (JobId) which you use to get the results of the operation. When text detection is finished, Amazon Rekognition Video publishes a completion status to the Amazon Simple Notification Service topic that you specify in NotificationChannel. To get the results of the text detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. if so, call GetTextDetection and pass the job identifier (JobId) from the initial call to StartTextDetection.
StopProjectVersion
Show Description Stops a running model. The operation might take a while to complete. To check the current status, call DescribeProjectVersions.
StopStreamProcessor
Show Description Stops a running stream processor that was created by CreateStreamProcessor.
TagResource
Show Description Adds one or more key-value tags to an Amazon Rekognition collection, stream processor, or Custom Labels model. For more information, see Tagging AWS Resources. This operation requires permissions to perform the rekognition:TagResource action.
UntagResource
Show Description Removes one or more tags from an Amazon Rekognition collection, stream processor, or Custom Labels model. This operation requires permissions to perform the rekognition:UntagResource action.

Resource-groups Events

Service Event Name Description
resource-groups CreateGroup
Show Description Creates a resource group with the specified name and description. You can optionally include a resource query, or a service configuration. For more information about constructing a resource query, see Create a tag-based group in Resource Groups. For more information about service configurations, see Service configurations for resource groups. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:CreateGroup
DeleteGroup
Show Description Deletes the specified resource group. Deleting a resource group does not delete any resources that are members of the group; it only deletes the group structure. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:DeleteGroup
GetGroup
Show Description Returns information about a specified resource group. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:GetGroup
GetGroupConfiguration
Show Description Returns the service configuration associated with the specified resource group. For details about the service configuration syntax, see Service configurations for resource groups. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:GetGroupConfiguration
GetGroupQuery
Show Description Retrieves the resource query associated with the specified resource group. For more information about resource queries, see Create a tag-based group in Resource Groups. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:GetGroupQuery
GetTags
Show Description Returns a list of tags that are associated with a resource group, specified by an ARN. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:GetTags
GroupResources
Show Description Adds the specified resources to the specified group. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:GroupResources
ListGroupResources
Show Description Returns a list of ARNs of the resources that are members of a specified resource group. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:ListGroupResources
  • cloudformation:DescribeStacks
  • cloudformation:ListStackResources
  • tag:GetResources
ListGroups
Show Description Returns a list of existing resource groups in your account. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:ListGroups
PutGroupConfiguration
Show Description Attaches a service configuration to the specified group. This occurs asynchronously, and can take time to complete. You can use GetGroupConfiguration to check the status of the update. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:PutGroupConfiguration
SearchResources
Show Description Returns a list of AWS resource identifiers that matches the specified query. The query uses the same format as a resource query in a CreateGroup or UpdateGroupQuery operation. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:SearchResources
  • cloudformation:DescribeStacks
  • cloudformation:ListStackResources
  • tag:GetResources
Tag
Show Description Adds tags to a resource group with the specified ARN. Existing tags on a resource group are not changed if they are not specified in the request parameters. Do not store personally identifiable information (PII) or other confidential or sensitive information in tags. We use tags to provide you with billing and administration services. Tags are not intended to be used for private or sensitive data. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:Tag
UngroupResources
Show Description Removes the specified resources from the specified group. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:UngroupResources
Untag
Show Description Deletes tags from a specified resource group. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:Untag
UpdateGroup
Show Description Updates the description for an existing group. You cannot update the name of a resource group. Minimum permissions To run this command, you must have the following permissions:
  • resource-groups:UpdateGroup

Resourcegroupstaggingapi Events

Service Event Name Description
resourcegroupstaggingapi DescribeReportCreation
Show Description Describes the status of the StartReportCreation operation. You can call this operation only from the organization's management account and from the us-east-1 Region.
GetComplianceSummary
Show Description Returns a table that shows counts of resources that are noncompliant with their tag policies. For more information on tag policies, see Tag Policies in the AWS Organizations User Guide. You can call this operation only from the organization's management account and from the us-east-1 Region. This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.
GetResources
Show Description Returns all the tagged or previously tagged resources that are located in the specified Region for the AWS account. Depending on what information you want returned, you can also specify the following:
  • Filters that specify what tags and resource types you want returned. The response includes all tags that are associated with the requested resources.
  • Information about compliance with the account's effective tag policy. For more information on tag policies, see Tag Policies in the AWS Organizations User Guide.
This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.
GetTagKeys
Show Description Returns all tag keys currently in use in the specified Region for the calling AWS account. This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.
GetTagValues
Show Description Returns all tag values for the specified key that are used in the specified AWS Region for the calling AWS account. This operation supports pagination, where the response can be sent in multiple pages. You should check the PaginationToken response parameter to determine if there are additional results available to return. Repeat the query, passing the PaginationToken response parameter value as an input to the next request until you recieve a null value. A null value for PaginationToken indicates that there are no more results waiting to be returned.
StartReportCreation
Show Description Generates a report that lists all tagged resources in the accounts across your organization and tells whether each resource is compliant with the effective tag policy. Compliance data is refreshed daily. The report is generated asynchronously. The generated report is saved to the following location: s3://example-bucket/AwsTagPolicies/o-exampleorgid/YYYY-MM-ddTHH:mm:ssZ/report.csv You can call this operation only from the organization's management account and from the us-east-1 Region.
TagResources
Show Description Applies one or more tags to the specified resources. Note the following:
  • Not all resources can have tags. For a list of services with resources that support tagging using this operation, see Services that support the Resource Groups Tagging API.
  • Each resource can have up to 50 tags. For other limits, see Tag Naming and Usage Conventions in the AWS General Reference.
  • You can only tag resources that are located in the specified AWS Region for the AWS account.
  • To add tags to a resource, you need the necessary permissions for the service that the resource belongs to as well as permissions for adding tags. For more information, see the documentation for each service.
Do not store personally identifiable information (PII) or other confidential or sensitive information in tags. We use tags to provide you with billing and administration services. Tags are not intended to be used for private or sensitive data.

Robomaker Events

Service Event Name Description
robomaker BatchDeleteWorlds
Show Description Deletes one or more worlds in a batch operation.
BatchDescribeSimulationJob
Show Description Describes one or more simulation jobs.
CancelDeploymentJob
Show Description Cancels the specified deployment job.
CancelSimulationJob
Show Description Cancels the specified simulation job.
CancelSimulationJobBatch
Show Description Cancels a simulation job batch. When you cancel a simulation job batch, you are also cancelling all of the active simulation jobs created as part of the batch.
CancelWorldExportJob
Show Description Cancels the specified export job.
CancelWorldGenerationJob
Show Description Cancels the specified world generator job.
CreateDeploymentJob
Show Description Deploys a specific version of a robot application to robots in a fleet. The robot application must have a numbered applicationVersion for consistency reasons. To create a new version, use CreateRobotApplicationVersion or see Creating a Robot Application Version. After 90 days, deployment jobs expire and will be deleted. They will no longer be accessible.
CreateFleet
Show Description Creates a fleet, a logical group of robots running the same robot application.
CreateRobot
Show Description Creates a robot.
CreateRobotApplication
Show Description Creates a robot application.
CreateRobotApplicationVersion
Show Description Creates a version of a robot application.
CreateSimulationApplication
Show Description Creates a simulation application.
CreateSimulationApplicationVersion
Show Description Creates a simulation application with a specific revision id.
CreateSimulationJob
Show Description Creates a simulation job. After 90 days, simulation jobs expire and will be deleted. They will no longer be accessible.
CreateWorldExportJob
Show Description Creates a world export job.
CreateWorldGenerationJob
Show Description Creates worlds using the specified template.
CreateWorldTemplate
Show Description Creates a world template.
DeleteFleet
Show Description Deletes a fleet.
DeleteRobot
Show Description Deletes a robot.
DeleteRobotApplication
Show Description Deletes a robot application.
DeleteSimulationApplication
Show Description Deletes a simulation application.
DeleteWorldTemplate
Show Description Deletes a world template.
DeregisterRobot
Show Description Deregisters a robot.
DescribeDeploymentJob
Show Description Describes a deployment job.
DescribeFleet
Show Description Describes a fleet.
DescribeRobot
Show Description Describes a robot.
DescribeRobotApplication
Show Description Describes a robot application.
DescribeSimulationApplication
Show Description Describes a simulation application.
DescribeSimulationJob
Show Description Describes a simulation job.
DescribeSimulationJobBatch
Show Description Describes a simulation job batch.
DescribeWorld
Show Description Describes a world.
DescribeWorldExportJob
Show Description Describes a world export job.
DescribeWorldGenerationJob
Show Description Describes a world generation job.
DescribeWorldTemplate
Show Description Describes a world template.
GetWorldTemplateBody
Show Description Gets the world template body.
ListDeploymentJobs
Show Description Returns a list of deployment jobs for a fleet. You can optionally provide filters to retrieve specific deployment jobs.
ListFleets
Show Description Returns a list of fleets. You can optionally provide filters to retrieve specific fleets.
ListRobotApplications
Show Description Returns a list of robot application. You can optionally provide filters to retrieve specific robot applications.
ListRobots
Show Description Returns a list of robots. You can optionally provide filters to retrieve specific robots.
ListSimulationApplications
Show Description Returns a list of simulation applications. You can optionally provide filters to retrieve specific simulation applications.
ListSimulationJobBatches
Show Description Returns a list simulation job batches. You can optionally provide filters to retrieve specific simulation batch jobs.
ListSimulationJobs
Show Description Returns a list of simulation jobs. You can optionally provide filters to retrieve specific simulation jobs.
ListTagsForResource
Show Description Lists all tags on a AWS RoboMaker resource.
ListWorldExportJobs
Show Description Lists world export jobs.
ListWorldGenerationJobs
Show Description Lists world generator jobs.
ListWorldTemplates
Show Description Lists world templates.
ListWorlds
Show Description Lists worlds.
RegisterRobot
Show Description Registers a robot with a fleet.
RestartSimulationJob
Show Description Restarts a running simulation job.
StartSimulationJobBatch
Show Description Starts a new simulation job batch. The batch is defined using one or more SimulationJobRequest objects.
SyncDeploymentJob
Show Description Syncrhonizes robots in a fleet to the latest deployment. This is helpful if robots were added after a deployment.
TagResource
Show Description Adds or edits tags for a AWS RoboMaker resource. Each tag consists of a tag key and a tag value. Tag keys and tag values are both required, but tag values can be empty strings. For information about the rules that apply to tag keys and tag values, see User-Defined Tag Restrictions in the AWS Billing and Cost Management User Guide.
UntagResource
Show Description Removes the specified tags from the specified AWS RoboMaker resource. To remove a tag, specify the tag key. To change the tag value of an existing tag key, use TagResource .
UpdateRobotApplication
Show Description Updates a robot application.
UpdateSimulationApplication
Show Description Updates a simulation application.

Route53-recovery-cluster Events

Service Event Name Description
route53-recovery-cluster GetRoutingControlState
Show Description Get the state for a routing control. A routing control is a simple on/off switch that you can use to route traffic to cells. When the state is On, traffic flows to a cell. When it's off, traffic does not flow. Before you can create a routing control, you first must create a cluster to host the control. For more information, see CreateCluster. Access one of the endpoints for the cluster to get or update the routing control state to redirect traffic. For more information about working with routing controls, see Routing control in the Route 53 Application Recovery Controller Developer Guide.
UpdateRoutingControlState
Show Description Set the state of the routing control to reroute traffic. You can set the value to be On or Off. When the state is On, traffic flows to a cell. When it's off, traffic does not flow. For more information about working with routing controls, see Routing control in the Route 53 Application Recovery Controller Developer Guide.

Route53-recovery-control-config Events

Service Event Name Description
route53-recovery-control-config CreateCluster
Show Description Create a new cluster. A cluster is a set of redundant Regional endpoints against which you can run API calls to update or get the state of one or more routing controls. Each cluster has a name, status, Amazon Resource Name (ARN), and an array of the five cluster endpoints (one for each supported Amazon Web Services Region) that you can use with API calls to the Amazon Route 53 Application Recovery Controller cluster data plane.
CreateControlPanel
Show Description Creates a new control panel. A control panel represents a group of routing controls that can be changed together in a single transaction. You can use a control panel to centrally view the operational status of applications across your organization, and trigger multi-app failovers in a single transaction, for example, to fail over an Availability Zone or AWS Region.
CreateRoutingControl
Show Description Creates a new routing control. A routing control has one of two states: ON and OFF. You can map the routing control state to the state of an Amazon Route 53 health check, which can be used to control traffic routing. To get or update the routing control state, see the Recovery Cluster (data plane) API actions for Amazon Route 53 Application Recovery Controller.
CreateSafetyRule
Show Description Creates a safety rule in a control panel. Safety rules let you add safeguards around enabling and disabling routing controls, to help prevent unexpected outcomes. There are two types of safety rules: assertion rules and gating rules. Assertion rule: An assertion rule enforces that, when a routing control state is changed, the criteria set by the rule configuration is met. Otherwise, the change to the routing control is not accepted. Gating rule: A gating rule verifies that a set of gating controls evaluates as true, based on a rule configuration that you specify. If the gating rule evaluates to true, Amazon Route 53 Application Recovery Controller allows a set of routing control state changes to run and complete against the set of target controls.
DeleteCluster
Show Description Delete a cluster.
DeleteControlPanel
Show Description Deletes a control panel.
DeleteRoutingControl
Show Description Deletes a routing control.
DeleteSafetyRule
Show Description Deletes a safety rule./>
DescribeCluster
Show Description Display the details about a cluster. The response includes the cluster name, endpoints, status, and Amazon Resource Name (ARN).
DescribeControlPanel
Show Description Displays details about a control panel.
DescribeRoutingControl
Show Description Displays details about a routing control. A routing control has one of two states: ON and OFF. You can map the routing control state to the state of an Amazon Route 53 health check, which can be used to control routing. To get or update the routing control state, see the Recovery Cluster (data plane) API actions for Amazon Route 53 Application Recovery Controller.
DescribeSafetyRule
Show Description Describes the safety rules (that is, the assertion rules and gating rules) for the routing controls in a control panel.
ListAssociatedRoute53HealthChecks
Show Description Returns an array of all Amazon Route 53 health checks associated with a specific routing control.
ListClusters
Show Description Returns an array of all the clusters in an account.
ListControlPanels
Show Description Returns an array of control panels for a cluster.
ListRoutingControls
Show Description Returns an array of routing controls for a control panel. A routing control is an Amazon Route 53 Application Recovery Controller construct that has one of two states: ON and OFF. You can map the routing control state to the state of an Amazon Route 53 health check, which can be used to control routing.
ListSafetyRules
Show Description List the safety rules (the assertion rules and gating rules) that you've defined for the routing controls in a control panel.
UpdateControlPanel
Show Description Updates a control panel. The only update you can make to a control panel is to change the name of the control panel.
UpdateRoutingControl
Show Description Updates a routing control. You can only update the name of the routing control. To get or update the routing control state, see the Recovery Cluster (data plane) API actions for Amazon Route 53 Application Recovery Controller.

Route53-recovery-readiness Events

Service Event Name Description
route53-recovery-readiness CreateCell
Show Description Creates a new Cell.
CreateCrossAccountAuthorization
Show Description Create a new cross account readiness authorization.
CreateReadinessCheck
Show Description Creates a new Readiness Check.
CreateRecoveryGroup
Show Description Creates a new Recovery Group.
CreateResourceSet
Show Description Creates a new Resource Set.
DeleteCell
DeleteCrossAccountAuthorization
Show Description Delete cross account readiness authorization
DeleteReadinessCheck
DeleteRecoveryGroup
DeleteResourceSet
GetArchitectureRecommendations
Show Description Returns a collection of recommendations to improve resilliance and readiness check quality for a Recovery Group.
GetCell
Show Description Returns information about a Cell.
GetCellReadinessSummary
Show Description Returns information about readiness of a Cell.
GetReadinessCheck
Show Description Returns information about a ReadinessCheck.
GetReadinessCheckResourceStatus
Show Description Returns detailed information about the status of an individual resource within a Readiness Check's Resource Set.
GetReadinessCheckStatus
Show Description Returns information about the status of a Readiness Check.
GetRecoveryGroup
Show Description Returns information about a Recovery Group.
GetRecoveryGroupReadinessSummary
Show Description Returns information about a Recovery Group.
GetResourceSet
Show Description Returns information about a Resource Set.
ListCells
Show Description Returns a collection of Cells.
ListCrossAccountAuthorizations
Show Description Returns a collection of cross account readiness authorizations.
ListReadinessChecks
Show Description Returns a collection of Readiness Checks.
ListRecoveryGroups
Show Description Returns a collection of Recovery Groups.
ListResourceSets
Show Description Returns a collection of Resource Sets.
ListRules
Show Description Returns a collection of rules that are applied as part of Readiness Checks.
ListTagsForResources
Show Description Returns a list of the tags assigned to the specified resource.
TagResource
Show Description Adds tags to the specified resource. You can specify one or more tags to add.
UntagResource
UpdateCell
Show Description Updates an existing Cell.
UpdateReadinessCheck
Show Description Updates an exisiting Readiness Check.
UpdateRecoveryGroup
Show Description Updates an existing Recovery Group.

Route53 Events

Service Event Name Description
route53 ActivateKeySigningKey
Show Description Activates a key-signing key (KSK) so that it can be used for signing by DNSSEC. This operation changes the KSK status to ACTIVE.
AssociateVPCWithHostedZone
Show Description Associates an Amazon VPC with a private hosted zone. To perform the association, the VPC and the private hosted zone must already exist. You can't convert a public hosted zone into a private hosted zone. If you want to associate a VPC that was created by using one Amazon Web Services account with a private hosted zone that was created by using a different account, the Amazon Web Services account that created the private hosted zone must first submit a CreateVPCAssociationAuthorization request. Then the account that created the VPC must submit an AssociateVPCWithHostedZone request.
ChangeResourceRecordSets
Show Description Creates, changes, or deletes a resource record set, which contains authoritative DNS information for a specified domain name or subdomain name. For example, you can use ChangeResourceRecordSets to create a resource record set that routes traffic for test.example.com to a web server that has an IP address of 192.0.2.44. Deleting Resource Record Sets To delete a resource record set, you must specify all the same values that you specified when you created it. Change Batches and Transactional Changes The request body must include a document with a ChangeResourceRecordSetsRequest element. The request body contains a list of change items, known as a change batch. Change batches are considered transactional changes. Route 53 validates the changes in the request and then either makes all or none of the changes in the change batch request. This ensures that DNS routing isn't adversely affected by partial changes to the resource record sets in a hosted zone. For example, suppose a change batch request contains two changes: it deletes the CNAME resource record set for www.example.com and creates an alias resource record set for www.example.com. If validation for both records succeeds, Route 53 deletes the first resource record set and creates the second resource record set in a single operation. If validation for either the DELETE or the CREATE action fails, then the request is canceled, and the original CNAME record continues to exist. If you try to delete the same resource record set more than once in a single change batch, Route 53 returns an InvalidChangeBatch error. Traffic Flow To create resource record sets for complex routing configurations, use either the traffic flow visual editor in the Route 53 console or the API actions for traffic policies and traffic policy instances. Save the configuration as a traffic policy, then associate the traffic policy with one or more domain names (such as example.com) or subdomain names (such as www.example.com), in the same hosted zone or in multiple hosted zones. You can roll back the updates if the new configuration isn't performing as expected. For more information, see Using Traffic Flow to Route DNS Traffic in the Amazon Route 53 Developer Guide. Create, Delete, and Upsert Use ChangeResourceRecordsSetsRequest to perform the following actions:
  • CREATE: Creates a resource record set that has the specified values.
  • DELETE: Deletes an existing resource record set that has the specified values.
  • UPSERT: If a resource record set does not already exist, Amazon Web Services creates it. If a resource set does exist, Route 53 updates it with the values in the request.
Syntaxes for Creating, Updating, and Deleting Resource Record Sets The syntax for a request depends on the type of resource record set that you want to create, delete, or update, such as weighted, alias, or failover. The XML elements in your request must appear in the order listed in the syntax. For an example for each type of resource record set, see "Examples." Don't refer to the syntax in the "Parameter Syntax" section, which includes all of the elements for every kind of resource record set that you can create, delete, or update by using ChangeResourceRecordSets. Change Propagation to Route 53 DNS Servers When you submit a ChangeResourceRecordSets request, Route 53 propagates your changes to all of the Route 53 authoritative DNS servers. While your changes are propagating, GetChange returns a status of PENDING. When propagation is complete, GetChange returns a status of INSYNC. Changes generally propagate to all Route 53 name servers within 60 seconds. For more information, see GetChange. Limits on ChangeResourceRecordSets Requests For information about the limits on a ChangeResourceRecordSets request, see Limits in the Amazon Route 53 Developer Guide.
ChangeTagsForResource
Show Description Adds, edits, or deletes tags for a health check or a hosted zone. For information about using tags for cost allocation, see Using Cost Allocation Tags in the Billing and Cost Management User Guide.
CreateHealthCheck
Show Description Creates a new health check. For information about adding health checks to resource record sets, see HealthCheckId in ChangeResourceRecordSets. ELB Load Balancers If you're registering EC2 instances with an Elastic Load Balancing (ELB) load balancer, do not create Amazon Route 53 health checks for the EC2 instances. When you register an EC2 instance with a load balancer, you configure settings for an ELB health check, which performs a similar function to a Route 53 health check. Private Hosted Zones You can associate health checks with failover resource record sets in a private hosted zone. Note the following:
  • Route 53 health checkers are outside the VPC. To check the health of an endpoint within a VPC by IP address, you must assign a public IP address to the instance in the VPC.
  • You can configure a health checker to check the health of an external resource that the instance relies on, such as a database server.
  • You can create a CloudWatch metric, associate an alarm with the metric, and then create a health check that is based on the state of the alarm. For example, you might create a CloudWatch metric that checks the status of the Amazon EC2 StatusCheckFailed metric, add an alarm to the metric, and then create a health check that is based on the state of the alarm. For information about creating CloudWatch metrics and alarms by using the CloudWatch console, see the Amazon CloudWatch User Guide.
CreateHostedZone
Show Description Creates a new public or private hosted zone. You create records in a public hosted zone to define how you want to route traffic on the internet for a domain, such as example.com, and its subdomains (apex.example.com, acme.example.com). You create records in a private hosted zone to define how you want to route traffic for a domain and its subdomains within one or more Amazon Virtual Private Clouds (Amazon VPCs). You can't convert a public hosted zone to a private hosted zone or vice versa. Instead, you must create a new hosted zone with the same name and create new resource record sets. For more information about charges for hosted zones, see Amazon Route 53 Pricing. Note the following:
  • You can't create a hosted zone for a top-level domain (TLD) such as .com.
  • For public hosted zones, Route 53 automatically creates a default SOA record and four NS records for the zone. For more information about SOA and NS records, see NS and SOA Records that Route 53 Creates for a Hosted Zone in the Amazon Route 53 Developer Guide. If you want to use the same name servers for multiple public hosted zones, you can optionally associate a reusable delegation set with the hosted zone. See the DelegationSetId element.
  • If your domain is registered with a registrar other than Route 53, you must update the name servers with your registrar to make Route 53 the DNS service for the domain. For more information, see Migrating DNS Service for an Existing Domain to Amazon Route 53 in the Amazon Route 53 Developer Guide.
When you submit a CreateHostedZone request, the initial status of the hosted zone is PENDING. For public hosted zones, this means that the NS and SOA records are not yet available on all Route 53 DNS servers. When the NS and SOA records are available, the status of the zone changes to INSYNC. The CreateHostedZone request requires the caller to have an ec2:DescribeVpcs permission.
CreateKeySigningKey
Show Description Creates a new key-signing key (KSK) associated with a hosted zone. You can only have two KSKs per hosted zone.
CreateQueryLoggingConfig
Show Description Creates a configuration for DNS query logging. After you create a query logging configuration, Amazon Route 53 begins to publish log data to an Amazon CloudWatch Logs log group. DNS query logs contain information about the queries that Route 53 receives for a specified public hosted zone, such as the following:
  • Route 53 edge location that responded to the DNS query
  • Domain or subdomain that was requested
  • DNS record type, such as A or AAAA
  • DNS response code, such as NoError or ServFail
Log Group and Resource Policy
Before you create a query logging configuration, perform the following operations. If you create a query logging configuration using the Route 53 console, Route 53 performs these operations automatically.
  1. Create a CloudWatch Logs log group, and make note of the ARN, which you specify when you create a query logging configuration. Note the following:
    • You must create the log group in the us-east-1 region.
    • You must use the same Amazon Web Services account to create the log group and the hosted zone that you want to configure query logging for.
    • When you create log groups for query logging, we recommend that you use a consistent prefix, for example: /aws/route53/hosted zone name In the next step, you'll create a resource policy, which controls access to one or more log groups and the associated Amazon Web Services resources, such as Route 53 hosted zones. There's a limit on the number of resource policies that you can create, so we recommend that you use a consistent prefix so you can use the same resource policy for all the log groups that you create for query logging.
  2. Create a CloudWatch Logs resource policy, and give it the permissions that Route 53 needs to create log streams and to send query logs to log streams. For the value of Resource, specify the ARN for the log group that you created in the previous step. To use the same resource policy for all the CloudWatch Logs log groups that you created for query logging configurations, replace the hosted zone name with *, for example: arn:aws:logs:us-east-1:123412341234:log-group:/aws/route53/* You can't use the CloudWatch console to create or edit a resource policy. You must use the CloudWatch API, one of the Amazon Web Services SDKs, or the CLI.
Log Streams and Edge Locations
When Route 53 finishes creating the configuration for DNS query logging, it does the following:
  • Creates a log stream for an edge location the first time that the edge location responds to DNS queries for the specified hosted zone. That log stream is used to log all queries that Route 53 responds to for that edge location.
  • Begins to send query logs to the applicable log stream.
The name of each log stream is in the following format: hosted zone ID/edge location code The edge location code is a three-letter code and an arbitrarily assigned number, for example, DFW3. The three-letter code typically corresponds with the International Air Transport Association airport code for an airport near the edge location. (These abbreviations might change in the future.) For a list of edge locations, see "The Route 53 Global Network" on the Route 53 Product Details page.
Queries That Are Logged
Query logs contain only the queries that DNS resolvers forward to Route 53. If a DNS resolver has already cached the response to a query (such as the IP address for a load balancer for example.com), the resolver will continue to return the cached response. It doesn't forward another query to Route 53 until the TTL for the corresponding resource record set expires. Depending on how many DNS queries are submitted for a resource record set, and depending on the TTL for that resource record set, query logs might contain information about only one query out of every several thousand queries that are submitted to DNS. For more information about how DNS works, see Routing Internet Traffic to Your Website or Web Application in the Amazon Route 53 Developer Guide.
Log File Format
For a list of the values in each query log and the format of each value, see Logging DNS Queries in the Amazon Route 53 Developer Guide.
Pricing
For information about charges for query logs, see Amazon CloudWatch Pricing.
How to Stop Logging
If you want Route 53 to stop sending query logs to CloudWatch Logs, delete the query logging configuration. For more information, see DeleteQueryLoggingConfig.
CreateReusableDelegationSet
Show Description Creates a delegation set (a group of four name servers) that can be reused by multiple hosted zones that were created by the same Amazon Web Services account. You can also create a reusable delegation set that uses the four name servers that are associated with an existing hosted zone. Specify the hosted zone ID in the CreateReusableDelegationSet request. You can't associate a reusable delegation set with a private hosted zone. For information about using a reusable delegation set to configure white label name servers, see Configuring White Label Name Servers. The process for migrating existing hosted zones to use a reusable delegation set is comparable to the process for configuring white label name servers. You need to perform the following steps:
  1. Create a reusable delegation set.
  2. Recreate hosted zones, and reduce the TTL to 60 seconds or less.
  3. Recreate resource record sets in the new hosted zones.
  4. Change the registrar's name servers to use the name servers for the new hosted zones.
  5. Monitor traffic for the website or application.
  6. Change TTLs back to their original values.
If you want to migrate existing hosted zones to use a reusable delegation set, the existing hosted zones can't use any of the name servers that are assigned to the reusable delegation set. If one or more hosted zones do use one or more name servers that are assigned to the reusable delegation set, you can do one of the following:
  • For small numbers of hosted zones—up to a few hundred—it's relatively easy to create reusable delegation sets until you get one that has four name servers that don't overlap with any of the name servers in your hosted zones.
  • For larger numbers of hosted zones, the easiest solution is to use more than one reusable delegation set.
  • For larger numbers of hosted zones, you can also migrate hosted zones that have overlapping name servers to hosted zones that don't have overlapping name servers, then migrate the hosted zones again to use the reusable delegation set.
CreateTrafficPolicy
Show Description Creates a traffic policy, which you use to create multiple DNS resource record sets for one domain name (such as example.com) or one subdomain name (such as www.example.com).
CreateTrafficPolicyInstance
Show Description Creates resource record sets in a specified hosted zone based on the settings in a specified traffic policy version. In addition, CreateTrafficPolicyInstance associates the resource record sets with a specified domain name (such as example.com) or subdomain name (such as www.example.com). Amazon Route 53 responds to DNS queries for the domain or subdomain name by using the resource record sets that CreateTrafficPolicyInstance created.
CreateTrafficPolicyVersion
Show Description Creates a new version of an existing traffic policy. When you create a new version of a traffic policy, you specify the ID of the traffic policy that you want to update and a JSON-formatted document that describes the new version. You use traffic policies to create multiple DNS resource record sets for one domain name (such as example.com) or one subdomain name (such as www.example.com). You can create a maximum of 1000 versions of a traffic policy. If you reach the limit and need to create another version, you'll need to start a new traffic policy.
CreateVPCAssociationAuthorization
Show Description Authorizes the Amazon Web Services account that created a specified VPC to submit an AssociateVPCWithHostedZone request to associate the VPC with a specified hosted zone that was created by a different account. To submit a CreateVPCAssociationAuthorization request, you must use the account that created the hosted zone. After you authorize the association, use the account that created the VPC to submit an AssociateVPCWithHostedZone request. If you want to associate multiple VPCs that you created by using one account with a hosted zone that you created by using a different account, you must submit one authorization request for each VPC.
DeactivateKeySigningKey
Show Description Deactivates a key-signing key (KSK) so that it will not be used for signing by DNSSEC. This operation changes the KSK status to INACTIVE.
DeleteHealthCheck
Show Description Deletes a health check. Amazon Route 53 does not prevent you from deleting a health check even if the health check is associated with one or more resource record sets. If you delete a health check and you don't update the associated resource record sets, the future status of the health check can't be predicted and may change. This will affect the routing of DNS queries for your DNS failover configuration. For more information, see Replacing and Deleting Health Checks in the Amazon Route 53 Developer Guide. If you're using Cloud Map and you configured Cloud Map to create a Route 53 health check when you register an instance, you can't use the Route 53 DeleteHealthCheck command to delete the health check. The health check is deleted automatically when you deregister the instance; there can be a delay of several hours before the health check is deleted from Route 53.
DeleteHostedZone
Show Description Deletes a hosted zone. If the hosted zone was created by another service, such as Cloud Map, see Deleting Public Hosted Zones That Were Created by Another Service in the Amazon Route 53 Developer Guide for information about how to delete it. (The process is the same for public and private hosted zones that were created by another service.) If you want to keep your domain registration but you want to stop routing internet traffic to your website or web application, we recommend that you delete resource record sets in the hosted zone instead of deleting the hosted zone. If you delete a hosted zone, you can't undelete it. You must create a new hosted zone and update the name servers for your domain registration, which can require up to 48 hours to take effect. (If you delegated responsibility for a subdomain to a hosted zone and you delete the child hosted zone, you must update the name servers in the parent hosted zone.) In addition, if you delete a hosted zone, someone could hijack the domain and route traffic to their own resources using your domain name. If you want to avoid the monthly charge for the hosted zone, you can transfer DNS service for the domain to a free DNS service. When you transfer DNS service, you have to update the name servers for the domain registration. If the domain is registered with Route 53, see UpdateDomainNameservers for information about how to replace Route 53 name servers with name servers for the new DNS service. If the domain is registered with another registrar, use the method provided by the registrar to update name servers for the domain registration. For more information, perform an internet search on "free DNS service." You can delete a hosted zone only if it contains only the default SOA record and NS resource record sets. If the hosted zone contains other resource record sets, you must delete them before you can delete the hosted zone. If you try to delete a hosted zone that contains other resource record sets, the request fails, and Route 53 returns a HostedZoneNotEmpty error. For information about deleting records from your hosted zone, see ChangeResourceRecordSets. To verify that the hosted zone has been deleted, do one of the following:
  • Use the GetHostedZone action to request information about the hosted zone.
  • Use the ListHostedZones action to get a list of the hosted zones associated with the current Amazon Web Services account.
DeleteKeySigningKey
Show Description Deletes a key-signing key (KSK). Before you can delete a KSK, you must deactivate it. The KSK must be deactivated before you can delete it regardless of whether the hosted zone is enabled for DNSSEC signing.
DeleteQueryLoggingConfig
Show Description Deletes a configuration for DNS query logging. If you delete a configuration, Amazon Route 53 stops sending query logs to CloudWatch Logs. Route 53 doesn't delete any logs that are already in CloudWatch Logs. For more information about DNS query logs, see CreateQueryLoggingConfig.
DeleteReusableDelegationSet
Show Description Deletes a reusable delegation set. You can delete a reusable delegation set only if it isn't associated with any hosted zones. To verify that the reusable delegation set is not associated with any hosted zones, submit a GetReusableDelegationSet request and specify the ID of the reusable delegation set that you want to delete.
DeleteTrafficPolicy
Show Description Deletes a traffic policy. When you delete a traffic policy, Route 53 sets a flag on the policy to indicate that it has been deleted. However, Route 53 never fully deletes the traffic policy. Note the following:
  • Deleted traffic policies aren't listed if you run ListTrafficPolicies.
  • There's no way to get a list of deleted policies.
  • If you retain the ID of the policy, you can get information about the policy, including the traffic policy document, by running GetTrafficPolicy.
DeleteTrafficPolicyInstance
Show Description Deletes a traffic policy instance and all of the resource record sets that Amazon Route 53 created when you created the instance. In the Route 53 console, traffic policy instances are known as policy records.
DeleteVPCAssociationAuthorization
Show Description Removes authorization to submit an AssociateVPCWithHostedZone request to associate a specified VPC with a hosted zone that was created by a different account. You must use the account that created the hosted zone to submit a DeleteVPCAssociationAuthorization request. Sending this request only prevents the Amazon Web Services account that created the VPC from associating the VPC with the Amazon Route 53 hosted zone in the future. If the VPC is already associated with the hosted zone, DeleteVPCAssociationAuthorization won't disassociate the VPC from the hosted zone. If you want to delete an existing association, use DisassociateVPCFromHostedZone.
DisableHostedZoneDNSSEC
Show Description Disables DNSSEC signing in a specific hosted zone. This action does not deactivate any key-signing keys (KSKs) that are active in the hosted zone.
DisassociateVPCFromHostedZone
Show Description Disassociates an Amazon Virtual Private Cloud (Amazon VPC) from an Amazon Route 53 private hosted zone. Note the following:
  • You can't disassociate the last Amazon VPC from a private hosted zone.
  • You can't convert a private hosted zone into a public hosted zone.
  • You can submit a DisassociateVPCFromHostedZone request using either the account that created the hosted zone or the account that created the Amazon VPC.
  • Some services, such as Cloud Map and Amazon Elastic File System (Amazon EFS) automatically create hosted zones and associate VPCs with the hosted zones. A service can create a hosted zone using your account or using its own account. You can disassociate a VPC from a hosted zone only if the service created the hosted zone using your account. When you run DisassociateVPCFromHostedZone, if the hosted zone has a value for OwningAccount, you can use DisassociateVPCFromHostedZone. If the hosted zone has a value for OwningService, you can't use DisassociateVPCFromHostedZone.
EnableHostedZoneDNSSEC
Show Description Enables DNSSEC signing in a specific hosted zone.
GetAccountLimit
Show Description Gets the specified limit for the current account, for example, the maximum number of health checks that you can create using the account. For the default limit, see Limits in the Amazon Route 53 Developer Guide. To request a higher limit, open a case. You can also view account limits in Amazon Web Services Trusted Advisor. Sign in to the Amazon Web Services Management Console and open the Trusted Advisor console at https://console.aws.amazon.com/trustedadvisor/. Then choose Service limits in the navigation pane.
GetChange
Show Description Returns the current status of a change batch request. The status is one of the following values:
  • PENDING indicates that the changes in this request have not propagated to all Amazon Route 53 DNS servers. This is the initial status of all change batch requests.
  • INSYNC indicates that the changes have propagated to all Route 53 DNS servers.
GetCheckerIpRanges
Show Description Route 53 does not perform authorization for this API because it retrieves information that is already available to the public. GetCheckerIpRanges still works, but we recommend that you download ip-ranges.json, which includes IP address ranges for all Amazon Web Services services. For more information, see IP Address Ranges of Amazon Route 53 Servers in the Amazon Route 53 Developer Guide.
GetDNSSEC
Show Description Returns information about DNSSEC for a specific hosted zone, including the key-signing keys (KSKs) in the hosted zone.
GetGeoLocation
Show Description Gets information about whether a specified geographic location is supported for Amazon Route 53 geolocation resource record sets. Route 53 does not perform authorization for this API because it retrieves information that is already available to the public. Use the following syntax to determine whether a continent is supported for geolocation: GET /2013-04-01/geolocation?continentcode=two-letter abbreviation for a continent Use the following syntax to determine whether a country is supported for geolocation: GET /2013-04-01/geolocation?countrycode=two-character country code Use the following syntax to determine whether a subdivision of a country is supported for geolocation: GET /2013-04-01/geolocation?countrycode=two-character country code&subdivisioncode=subdivision code
GetHealthCheck
Show Description Gets information about a specified health check.
GetHealthCheckCount
Show Description Retrieves the number of health checks that are associated with the current Amazon Web Services account.
GetHealthCheckLastFailureReason
Show Description Gets the reason that a specified health check failed most recently.
GetHealthCheckStatus
Show Description Gets status of a specified health check. This API is intended for use during development to diagnose behavior. It doesn’t support production use-cases with high query rates that require immediate and actionable responses.
GetHostedZone
Show Description Gets information about a specified hosted zone including the four name servers assigned to the hosted zone.
GetHostedZoneCount
Show Description Retrieves the number of hosted zones that are associated with the current Amazon Web Services account.
GetHostedZoneLimit
Show Description Gets the specified limit for a specified hosted zone, for example, the maximum number of records that you can create in the hosted zone. For the default limit, see Limits in the Amazon Route 53 Developer Guide. To request a higher limit, open a case.
GetQueryLoggingConfig
Show Description Gets information about a specified configuration for DNS query logging. For more information about DNS query logs, see CreateQueryLoggingConfig and Logging DNS Queries.
GetReusableDelegationSet
Show Description Retrieves information about a specified reusable delegation set, including the four name servers that are assigned to the delegation set.
GetReusableDelegationSetLimit
Show Description Gets the maximum number of hosted zones that you can associate with the specified reusable delegation set. For the default limit, see Limits in the Amazon Route 53 Developer Guide. To request a higher limit, open a case.
GetTrafficPolicy
Show Description Gets information about a specific traffic policy version. For information about how of deleting a traffic policy affects the response from GetTrafficPolicy, see DeleteTrafficPolicy.
GetTrafficPolicyInstance
Show Description Gets information about a specified traffic policy instance. After you submit a CreateTrafficPolicyInstance or an UpdateTrafficPolicyInstance request, there's a brief delay while Amazon Route 53 creates the resource record sets that are specified in the traffic policy definition. For more information, see the State response element. In the Route 53 console, traffic policy instances are known as policy records.
GetTrafficPolicyInstanceCount
Show Description Gets the number of traffic policy instances that are associated with the current Amazon Web Services account.
ListGeoLocations
Show Description Retrieves a list of supported geographic locations. Countries are listed first, and continents are listed last. If Amazon Route 53 supports subdivisions for a country (for example, states or provinces), the subdivisions for that country are listed in alphabetical order immediately after the corresponding country. Route 53 does not perform authorization for this API because it retrieves information that is already available to the public. For a list of supported geolocation codes, see the GeoLocation data type.
ListHealthChecks
Show Description Retrieve a list of the health checks that are associated with the current Amazon Web Services account.
ListHostedZones
Show Description Retrieves a list of the public and private hosted zones that are associated with the current Amazon Web Services account. The response includes a HostedZones child element for each hosted zone. Amazon Route 53 returns a maximum of 100 items in each response. If you have a lot of hosted zones, you can use the maxitems parameter to list them in groups of up to 100.
ListHostedZonesByName
Show Description Retrieves a list of your hosted zones in lexicographic order. The response includes a HostedZones child element for each hosted zone created by the current Amazon Web Services account. ListHostedZonesByName sorts hosted zones by name with the labels reversed. For example: com.example.www. Note the trailing dot, which can change the sort order in some circumstances. If the domain name includes escape characters or Punycode, ListHostedZonesByName alphabetizes the domain name using the escaped or Punycoded value, which is the format that Amazon Route 53 saves in its database. For example, to create a hosted zone for exämple.com, you specify ex\344mple.com for the domain name. ListHostedZonesByName alphabetizes it as: com.ex\344mple. The labels are reversed and alphabetized using the escaped value. For more information about valid domain name formats, including internationalized domain names, see DNS Domain Name Format in the Amazon Route 53 Developer Guide. Route 53 returns up to 100 items in each response. If you have a lot of hosted zones, use the MaxItems parameter to list them in groups of up to 100. The response includes values that help navigate from one group of MaxItems hosted zones to the next:
  • The DNSName and HostedZoneId elements in the response contain the values, if any, specified for the dnsname and hostedzoneid parameters in the request that produced the current response.
  • The MaxItems element in the response contains the value, if any, that you specified for the maxitems parameter in the request that produced the current response.
  • If the value of IsTruncated in the response is true, there are more hosted zones associated with the current Amazon Web Services account. If IsTruncated is false, this response includes the last hosted zone that is associated with the current account. The NextDNSName element and NextHostedZoneId elements are omitted from the response.
  • The NextDNSName and NextHostedZoneId elements in the response contain the domain name and the hosted zone ID of the next hosted zone that is associated with the current Amazon Web Services account. If you want to list more hosted zones, make another call to ListHostedZonesByName, and specify the value of NextDNSName and NextHostedZoneId in the dnsname and hostedzoneid parameters, respectively.
ListHostedZonesByVPC
Show Description Lists all the private hosted zones that a specified VPC is associated with, regardless of which Amazon Web Services account or Amazon Web Services service owns the hosted zones. The HostedZoneOwner structure in the response contains one of the following values:
  • An OwningAccount element, which contains the account number of either the current Amazon Web Services account or another Amazon Web Services account. Some services, such as Cloud Map, create hosted zones using the current account.
  • An OwningService element, which identifies the Amazon Web Services service that created and owns the hosted zone. For example, if a hosted zone was created by Amazon Elastic File System (Amazon EFS), the value of Owner is efs.amazonaws.com.
ListQueryLoggingConfigs
Show Description Lists the configurations for DNS query logging that are associated with the current Amazon Web Services account or the configuration that is associated with a specified hosted zone. For more information about DNS query logs, see CreateQueryLoggingConfig. Additional information, including the format of DNS query logs, appears in Logging DNS Queries in the Amazon Route 53 Developer Guide.
ListResourceRecordSets
Show Description Lists the resource record sets in a specified hosted zone. ListResourceRecordSets returns up to 300 resource record sets at a time in ASCII order, beginning at a position specified by the name and type elements. Sort order ListResourceRecordSets sorts results first by DNS name with the labels reversed, for example: com.example.www. Note the trailing dot, which can change the sort order when the record name contains characters that appear before . (decimal 46) in the ASCII table. These characters include the following: ! " # $ % & ' ( ) * + , - When multiple records have the same DNS name, ListResourceRecordSets sorts results by the record type. Specifying where to start listing records You can use the name and type elements to specify the resource record set that the list begins with:
If you do not specify Name or Type
The results begin with the first resource record set that the hosted zone contains.
If you specify Name but not Type
The results begin with the first resource record set in the list whose name is greater than or equal to Name.
If you specify Type but not Name
Amazon Route 53 returns the InvalidInput error.
If you specify both Name and Type
The results begin with the first resource record set in the list whose name is greater than or equal to Name, and whose type is greater than or equal to Type.
Resource record sets that are PENDING This action returns the most current version of the records. This includes records that are PENDING, and that are not yet available on all Route 53 DNS servers. Changing resource record sets To ensure that you get an accurate listing of the resource record sets for a hosted zone at a point in time, do not submit a ChangeResourceRecordSets request while you're paging through the results of a ListResourceRecordSets request. If you do, some pages may display results without the latest changes while other pages display results with the latest changes. Displaying the next page of results If a ListResourceRecordSets command returns more than one page of results, the value of IsTruncated is true. To display the next page of results, get the values of NextRecordName, NextRecordType, and NextRecordIdentifier (if any) from the response. Then submit another ListResourceRecordSets request, and specify those values for StartRecordName, StartRecordType, and StartRecordIdentifier.
ListReusableDelegationSets
Show Description Retrieves a list of the reusable delegation sets that are associated with the current Amazon Web Services account.
ListTagsForResource
Show Description Lists tags for one health check or hosted zone. For information about using tags for cost allocation, see Using Cost Allocation Tags in the Billing and Cost Management User Guide.
ListTagsForResources
Show Description Lists tags for up to 10 health checks or hosted zones. For information about using tags for cost allocation, see Using Cost Allocation Tags in the Billing and Cost Management User Guide.
ListTrafficPolicies
Show Description Gets information about the latest version for every traffic policy that is associated with the current Amazon Web Services account. Policies are listed in the order that they were created in. For information about how of deleting a traffic policy affects the response from ListTrafficPolicies, see DeleteTrafficPolicy.
ListTrafficPolicyInstances
Show Description Gets information about the traffic policy instances that you created by using the current Amazon Web Services account. After you submit an UpdateTrafficPolicyInstance request, there's a brief delay while Amazon Route 53 creates the resource record sets that are specified in the traffic policy definition. For more information, see the State response element. Route 53 returns a maximum of 100 items in each response. If you have a lot of traffic policy instances, you can use the MaxItems parameter to list them in groups of up to 100.
ListTrafficPolicyInstancesByHostedZone
Show Description Gets information about the traffic policy instances that you created in a specified hosted zone. After you submit a CreateTrafficPolicyInstance or an UpdateTrafficPolicyInstance request, there's a brief delay while Amazon Route 53 creates the resource record sets that are specified in the traffic policy definition. For more information, see the State response element. Route 53 returns a maximum of 100 items in each response. If you have a lot of traffic policy instances, you can use the MaxItems parameter to list them in groups of up to 100.
ListTrafficPolicyInstancesByPolicy
Show Description Gets information about the traffic policy instances that you created by using a specify traffic policy version. After you submit a CreateTrafficPolicyInstance or an UpdateTrafficPolicyInstance request, there's a brief delay while Amazon Route 53 creates the resource record sets that are specified in the traffic policy definition. For more information, see the State response element. Route 53 returns a maximum of 100 items in each response. If you have a lot of traffic policy instances, you can use the MaxItems parameter to list them in groups of up to 100.
ListTrafficPolicyVersions
Show Description Gets information about all of the versions for a specified traffic policy. Traffic policy versions are listed in numerical order by VersionNumber.
ListVPCAssociationAuthorizations
Show Description Gets a list of the VPCs that were created by other accounts and that can be associated with a specified hosted zone because you've submitted one or more CreateVPCAssociationAuthorization requests. The response includes a VPCs element with a VPC child element for each VPC that can be associated with the hosted zone.
TestDNSAnswer
Show Description Gets the value that Amazon Route 53 returns in response to a DNS request for a specified record name and type. You can optionally specify the IP address of a DNS resolver, an EDNS0 client subnet IP address, and a subnet mask. This call only supports querying public hosted zones.
UpdateHealthCheck
Show Description Updates an existing health check. Note that some values can't be updated. For more information about updating health checks, see Creating, Updating, and Deleting Health Checks in the Amazon Route 53 Developer Guide.
UpdateHostedZoneComment
Show Description Updates the comment for a specified hosted zone.
UpdateTrafficPolicyComment
Show Description Updates the comment for a specified traffic policy version.

Route53domains Events

Service Event Name Description
route53domains AcceptDomainTransferFromAnotherAwsAccount
Show Description Accepts the transfer of a domain from another AWS account to the current AWS account. You initiate a transfer between AWS accounts using TransferDomainToAnotherAwsAccount. Use either ListOperations or GetOperationDetail to determine whether the operation succeeded. GetOperationDetail provides additional information, for example, Domain Transfer from Aws Account 111122223333 has been cancelled.
CancelDomainTransferToAnotherAwsAccount
Show Description Cancels the transfer of a domain from the current AWS account to another AWS account. You initiate a transfer between AWS accounts using TransferDomainToAnotherAwsAccount. You must cancel the transfer before the other AWS account accepts the transfer using AcceptDomainTransferFromAnotherAwsAccount. Use either ListOperations or GetOperationDetail to determine whether the operation succeeded. GetOperationDetail provides additional information, for example, Domain Transfer from Aws Account 111122223333 has been cancelled.
CheckDomainAvailability
Show Description This operation checks the availability of one domain name. Note that if the availability status of a domain is pending, you must submit another request to determine the availability of the domain name.
CheckDomainTransferability
Show Description Checks whether a domain name can be transferred to Amazon Route 53.
DeleteTagsForDomain
Show Description This operation deletes the specified tags for a domain. All tag operations are eventually consistent; subsequent operations might not immediately represent all issued operations.
DisableDomainAutoRenew
Show Description This operation disables automatic renewal of domain registration for the specified domain.
DisableDomainTransferLock
Show Description This operation removes the transfer lock on the domain (specifically the clientTransferProhibited status) to allow domain transfers. We recommend you refrain from performing this action unless you intend to transfer the domain to a different registrar. Successful submission returns an operation ID that you can use to track the progress and completion of the action. If the request is not completed successfully, the domain registrant will be notified by email.
EnableDomainAutoRenew
Show Description This operation configures Amazon Route 53 to automatically renew the specified domain before the domain registration expires. The cost of renewing your domain registration is billed to your AWS account. The period during which you can renew a domain name varies by TLD. For a list of TLDs and their renewal policies, see Domains That You Can Register with Amazon Route 53 in the Amazon Route 53 Developer Guide. Route 53 requires that you renew before the end of the renewal period so we can complete processing before the deadline.
EnableDomainTransferLock
Show Description This operation sets the transfer lock on the domain (specifically the clientTransferProhibited status) to prevent domain transfers. Successful submission returns an operation ID that you can use to track the progress and completion of the action. If the request is not completed successfully, the domain registrant will be notified by email.
GetContactReachabilityStatus
Show Description For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, this operation returns information about whether the registrant contact has responded. If you want us to resend the email, use the ResendContactReachabilityEmail operation.
GetDomainDetail
Show Description This operation returns detailed information about a specified domain that is associated with the current AWS account. Contact information for the domain is also returned as part of the output.
GetDomainSuggestions
Show Description The GetDomainSuggestions operation returns a list of suggested domain names.
GetOperationDetail
Show Description This operation returns the current status of an operation that is not completed.
ListDomains
Show Description This operation returns all the domain names registered with Amazon Route 53 for the current AWS account.
ListOperations
Show Description Returns information about all of the operations that return an operation ID and that have ever been performed on domains that were registered by the current account.
ListTagsForDomain
Show Description This operation returns all of the tags that are associated with the specified domain. All tag operations are eventually consistent; subsequent operations might not immediately represent all issued operations.
RegisterDomain
Show Description This operation registers a domain. Domains are registered either by Amazon Registrar (for .com, .net, and .org domains) or by our registrar associate, Gandi (for all other domains). For some top-level domains (TLDs), this operation requires extra parameters. When you register a domain, Amazon Route 53 does the following:
  • Creates a Route 53 hosted zone that has the same name as the domain. Route 53 assigns four name servers to your hosted zone and automatically updates your domain registration with the names of these name servers.
  • Enables autorenew, so your domain registration will renew automatically each year. We'll notify you in advance of the renewal date so you can choose whether to renew the registration.
  • Optionally enables privacy protection, so WHOIS queries return contact information either for Amazon Registrar (for .com, .net, and .org domains) or for our registrar associate, Gandi (for all other TLDs). If you don't enable privacy protection, WHOIS queries return the information that you entered for the registrant, admin, and tech contacts.
  • If registration is successful, returns an operation ID that you can use to track the progress and completion of the action. If the request is not completed successfully, the domain registrant is notified by email.
  • Charges your AWS account an amount based on the top-level domain. For more information, see Amazon Route 53 Pricing.
RejectDomainTransferFromAnotherAwsAccount
Show Description Rejects the transfer of a domain from another AWS account to the current AWS account. You initiate a transfer between AWS accounts using TransferDomainToAnotherAwsAccount. Use either ListOperations or GetOperationDetail to determine whether the operation succeeded. GetOperationDetail provides additional information, for example, Domain Transfer from Aws Account 111122223333 has been cancelled.
RenewDomain
Show Description This operation renews a domain for the specified number of years. The cost of renewing your domain is billed to your AWS account. We recommend that you renew your domain several weeks before the expiration date. Some TLD registries delete domains before the expiration date if you haven't renewed far enough in advance. For more information about renewing domain registration, see Renewing Registration for a Domain in the Amazon Route 53 Developer Guide.
ResendContactReachabilityEmail
Show Description For operations that require confirmation that the email address for the registrant contact is valid, such as registering a new domain, this operation resends the confirmation email to the current email address for the registrant contact.
RetrieveDomainAuthCode
Show Description This operation returns the AuthCode for the domain. To transfer a domain to another registrar, you provide this value to the new registrar.
TransferDomain
Show Description Transfers a domain from another registrar to Amazon Route 53. When the transfer is complete, the domain is registered either with Amazon Registrar (for .com, .net, and .org domains) or with our registrar associate, Gandi (for all other TLDs). For more information about transferring domains, see the following topics: If the registrar for your domain is also the DNS service provider for the domain, we highly recommend that you transfer your DNS service to Route 53 or to another DNS service provider before you transfer your registration. Some registrars provide free DNS service when you purchase a domain registration. When you transfer the registration, the previous registrar will not renew your domain registration and could end your DNS service at any time. If the registrar for your domain is also the DNS service provider for the domain and you don't transfer DNS service to another provider, your website, email, and the web applications associated with the domain might become unavailable. If the transfer is successful, this method returns an operation ID that you can use to track the progress and completion of the action. If the transfer doesn't complete successfully, the domain registrant will be notified by email.
TransferDomainToAnotherAwsAccount
Show Description Transfers a domain from the current AWS account to another AWS account. Note the following: When you transfer a domain from one AWS account to another, Route 53 doesn't transfer the hosted zone that is associated with the domain. DNS resolution isn't affected if the domain and the hosted zone are owned by separate accounts, so transferring the hosted zone is optional. For information about transferring the hosted zone to another AWS account, see Migrating a Hosted Zone to a Different AWS Account in the Amazon Route 53 Developer Guide. Use either ListOperations or GetOperationDetail to determine whether the operation succeeded. GetOperationDetail provides additional information, for example, Domain Transfer from Aws Account 111122223333 has been cancelled.
UpdateDomainContact
Show Description This operation updates the contact information for a particular domain. You must specify information for at least one contact: registrant, administrator, or technical. If the update is successful, this method returns an operation ID that you can use to track the progress and completion of the action. If the request is not completed successfully, the domain registrant will be notified by email.
UpdateDomainContactPrivacy
Show Description This operation updates the specified domain contact's privacy setting. When privacy protection is enabled, contact information such as email address is replaced either with contact information for Amazon Registrar (for .com, .net, and .org domains) or with contact information for our registrar associate, Gandi. This operation affects only the contact information for the specified contact type (registrant, administrator, or tech). If the request succeeds, Amazon Route 53 returns an operation ID that you can use with GetOperationDetail to track the progress and completion of the action. If the request doesn't complete successfully, the domain registrant will be notified by email. By disabling the privacy service via API, you consent to the publication of the contact information provided for this domain via the public WHOIS database. You certify that you are the registrant of this domain name and have the authority to make this decision. You may withdraw your consent at any time by enabling privacy protection using either UpdateDomainContactPrivacy or the Route 53 console. Enabling privacy protection removes the contact information provided for this domain from the WHOIS database. For more information on our privacy practices, see https://aws.amazon.com/privacy/.
UpdateDomainNameservers
Show Description This operation replaces the current set of name servers for the domain with the specified set of name servers. If you use Amazon Route 53 as your DNS service, specify the four name servers in the delegation set for the hosted zone for the domain. If successful, this operation returns an operation ID that you can use to track the progress and completion of the action. If the request is not completed successfully, the domain registrant will be notified by email.
UpdateTagsForDomain
Show Description This operation adds or updates tags for a specified domain. All tag operations are eventually consistent; subsequent operations might not immediately represent all issued operations.

Route53resolver Events

Service Event Name Description
route53resolver AssociateFirewallRuleGroup
Show Description Associates a FirewallRuleGroup with a VPC, to provide DNS filtering for the VPC.
AssociateResolverEndpointIpAddress
Show Description Adds IP addresses to an inbound or an outbound Resolver endpoint. If you want to add more than one IP address, submit one AssociateResolverEndpointIpAddress request for each IP address. To remove an IP address from an endpoint, see DisassociateResolverEndpointIpAddress.
AssociateResolverQueryLogConfig
Show Description Associates an Amazon VPC with a specified query logging configuration. Route 53 Resolver logs DNS queries that originate in all of the Amazon VPCs that are associated with a specified query logging configuration. To associate more than one VPC with a configuration, submit one AssociateResolverQueryLogConfig request for each VPC. The VPCs that you associate with a query logging configuration must be in the same Region as the configuration. To remove a VPC from a query logging configuration, see DisassociateResolverQueryLogConfig.
AssociateResolverRule
Show Description Associates a Resolver rule with a VPC. When you associate a rule with a VPC, Resolver forwards all DNS queries for the domain name that is specified in the rule and that originate in the VPC. The queries are forwarded to the IP addresses for the DNS resolvers that are specified in the rule. For more information about rules, see CreateResolverRule.
CreateFirewallDomainList
Show Description Creates an empty firewall domain list for use in DNS Firewall rules. You can populate the domains for the new list with a file, using ImportFirewallDomains, or with domain strings, using UpdateFirewallDomains.
CreateFirewallRule
Show Description Creates a single DNS Firewall rule in the specified rule group, using the specified domain list.
CreateFirewallRuleGroup
Show Description Creates an empty DNS Firewall rule group for filtering DNS network traffic in a VPC. You can add rules to the new rule group by calling CreateFirewallRule.
CreateResolverEndpoint
Show Description Creates a Resolver endpoint. There are two types of Resolver endpoints, inbound and outbound:
  • An inbound Resolver endpoint forwards DNS queries to the DNS service for a VPC from your network.
  • An outbound Resolver endpoint forwards DNS queries from the DNS service for a VPC to your network.
CreateResolverQueryLogConfig
Show Description Creates a Resolver query logging configuration, which defines where you want Resolver to save DNS query logs that originate in your VPCs. Resolver can log queries only for VPCs that are in the same Region as the query logging configuration. To specify which VPCs you want to log queries for, you use AssociateResolverQueryLogConfig. For more information, see AssociateResolverQueryLogConfig. You can optionally use Resource Access Manager (RAM) to share a query logging configuration with other Amazon Web Services accounts. The other accounts can then associate VPCs with the configuration. The query logs that Resolver creates for a configuration include all DNS queries that originate in all VPCs that are associated with the configuration.
CreateResolverRule
Show Description For DNS queries that originate in your VPCs, specifies which Resolver endpoint the queries pass through, one domain name that you want to forward to your network, and the IP addresses of the DNS resolvers in your network.
DeleteFirewallDomainList
Show Description Deletes the specified domain list.
DeleteFirewallRule
Show Description Deletes the specified firewall rule.
DeleteFirewallRuleGroup
Show Description Deletes the specified firewall rule group.
DeleteResolverEndpoint
Show Description Deletes a Resolver endpoint. The effect of deleting a Resolver endpoint depends on whether it's an inbound or an outbound Resolver endpoint:
  • Inbound: DNS queries from your network are no longer routed to the DNS service for the specified VPC.
  • Outbound: DNS queries from a VPC are no longer routed to your network.
DeleteResolverQueryLogConfig
Show Description Deletes a query logging configuration. When you delete a configuration, Resolver stops logging DNS queries for all of the Amazon VPCs that are associated with the configuration. This also applies if the query logging configuration is shared with other Amazon Web Services accounts, and the other accounts have associated VPCs with the shared configuration. Before you can delete a query logging configuration, you must first disassociate all VPCs from the configuration. See DisassociateResolverQueryLogConfig. If you used Resource Access Manager (RAM) to share a query logging configuration with other accounts, you must stop sharing the configuration before you can delete a configuration. The accounts that you shared the configuration with can first disassociate VPCs that they associated with the configuration, but that's not necessary. If you stop sharing the configuration, those VPCs are automatically disassociated from the configuration.
DeleteResolverRule
Show Description Deletes a Resolver rule. Before you can delete a Resolver rule, you must disassociate it from all the VPCs that you associated the Resolver rule with. For more information, see DisassociateResolverRule.
DisassociateFirewallRuleGroup
Show Description Disassociates a FirewallRuleGroup from a VPC, to remove DNS filtering from the VPC.
DisassociateResolverEndpointIpAddress
Show Description Removes IP addresses from an inbound or an outbound Resolver endpoint. If you want to remove more than one IP address, submit one DisassociateResolverEndpointIpAddress request for each IP address. To add an IP address to an endpoint, see AssociateResolverEndpointIpAddress.
DisassociateResolverQueryLogConfig
Show Description Disassociates a VPC from a query logging configuration. Before you can delete a query logging configuration, you must first disassociate all VPCs from the configuration. If you used Resource Access Manager (RAM) to share a query logging configuration with other accounts, VPCs can be disassociated from the configuration in the following ways:
  • The accounts that you shared the configuration with can disassociate VPCs from the configuration.
  • You can stop sharing the configuration.
DisassociateResolverRule
Show Description Removes the association between a specified Resolver rule and a specified VPC. If you disassociate a Resolver rule from a VPC, Resolver stops forwarding DNS queries for the domain name that you specified in the Resolver rule.
GetFirewallConfig
Show Description Retrieves the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).
GetFirewallDomainList
Show Description Retrieves the specified firewall domain list.
GetFirewallRuleGroup
Show Description Retrieves the specified firewall rule group.
GetFirewallRuleGroupAssociation
Show Description Retrieves a firewall rule group association, which enables DNS filtering for a VPC with one rule group. A VPC can have more than one firewall rule group association, and a rule group can be associated with more than one VPC.
GetFirewallRuleGroupPolicy
Show Description Returns the Identity and Access Management (Amazon Web Services IAM) policy for sharing the specified rule group. You can use the policy to share the rule group using Resource Access Manager (RAM).
GetResolverConfig
Show Description Retrieves the behavior configuration of Route 53 Resolver behavior for a single VPC from Amazon Virtual Private Cloud.
GetResolverDnssecConfig
Show Description Gets DNSSEC validation information for a specified resource.
GetResolverEndpoint
Show Description Gets information about a specified Resolver endpoint, such as whether it's an inbound or an outbound Resolver endpoint, and the current status of the endpoint.
GetResolverQueryLogConfig
Show Description Gets information about a specified Resolver query logging configuration, such as the number of VPCs that the configuration is logging queries for and the location that logs are sent to.
GetResolverQueryLogConfigAssociation
Show Description Gets information about a specified association between a Resolver query logging configuration and an Amazon VPC. When you associate a VPC with a query logging configuration, Resolver logs DNS queries that originate in that VPC.
GetResolverQueryLogConfigPolicy
Show Description Gets information about a query logging policy. A query logging policy specifies the Resolver query logging operations and resources that you want to allow another Amazon Web Services account to be able to use.
GetResolverRule
Show Description Gets information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the ID of the outbound Resolver endpoint that the rule is associated with.
GetResolverRuleAssociation
Show Description Gets information about an association between a specified Resolver rule and a VPC. You associate a Resolver rule and a VPC using AssociateResolverRule.
GetResolverRulePolicy
Show Description Gets information about the Resolver rule policy for a specified rule. A Resolver rule policy includes the rule that you want to share with another account, the account that you want to share the rule with, and the Resolver operations that you want to allow the account to use.
ImportFirewallDomains
Show Description Imports domain names from a file into a domain list, for use in a DNS firewall rule group. Each domain specification in your domain list must satisfy the following requirements:
  • It can optionally start with * (asterisk).
  • With the exception of the optional starting asterisk, it must only contain the following characters: A-Z, a-z, 0-9, - (hyphen).
  • It must be from 1-255 characters in length.
ListFirewallConfigs
Show Description Retrieves the firewall configurations that you have defined. DNS Firewall uses the configurations to manage firewall behavior for your VPCs. A single call might return only a partial list of the configurations. For information, see MaxResults.
ListFirewallDomainLists
Show Description Retrieves the firewall domain lists that you have defined. For each firewall domain list, you can retrieve the domains that are defined for a list by calling ListFirewallDomains. A single call to this list operation might return only a partial list of the domain lists. For information, see MaxResults.
ListFirewallDomains
Show Description Retrieves the domains that you have defined for the specified firewall domain list. A single call might return only a partial list of the domains. For information, see MaxResults.
ListFirewallRuleGroupAssociations
Show Description Retrieves the firewall rule group associations that you have defined. Each association enables DNS filtering for a VPC with one rule group. A single call might return only a partial list of the associations. For information, see MaxResults.
ListFirewallRuleGroups
Show Description Retrieves the minimal high-level information for the rule groups that you have defined. A single call might return only a partial list of the rule groups. For information, see MaxResults.
ListFirewallRules
Show Description Retrieves the firewall rules that you have defined for the specified firewall rule group. DNS Firewall uses the rules in a rule group to filter DNS network traffic for a VPC. A single call might return only a partial list of the rules. For information, see MaxResults.
ListResolverConfigs
Show Description Retrieves the Resolver configurations that you have defined. Route 53 Resolver uses the configurations to manage DNS resolution behavior for your VPCs.
ListResolverDnssecConfigs
Show Description Lists the configurations for DNSSEC validation that are associated with the current Amazon Web Services account.
ListResolverEndpointIpAddresses
Show Description Gets the IP addresses for a specified Resolver endpoint.
ListResolverEndpoints
Show Description Lists all the Resolver endpoints that were created using the current Amazon Web Services account.
ListResolverQueryLogConfigAssociations
Show Description Lists information about associations between Amazon VPCs and query logging configurations.
ListResolverQueryLogConfigs
Show Description Lists information about the specified query logging configurations. Each configuration defines where you want Resolver to save DNS query logs and specifies the VPCs that you want to log queries for.
ListResolverRuleAssociations
Show Description Lists the associations that were created between Resolver rules and VPCs using the current Amazon Web Services account.
ListResolverRules
Show Description Lists the Resolver rules that were created using the current Amazon Web Services account.
ListTagsForResource
Show Description Lists the tags that you associated with the specified resource.
PutFirewallRuleGroupPolicy
Show Description Attaches an Identity and Access Management (Amazon Web Services IAM) policy for sharing the rule group. You can use the policy to share the rule group using Resource Access Manager (RAM).
PutResolverQueryLogConfigPolicy
Show Description Specifies an Amazon Web Services account that you want to share a query logging configuration with, the query logging configuration that you want to share, and the operations that you want the account to be able to perform on the configuration.
PutResolverRulePolicy
Show Description Specifies an Amazon Web Services rule that you want to share with another account, the account that you want to share the rule with, and the operations that you want the account to be able to perform on the rule.
TagResource
Show Description Adds one or more tags to a specified resource.
UntagResource
Show Description Removes one or more tags from a specified resource.
UpdateFirewallConfig
Show Description Updates the configuration of the firewall behavior provided by DNS Firewall for a single VPC from Amazon Virtual Private Cloud (Amazon VPC).
UpdateFirewallDomains
Show Description Updates the firewall domain list from an array of domain specifications.
UpdateFirewallRule
Show Description Updates the specified firewall rule.
UpdateFirewallRuleGroupAssociation
Show Description Changes the association of a FirewallRuleGroup with a VPC. The association enables DNS filtering for the VPC.
UpdateResolverConfig
Show Description Updates the behavior configuration of Route 53 Resolver behavior for a single VPC from Amazon Virtual Private Cloud.
UpdateResolverDnssecConfig
Show Description Updates an existing DNSSEC validation configuration. If there is no existing DNSSEC validation configuration, one is created.
UpdateResolverEndpoint
Show Description Updates the name of an inbound or an outbound Resolver endpoint.

S3 Events

Service Event Name Description
s3 AbortMultipartUpload
Show Description This action aborts a multipart upload. After a multipart upload is aborted, no additional parts can be uploaded using that upload ID. The storage consumed by any previously uploaded parts will be freed. However, if any part uploads are currently in progress, those part uploads might or might not succeed. As a result, it might be necessary to abort a given multipart upload multiple times in order to completely free all storage consumed by all parts. To verify that all parts have been removed, so you don't get charged for the part storage, you should call the ListParts action and ensure that the parts list is empty. For information about permissions required to use the multipart upload, see Multipart Upload and Permissions. The following operations are related to AbortMultipartUpload:
CompleteMultipartUpload
Show Description Completes a multipart upload by assembling previously uploaded parts. You first initiate the multipart upload and then upload all parts using the UploadPart operation. After successfully uploading all relevant parts of an upload, you call this action to complete the upload. Upon receiving this request, Amazon S3 concatenates all the parts in ascending order by part number to create a new object. In the Complete Multipart Upload request, you must provide the parts list. You must ensure that the parts list is complete. This action concatenates the parts that you provide in the list. For each part in the list, you must provide the part number and the ETag value, returned after that part was uploaded. Processing of a Complete Multipart Upload request could take several minutes to complete. After Amazon S3 begins processing the request, it sends an HTTP response header that specifies a 200 OK response. While processing is in progress, Amazon S3 periodically sends white space characters to keep the connection from timing out. Because a request could fail after the initial 200 OK response has been sent, it is important that you check the response body to determine whether the request succeeded. Note that if CompleteMultipartUpload fails, applications should be prepared to retry the failed requests. For more information, see Amazon S3 Error Best Practices. For more information about multipart uploads, see Uploading Objects Using Multipart Upload. For information about permissions required to use the multipart upload API, see Multipart Upload and Permissions. CompleteMultipartUpload has the following special errors:
  • Error code: EntityTooSmall
    • Description: Your proposed upload is smaller than the minimum allowed object size. Each part must be at least 5 MB in size, except the last part.
    • 400 Bad Request
  • Error code: InvalidPart
    • Description: One or more of the specified parts could not be found. The part might not have been uploaded, or the specified entity tag might not have matched the part's entity tag.
    • 400 Bad Request
  • Error code: InvalidPartOrder
    • Description: The list of parts was not in ascending order. The parts list must be specified in order by part number.
    • 400 Bad Request
  • Error code: NoSuchUpload
    • Description: The specified multipart upload does not exist. The upload ID might be invalid, or the multipart upload might have been aborted or completed.
    • 404 Not Found
The following operations are related to CompleteMultipartUpload:
CopyObject
Show Description Creates a copy of an object that is already stored in Amazon S3. You can store individual objects of up to 5 TB in Amazon S3. You create a copy of your object up to 5 GB in size in a single atomic action using this API. However, to copy an object greater than 5 GB, you must use the multipart upload Upload Part - Copy API. For more information, see Copy Object Using the REST Multipart Upload API. All copy requests must be authenticated. Additionally, you must have read access to the source object and write access to the destination bucket. For more information, see REST Authentication. Both the Region that you want to copy the object from and the Region that you want to copy the object to must be enabled for your account. A copy request might return an error when Amazon S3 receives the copy request or while Amazon S3 is copying the files. If the error occurs before the copy action starts, you receive a standard Amazon S3 error. If the error occurs during the copy operation, the error response is embedded in the 200 OK response. This means that a 200 OK response can contain either a success or an error. Design your application to parse the contents of the response and handle it appropriately. If the copy is successful, you receive a response with information about the copied object. If the request is an HTTP 1.1 request, the response is chunk encoded. If it were not, it would not contain the content-length, and you would need to read the entire body. The copy request charge is based on the storage class and Region that you specify for the destination object. For pricing information, see Amazon S3 pricing. Amazon S3 transfer acceleration does not support cross-Region copies. If you request a cross-Region copy using a transfer acceleration endpoint, you get a 400 Bad Request error. For more information, see Transfer Acceleration. Metadata When copying an object, you can preserve all metadata (default) or specify new metadata. However, the ACL is not preserved and is set to private for the user making the request. To override the default ACL setting, specify a new ACL when generating a copy request. For more information, see Using ACLs. To specify whether you want the object metadata copied from the source object or replaced with metadata provided in the request, you can optionally add the x-amz-metadata-directive header. When you grant permissions, you can use the s3:x-amz-metadata-directive condition key to enforce certain metadata behavior when objects are uploaded. For more information, see Specifying Conditions in a Policy in the Amazon S3 User Guide. For a complete list of Amazon S3-specific condition keys, see Actions, Resources, and Condition Keys for Amazon S3. x-amz-copy-source-if Headers To only copy an object under certain conditions, such as whether the Etag matches or whether the object was modified before or after a specified date, use the following request parameters:
  • x-amz-copy-source-if-match
  • x-amz-copy-source-if-none-match
  • x-amz-copy-source-if-unmodified-since
  • x-amz-copy-source-if-modified-since
If both the x-amz-copy-source-if-match and x-amz-copy-source-if-unmodified-since headers are present in the request and evaluate as follows, Amazon S3 returns 200 OK and copies the data:
  • x-amz-copy-source-if-match condition evaluates to true
  • x-amz-copy-source-if-unmodified-since condition evaluates to false
If both the x-amz-copy-source-if-none-match and x-amz-copy-source-if-modified-since headers are present in the request and evaluate as follows, Amazon S3 returns the 412 Precondition Failed response code:
  • x-amz-copy-source-if-none-match condition evaluates to false
  • x-amz-copy-source-if-modified-since condition evaluates to true
All headers with the x-amz- prefix, including x-amz-copy-source, must be signed. Server-side encryption When you perform a CopyObject operation, you can optionally use the appropriate encryption-related headers to encrypt the object using server-side encryption with Amazon Web Services managed encryption keys (SSE-S3 or SSE-KMS) or a customer-provided encryption key. With server-side encryption, Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts the data when you access it. For more information about server-side encryption, see Using Server-Side Encryption. If a target object uses SSE-KMS, you can enable an S3 Bucket Key for the object. For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide. Access Control List (ACL)-Specific Request Headers When copying an object, you can optionally use headers to grant ACL-based permissions. By default, all objects are private. Only the owner has full access control. When adding a new object, you can grant permissions to individual Amazon Web Services accounts or to predefined groups defined by Amazon S3. These permissions are then added to the ACL on the object. For more information, see Access Control List (ACL) Overview and Managing ACLs Using the REST API. Storage Class Options You can use the CopyObject action to change the storage class of an object that is already stored in Amazon S3 using the StorageClass parameter. For more information, see Storage Classes in the Amazon S3 User Guide. Versioning By default, x-amz-copy-source identifies the current version of an object to copy. If the current version is a delete marker, Amazon S3 behaves as if the object was deleted. To copy a different version, use the versionId subresource. If you enable versioning on the target bucket, Amazon S3 generates a unique version ID for the object being copied. This version ID is different from the version ID of the source object. Amazon S3 returns the version ID of the copied object in the x-amz-version-id response header in the response. If you do not enable versioning or suspend it on the target bucket, the version ID that Amazon S3 generates is always null. If the source object's storage class is GLACIER, you must restore a copy of this object before you can use it as a source object for the copy operation. For more information, see RestoreObject. The following operations are related to CopyObject: For more information, see Copying Objects.
CreateBucket
Show Description Creates a new S3 bucket. To create a bucket, you must register with Amazon S3 and have a valid Amazon Web Services Access Key ID to authenticate requests. Anonymous requests are never allowed to create buckets. By creating the bucket, you become the bucket owner. Not every string is an acceptable bucket name. For information about bucket naming restrictions, see Bucket naming rules. If you want to create an Amazon S3 on Outposts bucket, see Create Bucket. By default, the bucket is created in the US East (N. Virginia) Region. You can optionally specify a Region in the request body. You might choose a Region to optimize latency, minimize costs, or address regulatory requirements. For example, if you reside in Europe, you will probably find it advantageous to create buckets in the Europe (Ireland) Region. For more information, see Accessing a bucket. If you send your create bucket request to the s3.amazonaws.com endpoint, the request goes to the us-east-1 Region. Accordingly, the signature calculations in Signature Version 4 must use us-east-1 as the Region, even if the location constraint in the request specifies another Region where the bucket is to be created. If you create a bucket in a Region other than US East (N. Virginia), your application must be able to handle 307 redirect. For more information, see Virtual hosting of buckets. When creating a bucket using this operation, you can optionally specify the accounts or groups that should be granted specific permissions on the bucket. There are two ways to grant the appropriate permissions using the request headers.
  • Specify a canned ACL using the x-amz-acl request header. Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. For more information, see Canned ACL.
  • Specify access permissions explicitly using the x-amz-grant-read, x-amz-grant-write, x-amz-grant-read-acp, x-amz-grant-write-acp, and x-amz-grant-full-control headers. These headers map to the set of permissions Amazon S3 supports in an ACL. For more information, see Access control list (ACL) overview. You specify each grantee as a type=value pair, where the type is one of the following:
    • id – if the value specified is the canonical user ID of an Amazon Web Services account
    • uri – if you are granting permissions to a predefined group
    • emailAddress – if the value specified is the email address of an Amazon Web Services account Using email addresses to specify a grantee is only supported in the following Amazon Web Services Regions:
      • US East (N. Virginia)
      • US West (N. California)
      • US West (Oregon)
      • Asia Pacific (Singapore)
      • Asia Pacific (Sydney)
      • Asia Pacific (Tokyo)
      • Europe (Ireland)
      • South America (São Paulo)
      For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.
    For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata: x-amz-grant-read: id="11112222333", id="444455556666"
You can use either a canned ACL or specify access permissions explicitly. You cannot do both. Permissions If your CreateBucket request specifies ACL permissions and the ACL is public-read, public-read-write, authenticated-read, or if you specify access permissions explicitly through any other ACL, both s3:CreateBucket and s3:PutBucketAcl permissions are needed. If the ACL the CreateBucket request is private, only s3:CreateBucket permission is needed. If ObjectLockEnabledForBucket is set to true in your CreateBucket request, s3:PutBucketObjectLockConfiguration and s3:PutBucketVersioning permissions are required. The following operations are related to CreateBucket:
CreateMultipartUpload
Show Description This action initiates a multipart upload and returns an upload ID. This upload ID is used to associate all of the parts in the specific multipart upload. You specify this upload ID in each of your subsequent upload part requests (see UploadPart). You also include this upload ID in the final request to either complete or abort the multipart upload request. For more information about multipart uploads, see Multipart Upload Overview. If you have configured a lifecycle rule to abort incomplete multipart uploads, the upload must complete within the number of days specified in the bucket lifecycle configuration. Otherwise, the incomplete multipart upload becomes eligible for an abort action and Amazon S3 aborts the multipart upload. For more information, see Aborting Incomplete Multipart Uploads Using a Bucket Lifecycle Policy. For information about the permissions required to use the multipart upload API, see Multipart Upload and Permissions. For request signing, multipart upload is just a series of regular requests. You initiate a multipart upload, send one or more requests to upload parts, and then complete the multipart upload process. You sign each request individually. There is nothing special about signing multipart upload requests. For more information about signing, see Authenticating Requests (Amazon Web Services Signature Version 4). After you initiate a multipart upload and upload one or more parts, to stop being charged for storing the uploaded parts, you must either complete or abort the multipart upload. Amazon S3 frees up the space used to store the parts and stop charging you for storing them only after you either complete or abort a multipart upload. You can optionally request server-side encryption. For server-side encryption, Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts it when you access it. You can provide your own encryption key, or use Amazon Web Services KMS keys or Amazon S3-managed encryption keys. If you choose to provide your own encryption key, the request headers you provide in UploadPart and UploadPartCopy requests must match the headers you used in the request to initiate the upload by using CreateMultipartUpload. To perform a multipart upload with encryption using an Amazon Web Services KMS key, the requester must have permission to the kms:Decrypt and kms:GenerateDataKey* actions on the key. These permissions are required because Amazon S3 must decrypt and read data from the encrypted file parts before it completes the multipart upload. For more information, see Multipart upload API and permissions in the Amazon S3 User Guide. If your Identity and Access Management (IAM) user or role is in the same Amazon Web Services account as the KMS key, then you must have these permissions on the key policy. If your IAM user or role belongs to a different account than the key, then you must have the permissions on both the key policy and your IAM user or role. For more information, see Protecting Data Using Server-Side Encryption.
Access Permissions
When copying an object, you can optionally specify the accounts or groups that should be granted specific permissions on the new object. There are two ways to grant the permissions using the request headers:
  • Specify a canned ACL with the x-amz-acl request header. For more information, see Canned ACL.
  • Specify access permissions explicitly with the x-amz-grant-read, x-amz-grant-read-acp, x-amz-grant-write-acp, and x-amz-grant-full-control headers. These parameters map to the set of permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview.
You can use either a canned ACL or specify access permissions explicitly. You cannot do both.
Server-Side- Encryption-Specific Request Headers
You can optionally tell Amazon S3 to encrypt data at rest using server-side encryption. Server-side encryption is for data encryption at rest. Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts it when you access it. The option you use depends on whether you want to use Amazon Web Services managed encryption keys or provide your own encryption key.
  • Use encryption keys managed by Amazon S3 or customer managed key stored in Amazon Web Services Key Management Service (Amazon Web Services KMS) – If you want Amazon Web Services to manage the keys used to encrypt data, specify the following headers in the request.
    • x-amz-server-side-encryption
    • x-amz-server-side-encryption-aws-kms-key-id
    • x-amz-server-side-encryption-context
    If you specify x-amz-server-side-encryption:aws:kms, but don't provide x-amz-server-side-encryption-aws-kms-key-id, Amazon S3 uses the Amazon Web Services managed key in Amazon Web Services KMS to protect the data. All GET and PUT requests for an object protected by Amazon Web Services KMS fail if you don't make them with SSL or by using SigV4. For more information about server-side encryption with KMS key (SSE-KMS), see Protecting Data Using Server-Side Encryption with KMS keys.
  • Use customer-provided encryption keys – If you want to manage your own encryption keys, provide all the following headers in the request.
    • x-amz-server-side-encryption-customer-algorithm
    • x-amz-server-side-encryption-customer-key
    • x-amz-server-side-encryption-customer-key-MD5
    For more information about server-side encryption with KMS keys (SSE-KMS), see Protecting Data Using Server-Side Encryption with KMS keys.
Access-Control-List (ACL)-Specific Request Headers
You also can use the following access control–related headers with this operation. By default, all objects are private. Only the owner has full access control. When adding a new object, you can grant permissions to individual Amazon Web Services accounts or to predefined groups defined by Amazon S3. These permissions are then added to the access control list (ACL) on the object. For more information, see Using ACLs. With this operation, you can grant access permissions using one of the following two methods:
  • Specify a canned ACL (x-amz-acl) — Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. For more information, see Canned ACL.
  • Specify access permissions explicitly — To explicitly grant access permissions to specific Amazon Web Services accounts or groups, use the following headers. Each header maps to specific permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview. In the header, you specify a list of grantees who get the specific permission. To grant permissions explicitly, use:
    • x-amz-grant-read
    • x-amz-grant-write
    • x-amz-grant-read-acp
    • x-amz-grant-write-acp
    • x-amz-grant-full-control
    You specify each grantee as a type=value pair, where the type is one of the following:
    • id – if the value specified is the canonical user ID of an Amazon Web Services account
    • uri – if you are granting permissions to a predefined group
    • emailAddress – if the value specified is the email address of an Amazon Web Services account Using email addresses to specify a grantee is only supported in the following Amazon Web Services Regions:
      • US East (N. Virginia)
      • US West (N. California)
      • US West (Oregon)
      • Asia Pacific (Singapore)
      • Asia Pacific (Sydney)
      • Asia Pacific (Tokyo)
      • Europe (Ireland)
      • South America (São Paulo)
      For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.
    For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata: x-amz-grant-read: id="11112222333", id="444455556666"
The following operations are related to CreateMultipartUpload:
DeleteBucket
DeleteBucketAnalyticsConfiguration
DeleteBucketCors
DeleteBucketEncryption
DeleteBucketIntelligentTieringConfiguration
DeleteBucketInventoryConfiguration
DeleteBucketLifecycle
DeleteBucketMetricsConfiguration
DeleteBucketOwnershipControls
DeleteBucketPolicy
DeleteBucketReplication
DeleteBucketTagging
DeleteBucketWebsite
DeleteObject
Show Description Removes the null version (if there is one) of an object and inserts a delete marker, which becomes the latest version of the object. If there isn't a null version, Amazon S3 does not remove any objects but will still respond that the command was successful. To remove a specific version, you must be the bucket owner and you must use the version Id subresource. Using this subresource permanently deletes the version. If the object deleted is a delete marker, Amazon S3 sets the response header, x-amz-delete-marker, to true. If the object you want to delete is in a bucket where the bucket versioning configuration is MFA Delete enabled, you must include the x-amz-mfa request header in the DELETE versionId request. Requests that include x-amz-mfa must use HTTPS. For more information about MFA Delete, see Using MFA Delete. To see sample requests that use versioning, see Sample Request. You can delete objects by explicitly calling DELETE Object or configure its lifecycle (PutBucketLifecycle) to enable Amazon S3 to remove them for you. If you want to block users or accounts from removing or deleting objects from your bucket, you must deny them the s3:DeleteObject, s3:DeleteObjectVersion, and s3:PutLifeCycleConfiguration actions. The following action is related to DeleteObject:
DeleteObjectTagging
Show Description Removes the entire tag set from the specified object. For more information about managing object tags, see Object Tagging. To use this operation, you must have permission to perform the s3:DeleteObjectTagging action. To delete tags of a specific object version, add the versionId query parameter in the request. You will need permission for the s3:DeleteObjectVersionTagging action. The following operations are related to DeleteBucketMetricsConfiguration:
DeleteObjects
Show Description This action enables you to delete multiple objects from a bucket using a single HTTP request. If you know the object keys that you want to delete, then this action provides a suitable alternative to sending individual delete requests, reducing per-request overhead. The request contains a list of up to 1000 keys that you want to delete. In the XML, you provide the object key names, and optionally, version IDs if you want to delete a specific version of the object from a versioning-enabled bucket. For each key, Amazon S3 performs a delete action and returns the result of that delete, success, or failure, in the response. Note that if the object specified in the request is not found, Amazon S3 returns the result as deleted. The action supports two modes for the response: verbose and quiet. By default, the action uses verbose mode in which the response includes the result of deletion of each key in your request. In quiet mode the response includes only keys where the delete action encountered an error. For a successful deletion, the action does not return any information about the delete in the response body. When performing this action on an MFA Delete enabled bucket, that attempts to delete any versioned objects, you must include an MFA token. If you do not provide one, the entire request will fail, even if there are non-versioned objects you are trying to delete. If you provide an invalid token, whether there are versioned keys in the request or not, the entire Multi-Object Delete request will fail. For information about MFA Delete, see MFA Delete. Finally, the Content-MD5 header is required for all Multi-Object Delete requests. Amazon S3 uses the header value to ensure that your request body has not been altered in transit. The following operations are related to DeleteObjects:
DeletePublicAccessBlock
GetBucketAccelerateConfiguration
Show Description This implementation of the GET action uses the accelerate subresource to return the Transfer Acceleration state of a bucket, which is either Enabled or Suspended. Amazon S3 Transfer Acceleration is a bucket-level feature that enables you to perform faster data transfers to and from Amazon S3. To use this operation, you must have permission to perform the s3:GetAccelerateConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to your Amazon S3 Resources in the Amazon S3 User Guide. You set the Transfer Acceleration state of an existing bucket to Enabled or Suspended by using the PutBucketAccelerateConfiguration operation. A GET accelerate request does not return a state value for a bucket that has no transfer acceleration state. A bucket has no Transfer Acceleration state if a state has never been set on the bucket. For more information about transfer acceleration, see Transfer Acceleration in the Amazon S3 User Guide.

Related Resources

</details> </td> </tr>
GetBucketAcl
Show Description This implementation of the GET action uses the acl subresource to return the access control list (ACL) of a bucket. To use GET to return the ACL of the bucket, you must have READ_ACP access to the bucket. If READ_ACP permission is granted to the anonymous user, you can return the ACL of the bucket without using an authorization header.

Related Resources

</details> </td> </tr>
GetBucketAnalyticsConfiguration
Show Description This implementation of the GET action returns an analytics configuration (identified by the analytics configuration ID) from the bucket. To use this operation, you must have permissions to perform the s3:GetAnalyticsConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources in the Amazon S3 User Guide. For information about Amazon S3 analytics feature, see Amazon S3 Analytics – Storage Class Analysis in the Amazon S3 User Guide.

Related Resources

</details> </td> </tr>
GetBucketCors
Show Description Returns the cors configuration information set for the bucket. To use this operation, you must have permission to perform the s3:GetBucketCORS action. By default, the bucket owner has this permission and can grant it to others. For more information about cors, see Enabling Cross-Origin Resource Sharing. The following operations are related to GetBucketCors:
GetBucketEncryption
Show Description Returns the default encryption configuration for an Amazon S3 bucket. If the bucket does not have a default encryption configuration, GetBucketEncryption returns ServerSideEncryptionConfigurationNotFoundError. For information about the Amazon S3 default encryption feature, see Amazon S3 Default Bucket Encryption. To use this operation, you must have permission to perform the s3:GetEncryptionConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. The following operations are related to GetBucketEncryption:
GetBucketIntelligentTieringConfiguration
Show Description Gets the S3 Intelligent-Tiering configuration from the specified bucket. The S3 Intelligent-Tiering storage class is designed to optimize storage costs by automatically moving data to the most cost-effective storage access tier, without performance impact or operational overhead. S3 Intelligent-Tiering delivers automatic cost savings in two low latency and high throughput access tiers. For data that can be accessed asynchronously, you can choose to activate automatic archiving capabilities within the S3 Intelligent-Tiering storage class. The S3 Intelligent-Tiering storage class is the ideal storage class for data with unknown, changing, or unpredictable access patterns, independent of object size or retention period. If the size of an object is less than 128 KB, it is not eligible for auto-tiering. Smaller objects can be stored, but they are always charged at the Frequent Access tier rates in the S3 Intelligent-Tiering storage class. For more information, see Storage class for automatically optimizing frequently and infrequently accessed objects. Operations related to GetBucketIntelligentTieringConfiguration include:
GetBucketInventoryConfiguration
Show Description Returns an inventory configuration (identified by the inventory configuration ID) from the bucket. To use this operation, you must have permissions to perform the s3:GetInventoryConfiguration action. The bucket owner has this permission by default and can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. For information about the Amazon S3 inventory feature, see Amazon S3 Inventory. The following operations are related to GetBucketInventoryConfiguration:
GetBucketLifecycle
Show Description For an updated version of this API, see GetBucketLifecycleConfiguration. If you configured a bucket lifecycle using the filter element, you should see the updated version of this topic. This topic is provided for backward compatibility. Returns the lifecycle configuration information set on the bucket. For information about lifecycle configuration, see Object Lifecycle Management. To use this operation, you must have permission to perform the s3:GetLifecycleConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. GetBucketLifecycle has the following special error:
  • Error code: NoSuchLifecycleConfiguration
    • Description: The lifecycle configuration does not exist.
    • HTTP Status Code: 404 Not Found
    • SOAP Fault Code Prefix: Client
The following operations are related to GetBucketLifecycle:
GetBucketLifecycleConfiguration
Show Description Bucket lifecycle configuration now supports specifying a lifecycle rule using an object key name prefix, one or more object tags, or a combination of both. Accordingly, this section describes the latest API. The response describes the new filter element that you can use to specify a filter to select a subset of objects to which the rule applies. If you are using a previous version of the lifecycle configuration, it still works. For the earlier action, see GetBucketLifecycle. Returns the lifecycle configuration information set on the bucket. For information about lifecycle configuration, see Object Lifecycle Management. To use this operation, you must have permission to perform the s3:GetLifecycleConfiguration action. The bucket owner has this permission, by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. GetBucketLifecycleConfiguration has the following special error:
  • Error code: NoSuchLifecycleConfiguration
    • Description: The lifecycle configuration does not exist.
    • HTTP Status Code: 404 Not Found
    • SOAP Fault Code Prefix: Client
The following operations are related to GetBucketLifecycleConfiguration:
GetBucketLocation
Show Description Returns the Region the bucket resides in. You set the bucket's Region using the LocationConstraint request parameter in a CreateBucket request. For more information, see CreateBucket. To use this implementation of the operation, you must be the bucket owner. To use this API against an access point, provide the alias of the access point in place of the bucket name. The following operations are related to GetBucketLocation:
GetBucketLogging
Show Description Returns the logging status of a bucket and the permissions users have to view and modify that status. To use GET, you must be the bucket owner. The following operations are related to GetBucketLogging:
GetBucketMetricsConfiguration
Show Description Gets a metrics configuration (specified by the metrics configuration ID) from the bucket. Note that this doesn't include the daily storage metrics. To use this operation, you must have permissions to perform the s3:GetMetricsConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. For information about CloudWatch request metrics for Amazon S3, see Monitoring Metrics with Amazon CloudWatch. The following operations are related to GetBucketMetricsConfiguration:
GetBucketNotification
Show Description No longer used, see GetBucketNotificationConfiguration.
GetBucketNotificationConfiguration
Show Description Returns the notification configuration of a bucket. If notifications are not enabled on the bucket, the action returns an empty NotificationConfiguration element. By default, you must be the bucket owner to read the notification configuration of a bucket. However, the bucket owner can use a bucket policy to grant permission to other users to read this configuration with the s3:GetBucketNotification permission. For more information about setting and reading the notification configuration on a bucket, see Setting Up Notification of Bucket Events. For more information about bucket policies, see Using Bucket Policies. The following action is related to GetBucketNotification:
GetBucketOwnershipControls
Show Description Retrieves OwnershipControls for an Amazon S3 bucket. To use this operation, you must have the s3:GetBucketOwnershipControls permission. For more information about Amazon S3 permissions, see Specifying Permissions in a Policy. For information about Amazon S3 Object Ownership, see Using Object Ownership. The following operations are related to GetBucketOwnershipControls:
GetBucketPolicy
Show Description Returns the policy of a specified bucket. If you are using an identity other than the root user of the Amazon Web Services account that owns the bucket, the calling identity must have the GetBucketPolicy permissions on the specified bucket and belong to the bucket owner's account in order to use this operation. If you don't have GetBucketPolicy permissions, Amazon S3 returns a 403 Access Denied error. If you have the correct permissions, but you're not using an identity that belongs to the bucket owner's account, Amazon S3 returns a 405 Method Not Allowed error. As a security precaution, the root user of the Amazon Web Services account that owns a bucket can always use this operation, even if the policy explicitly denies the root user the ability to perform this action. For more information about bucket policies, see Using Bucket Policies and User Policies. The following action is related to GetBucketPolicy:
GetBucketPolicyStatus
Show Description Retrieves the policy status for an Amazon S3 bucket, indicating whether the bucket is public. In order to use this operation, you must have the s3:GetBucketPolicyStatus permission. For more information about Amazon S3 permissions, see Specifying Permissions in a Policy. For more information about when Amazon S3 considers a bucket public, see The Meaning of "Public". The following operations are related to GetBucketPolicyStatus:
GetBucketReplication
Show Description Returns the replication configuration of a bucket. It can take a while to propagate the put or delete a replication configuration to all Amazon S3 systems. Therefore, a get request soon after put or delete can return a wrong result. For information about replication configuration, see Replication in the Amazon S3 User Guide. This action requires permissions for the s3:GetReplicationConfiguration action. For more information about permissions, see Using Bucket Policies and User Policies. If you include the Filter element in a replication configuration, you must also include the DeleteMarkerReplication and Priority elements. The response also returns those elements. For information about GetBucketReplication errors, see List of replication-related error codes The following operations are related to GetBucketReplication:
GetBucketRequestPayment
Show Description Returns the request payment configuration of a bucket. To use this version of the operation, you must be the bucket owner. For more information, see Requester Pays Buckets. The following operations are related to GetBucketRequestPayment:
GetBucketTagging
Show Description Returns the tag set associated with the bucket. To use this operation, you must have permission to perform the s3:GetBucketTagging action. By default, the bucket owner has this permission and can grant this permission to others. GetBucketTagging has the following special error:
  • Error code: NoSuchTagSetError
    • Description: There is no tag set associated with the bucket.
The following operations are related to GetBucketTagging:
GetBucketVersioning
Show Description Returns the versioning state of a bucket. To retrieve the versioning state of a bucket, you must be the bucket owner. This implementation also returns the MFA Delete status of the versioning state. If the MFA Delete status is enabled, the bucket owner must use an authentication device to change the versioning state of the bucket. The following operations are related to GetBucketVersioning:
GetBucketWebsite
Show Description Returns the website configuration for a bucket. To host website on Amazon S3, you can configure a bucket as website by adding a website configuration. For more information about hosting websites, see Hosting Websites on Amazon S3. This GET action requires the S3:GetBucketWebsite permission. By default, only the bucket owner can read the bucket website configuration. However, bucket owners can allow other users to read the website configuration by writing a bucket policy granting them the S3:GetBucketWebsite permission. The following operations are related to DeleteBucketWebsite:
GetObject
Show Description Retrieves objects from Amazon S3. To use GET, you must have READ access to the object. If you grant READ access to the anonymous user, you can return the object without using an authorization header. An Amazon S3 bucket has no directory hierarchy such as you would find in a typical computer file system. You can, however, create a logical hierarchy by using object key names that imply a folder structure. For example, instead of naming an object sample.jpg, you can name it photos/2006/February/sample.jpg. To get an object from such a logical hierarchy, specify the full key name for the object in the GET operation. For a virtual hosted-style request example, if you have the object photos/2006/February/sample.jpg, specify the resource as /photos/2006/February/sample.jpg. For a path-style request example, if you have the object photos/2006/February/sample.jpg in the bucket named examplebucket, specify the resource as /examplebucket/photos/2006/February/sample.jpg. For more information about request types, see HTTP Host Header Bucket Specification. To distribute large files to many people, you can save bandwidth costs by using BitTorrent. For more information, see Amazon S3 Torrent. For more information about returning the ACL of an object, see GetObjectAcl. If the object you are retrieving is stored in the S3 Glacier or S3 Glacier Deep Archive storage class, or S3 Intelligent-Tiering Archive or S3 Intelligent-Tiering Deep Archive tiers, before you can retrieve the object you must first restore a copy using RestoreObject. Otherwise, this action returns an InvalidObjectStateError error. For information about restoring archived objects, see Restoring Archived Objects. Encryption request headers, like x-amz-server-side-encryption, should not be sent for GET requests if your object uses server-side encryption with KMS keys (SSE-KMS) or server-side encryption with Amazon S3–managed encryption keys (SSE-S3). If your object does use these types of keys, you’ll get an HTTP 400 BadRequest error. If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you GET the object, you must use the following headers:
  • x-amz-server-side-encryption-customer-algorithm
  • x-amz-server-side-encryption-customer-key
  • x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys). Assuming you have the relevant permission to read object tags, the response also returns the x-amz-tagging-count header that provides the count of number of tags associated with the object. You can use GetObjectTagging to retrieve the tag set associated with an object. Permissions You need the relevant read object (or version) permission for this operation. For more information, see Specifying Permissions in a Policy. If the object you request does not exist, the error Amazon S3 returns depends on whether you also have the s3:ListBucket permission.
  • If you have the s3:ListBucket permission on the bucket, Amazon S3 will return an HTTP status code 404 ("no such key") error.
  • If you don’t have the s3:ListBucket permission, Amazon S3 will return an HTTP status code 403 ("access denied") error.
Versioning By default, the GET action returns the current version of an object. To return a different version, use the versionId subresource.
  • You need the s3:GetObjectVersion permission to access a specific version of an object.
  • If the current version of the object is a delete marker, Amazon S3 behaves as if the object was deleted and includes x-amz-delete-marker: true in the response.
For more information about versioning, see PutBucketVersioning. Overriding Response Header Values There are times when you want to override certain response header values in a GET response. For example, you might override the Content-Disposition response header value in your GET request. You can override values for a set of response headers using the following query parameters. These response header values are sent only on a successful request, that is, when status code 200 OK is returned. The set of headers you can override using these parameters is a subset of the headers that Amazon S3 accepts when you create an object. The response headers that you can override for the GET response are Content-Type, Content-Language, Expires, Cache-Control, Content-Disposition, and Content-Encoding. To override these header values in the GET response, you use the following request parameters. You must sign the request, either using an Authorization header or a presigned URL, when using these parameters. They cannot be used with an unsigned (anonymous) request.
  • response-content-type
  • response-content-language
  • response-expires
  • response-cache-control
  • response-content-disposition
  • response-content-encoding
Additional Considerations about Request Headers If both of the If-Match and If-Unmodified-Since headers are present in the request as follows: If-Match condition evaluates to true, and; If-Unmodified-Since condition evaluates to false; then, S3 returns 200 OK and the data requested. If both of the If-None-Match and If-Modified-Since headers are present in the request as follows: If-None-Match condition evaluates to false, and; If-Modified-Since condition evaluates to true; then, S3 returns 304 Not Modified response code. For more information about conditional requests, see RFC 7232. The following operations are related to GetObject:
GetObjectAcl
Show Description Returns the access control list (ACL) of an object. To use this operation, you must have READ_ACP access to the object. This action is not supported by Amazon S3 on Outposts. Versioning By default, GET returns ACL information about the current version of an object. To return ACL information about a different version, use the versionId subresource. The following operations are related to GetObjectAcl:
GetObjectLegalHold
Show Description Gets an object's current Legal Hold status. For more information, see Locking Objects. This action is not supported by Amazon S3 on Outposts.
GetObjectLockConfiguration
Show Description Gets the Object Lock configuration for a bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see Locking Objects.
GetObjectRetention
Show Description Retrieves an object's retention settings. For more information, see Locking Objects. This action is not supported by Amazon S3 on Outposts.
GetObjectTagging
Show Description Returns the tag-set of an object. You send the GET request against the tagging subresource associated with the object. To use this operation, you must have permission to perform the s3:GetObjectTagging action. By default, the GET action returns information about current version of an object. For a versioned bucket, you can have multiple versions of an object in your bucket. To retrieve tags of any other version, use the versionId query parameter. You also need permission for the s3:GetObjectVersionTagging action. By default, the bucket owner has this permission and can grant this permission to others. For information about the Amazon S3 object tagging feature, see Object Tagging. The following action is related to GetObjectTagging:
GetObjectTorrent
Show Description Returns torrent files from a bucket. BitTorrent can save you bandwidth when you're distributing large files. For more information about BitTorrent, see Using BitTorrent with Amazon S3. You can get torrent only for objects that are less than 5 GB in size, and that are not encrypted using server-side encryption with a customer-provided encryption key. To use GET, you must have READ access to the object. This action is not supported by Amazon S3 on Outposts. The following action is related to GetObjectTorrent:
GetPublicAccessBlock
Show Description Retrieves the PublicAccessBlock configuration for an Amazon S3 bucket. To use this operation, you must have the s3:GetBucketPublicAccessBlock permission. For more information about Amazon S3 permissions, see Specifying Permissions in a Policy. When Amazon S3 evaluates the PublicAccessBlock configuration for a bucket or an object, it checks the PublicAccessBlock configuration for both the bucket (or the bucket that contains the object) and the bucket owner's account. If the PublicAccessBlock settings are different between the bucket and the account, Amazon S3 uses the most restrictive combination of the bucket-level and account-level settings. For more information about when Amazon S3 considers a bucket or an object public, see The Meaning of "Public". The following operations are related to GetPublicAccessBlock:
HeadBucket
HeadObject
Show Description The HEAD action retrieves metadata from an object without returning the object itself. This action is useful if you're only interested in an object's metadata. To use HEAD, you must have READ access to the object. A HEAD request has the same options as a GET action on an object. The response is identical to the GET response except that there is no response body. Because of this, if the HEAD request generates an error, it returns a generic 404 Not Found or 403 Forbidden code. It is not possible to retrieve the exact exception beyond these error codes. If you encrypt an object by using server-side encryption with customer-provided encryption keys (SSE-C) when you store the object in Amazon S3, then when you retrieve the metadata from the object, you must use the following headers:
  • x-amz-server-side-encryption-customer-algorithm
  • x-amz-server-side-encryption-customer-key
  • x-amz-server-side-encryption-customer-key-MD5
For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys).
  • Encryption request headers, like x-amz-server-side-encryption, should not be sent for GET requests if your object uses server-side encryption with KMS keys (SSE-KMS) or server-side encryption with Amazon S3–managed encryption keys (SSE-S3). If your object does use these types of keys, you’ll get an HTTP 400 BadRequest error.
  • The last modified property in this case is the creation date of the object.
Request headers are limited to 8 KB in size. For more information, see Common Request Headers. Consider the following when using request headers:
  • Consideration 1 – If both of the If-Match and If-Unmodified-Since headers are present in the request as follows:
    • If-Match condition evaluates to true, and;
    • If-Unmodified-Since condition evaluates to false;
    Then Amazon S3 returns 200 OK and the data requested.
  • Consideration 2 – If both of the If-None-Match and If-Modified-Since headers are present in the request as follows:
    • If-None-Match condition evaluates to false, and;
    • If-Modified-Since condition evaluates to true;
    Then Amazon S3 returns the 304 Not Modified response code.
For more information about conditional requests, see RFC 7232. Permissions You need the relevant read object (or version) permission for this operation. For more information, see Specifying Permissions in a Policy. If the object you request does not exist, the error Amazon S3 returns depends on whether you also have the s3:ListBucket permission.
  • If you have the s3:ListBucket permission on the bucket, Amazon S3 returns an HTTP status code 404 ("no such key") error.
  • If you don’t have the s3:ListBucket permission, Amazon S3 returns an HTTP status code 403 ("access denied") error.
The following action is related to HeadObject:
ListBucketAnalyticsConfigurations
Show Description Lists the analytics configurations for the bucket. You can have up to 1,000 analytics configurations per bucket. This action supports list pagination and does not return more than 100 configurations at a time. You should always check the IsTruncated element in the response. If there are no more configurations to list, IsTruncated is set to false. If there are more configurations to list, IsTruncated is set to true, and there will be a value in NextContinuationToken. You use the NextContinuationToken value to continue the pagination of the list by passing the value in continuation-token in the request to GET the next page. To use this operation, you must have permissions to perform the s3:GetAnalyticsConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. For information about Amazon S3 analytics feature, see Amazon S3 Analytics – Storage Class Analysis. The following operations are related to ListBucketAnalyticsConfigurations:
ListBucketIntelligentTieringConfigurations
Show Description Lists the S3 Intelligent-Tiering configuration from the specified bucket. The S3 Intelligent-Tiering storage class is designed to optimize storage costs by automatically moving data to the most cost-effective storage access tier, without performance impact or operational overhead. S3 Intelligent-Tiering delivers automatic cost savings in two low latency and high throughput access tiers. For data that can be accessed asynchronously, you can choose to activate automatic archiving capabilities within the S3 Intelligent-Tiering storage class. The S3 Intelligent-Tiering storage class is the ideal storage class for data with unknown, changing, or unpredictable access patterns, independent of object size or retention period. If the size of an object is less than 128 KB, it is not eligible for auto-tiering. Smaller objects can be stored, but they are always charged at the Frequent Access tier rates in the S3 Intelligent-Tiering storage class. For more information, see Storage class for automatically optimizing frequently and infrequently accessed objects. Operations related to ListBucketIntelligentTieringConfigurations include:
ListBucketInventoryConfigurations
Show Description Returns a list of inventory configurations for the bucket. You can have up to 1,000 analytics configurations per bucket. This action supports list pagination and does not return more than 100 configurations at a time. Always check the IsTruncated element in the response. If there are no more configurations to list, IsTruncated is set to false. If there are more configurations to list, IsTruncated is set to true, and there is a value in NextContinuationToken. You use the NextContinuationToken value to continue the pagination of the list by passing the value in continuation-token in the request to GET the next page. To use this operation, you must have permissions to perform the s3:GetInventoryConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. For information about the Amazon S3 inventory feature, see Amazon S3 Inventory The following operations are related to ListBucketInventoryConfigurations:
ListBucketMetricsConfigurations
Show Description Lists the metrics configurations for the bucket. The metrics configurations are only for the request metrics of the bucket and do not provide information on daily storage metrics. You can have up to 1,000 configurations per bucket. This action supports list pagination and does not return more than 100 configurations at a time. Always check the IsTruncated element in the response. If there are no more configurations to list, IsTruncated is set to false. If there are more configurations to list, IsTruncated is set to true, and there is a value in NextContinuationToken. You use the NextContinuationToken value to continue the pagination of the list by passing the value in continuation-token in the request to GET the next page. To use this operation, you must have permissions to perform the s3:GetMetricsConfiguration action. The bucket owner has this permission by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. For more information about metrics configurations and CloudWatch request metrics, see Monitoring Metrics with Amazon CloudWatch. The following operations are related to ListBucketMetricsConfigurations:
ListBuckets
Show Description Returns a list of all buckets owned by the authenticated sender of the request.
ListMultipartUploads
Show Description This action lists in-progress multipart uploads. An in-progress multipart upload is a multipart upload that has been initiated using the Initiate Multipart Upload request, but has not yet been completed or aborted. This action returns at most 1,000 multipart uploads in the response. 1,000 multipart uploads is the maximum number of uploads a response can include, which is also the default value. You can further limit the number of uploads in a response by specifying the max-uploads parameter in the response. If additional multipart uploads satisfy the list criteria, the response will contain an IsTruncated element with the value true. To list the additional multipart uploads, use the key-marker and upload-id-marker request parameters. In the response, the uploads are sorted by key. If your application has initiated more than one multipart upload using the same object key, then uploads in the response are first sorted by key. Additionally, uploads are sorted in ascending order within each key by the upload initiation time. For more information on multipart uploads, see Uploading Objects Using Multipart Upload. For information on permissions required to use the multipart upload API, see Multipart Upload and Permissions. The following operations are related to ListMultipartUploads:
ListObjectVersions
Show Description Returns metadata about all versions of the objects in a bucket. You can also use request parameters as selection criteria to return metadata about a subset of all the object versions. To use this operation, you must have permissions to perform the s3:ListBucketVersions action. Be aware of the name difference. A 200 OK response can contain valid or invalid XML. Make sure to design your application to parse the contents of the response and handle it appropriately. To use this operation, you must have READ access to the bucket. This action is not supported by Amazon S3 on Outposts. The following operations are related to ListObjectVersions:
ListObjects
Show Description Returns some or all (up to 1,000) of the objects in a bucket. You can use the request parameters as selection criteria to return a subset of the objects in a bucket. A 200 OK response can contain valid or invalid XML. Be sure to design your application to parse the contents of the response and handle it appropriately. This action has been revised. We recommend that you use the newer version, ListObjectsV2, when developing applications. For backward compatibility, Amazon S3 continues to support ListObjects. The following operations are related to ListObjects:
ListObjectsV2
Show Description Returns some or all (up to 1,000) of the objects in a bucket with each request. You can use the request parameters as selection criteria to return a subset of the objects in a bucket. A 200 OK response can contain valid or invalid XML. Make sure to design your application to parse the contents of the response and handle it appropriately. Objects are returned sorted in an ascending order of the respective key names in the list. For more information about listing objects, see Listing object keys programmatically To use this operation, you must have READ access to the bucket. To use this action in an Identity and Access Management (IAM) policy, you must have permissions to perform the s3:ListBucket action. The bucket owner has this permission by default and can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. This section describes the latest revision of this action. We recommend that you use this revised API for application development. For backward compatibility, Amazon S3 continues to support the prior version of this API, ListObjects. To get a list of your buckets, see ListBuckets. The following operations are related to ListObjectsV2:
ListParts
Show Description Lists the parts that have been uploaded for a specific multipart upload. This operation must include the upload ID, which you obtain by sending the initiate multipart upload request (see CreateMultipartUpload). This request returns a maximum of 1,000 uploaded parts. The default number of parts returned is 1,000 parts. You can restrict the number of parts returned by specifying the max-parts request parameter. If your multipart upload consists of more than 1,000 parts, the response returns an IsTruncated field with the value of true, and a NextPartNumberMarker element. In subsequent ListParts requests you can include the part-number-marker query string parameter and set its value to the NextPartNumberMarker field value from the previous response. For more information on multipart uploads, see Uploading Objects Using Multipart Upload. For information on permissions required to use the multipart upload API, see Multipart Upload and Permissions. The following operations are related to ListParts:
PutBucketAccelerateConfiguration
PutBucketAcl
PutBucketAnalyticsConfiguration
PutBucketCors
PutBucketEncryption
PutBucketIntelligentTieringConfiguration
PutBucketInventoryConfiguration
PutBucketLifecycle
PutBucketLifecycleConfiguration
PutBucketLogging
PutBucketMetricsConfiguration
PutBucketNotification
PutBucketNotificationConfiguration
PutBucketOwnershipControls
PutBucketPolicy
PutBucketReplication
PutBucketRequestPayment
PutBucketTagging
PutBucketVersioning
PutBucketWebsite
PutObject
Show Description Adds an object to a bucket. You must have WRITE permissions on a bucket to add an object to it. Amazon S3 never adds partial objects; if you receive a success response, Amazon S3 added the entire object to the bucket. Amazon S3 is a distributed system. If it receives multiple write requests for the same object simultaneously, it overwrites all but the last object written. Amazon S3 does not provide object locking; if you need this, make sure to build it into your application layer or use versioning instead. To ensure that data is not corrupted traversing the network, use the Content-MD5 header. When you use this header, Amazon S3 checks the object against the provided MD5 value and, if they do not match, returns an error. Additionally, you can calculate the MD5 while putting an object to Amazon S3 and compare the returned ETag to the calculated MD5 value.
  • To successfully complete the PutObject request, you must have the s3:PutObject in your IAM permissions.
  • To successfully change the objects acl of your PutObject request, you must have the s3:PutObjectAcl in your IAM permissions.
  • The Content-MD5 header is required for any request to upload an object with a retention period configured using Amazon S3 Object Lock. For more information about Amazon S3 Object Lock, see Amazon S3 Object Lock Overview in the Amazon S3 User Guide.
Server-side Encryption You can optionally request server-side encryption. With server-side encryption, Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts the data when you access it. You have the option to provide your own encryption key or use Amazon Web Services managed encryption keys (SSE-S3 or SSE-KMS). For more information, see Using Server-Side Encryption. If you request server-side encryption using Amazon Web Services Key Management Service (SSE-KMS), you can enable an S3 Bucket Key at the object-level. For more information, see Amazon S3 Bucket Keys in the Amazon S3 User Guide. Access Control List (ACL)-Specific Request Headers You can use headers to grant ACL- based permissions. By default, all objects are private. Only the owner has full access control. When adding a new object, you can grant permissions to individual Amazon Web Services accounts or to predefined groups defined by Amazon S3. These permissions are then added to the ACL on the object. For more information, see Access Control List (ACL) Overview and Managing ACLs Using the REST API. Storage Class Options By default, Amazon S3 uses the STANDARD Storage Class to store newly created objects. The STANDARD storage class provides high durability and high availability. Depending on performance needs, you can specify a different Storage Class. Amazon S3 on Outposts only uses the OUTPOSTS Storage Class. For more information, see Storage Classes in the Amazon S3 User Guide. Versioning If you enable versioning for a bucket, Amazon S3 automatically generates a unique version ID for the object being stored. Amazon S3 returns this ID in the response. When you enable versioning for a bucket, if Amazon S3 receives multiple write requests for the same object simultaneously, it stores all of the objects. For more information about versioning, see Adding Objects to Versioning Enabled Buckets. For information about returning the versioning state of a bucket, see GetBucketVersioning.

Related Resources

</details> </td> </tr>
PutObjectAcl
Show Description Uses the acl subresource to set the access control list (ACL) permissions for a new or existing object in an S3 bucket. You must have WRITE_ACP permission to set the ACL of an object. For more information, see What permissions can I grant? in the Amazon S3 User Guide. This action is not supported by Amazon S3 on Outposts. Depending on your application needs, you can choose to set the ACL on an object using either the request body or the headers. For example, if you have an existing application that updates a bucket ACL using the request body, you can continue to use that approach. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide. Access Permissions You can set access permissions using one of the following methods:
  • Specify a canned ACL with the x-amz-acl request header. Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Each canned ACL has a predefined set of grantees and permissions. Specify the canned ACL name as the value of x-amz-acl. If you use this header, you cannot use other access control-specific headers in your request. For more information, see Canned ACL.
  • Specify access permissions explicitly with the x-amz-grant-read, x-amz-grant-read-acp, x-amz-grant-write-acp, and x-amz-grant-full-control headers. When using these headers, you specify explicit access permissions and grantees (Amazon Web Services accounts or Amazon S3 groups) who will receive the permission. If you use these ACL-specific headers, you cannot use x-amz-acl header to set a canned ACL. These parameters map to the set of permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview. You specify each grantee as a type=value pair, where the type is one of the following:
    • id – if the value specified is the canonical user ID of an Amazon Web Services account
    • uri – if you are granting permissions to a predefined group
    • emailAddress – if the value specified is the email address of an Amazon Web Services account Using email addresses to specify a grantee is only supported in the following Amazon Web Services Regions:
      • US East (N. Virginia)
      • US West (N. California)
      • US West (Oregon)
      • Asia Pacific (Singapore)
      • Asia Pacific (Sydney)
      • Asia Pacific (Tokyo)
      • Europe (Ireland)
      • South America (São Paulo)
      For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.
    For example, the following x-amz-grant-read header grants list objects permission to the two Amazon Web Services accounts identified by their email addresses. x-amz-grant-read: emailAddress="xyz@amazon.com", emailAddress="abc@amazon.com"
You can use either a canned ACL or specify access permissions explicitly. You cannot do both. Grantee Values You can specify the person (grantee) to whom you're assigning access rights (using request elements) in the following ways:
  • By the person's ID: <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"><ID><>ID<></ID><DisplayName><>GranteesEmail<></DisplayName> </Grantee> DisplayName is optional and ignored in the request.
  • By URI: <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group"><URI><>http://acs.amazonaws.com/groups/global/AuthenticatedUsers<></URI></Grantee>
  • By Email address: <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AmazonCustomerByEmail"><EmailAddress><>Grantees@email.com<></EmailAddress>lt;/Grantee> The grantee is resolved to the CanonicalUser and, in a response to a GET Object acl request, appears as the CanonicalUser. Using email addresses to specify a grantee is only supported in the following Amazon Web Services Regions:
    • US East (N. Virginia)
    • US West (N. California)
    • US West (Oregon)
    • Asia Pacific (Singapore)
    • Asia Pacific (Sydney)
    • Asia Pacific (Tokyo)
    • Europe (Ireland)
    • South America (São Paulo)
    For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.
Versioning The ACL of an object is set at the object version level. By default, PUT sets the ACL of the current version of an object. To set the ACL of a different version, use the versionId subresource.

Related Resources

</details> </td> </tr>
PutObjectLegalHold
Show Description Applies a Legal Hold configuration to the specified object. For more information, see Locking Objects. This action is not supported by Amazon S3 on Outposts.
PutObjectLockConfiguration
Show Description Places an Object Lock configuration on the specified bucket. The rule specified in the Object Lock configuration will be applied by default to every new object placed in the specified bucket. For more information, see Locking Objects.
  • The DefaultRetention settings require both a mode and a period.
  • The DefaultRetention period can be either Days or Years but you must select one. You cannot specify Days and Years at the same time.
  • You can only enable Object Lock for new buckets. If you want to turn on Object Lock for an existing bucket, contact Amazon Web Services Support.
PutObjectRetention
Show Description Places an Object Retention configuration on an object. For more information, see Locking Objects. Users or accounts require the s3:PutObjectRetention permission in order to place an Object Retention configuration on objects. Bypassing a Governance Retention configuration requires the s3:BypassGovernanceRetention permission. This action is not supported by Amazon S3 on Outposts. Permissions When the Object Lock retention mode is set to compliance, you need s3:PutObjectRetention and s3:BypassGovernanceRetention permissions. For other requests to PutObjectRetention, only s3:PutObjectRetention permissions are required.
PutObjectTagging
Show Description Sets the supplied tag-set to an object that already exists in a bucket. A tag is a key-value pair. You can associate tags with an object by sending a PUT request against the tagging subresource that is associated with the object. You can retrieve tags by sending a GET request. For more information, see GetObjectTagging. For tagging-related restrictions related to characters and encodings, see Tag Restrictions. Note that Amazon S3 limits the maximum number of tags to 10 tags per object. To use this operation, you must have permission to perform the s3:PutObjectTagging action. By default, the bucket owner has this permission and can grant this permission to others. To put tags of any other version, use the versionId query parameter. You also need permission for the s3:PutObjectVersionTagging action. For information about the Amazon S3 object tagging feature, see Object Tagging.

Special Errors

    • Code: InvalidTagError
    • Cause: The tag provided was not a valid tag. This error can occur if the tag did not pass input validation. For more information, see Object Tagging.
    • Code: MalformedXMLError
    • Cause: The XML provided does not match the schema.
    • Code: OperationAbortedError
    • Cause: A conflicting conditional action is currently in progress against this resource. Please try again.
    • Code: InternalError
    • Cause: The service was unable to apply the provided tag to the object.

Related Resources

</details> </td> </tr>
PutPublicAccessBlock
RestoreObject
Show Description Restores an archived copy of an object back into Amazon S3 This action is not supported by Amazon S3 on Outposts. This action performs the following types of requests:
  • select - Perform a select query on an archived object
  • restore an archive - Restore an archived object
To use this operation, you must have permissions to perform the s3:RestoreObject action. The bucket owner has this permission by default and can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources in the Amazon S3 User Guide. Querying Archives with Select Requests You use a select type of request to perform SQL queries on archived objects. The archived objects that are being queried by the select request must be formatted as uncompressed comma-separated values (CSV) files. You can run queries and custom analytics on your archived data without having to restore your data to a hotter Amazon S3 tier. For an overview about select requests, see Querying Archived Objects in the Amazon S3 User Guide. When making a select request, do the following:
  • Define an output location for the select query's output. This must be an Amazon S3 bucket in the same Amazon Web Services Region as the bucket that contains the archive object that is being queried. The Amazon Web Services account that initiates the job must have permissions to write to the S3 bucket. You can specify the storage class and encryption for the output objects stored in the bucket. For more information about output, see Querying Archived Objects in the Amazon S3 User Guide. For more information about the S3 structure in the request body, see the following:
  • Define the SQL expression for the SELECT type of restoration for your query in the request body's SelectParameters structure. You can use expressions like the following examples.
    • The following expression returns all records from the specified object. SELECT * FROM Object
    • Assuming that you are not using any headers for data stored in the object, you can specify columns with positional headers. SELECT s._1, s._2 FROM Object s WHERE s._3 > 100
    • If you have headers and you set the fileHeaderInfo in the CSV structure in the request body to USE, you can specify headers in the query. (If you set the fileHeaderInfo field to IGNORE, the first row is skipped for the query.) You cannot mix ordinal positions with header column names. SELECT s.Id, s.FirstName, s.SSN FROM S3Object s
For more information about using SQL with S3 Glacier Select restore, see SQL Reference for Amazon S3 Select and S3 Glacier Select in the Amazon S3 User Guide. When making a select request, you can also do the following:
  • To expedite your queries, specify the Expedited tier. For more information about tiers, see "Restoring Archives," later in this topic.
  • Specify details about the data serialization format of both the input object that is being queried and the serialization of the CSV-encoded query results.
The following are additional important facts about the select feature:
  • The output results are new Amazon S3 objects. Unlike archive retrievals, they are stored until explicitly deleted-manually or through a lifecycle policy.
  • You can issue more than one select request on the same Amazon S3 object. Amazon S3 doesn't deduplicate requests, so avoid issuing duplicate requests.
  • Amazon S3 accepts a select request even if the object has already been restored. A select request doesn’t return error response 409.
Restoring objects Objects that you archive to the S3 Glacier or S3 Glacier Deep Archive storage class, and S3 Intelligent-Tiering Archive or S3 Intelligent-Tiering Deep Archive tiers are not accessible in real time. For objects in Archive Access or Deep Archive Access tiers you must first initiate a restore request, and then wait until the object is moved into the Frequent Access tier. For objects in S3 Glacier or S3 Glacier Deep Archive storage classes you must first initiate a restore request, and then wait until a temporary copy of the object is available. To access an archived object, you must restore the object for the duration (number of days) that you specify. To restore a specific object version, you can provide a version ID. If you don't provide a version ID, Amazon S3 restores the current version. When restoring an archived object (or using a select request), you can specify one of the following data access tier options in the Tier element of the request body:
  • Expedited - Expedited retrievals allow you to quickly access your data stored in the S3 Glacier storage class or S3 Intelligent-Tiering Archive tier when occasional urgent requests for a subset of archives are required. For all but the largest archived objects (250 MB+), data accessed using Expedited retrievals is typically made available within 1–5 minutes. Provisioned capacity ensures that retrieval capacity for Expedited retrievals is available when you need it. Expedited retrievals and provisioned capacity are not available for objects stored in the S3 Glacier Deep Archive storage class or S3 Intelligent-Tiering Deep Archive tier.
  • Standard - Standard retrievals allow you to access any of your archived objects within several hours. This is the default option for retrieval requests that do not specify the retrieval option. Standard retrievals typically finish within 3–5 hours for objects stored in the S3 Glacier storage class or S3 Intelligent-Tiering Archive tier. They typically finish within 12 hours for objects stored in the S3 Glacier Deep Archive storage class or S3 Intelligent-Tiering Deep Archive tier. Standard retrievals are free for objects stored in S3 Intelligent-Tiering.
  • Bulk - Bulk retrievals are the lowest-cost retrieval option in S3 Glacier, enabling you to retrieve large amounts, even petabytes, of data inexpensively. Bulk retrievals typically finish within 5–12 hours for objects stored in the S3 Glacier storage class or S3 Intelligent-Tiering Archive tier. They typically finish within 48 hours for objects stored in the S3 Glacier Deep Archive storage class or S3 Intelligent-Tiering Deep Archive tier. Bulk retrievals are free for objects stored in S3 Intelligent-Tiering.
For more information about archive retrieval options and provisioned capacity for Expedited data access, see Restoring Archived Objects in the Amazon S3 User Guide. You can use Amazon S3 restore speed upgrade to change the restore speed to a faster speed while it is in progress. For more information, see Upgrading the speed of an in-progress restore in the Amazon S3 User Guide. To get the status of object restoration, you can send a HEAD request. Operations return the x-amz-restore header, which provides information about the restoration status, in the response. You can use Amazon S3 event notifications to notify you when a restore is initiated or completed. For more information, see Configuring Amazon S3 Event Notifications in the Amazon S3 User Guide. After restoring an archived object, you can update the restoration period by reissuing the request with a new period. Amazon S3 updates the restoration period relative to the current time and charges only for the request-there are no data transfer charges. You cannot update the restoration period when Amazon S3 is actively processing your current restore request for the object. If your bucket has a lifecycle configuration with a rule that includes an expiration action, the object expiration overrides the life span that you specify in a restore request. For example, if you restore an object copy for 10 days, but the object is scheduled to expire in 3 days, Amazon S3 deletes the object in 3 days. For more information about lifecycle configuration, see PutBucketLifecycleConfiguration and Object Lifecycle Management in Amazon S3 User Guide. Responses A successful action returns either the 200 OK or 202 Accepted status code.
  • If the object is not previously restored, then Amazon S3 returns 202 Accepted in the response.
  • If the object is previously restored, Amazon S3 returns 200 OK in the response.

Special Errors

    • Code: RestoreAlreadyInProgress
    • Cause: Object restore is already in progress. (This error does not apply to SELECT type requests.)
    • HTTP Status Code: 409 Conflict
    • SOAP Fault Code Prefix: Client
    • Code: GlacierExpeditedRetrievalNotAvailable
    • Cause: expedited retrievals are currently not available. Try again later. (Returned if there is insufficient capacity to process the Expedited request. This error applies only to Expedited retrievals and not to S3 Standard or Bulk retrievals.)
    • HTTP Status Code: 503
    • SOAP Fault Code Prefix: N/A

Related Resources

</details> </td> </tr>
SelectObjectContent
Show Description This action filters the contents of an Amazon S3 object based on a simple structured query language (SQL) statement. In the request, along with the SQL expression, you must also specify a data serialization format (JSON, CSV, or Apache Parquet) of the object. Amazon S3 uses this format to parse object data into records, and returns only records that match the specified SQL expression. You must also specify the data serialization format for the response. This action is not supported by Amazon S3 on Outposts. For more information about Amazon S3 Select, see Selecting Content from Objects in the Amazon S3 User Guide. For more information about using SQL with Amazon S3 Select, see SQL Reference for Amazon S3 Select and S3 Glacier Select in the Amazon S3 User Guide.

Permissions You must have s3:GetObject permission for this operation. Amazon S3 Select does not support anonymous access. For more information about permissions, see Specifying Permissions in a Policy in the Amazon S3 User Guide.

Object Data Formats You can use Amazon S3 Select to query objects that have the following format properties:

  • CSV, JSON, and Parquet - Objects must be in CSV, JSON, or Parquet format.
  • UTF-8 - UTF-8 is the only encoding type Amazon S3 Select supports.
  • GZIP or BZIP2 - CSV and JSON files can be compressed using GZIP or BZIP2. GZIP and BZIP2 are the only compression formats that Amazon S3 Select supports for CSV and JSON files. Amazon S3 Select supports columnar compression for Parquet using GZIP or Snappy. Amazon S3 Select does not support whole-object compression for Parquet objects.
  • Server-side encryption - Amazon S3 Select supports querying objects that are protected with server-side encryption. For objects that are encrypted with customer-provided encryption keys (SSE-C), you must use HTTPS, and you must use the headers that are documented in the GetObject. For more information about SSE-C, see Server-Side Encryption (Using Customer-Provided Encryption Keys) in the Amazon S3 User Guide. For objects that are encrypted with Amazon S3 managed encryption keys (SSE-S3) and Amazon Web Services KMS keys (SSE-KMS), server-side encryption is handled transparently, so you don't need to specify anything. For more information about server-side encryption, including SSE-S3 and SSE-KMS, see Protecting Data Using Server-Side Encryption in the Amazon S3 User Guide.
Working with the Response Body Given the response size is unknown, Amazon S3 Select streams the response as a series of messages and includes a Transfer-Encoding header with chunked as its value in the response. For more information, see Appendix: SelectObjectContent Response.

GetObject Support The SelectObjectContent action does not support the following GetObject functionality. For more information, see GetObject.

  • Range: Although you can specify a scan range for an Amazon S3 Select request (see SelectObjectContentRequest - ScanRange in the request parameters), you cannot specify the range of bytes of an object to return.
  • GLACIER, DEEP_ARCHIVE and REDUCED_REDUNDANCY storage classes: You cannot specify the GLACIER, DEEP_ARCHIVE, or REDUCED_REDUNDANCY storage classes. For more information, about storage classes see Storage Classes in the Amazon S3 User Guide.

Special Errors For a list of special errors for this operation, see List of SELECT Object Content Error Codes

Related Resources

</details> </td> </tr>
UploadPart
Show Description Uploads a part in a multipart upload. In this operation, you provide part data in your request. However, you have an option to specify your existing Amazon S3 object as a data source for the part you are uploading. To upload a part from an existing object, you use the UploadPartCopy operation. You must initiate a multipart upload (see CreateMultipartUpload) before you can upload any part. In response to your initiate request, Amazon S3 returns an upload ID, a unique identifier, that you must include in your upload part request. Part numbers can be any number from 1 to 10,000, inclusive. A part number uniquely identifies a part and also defines its position within the object being created. If you upload a new part using the same part number that was used with a previous part, the previously uploaded part is overwritten. Each part must be at least 5 MB in size, except the last part. There is no size limit on the last part of your multipart upload. To ensure that data is not corrupted when traversing the network, specify the Content-MD5 header in the upload part request. Amazon S3 checks the part data against the provided MD5 value. If they do not match, Amazon S3 returns an error. If the upload request is signed with Signature Version 4, then Amazon Web Services S3 uses the x-amz-content-sha256 header as a checksum instead of Content-MD5. For more information see Authenticating Requests: Using the Authorization Header (Amazon Web Services Signature Version 4). Note: After you initiate multipart upload and upload one or more parts, you must either complete or abort multipart upload in order to stop getting charged for storage of the uploaded parts. Only after you either complete or abort multipart upload, Amazon S3 frees up the parts storage and stops charging you for the parts storage. For more information on multipart uploads, go to Multipart Upload Overview in the Amazon S3 User Guide . For information on the permissions required to use the multipart upload API, go to Multipart Upload and Permissions in the Amazon S3 User Guide. You can optionally request server-side encryption where Amazon S3 encrypts your data as it writes it to disks in its data centers and decrypts it for you when you access it. You have the option of providing your own encryption key, or you can use the Amazon Web Services managed encryption keys. If you choose to provide your own encryption key, the request headers you provide in the request must match the headers you used in the request to initiate the upload by using CreateMultipartUpload. For more information, go to Using Server-Side Encryption in the Amazon S3 User Guide. Server-side encryption is supported by the S3 Multipart Upload actions. Unless you are using a customer-provided encryption key, you don't need to specify the encryption parameters in each UploadPart request. Instead, you only need to specify the server-side encryption parameters in the initial Initiate Multipart request. For more information, see CreateMultipartUpload. If you requested server-side encryption using a customer-provided encryption key in your initiate multipart upload request, you must provide identical encryption information in each part upload using the following headers.
  • x-amz-server-side-encryption-customer-algorithm
  • x-amz-server-side-encryption-customer-key
  • x-amz-server-side-encryption-customer-key-MD5

Special Errors

    • Code: NoSuchUpload
    • Cause: The specified multipart upload does not exist. The upload ID might be invalid, or the multipart upload might have been aborted or completed.
    • HTTP Status Code: 404 Not Found
    • SOAP Fault Code Prefix: Client

Related Resources

</details> </td> </tr>
UploadPartCopy
Show Description Uploads a part by copying data from an existing object as data source. You specify the data source by adding the request header x-amz-copy-source in your request and a byte range by adding the request header x-amz-copy-source-range in your request. The minimum allowable part size for a multipart upload is 5 MB. For more information about multipart upload limits, go to Quick Facts in the Amazon S3 User Guide. Instead of using an existing object as part data, you might use the UploadPart action and provide data in your request. You must initiate a multipart upload before you can upload any part. In response to your initiate request. Amazon S3 returns a unique identifier, the upload ID, that you must include in your upload part request. For more information about using the UploadPartCopy operation, see the following:
  • For conceptual information about multipart uploads, see Uploading Objects Using Multipart Upload in the Amazon S3 User Guide.
  • For information about permissions required to use the multipart upload API, see Multipart Upload and Permissions in the Amazon S3 User Guide.
  • For information about copying objects using a single atomic action vs. the multipart upload, see Operations on Objects in the Amazon S3 User Guide.
  • For information about using server-side encryption with customer-provided encryption keys with the UploadPartCopy operation, see CopyObject and UploadPart.
Note the following additional considerations about the request headers x-amz-copy-source-if-match, x-amz-copy-source-if-none-match, x-amz-copy-source-if-unmodified-since, and x-amz-copy-source-if-modified-since:
  • Consideration 1 - If both of the x-amz-copy-source-if-match and x-amz-copy-source-if-unmodified-since headers are present in the request as follows: x-amz-copy-source-if-match condition evaluates to true, and; x-amz-copy-source-if-unmodified-since condition evaluates to false; Amazon S3 returns 200 OK and copies the data.
  • Consideration 2 - If both of the x-amz-copy-source-if-none-match and x-amz-copy-source-if-modified-since headers are present in the request as follows: x-amz-copy-source-if-none-match condition evaluates to false, and; x-amz-copy-source-if-modified-since condition evaluates to true; Amazon S3 returns 412 Precondition Failed response code.
Versioning If your bucket has versioning enabled, you could have multiple versions of the same object. By default, x-amz-copy-source identifies the current version of the object to copy. If the current version is a delete marker and you don't specify a versionId in the x-amz-copy-source, Amazon S3 returns a 404 error, because the object does not exist. If you specify versionId in the x-amz-copy-source and the versionId is a delete marker, Amazon S3 returns an HTTP 400 error, because you are not allowed to specify a delete marker as a version for the x-amz-copy-source. You can optionally specify a specific version of the source object to copy by adding the versionId subresource as shown in the following example: x-amz-copy-source: /bucket/object?versionId=version id

Special Errors

    • Code: NoSuchUpload
    • Cause: The specified multipart upload does not exist. The upload ID might be invalid, or the multipart upload might have been aborted or completed.
    • HTTP Status Code: 404 Not Found
    • Code: InvalidRequest
    • Cause: The specified copy source is not supported as a byte-range copy source.
    • HTTP Status Code: 400 Bad Request

Related Resources

</details> </td> </tr> </tbody> </table> ## S3control Events
Service Event Name Description
s3control CreateAccessPoint
Show Description Creates an access point and associates it with the specified bucket. For more information, see Managing Data Access with Amazon S3 Access Points in the Amazon S3 User Guide.

S3 on Outposts only supports VPC-style access points. For more information, see Accessing Amazon S3 on Outposts using virtual private cloud (VPC) only access points in the Amazon S3 User Guide. All Amazon S3 on Outposts REST API requests for this action require an additional parameter of x-amz-outpost-id to be passed with the request and an S3 on Outposts endpoint hostname prefix instead of s3-control. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the x-amz-outpost-id derived using the access point ARN, see the Examples section.

The following actions are related to CreateAccessPoint:

CreateAccessPointForObjectLambda
Show Description Creates an Object Lambda Access Point. For more information, see Transforming objects with Object Lambda Access Points in the Amazon S3 User Guide. The following actions are related to CreateAccessPointForObjectLambda:
CreateBucket
Show Description This action creates an Amazon S3 on Outposts bucket. To create an S3 bucket, see Create Bucket in the Amazon S3 API Reference. Creates a new Outposts bucket. By creating the bucket, you become the bucket owner. To create an Outposts bucket, you must have S3 on Outposts. For more information, see Using Amazon S3 on Outposts in Amazon S3 User Guide. Not every string is an acceptable bucket name. For information on bucket naming restrictions, see Working with Amazon S3 Buckets. S3 on Outposts buckets support:
  • Tags
  • LifecycleConfigurations for deleting expired objects
For a complete list of restrictions and Amazon S3 feature limitations on S3 on Outposts, see Amazon S3 on Outposts Restrictions and Limitations. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and x-amz-outpost-id in your API request, see the Examples section. The following actions are related to CreateBucket for Amazon S3 on Outposts:
CreateJob
Show Description You can use S3 Batch Operations to perform large-scale batch actions on Amazon S3 objects. Batch Operations can run a single action on lists of Amazon S3 objects that you specify. For more information, see S3 Batch Operations in the Amazon S3 User Guide. This action creates a S3 Batch Operations job.

Related actions include:

CreateMultiRegionAccessPoint
Show Description Creates a Multi-Region Access Point and associates it with the specified buckets. For more information about creating Multi-Region Access Points, see Creating Multi-Region Access Points in the Amazon S3 User Guide. This action will always be routed to the US West (Oregon) Region. For more information about the restrictions around managing Multi-Region Access Points, see Managing Multi-Region Access Points in the Amazon S3 User Guide. This request is asynchronous, meaning that you might receive a response before the command has completed. When this request provides a response, it provides a token that you can use to monitor the status of the request with DescribeMultiRegionAccessPointOperation. The following actions are related to CreateMultiRegionAccessPoint:
DeleteAccessPoint
DeleteAccessPointForObjectLambda
DeleteAccessPointPolicy
DeleteAccessPointPolicyForObjectLambda
DeleteBucket
DeleteBucketLifecycleConfiguration
DeleteBucketPolicy
DeleteBucketTagging
DeleteJobTagging
Show Description Removes the entire tag set from the specified S3 Batch Operations job. To use this operation, you must have permission to perform the s3:DeleteJobTagging action. For more information, see Controlling access and labeling jobs using tags in the Amazon S3 User Guide.

Related actions include:

DeleteMultiRegionAccessPoint
Show Description Deletes a Multi-Region Access Point. This action does not delete the buckets associated with the Multi-Region Access Point, only the Multi-Region Access Point itself. This action will always be routed to the US West (Oregon) Region. For more information about the restrictions around managing Multi-Region Access Points, see Managing Multi-Region Access Points in the Amazon S3 User Guide. This request is asynchronous, meaning that you might receive a response before the command has completed. When this request provides a response, it provides a token that you can use to monitor the status of the request with DescribeMultiRegionAccessPointOperation. The following actions are related to DeleteMultiRegionAccessPoint:
DeletePublicAccessBlock
DeleteStorageLensConfiguration
DeleteStorageLensConfigurationTagging
Show Description Deletes the Amazon S3 Storage Lens configuration tags. For more information about S3 Storage Lens, see Assessing your storage activity and usage with Amazon S3 Storage Lens in the Amazon S3 User Guide. To use this action, you must have permission to perform the s3:DeleteStorageLensConfigurationTagging action. For more information, see Setting permissions to use Amazon S3 Storage Lens in the Amazon S3 User Guide.
DescribeJob
Show Description Retrieves the configuration parameters and status for a Batch Operations job. For more information, see S3 Batch Operations in the Amazon S3 User Guide.

Related actions include:

DescribeMultiRegionAccessPointOperation
Show Description Retrieves the status of an asynchronous request to manage a Multi-Region Access Point. For more information about managing Multi-Region Access Points and how asynchronous requests work, see Managing Multi-Region Access Points in the Amazon S3 User Guide. The following actions are related to GetMultiRegionAccessPoint:
GetAccessPoint
Show Description Returns configuration information about the specified access point.

All Amazon S3 on Outposts REST API requests for this action require an additional parameter of x-amz-outpost-id to be passed with the request and an S3 on Outposts endpoint hostname prefix instead of s3-control. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the x-amz-outpost-id derived using the access point ARN, see the Examples section. The following actions are related to GetAccessPoint:

GetAccessPointConfigurationForObjectLambda
Show Description Returns configuration for an Object Lambda Access Point. The following actions are related to GetAccessPointConfigurationForObjectLambda:
GetAccessPointForObjectLambda
Show Description Returns configuration information about the specified Object Lambda Access Point The following actions are related to GetAccessPointForObjectLambda:
GetAccessPointPolicy
Show Description Returns the access point policy associated with the specified access point. The following actions are related to GetAccessPointPolicy:
GetAccessPointPolicyForObjectLambda
Show Description Returns the resource policy for an Object Lambda Access Point. The following actions are related to GetAccessPointPolicyForObjectLambda:
GetAccessPointPolicyStatus
Show Description Indicates whether the specified access point currently has a policy that allows public access. For more information about public access through access points, see Managing Data Access with Amazon S3 access points in the Amazon S3 User Guide.
GetAccessPointPolicyStatusForObjectLambda
Show Description Returns the status of the resource policy associated with an Object Lambda Access Point.
GetBucket
Show Description Gets an Amazon S3 on Outposts bucket. For more information, see Using Amazon S3 on Outposts in the Amazon S3 User Guide. If you are using an identity other than the root user of the Amazon Web Services account that owns the Outposts bucket, the calling identity must have the s3-outposts:GetBucket permissions on the specified Outposts bucket and belong to the Outposts bucket owner's account in order to use this action. Only users from Outposts bucket owner account with the right permissions can perform actions on an Outposts bucket. If you don't have s3-outposts:GetBucket permissions or you're not using an identity that belongs to the bucket owner's account, Amazon S3 returns a 403 Access Denied error. The following actions are related to GetBucket for Amazon S3 on Outposts: All Amazon S3 on Outposts REST API requests for this action require an additional parameter of x-amz-outpost-id to be passed with the request and an S3 on Outposts endpoint hostname prefix instead of s3-control. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the x-amz-outpost-id derived using the access point ARN, see the Examples section.
GetBucketLifecycleConfiguration
Show Description This action gets an Amazon S3 on Outposts bucket's lifecycle configuration. To get an S3 bucket's lifecycle configuration, see GetBucketLifecycleConfiguration in the Amazon S3 API Reference. Returns the lifecycle configuration information set on the Outposts bucket. For more information, see Using Amazon S3 on Outposts and for information about lifecycle configuration, see Object Lifecycle Management in Amazon S3 User Guide. To use this action, you must have permission to perform the s3-outposts:GetLifecycleConfiguration action. The Outposts bucket owner has this permission, by default. The bucket owner can grant this permission to others. For more information about permissions, see Permissions Related to Bucket Subresource Operations and Managing Access Permissions to Your Amazon S3 Resources. All Amazon S3 on Outposts REST API requests for this action require an additional parameter of x-amz-outpost-id to be passed with the request and an S3 on Outposts endpoint hostname prefix instead of s3-control. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the x-amz-outpost-id derived using the access point ARN, see the Examples section. GetBucketLifecycleConfiguration has the following special error:
  • Error code: NoSuchLifecycleConfiguration
    • Description: The lifecycle configuration does not exist.
    • HTTP Status Code: 404 Not Found
    • SOAP Fault Code Prefix: Client
The following actions are related to GetBucketLifecycleConfiguration:
GetBucketPolicy
Show Description This action gets a bucket policy for an Amazon S3 on Outposts bucket. To get a policy for an S3 bucket, see GetBucketPolicy in the Amazon S3 API Reference. Returns the policy of a specified Outposts bucket. For more information, see Using Amazon S3 on Outposts in the Amazon S3 User Guide. If you are using an identity other than the root user of the Amazon Web Services account that owns the bucket, the calling identity must have the GetBucketPolicy permissions on the specified bucket and belong to the bucket owner's account in order to use this action. Only users from Outposts bucket owner account with the right permissions can perform actions on an Outposts bucket. If you don't have s3-outposts:GetBucketPolicy permissions or you're not using an identity that belongs to the bucket owner's account, Amazon S3 returns a 403 Access Denied error. As a security precaution, the root user of the Amazon Web Services account that owns a bucket can always use this action, even if the policy explicitly denies the root user the ability to perform this action. For more information about bucket policies, see Using Bucket Policies and User Policies. All Amazon S3 on Outposts REST API requests for this action require an additional parameter of x-amz-outpost-id to be passed with the request and an S3 on Outposts endpoint hostname prefix instead of s3-control. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the x-amz-outpost-id derived using the access point ARN, see the Examples section. The following actions are related to GetBucketPolicy:
GetBucketTagging
Show Description This action gets an Amazon S3 on Outposts bucket's tags. To get an S3 bucket tags, see GetBucketTagging in the Amazon S3 API Reference. Returns the tag set associated with the Outposts bucket. For more information, see Using Amazon S3 on Outposts in the Amazon S3 User Guide. To use this action, you must have permission to perform the GetBucketTagging action. By default, the bucket owner has this permission and can grant this permission to others. GetBucketTagging has the following special error:
  • Error code: NoSuchTagSetError
    • Description: There is no tag set associated with the bucket.
All Amazon S3 on Outposts REST API requests for this action require an additional parameter of x-amz-outpost-id to be passed with the request and an S3 on Outposts endpoint hostname prefix instead of s3-control. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the x-amz-outpost-id derived using the access point ARN, see the Examples section. The following actions are related to GetBucketTagging:
GetJobTagging
Show Description Returns the tags on an S3 Batch Operations job. To use this operation, you must have permission to perform the s3:GetJobTagging action. For more information, see Controlling access and labeling jobs using tags in the Amazon S3 User Guide.

Related actions include:

GetMultiRegionAccessPoint
Show Description Returns configuration information about the specified Multi-Region Access Point. This action will always be routed to the US West (Oregon) Region. For more information about the restrictions around managing Multi-Region Access Points, see Managing Multi-Region Access Points in the Amazon S3 User Guide. The following actions are related to GetMultiRegionAccessPoint:
GetMultiRegionAccessPointPolicy
Show Description Returns the access control policy of the specified Multi-Region Access Point. This action will always be routed to the US West (Oregon) Region. For more information about the restrictions around managing Multi-Region Access Points, see Managing Multi-Region Access Points in the Amazon S3 User Guide. The following actions are related to GetMultiRegionAccessPointPolicy:
GetMultiRegionAccessPointPolicyStatus
Show Description Indicates whether the specified Multi-Region Access Point has an access control policy that allows public access. This action will always be routed to the US West (Oregon) Region. For more information about the restrictions around managing Multi-Region Access Points, see Managing Multi-Region Access Points in the Amazon S3 User Guide. The following actions are related to GetMultiRegionAccessPointPolicyStatus:
GetPublicAccessBlock
Show Description Retrieves the PublicAccessBlock configuration for an Amazon Web Services account. For more information, see Using Amazon S3 block public access. Related actions include:
GetStorageLensConfiguration
Show Description Gets the Amazon S3 Storage Lens configuration. For more information, see Assessing your storage activity and usage with Amazon S3 Storage Lens in the Amazon S3 User Guide. To use this action, you must have permission to perform the s3:GetStorageLensConfiguration action. For more information, see Setting permissions to use Amazon S3 Storage Lens in the Amazon S3 User Guide.
GetStorageLensConfigurationTagging
Show Description Gets the tags of Amazon S3 Storage Lens configuration. For more information about S3 Storage Lens, see Assessing your storage activity and usage with Amazon S3 Storage Lens in the Amazon S3 User Guide. To use this action, you must have permission to perform the s3:GetStorageLensConfigurationTagging action. For more information, see Setting permissions to use Amazon S3 Storage Lens in the Amazon S3 User Guide.
ListAccessPoints
Show Description Returns a list of the access points currently associated with the specified bucket. You can retrieve up to 1000 access points per call. If the specified bucket has more than 1,000 access points (or the number specified in maxResults, whichever is less), the response will include a continuation token that you can use to list the additional access points.

All Amazon S3 on Outposts REST API requests for this action require an additional parameter of x-amz-outpost-id to be passed with the request and an S3 on Outposts endpoint hostname prefix instead of s3-control. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and the x-amz-outpost-id derived using the access point ARN, see the Examples section. The following actions are related to ListAccessPoints:

ListAccessPointsForObjectLambda
Show Description Returns a list of the access points associated with the Object Lambda Access Point. You can retrieve up to 1000 access points per call. If there are more than 1,000 access points (or the number specified in maxResults, whichever is less), the response will include a continuation token that you can use to list the additional access points. The following actions are related to ListAccessPointsForObjectLambda:
ListJobs
Show Description Lists current S3 Batch Operations jobs and jobs that have ended within the last 30 days for the Amazon Web Services account making the request. For more information, see S3 Batch Operations in the Amazon S3 User Guide. Related actions include:

ListMultiRegionAccessPoints
Show Description Returns a list of the Multi-Region Access Points currently associated with the specified Amazon Web Services account. Each call can return up to 100 Multi-Region Access Points, the maximum number of Multi-Region Access Points that can be associated with a single account. This action will always be routed to the US West (Oregon) Region. For more information about the restrictions around managing Multi-Region Access Points, see Managing Multi-Region Access Points in the Amazon S3 User Guide. The following actions are related to ListMultiRegionAccessPoint:
ListRegionalBuckets
Show Description Returns a list of all Outposts buckets in an Outpost that are owned by the authenticated sender of the request. For more information, see Using Amazon S3 on Outposts in the Amazon S3 User Guide. For an example of the request syntax for Amazon S3 on Outposts that uses the S3 on Outposts endpoint hostname prefix and x-amz-outpost-id in your request, see the Examples section.
ListStorageLensConfigurations
Show Description Gets a list of Amazon S3 Storage Lens configurations. For more information about S3 Storage Lens, see Assessing your storage activity and usage with Amazon S3 Storage Lens in the Amazon S3 User Guide. To use this action, you must have permission to perform the s3:ListStorageLensConfigurations action. For more information, see Setting permissions to use Amazon S3 Storage Lens in the Amazon S3 User Guide.
PutAccessPointConfigurationForObjectLambda
PutAccessPointPolicy
PutAccessPointPolicyForObjectLambda
PutBucketLifecycleConfiguration
PutBucketPolicy
PutBucketTagging
PutJobTagging
Show Description Sets the supplied tag-set on an S3 Batch Operations job. A tag is a key-value pair. You can associate S3 Batch Operations tags with any job by sending a PUT request against the tagging subresource that is associated with the job. To modify the existing tag set, you can either replace the existing tag set entirely, or make changes within the existing tag set by retrieving the existing tag set using GetJobTagging, modify that tag set, and use this action to replace the tag set with the one you modified. For more information, see Controlling access and labeling jobs using tags in the Amazon S3 User Guide.

  • If you send this request with an empty tag set, Amazon S3 deletes the existing tag set on the Batch Operations job. If you use this method, you are charged for a Tier 1 Request (PUT). For more information, see Amazon S3 pricing.
  • For deleting existing tags for your Batch Operations job, a DeleteJobTagging request is preferred because it achieves the same result without incurring charges.
  • A few things to consider about using tags:
    • Amazon S3 limits the maximum number of tags to 50 tags per job.
    • You can associate up to 50 tags with a job as long as they have unique tag keys.
    • A tag key can be up to 128 Unicode characters in length, and tag values can be up to 256 Unicode characters in length.
    • The key and values are case sensitive.
    • For tagging-related restrictions related to characters and encodings, see User-Defined Tag Restrictions in the Billing and Cost Management User Guide.

To use this action, you must have permission to perform the s3:PutJobTagging action. Related actions include:

PutMultiRegionAccessPointPolicy
Show Description Associates an access control policy with the specified Multi-Region Access Point. Each Multi-Region Access Point can have only one policy, so a request made to this action replaces any existing policy that is associated with the specified Multi-Region Access Point. This action will always be routed to the US West (Oregon) Region. For more information about the restrictions around managing Multi-Region Access Points, see Managing Multi-Region Access Points in the Amazon S3 User Guide. The following actions are related to PutMultiRegionAccessPointPolicy:
PutPublicAccessBlock
PutStorageLensConfiguration
PutStorageLensConfigurationTagging
Show Description Put or replace tags on an existing Amazon S3 Storage Lens configuration. For more information about S3 Storage Lens, see Assessing your storage activity and usage with Amazon S3 Storage Lens in the Amazon S3 User Guide. To use this action, you must have permission to perform the s3:PutStorageLensConfigurationTagging action. For more information, see Setting permissions to use Amazon S3 Storage Lens in the Amazon S3 User Guide.
UpdateJobPriority
Show Description Updates an existing S3 Batch Operations job's priority. For more information, see S3 Batch Operations in the Amazon S3 User Guide.

Related actions include:

## S3outposts Events
Service Event Name Description
s3outposts CreateEndpoint
Show Description Amazon S3 on Outposts Access Points simplify managing data access at scale for shared datasets in S3 on Outposts. S3 on Outposts uses endpoints to connect to Outposts buckets so that you can perform actions within your virtual private cloud (VPC). For more information, see Accessing S3 on Outposts using VPC only access points. This action creates an endpoint and associates it with the specified Outposts. It can take up to 5 minutes for this action to complete.

Related actions include:

DeleteEndpoint
## Sagemaker-a2i-runtime Events
Service Event Name Description
sagemaker-a2i-runtime DeleteHumanLoop
Show Description Deletes the specified human loop for a flow definition. If the human loop was deleted, this operation will return a ResourceNotFoundException.
DescribeHumanLoop
Show Description Returns information about the specified human loop. If the human loop was deleted, this operation will return a ResourceNotFoundException error.
ListHumanLoops
Show Description Returns information about human loops, given the specified parameters. If a human loop was deleted, it will not be included.
StartHumanLoop
Show Description Starts a human loop, provided that at least one activation condition is met.
## Sagemaker-edge Events
Service Event Name Description
sagemaker-edge GetDeviceRegistration
Show Description Use to check if a device is registered with SageMaker Edge Manager.
## Sagemaker-featurestore-runtime Events
Service Event Name Description
sagemaker-featurestore-runtime BatchGetRecord
Show Description Retrieves a batch of Records from a FeatureGroup.
DeleteRecord
GetRecord
Show Description Use for OnlineStore serving from a FeatureStore. Only the latest records stored in the OnlineStore can be retrieved. If no Record with RecordIdentifierValue is found, then an empty result is returned.
## Sagemaker-runtime Events
Service Event Name Description
sagemaker-runtime InvokeEndpoint
Show Description After you deploy a model into production using Amazon SageMaker hosting services, your client applications use this API to get inferences from the model hosted at the specified endpoint. For an overview of Amazon SageMaker, see How It Works. Amazon SageMaker strips all POST headers except those supported by the API. Amazon SageMaker might add additional headers. You should not rely on the behavior of headers outside those enumerated in the request syntax. Calls to InvokeEndpoint are authenticated by using AWS Signature Version 4. For information, see Authenticating Requests (AWS Signature Version 4) in the Amazon S3 API Reference. A customer's model containers must respond to requests within 60 seconds. The model itself can have a maximum processing time of 60 seconds before responding to invocations. If your model is going to take 50-60 seconds of processing time, the SDK socket timeout should be set to be 70 seconds. Endpoints are scoped to an individual account, and are not public. The URL does not contain the account ID, but Amazon SageMaker determines the account ID from the authentication token that is supplied by the caller.
## Sagemaker Events
Service Event Name Description
sagemaker AddAssociation
Show Description Creates an association between the source and the destination. A source can be associated with multiple destinations, and a destination can be associated with multiple sources. An association is a lineage tracking entity. For more information, see Amazon SageMaker ML Lineage Tracking.
AddTags
Show Description Adds or overwrites one or more tags for the specified Amazon SageMaker resource. You can add tags to notebook instances, training jobs, hyperparameter tuning jobs, batch transform jobs, models, labeling jobs, work teams, endpoint configurations, and endpoints. Each tag consists of a key and an optional value. Tag keys must be unique per resource. For more information about tags, see For more information, see Amazon Web Services Tagging Strategies. Tags that you add to a hyperparameter tuning job by calling this API are also added to any training jobs that the hyperparameter tuning job launches after you call this API, but not to training jobs that the hyperparameter tuning job launched before you called this API. To make sure that the tags associated with a hyperparameter tuning job are also added to all training jobs that the hyperparameter tuning job launches, add the tags when you first create the tuning job by specifying them in the Tags parameter of CreateHyperParameterTuningJob Tags that you add to a SageMaker Studio Domain or User Profile by calling this API are also added to any Apps that the Domain or User Profile launches after you call this API, but not to Apps that the Domain or User Profile launched before you called this API. To make sure that the tags associated with a Domain or User Profile are also added to all Apps that the Domain or User Profile launches, add the tags when you first create the Domain or User Profile by specifying them in the Tags parameter of CreateDomain or CreateUserProfile.
AssociateTrialComponent
Show Description Associates a trial component with a trial. A trial component can be associated with multiple trials. To disassociate a trial component from a trial, call the DisassociateTrialComponent API.
BatchDescribeModelPackage
Show Description This action batch describes a list of versioned model packages
CreateAction
Show Description Creates an action. An action is a lineage tracking entity that represents an action or activity. For example, a model deployment or an HPO job. Generally, an action involves at least one input or output artifact. For more information, see Amazon SageMaker ML Lineage Tracking.
CreateAlgorithm
Show Description Create a machine learning algorithm that you can use in Amazon SageMaker and list in the Amazon Web Services Marketplace.
CreateApp
Show Description Creates a running app for the specified UserProfile. Supported apps are JupyterServer and KernelGateway. This operation is automatically invoked by Amazon SageMaker Studio upon access to the associated Domain, and when new kernel configurations are selected by the user. A user may have multiple Apps active simultaneously.
CreateAppImageConfig
Show Description Creates a configuration for running a SageMaker image as a KernelGateway app. The configuration specifies the Amazon Elastic File System (EFS) storage volume on the image, and a list of the kernels in the image.
CreateArtifact
Show Description Creates an artifact. An artifact is a lineage tracking entity that represents a URI addressable object or data. Some examples are the S3 URI of a dataset and the ECR registry path of an image. For more information, see Amazon SageMaker ML Lineage Tracking.
CreateAutoMLJob
Show Description Creates an Autopilot job. Find the best-performing model after you run an Autopilot job by calling . For information about how to use Autopilot, see Automate Model Development with Amazon SageMaker Autopilot.
CreateCodeRepository
Show Description Creates a Git repository as a resource in your Amazon SageMaker account. You can associate the repository with notebook instances so that you can use Git source control for the notebooks you create. The Git repository is a resource in your Amazon SageMaker account, so it can be associated with more than one notebook instance, and it persists independently from the lifecycle of any notebook instances it is associated with. The repository can be hosted either in Amazon Web Services CodeCommit or in any other Git repository.
CreateCompilationJob
Show Description Starts a model compilation job. After the model has been compiled, Amazon SageMaker saves the resulting model artifacts to an Amazon Simple Storage Service (Amazon S3) bucket that you specify. If you choose to host your model using Amazon SageMaker hosting services, you can use the resulting model artifacts as part of the model. You can also use the artifacts with Amazon Web Services IoT Greengrass. In that case, deploy them as an ML resource. In the request body, you provide the following:
  • A name for the compilation job
  • Information about the input model artifacts
  • The output location for the compiled model and the device (target) that the model runs on
  • The Amazon Resource Name (ARN) of the IAM role that Amazon SageMaker assumes to perform the model compilation job.
You can also provide a Tag to track the model compilation job's resource use and costs. The response body contains the CompilationJobArn for the compiled job. To stop a model compilation job, use StopCompilationJob. To get information about a particular model compilation job, use DescribeCompilationJob. To get information about multiple model compilation jobs, use ListCompilationJobs.
CreateContext
Show Description Creates a context. A context is a lineage tracking entity that represents a logical grouping of other tracking or experiment entities. Some examples are an endpoint and a model package. For more information, see Amazon SageMaker ML Lineage Tracking.
CreateDataQualityJobDefinition
Show Description Creates a definition for a job that monitors data quality and drift. For information about model monitor, see Amazon SageMaker Model Monitor.
CreateDeviceFleet
CreateDomain
Show Description Creates a Domain used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. An Amazon Web Services account is limited to one domain per region. Users within a domain can share notebook files and other artifacts with each other. EFS storage When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files. SageMaker uses the Amazon Web Services Key Management Service (Amazon Web Services KMS) to encrypt the EFS volume attached to the domain with an Amazon Web Services managed key by default. For more control, you can specify a customer managed key. For more information, see Protect Data at Rest Using Encryption. VPC configuration All SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the AppNetworkAccessType parameter. AppNetworkAccessType corresponds to the network access type that you choose when you onboard to Studio. The following options are available:
  • PublicInternetOnly - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.
  • VpcOnly - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway. When internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.
NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully. For more information, see Connect SageMaker Studio Notebooks to Resources in a VPC.
CreateEdgePackagingJob
CreateEndpoint
Show Description Creates an endpoint using the endpoint configuration specified in the request. Amazon SageMaker uses the endpoint to provision resources and deploy models. You create the endpoint configuration with the CreateEndpointConfig API. Use this API to deploy models using Amazon SageMaker hosting services. For an example that calls this method when deploying a model to Amazon SageMaker hosting services, see the Create Endpoint example notebook. You must not delete an EndpointConfig that is in use by an endpoint that is live or while the UpdateEndpoint or CreateEndpoint operations are being performed on the endpoint. To update an endpoint, you must create a new EndpointConfig. The endpoint name must be unique within an Amazon Web Services Region in your Amazon Web Services account. When it receives the request, Amazon SageMaker creates the endpoint, launches the resources (ML compute instances), and deploys the model(s) on them. When you call CreateEndpoint, a load call is made to DynamoDB to verify that your endpoint configuration exists. When you read data from a DynamoDB table supporting Eventually Consistent Reads , the response might not reflect the results of a recently completed write operation. The response might include some stale data. If the dependent entities are not yet in DynamoDB, this causes a validation error. If you repeat your read request after a short time, the response should return the latest data. So retry logic is recommended to handle these possible issues. We also recommend that customers call DescribeEndpointConfig before calling CreateEndpoint to minimize the potential impact of a DynamoDB eventually consistent read. When Amazon SageMaker receives the request, it sets the endpoint status to Creating. After it creates the endpoint, it sets the status to InService. Amazon SageMaker can then process incoming requests for inferences. To check the status of an endpoint, use the DescribeEndpoint API. If any of the models hosted at this endpoint get model data from an Amazon S3 location, Amazon SageMaker uses Amazon Web Services Security Token Service to download model artifacts from the S3 path you provided. Amazon Web Services STS is activated in your IAM user account by default. If you previously deactivated Amazon Web Services STS for a region, you need to reactivate Amazon Web Services STS for that region. For more information, see Activating and Deactivating Amazon Web Services STS in an Amazon Web Services Region in the Amazon Web Services Identity and Access Management User Guide. To add the IAM role policies for using this API operation, go to the IAM console, and choose Roles in the left navigation pane. Search the IAM role that you want to grant access to use the CreateEndpoint and CreateEndpointConfig API operations, add the following policies to the role.
  • Option 1: For a full SageMaker access, search and attach the AmazonSageMakerFullAccess policy.
  • Option 2: For granting a limited access to an IAM role, paste the following Action elements manually into the JSON file of the IAM role: "Action": ["sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig"] "Resource": [ "arn:aws:sagemaker:region:account-id:endpoint/endpointName" "arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName" ] For more information, see SageMaker API Permissions: Actions, Permissions, and Resources Reference.
CreateEndpointConfig
Show Description Creates an endpoint configuration that Amazon SageMaker hosting services uses to deploy models. In the configuration, you identify one or more models, created using the CreateModel API, to deploy and the resources that you want Amazon SageMaker to provision. Then you call the CreateEndpoint API. Use this API if you want to use Amazon SageMaker hosting services to deploy models into production. In the request, you define a ProductionVariant, for each model that you want to deploy. Each ProductionVariant parameter also describes the resources that you want Amazon SageMaker to provision. This includes the number and type of ML compute instances to deploy. If you are hosting multiple models, you also assign a VariantWeight to specify how much traffic you want to allocate to each model. For example, suppose that you want to host two models, A and B, and you assign traffic weight 2 for model A and 1 for model B. Amazon SageMaker distributes two-thirds of the traffic to Model A, and one-third to model B. When you call CreateEndpoint, a load call is made to DynamoDB to verify that your endpoint configuration exists. When you read data from a DynamoDB table supporting Eventually Consistent Reads , the response might not reflect the results of a recently completed write operation. The response might include some stale data. If the dependent entities are not yet in DynamoDB, this causes a validation error. If you repeat your read request after a short time, the response should return the latest data. So retry logic is recommended to handle these possible issues. We also recommend that customers call DescribeEndpointConfig before calling CreateEndpoint to minimize the potential impact of a DynamoDB eventually consistent read.
CreateExperiment
Show Description Creates an SageMaker experiment. An experiment is a collection of trials that are observed, compared and evaluated as a group. A trial is a set of steps, called trial components, that produce a machine learning model. The goal of an experiment is to determine the components that produce the best model. Multiple trials are performed, each one isolating and measuring the impact of a change to one or more inputs, while keeping the remaining inputs constant. When you use SageMaker Studio or the SageMaker Python SDK, all experiments, trials, and trial components are automatically tracked, logged, and indexed. When you use the Amazon Web Services SDK for Python (Boto), you must use the logging APIs provided by the SDK. You can add tags to experiments, trials, trial components and then use the Search API to search for the tags. To add a description to an experiment, specify the optional Description parameter. To add a description later, or to change the description, call the UpdateExperiment API. To get a list of all your experiments, call the ListExperiments API. To view an experiment's properties, call the DescribeExperiment API. To get a list of all the trials associated with an experiment, call the ListTrials API. To create a trial call the CreateTrial API.
CreateFeatureGroup
Show Description Create a new FeatureGroup. A FeatureGroup is a group of Features defined in the FeatureStore to describe a Record. The FeatureGroup defines the schema and features contained in the FeatureGroup. A FeatureGroup definition is composed of a list of Features, a RecordIdentifierFeatureName, an EventTimeFeatureName and configurations for its OnlineStore and OfflineStore. Check Amazon Web Services service quotas to see the FeatureGroups quota for your Amazon Web Services account. You must include at least one of OnlineStoreConfig and OfflineStoreConfig to create a FeatureGroup.
CreateFlowDefinition
Show Description Creates a flow definition.
CreateHumanTaskUi
Show Description Defines the settings you will use for the human review workflow user interface. Reviewers will see a three-panel interface with an instruction area, the item to review, and an input area.
CreateHyperParameterTuningJob
Show Description Starts a hyperparameter tuning job. A hyperparameter tuning job finds the best version of a model by running many training jobs on your dataset using the algorithm you choose and values for hyperparameters within ranges that you specify. It then chooses the hyperparameter values that result in a model that performs the best, as measured by an objective metric that you choose.
CreateImage
Show Description Creates a custom SageMaker image. A SageMaker image is a set of image versions. Each image version represents a container image stored in Amazon Container Registry (ECR). For more information, see Bring your own SageMaker image.
CreateImageVersion
Show Description Creates a version of the SageMaker image specified by ImageName. The version represents the Amazon Container Registry (ECR) container image specified by BaseImage.
CreateLabelingJob
Show Description Creates a job that uses workers to label the data objects in your input dataset. You can use the labeled data to train machine learning models. You can select your workforce from one of three providers:
  • A private workforce that you create. It can include employees, contractors, and outside experts. Use a private workforce when want the data to stay within your organization or when a specific set of skills is required.
  • One or more vendors that you select from the Amazon Web Services Marketplace. Vendors provide expertise in specific areas.
  • The Amazon Mechanical Turk workforce. This is the largest workforce, but it should only be used for public data or data that has been stripped of any personally identifiable information.
You can also use automated data labeling to reduce the number of data objects that need to be labeled by a human. Automated data labeling uses active learning to determine if a data object can be labeled by machine or if it needs to be sent to a human worker. For more information, see Using Automated Data Labeling. The data objects to be labeled are contained in an Amazon S3 bucket. You create a manifest file that describes the location of each object. For more information, see Using Input and Output Data. The output can be used as the manifest file for another labeling job or as training data for your machine learning models. You can use this operation to create a static labeling job or a streaming labeling job. A static labeling job stops if all data objects in the input manifest file identified in ManifestS3Uri have been labeled. A streaming labeling job runs perpetually until it is manually stopped, or remains idle for 10 days. You can send new data objects to an active (InProgress) streaming labeling job in real time. To learn how to create a static labeling job, see Create a Labeling Job (API) in the Amazon SageMaker Developer Guide. To learn how to create a streaming labeling job, see Create a Streaming Labeling Job.
CreateModel
Show Description Creates a model in Amazon SageMaker. In the request, you name the model and describe a primary container. For the primary container, you specify the Docker image that contains inference code, artifacts (from prior training), and a custom environment map that the inference code uses when you deploy the model for predictions. Use this API to create a model if you want to use Amazon SageMaker hosting services or run a batch transform job. To host your model, you create an endpoint configuration with the CreateEndpointConfig API, and then create an endpoint with the CreateEndpoint API. Amazon SageMaker then deploys all of the containers that you defined for the model in the hosting environment. For an example that calls this method when deploying a model to Amazon SageMaker hosting services, see Deploy the Model to Amazon SageMaker Hosting Services (Amazon Web Services SDK for Python (Boto 3)). To run a batch transform using your model, you start a job with the CreateTransformJob API. Amazon SageMaker uses your model and your dataset to get inferences which are then saved to a specified S3 location. In the CreateModel request, you must define a container with the PrimaryContainer parameter. In the request, you also provide an IAM role that Amazon SageMaker can assume to access model artifacts and docker image for deployment on ML compute hosting instances or for batch transform jobs. In addition, you also use the IAM role to manage permissions the inference code needs. For example, if the inference code access any other Amazon Web Services resources, you grant necessary permissions via this role.
CreateModelBiasJobDefinition
Show Description Creates the definition for a model bias job.
CreateModelExplainabilityJobDefinition
Show Description Creates the definition for a model explainability job.
CreateModelPackage
Show Description Creates a model package that you can use to create Amazon SageMaker models or list on Amazon Web Services Marketplace, or a versioned model that is part of a model group. Buyers can subscribe to model packages listed on Amazon Web Services Marketplace to create models in Amazon SageMaker. To create a model package by specifying a Docker container that contains your inference code and the Amazon S3 location of your model artifacts, provide values for InferenceSpecification. To create a model from an algorithm resource that you created or subscribed to in Amazon Web Services Marketplace, provide a value for SourceAlgorithmSpecification. There are two types of model packages:
  • Versioned - a model that is part of a model group in the model registry.
  • Unversioned - a model package that is not part of a model group.
CreateModelPackageGroup
Show Description Creates a model group. A model group contains a group of model versions.
CreateModelQualityJobDefinition
Show Description Creates a definition for a job that monitors model quality and drift. For information about model monitor, see Amazon SageMaker Model Monitor.
CreateMonitoringSchedule
Show Description Creates a schedule that regularly starts Amazon SageMaker Processing Jobs to monitor the data captured for an Amazon SageMaker Endoint.
CreateNotebookInstance
Show Description Creates an Amazon SageMaker notebook instance. A notebook instance is a machine learning (ML) compute instance running on a Jupyter notebook. In a CreateNotebookInstance request, specify the type of ML compute instance that you want to run. Amazon SageMaker launches the instance, installs common libraries that you can use to explore datasets for model training, and attaches an ML storage volume to the notebook instance. Amazon SageMaker also provides a set of example notebooks. Each notebook demonstrates how to use Amazon SageMaker with a specific algorithm or with a machine learning framework. After receiving the request, Amazon SageMaker does the following:
  1. Creates a network interface in the Amazon SageMaker VPC.
  2. (Option) If you specified SubnetId, Amazon SageMaker creates a network interface in your own VPC, which is inferred from the subnet ID that you provide in the input. When creating this network interface, Amazon SageMaker attaches the security group that you specified in the request to the network interface that it creates in your VPC.
  3. Launches an EC2 instance of the type specified in the request in the Amazon SageMaker VPC. If you specified SubnetId of your VPC, Amazon SageMaker specifies both network interfaces when launching this instance. This enables inbound traffic from your own VPC to the notebook instance, assuming that the security groups allow it.
After creating the notebook instance, Amazon SageMaker returns its Amazon Resource Name (ARN). You can't change the name of a notebook instance after you create it. After Amazon SageMaker creates the notebook instance, you can connect to the Jupyter server and work in Jupyter notebooks. For example, you can write code to explore a dataset that you can use for model training, train a model, host models by creating Amazon SageMaker endpoints, and validate hosted models. For more information, see How It Works.
CreateNotebookInstanceLifecycleConfig
Show Description Creates a lifecycle configuration that you can associate with a notebook instance. A lifecycle configuration is a collection of shell scripts that run when you create or start a notebook instance. Each lifecycle configuration script has a limit of 16384 characters. The value of the $PATH environment variable that is available to both scripts is /sbin:bin:/usr/sbin:/usr/bin. View CloudWatch Logs for notebook instance lifecycle configurations in log group /aws/sagemaker/NotebookInstances in log stream [notebook-instance-name]/[LifecycleConfigHook]. Lifecycle configuration scripts cannot run for longer than 5 minutes. If a script runs for longer than 5 minutes, it fails and the notebook instance is not created or started. For information about notebook instance lifestyle configurations, see Step 2.1: (Optional) Customize a Notebook Instance.
CreatePipeline
Show Description Creates a pipeline using a JSON pipeline definition.
CreatePresignedDomainUrl
Show Description Creates a URL for a specified UserProfile in a Domain. When accessed in a web browser, the user will be automatically signed in to Amazon SageMaker Studio, and granted access to all of the Apps and files associated with the Domain's Amazon Elastic File System (EFS) volume. This operation can only be called when the authentication mode equals IAM. The IAM role or user used to call this API defines the permissions to access the app. Once the presigned URL is created, no additional permission is required to access this URL. IAM authorization policies for this API are also enforced for every HTTP request and WebSocket frame that attempts to connect to the app. You can restrict access to this API and to the URL that it returns to a list of IP addresses, Amazon VPCs or Amazon VPC Endpoints that you specify. For more information, see Connect to SageMaker Studio Through an Interface VPC Endpoint . The URL that you get from a call to CreatePresignedDomainUrl has a default timeout of 5 minutes. You can configure this value using ExpiresInSeconds. If you try to use the URL after the timeout limit expires, you are directed to the Amazon Web Services console sign-in page.
CreatePresignedNotebookInstanceUrl
Show Description Returns a URL that you can use to connect to the Jupyter server from a notebook instance. In the Amazon SageMaker console, when you choose Open next to a notebook instance, Amazon SageMaker opens a new tab showing the Jupyter server home page from the notebook instance. The console uses this API to get the URL and show the page. The IAM role or user used to call this API defines the permissions to access the notebook instance. Once the presigned URL is created, no additional permission is required to access this URL. IAM authorization policies for this API are also enforced for every HTTP request and WebSocket frame that attempts to connect to the notebook instance. You can restrict access to this API and to the URL that it returns to a list of IP addresses that you specify. Use the NotIpAddress condition operator and the aws:SourceIP condition context key to specify the list of IP addresses that you want to have access to the notebook instance. For more information, see Limit Access to a Notebook Instance by IP Address. The URL that you get from a call to CreatePresignedNotebookInstanceUrl is valid only for 5 minutes. If you try to use the URL after the 5-minute limit expires, you are directed to the Amazon Web Services console sign-in page.
CreateProcessingJob
Show Description Creates a processing job.
CreateProject
Show Description Creates a machine learning (ML) project that can contain one or more templates that set up an ML pipeline from training to deploying an approved model.
CreateStudioLifecycleConfig
Show Description Creates a new Studio Lifecycle Configuration.
CreateTrainingJob
Show Description Starts a model training job. After training completes, Amazon SageMaker saves the resulting model artifacts to an Amazon S3 location that you specify. If you choose to host your model using Amazon SageMaker hosting services, you can use the resulting model artifacts as part of the model. You can also use the artifacts in a machine learning service other than Amazon SageMaker, provided that you know how to use them for inference. In the request body, you provide the following:
  • AlgorithmSpecification - Identifies the training algorithm to use.
  • HyperParameters - Specify these algorithm-specific parameters to enable the estimation of model parameters during training. Hyperparameters can be tuned to optimize this learning process. For a list of hyperparameters for each training algorithm provided by Amazon SageMaker, see Algorithms.
  • InputDataConfig - Describes the training dataset and the Amazon S3, EFS, or FSx location where it is stored.
  • OutputDataConfig - Identifies the Amazon S3 bucket where you want Amazon SageMaker to save the results of model training.
  • ResourceConfig - Identifies the resources, ML compute instances, and ML storage volumes to deploy for model training. In distributed training, you specify more than one instance.
  • EnableManagedSpotTraining - Optimize the cost of training machine learning models by up to 80% by using Amazon EC2 Spot instances. For more information, see Managed Spot Training.
  • RoleArn - The Amazon Resource Name (ARN) that Amazon SageMaker assumes to perform tasks on your behalf during model training. You must grant this role the necessary permissions so that Amazon SageMaker can successfully complete model training.
  • StoppingCondition - To help cap training costs, use MaxRuntimeInSeconds to set a time limit for training. Use MaxWaitTimeInSeconds to specify how long a managed spot training job has to complete.
  • Environment - The environment variables to set in the Docker container.
  • RetryStrategy - The number of times to retry the job when the job fails due to an InternalServerError.
For more information about Amazon SageMaker, see How It Works.
CreateTransformJob
Show Description Starts a transform job. A transform job uses a trained model to get inferences on a dataset and saves these results to an Amazon S3 location that you specify. To perform batch transformations, you create a transform job and use the data that you have readily available. In the request body, you provide the following:
  • TransformJobName - Identifies the transform job. The name must be unique within an Amazon Web Services Region in an Amazon Web Services account.
  • ModelName - Identifies the model to use. ModelName must be the name of an existing Amazon SageMaker model in the same Amazon Web Services Region and Amazon Web Services account. For information on creating a model, see CreateModel.
  • TransformInput - Describes the dataset to be transformed and the Amazon S3 location where it is stored.
  • TransformOutput - Identifies the Amazon S3 location where you want Amazon SageMaker to save the results from the transform job.
  • TransformResources - Identifies the ML compute instances for the transform job.
For more information about how batch transformation works, see Batch Transform.
CreateTrial
Show Description Creates an SageMaker trial. A trial is a set of steps called trial components that produce a machine learning model. A trial is part of a single SageMaker experiment. When you use SageMaker Studio or the SageMaker Python SDK, all experiments, trials, and trial components are automatically tracked, logged, and indexed. When you use the Amazon Web Services SDK for Python (Boto), you must use the logging APIs provided by the SDK. You can add tags to a trial and then use the Search API to search for the tags. To get a list of all your trials, call the ListTrials API. To view a trial's properties, call the DescribeTrial API. To create a trial component, call the CreateTrialComponent API.
CreateTrialComponent
Show Description Creates a trial component, which is a stage of a machine learning trial. A trial is composed of one or more trial components. A trial component can be used in multiple trials. Trial components include pre-processing jobs, training jobs, and batch transform jobs. When you use SageMaker Studio or the SageMaker Python SDK, all experiments, trials, and trial components are automatically tracked, logged, and indexed. When you use the Amazon Web Services SDK for Python (Boto), you must use the logging APIs provided by the SDK. You can add tags to a trial component and then use the Search API to search for the tags.
CreateUserProfile
Show Description Creates a user profile. A user profile represents a single user within a domain, and is the main way to reference a "person" for the purposes of sharing, reporting, and other user-oriented features. This entity is created when a user onboards to Amazon SageMaker Studio. If an administrator invites a person by email or imports them from SSO, a user profile is automatically created. A user profile is the primary holder of settings for an individual user and has a reference to the user's private Amazon Elastic File System (EFS) home directory.
CreateWorkforce
Show Description Use this operation to create a workforce. This operation will return an error if a workforce already exists in the Amazon Web Services Region that you specify. You can only create one workforce in each Amazon Web Services Region per Amazon Web Services account. If you want to create a new workforce in an Amazon Web Services Region where a workforce already exists, use the API operation to delete the existing workforce and then use CreateWorkforce to create a new workforce. To create a private workforce using Amazon Cognito, you must specify a Cognito user pool in CognitoConfig. You can also create an Amazon Cognito workforce using the Amazon SageMaker console. For more information, see Create a Private Workforce (Amazon Cognito). To create a private workforce using your own OIDC Identity Provider (IdP), specify your IdP configuration in OidcConfig. Your OIDC IdP must support groups because groups are used by Ground Truth and Amazon A2I to create work teams. For more information, see Create a Private Workforce (OIDC IdP).
CreateWorkteam
Show Description Creates a new work team for labeling your data. A work team is defined by one or more Amazon Cognito user pools. You must first create the user pools before you can create a work team. You cannot create more than 25 work teams in an account and region.
DeleteAction
Show Description Deletes an action.
DeleteAlgorithm
DeleteApp
DeleteAppImageConfig
DeleteArtifact
Show Description Deletes an artifact. Either ArtifactArn or Source must be specified.
DeleteAssociation
Show Description Deletes an association.
DeleteCodeRepository
DeleteContext
Show Description Deletes an context.
DeleteDataQualityJobDefinition
DeleteDeviceFleet
DeleteDomain
DeleteEndpoint
DeleteEndpointConfig
DeleteExperiment
Show Description Deletes an SageMaker experiment. All trials associated with the experiment must be deleted first. Use the ListTrials API to get a list of the trials associated with the experiment.
DeleteFeatureGroup
DeleteFlowDefinition
Show Description Deletes the specified flow definition.
DeleteHumanTaskUi
Show Description Use this operation to delete a human task user interface (worker task template). To see a list of human task user interfaces (work task templates) in your account, use . When you delete a worker task template, it no longer appears when you call ListHumanTaskUis.
DeleteImage
Show Description Deletes a SageMaker image and all versions of the image. The container images aren't deleted.
DeleteImageVersion
Show Description Deletes a version of a SageMaker image. The container image the version represents isn't deleted.
DeleteModel
DeleteModelBiasJobDefinition
DeleteModelExplainabilityJobDefinition
DeleteModelPackage
DeleteModelPackageGroup
DeleteModelPackageGroupPolicy
DeleteModelQualityJobDefinition
DeleteMonitoringSchedule
DeleteNotebookInstance
DeleteNotebookInstanceLifecycleConfig
DeletePipeline
Show Description Deletes a pipeline if there are no running instances of the pipeline. To delete a pipeline, you must stop all running instances of the pipeline using the StopPipelineExecution API. When you delete a pipeline, all instances of the pipeline are deleted.
DeleteProject
DeleteStudioLifecycleConfig
DeleteTags
Show Description Deletes the specified tags from an Amazon SageMaker resource. To list a resource's tags, use the ListTags API. When you call this API to delete tags from a hyperparameter tuning job, the deleted tags are not removed from training jobs that the hyperparameter tuning job launched before you called this API. When you call this API to delete tags from a SageMaker Studio Domain or User Profile, the deleted tags are not removed from Apps that the SageMaker Studio Domain or User Profile launched before you called this API.
DeleteTrial
Show Description Deletes the specified trial. All trial components that make up the trial must be deleted first. Use the DescribeTrialComponent API to get the list of trial components.
DeleteTrialComponent
Show Description Deletes the specified trial component. A trial component must be disassociated from all trials before the trial component can be deleted. To disassociate a trial component from a trial, call the DisassociateTrialComponent API.
DeleteUserProfile
DeleteWorkforce
Show Description Use this operation to delete a workforce. If you want to create a new workforce in an Amazon Web Services Region where a workforce already exists, use this operation to delete the existing workforce and then use to create a new workforce. If a private workforce contains one or more work teams, you must use the operation to delete all work teams before you delete the workforce. If you try to delete a workforce that contains one or more work teams, you will recieve a ResourceInUse error.
DeleteWorkteam
Show Description Deletes an existing work team. This operation can't be undone.
DeregisterDevices
DescribeAction
Show Description Describes an action.
DescribeAlgorithm
Show Description Returns a description of the specified algorithm that is in your account.
DescribeApp
Show Description Describes the app.
DescribeAppImageConfig
Show Description Describes an AppImageConfig.
DescribeArtifact
Show Description Describes an artifact.
DescribeAutoMLJob
Show Description Returns information about an Amazon SageMaker AutoML job.
DescribeCodeRepository
Show Description Gets details about the specified Git repository.
DescribeCompilationJob
Show Description Returns information about a model compilation job. To create a model compilation job, use CreateCompilationJob. To get information about multiple model compilation jobs, use ListCompilationJobs.
DescribeContext
Show Description Describes a context.
DescribeDataQualityJobDefinition
Show Description Gets the details of a data quality monitoring job definition.
DescribeDevice
Show Description Describes the device.
DescribeDeviceFleet
Show Description A description of the fleet the device belongs to.
DescribeDomain
Show Description The description of the domain.
DescribeEdgePackagingJob
Show Description A description of edge packaging jobs.
DescribeEndpoint
Show Description Returns the description of an endpoint.
DescribeEndpointConfig
Show Description Returns the description of an endpoint configuration created using the CreateEndpointConfig API.
DescribeExperiment
Show Description Provides a list of an experiment's properties.
DescribeFeatureGroup
Show Description Use this operation to describe a FeatureGroup. The response includes information on the creation time, FeatureGroup name, the unique identifier for each FeatureGroup, and more.
DescribeFlowDefinition
Show Description Returns information about the specified flow definition.
DescribeHumanTaskUi
Show Description Returns information about the requested human task user interface (worker task template).
DescribeHyperParameterTuningJob
Show Description Gets a description of a hyperparameter tuning job.
DescribeImage
Show Description Describes a SageMaker image.
DescribeImageVersion
Show Description Describes a version of a SageMaker image.
DescribeLabelingJob
Show Description Gets information about a labeling job.
DescribeModel
Show Description Describes a model that you created using the CreateModel API.
DescribeModelBiasJobDefinition
Show Description Returns a description of a model bias job definition.
DescribeModelExplainabilityJobDefinition
Show Description Returns a description of a model explainability job definition.
DescribeModelPackage
Show Description Returns a description of the specified model package, which is used to create SageMaker models or list them on Amazon Web Services Marketplace. To create models in SageMaker, buyers can subscribe to model packages listed on Amazon Web Services Marketplace.
DescribeModelPackageGroup
Show Description Gets a description for the specified model group.
DescribeModelQualityJobDefinition
Show Description Returns a description of a model quality job definition.
DescribeMonitoringSchedule
Show Description Describes the schedule for a monitoring job.
DescribeNotebookInstance
Show Description Returns information about a notebook instance.
DescribeNotebookInstanceLifecycleConfig
Show Description Returns a description of a notebook instance lifecycle configuration. For information about notebook instance lifestyle configurations, see Step 2.1: (Optional) Customize a Notebook Instance.
DescribePipeline
Show Description Describes the details of a pipeline.
DescribePipelineDefinitionForExecution
Show Description Describes the details of an execution's pipeline definition.
DescribePipelineExecution
Show Description Describes the details of a pipeline execution.
DescribeProcessingJob
Show Description Returns a description of a processing job.
DescribeProject
Show Description Describes the details of a project.
DescribeStudioLifecycleConfig
Show Description Describes the Studio Lifecycle Configuration.
DescribeSubscribedWorkteam
Show Description Gets information about a work team provided by a vendor. It returns details about the subscription with a vendor in the Amazon Web Services Marketplace.
DescribeTrainingJob
Show Description Returns information about a training job. Some of the attributes below only appear if the training job successfully starts. If the training job fails, TrainingJobStatus is Failed and, depending on the FailureReason, attributes like TrainingStartTime, TrainingTimeInSeconds, TrainingEndTime, and BillableTimeInSeconds may not be present in the response.
DescribeTransformJob
Show Description Returns information about a transform job.
DescribeTrial
Show Description Provides a list of a trial's properties.
DescribeTrialComponent
Show Description Provides a list of a trials component's properties.
DescribeUserProfile
Show Description Describes a user profile. For more information, see CreateUserProfile.
DescribeWorkforce
Show Description Lists private workforce information, including workforce name, Amazon Resource Name (ARN), and, if applicable, allowed IP address ranges (CIDRs). Allowable IP address ranges are the IP addresses that workers can use to access tasks. This operation applies only to private workforces.
DescribeWorkteam
Show Description Gets information about a specific work team. You can see information such as the create date, the last updated date, membership information, and the work team's Amazon Resource Name (ARN).
DisableSagemakerServicecatalogPortfolio
Show Description Disables using Service Catalog in SageMaker. Service Catalog is used to create SageMaker projects.
DisassociateTrialComponent
Show Description Disassociates a trial component from a trial. This doesn't effect other trials the component is associated with. Before you can delete a component, you must disassociate the component from all trials it is associated with. To associate a trial component with a trial, call the AssociateTrialComponent API. To get a list of the trials a component is associated with, use the Search API. Specify ExperimentTrialComponent for the Resource parameter. The list appears in the response under Results.TrialComponent.Parents.
EnableSagemakerServicecatalogPortfolio
Show Description Enables using Service Catalog in SageMaker. Service Catalog is used to create SageMaker projects.
GetDeviceFleetReport
Show Description Describes a fleet.
GetModelPackageGroupPolicy
Show Description Gets a resource policy that manages access for a model group. For information about resource policies, see Identity-based policies and resource-based policies in the Amazon Web Services Identity and Access Management User Guide..
GetSagemakerServicecatalogPortfolioStatus
Show Description Gets the status of Service Catalog in SageMaker. Service Catalog is used to create SageMaker projects.
GetSearchSuggestions
Show Description An auto-complete API for the search functionality in the Amazon SageMaker console. It returns suggestions of possible matches for the property name to use in Search queries. Provides suggestions for HyperParameters, Tags, and Metrics.
ListActions
Show Description Lists the actions in your account and their properties.
ListAlgorithms
Show Description Lists the machine learning algorithms that have been created.
ListAppImageConfigs
Show Description Lists the AppImageConfigs in your account and their properties. The list can be filtered by creation time or modified time, and whether the AppImageConfig name contains a specified string.
ListApps
Show Description Lists apps.
ListArtifacts
Show Description Lists the artifacts in your account and their properties.
ListAssociations
Show Description Lists the associations in your account and their properties.
ListAutoMLJobs
Show Description Request a list of jobs.
ListCandidatesForAutoMLJob
Show Description List the candidates created for the job.
ListCodeRepositories
Show Description Gets a list of the Git repositories in your account.
ListCompilationJobs
Show Description Lists model compilation jobs that satisfy various filters. To create a model compilation job, use CreateCompilationJob. To get information about a particular model compilation job you have created, use DescribeCompilationJob.
ListContexts
Show Description Lists the contexts in your account and their properties.
ListDataQualityJobDefinitions
Show Description Lists the data quality job definitions in your account.
ListDeviceFleets
Show Description Returns a list of devices in the fleet.
ListDevices
Show Description A list of devices.
ListDomains
Show Description Lists the domains.
ListEdgePackagingJobs
Show Description Returns a list of edge packaging jobs.
ListEndpointConfigs
Show Description Lists endpoint configurations.
ListEndpoints
Show Description Lists endpoints.
ListExperiments
Show Description Lists all the experiments in your account. The list can be filtered to show only experiments that were created in a specific time range. The list can be sorted by experiment name or creation time.
ListFeatureGroups
Show Description List FeatureGroups based on given filter and order.
ListFlowDefinitions
Show Description Returns information about the flow definitions in your account.
ListHumanTaskUis
Show Description Returns information about the human task user interfaces in your account.
ListHyperParameterTuningJobs
Show Description Gets a list of HyperParameterTuningJobSummary objects that describe the hyperparameter tuning jobs launched in your account.
ListImageVersions
Show Description Lists the versions of a specified image and their properties. The list can be filtered by creation time or modified time.
ListImages
Show Description Lists the images in your account and their properties. The list can be filtered by creation time or modified time, and whether the image name contains a specified string.
ListLabelingJobs
Show Description Gets a list of labeling jobs.
ListLabelingJobsForWorkteam
Show Description Gets a list of labeling jobs assigned to a specified work team.
ListModelBiasJobDefinitions
Show Description Lists model bias jobs definitions that satisfy various filters.
ListModelExplainabilityJobDefinitions
Show Description Lists model explainability job definitions that satisfy various filters.
ListModelPackageGroups
Show Description Gets a list of the model groups in your Amazon Web Services account.
ListModelPackages
Show Description Lists the model packages that have been created.
ListModelQualityJobDefinitions
Show Description Gets a list of model quality monitoring job definitions in your account.
ListModels
Show Description Lists models created with the CreateModel API.
ListMonitoringExecutions
Show Description Returns list of all monitoring job executions.
ListMonitoringSchedules
Show Description Returns list of all monitoring schedules.
ListNotebookInstanceLifecycleConfigs
Show Description Lists notebook instance lifestyle configurations created with the CreateNotebookInstanceLifecycleConfig API.
ListNotebookInstances
Show Description Returns a list of the Amazon SageMaker notebook instances in the requester's account in an Amazon Web Services Region.
ListPipelineExecutionSteps
Show Description Gets a list of PipeLineExecutionStep objects.
ListPipelineExecutions
Show Description Gets a list of the pipeline executions.
ListPipelineParametersForExecution
Show Description Gets a list of parameters for a pipeline execution.
ListPipelines
Show Description Gets a list of pipelines.
ListProcessingJobs
Show Description Lists processing jobs that satisfy various filters.
ListProjects
Show Description Gets a list of the projects in an Amazon Web Services account.
ListStudioLifecycleConfigs
Show Description Lists the Studio Lifecycle Configurations in your Amazon Web Services Account.
ListSubscribedWorkteams
Show Description Gets a list of the work teams that you are subscribed to in the Amazon Web Services Marketplace. The list may be empty if no work team satisfies the filter specified in the NameContains parameter.
ListTags
Show Description Returns the tags for the specified Amazon SageMaker resource.
ListTrainingJobs
Show Description Lists training jobs. When StatusEquals and MaxResults are set at the same time, the MaxResults number of training jobs are first retrieved ignoring the StatusEquals parameter and then they are filtered by the StatusEquals parameter, which is returned as a response. For example, if ListTrainingJobs is invoked with the following parameters: { ... MaxResults: 100, StatusEquals: InProgress ... } First, 100 trainings jobs with any status, including those other than InProgress, are selected (sorted according to the creation time, from the most current to the oldest). Next, those with a status of InProgress are returned. You can quickly test the API using the following Amazon Web Services CLI code. aws sagemaker list-training-jobs --max-results 100 --status-equals InProgress
ListTrainingJobsForHyperParameterTuningJob
Show Description Gets a list of TrainingJobSummary objects that describe the training jobs that a hyperparameter tuning job launched.
ListTransformJobs
Show Description Lists transform jobs.
ListTrialComponents
Show Description Lists the trial components in your account. You can sort the list by trial component name or creation time. You can filter the list to show only components that were created in a specific time range. You can also filter on one of the following:
  • ExperimentName
  • SourceArn
  • TrialName
ListTrials
Show Description Lists the trials in your account. Specify an experiment name to limit the list to the trials that are part of that experiment. Specify a trial component name to limit the list to the trials that associated with that trial component. The list can be filtered to show only trials that were created in a specific time range. The list can be sorted by trial name or creation time.
ListUserProfiles
Show Description Lists user profiles.
ListWorkforces
Show Description Use this operation to list all private and vendor workforces in an Amazon Web Services Region. Note that you can only have one private workforce per Amazon Web Services Region.
ListWorkteams
Show Description Gets a list of private work teams that you have defined in a region. The list may be empty if no work team satisfies the filter specified in the NameContains parameter.
PutModelPackageGroupPolicy
Show Description Adds a resouce policy to control access to a model group. For information about resoure policies, see Identity-based policies and resource-based policies in the Amazon Web Services Identity and Access Management User Guide..
RegisterDevices
RenderUiTemplate
Show Description Renders the UI template so that you can preview the worker's experience.
RetryPipelineExecution
Show Description Retry the execution of the pipeline.
Search
Show Description Finds Amazon SageMaker resources that match a search query. Matching resources are returned as a list of SearchRecord objects in the response. You can sort the search results by any resource property in a ascending or descending order. You can query against the following value types: numeric, text, Boolean, and timestamp.
SendPipelineExecutionStepFailure
Show Description Notifies the pipeline that the execution of a callback step failed, along with a message describing why. When a callback step is run, the pipeline generates a callback token and includes the token in a message sent to Amazon Simple Queue Service (Amazon SQS).
SendPipelineExecutionStepSuccess
Show Description Notifies the pipeline that the execution of a callback step succeeded and provides a list of the step's output parameters. When a callback step is run, the pipeline generates a callback token and includes the token in a message sent to Amazon Simple Queue Service (Amazon SQS).
StartMonitoringSchedule
StartNotebookInstance
StartPipelineExecution
Show Description Starts a pipeline execution.
StopAutoMLJob
StopCompilationJob
StopEdgePackagingJob
StopHyperParameterTuningJob
StopLabelingJob
StopMonitoringSchedule
StopNotebookInstance
StopPipelineExecution
Show Description Stops a pipeline execution. Callback Step A pipeline execution won't stop while a callback step is running. When you call StopPipelineExecution on a pipeline execution with a running callback step, SageMaker Pipelines sends an additional Amazon SQS message to the specified SQS queue. The body of the SQS message contains a "Status" field which is set to "Stopping". You should add logic to your Amazon SQS message consumer to take any needed action (for example, resource cleanup) upon receipt of the message followed by a call to SendPipelineExecutionStepSuccess or SendPipelineExecutionStepFailure. Only when SageMaker Pipelines receives one of these calls will it stop the pipeline execution. Lambda Step A pipeline execution can't be stopped while a lambda step is running because the Lambda function invoked by the lambda step can't be stopped. If you attempt to stop the execution while the Lambda function is running, the pipeline waits for the Lambda function to finish or until the timeout is hit, whichever occurs first, and then stops. If the Lambda function finishes, the pipeline execution status is Stopped. If the timeout is hit the pipeline execution status is Failed.
StopProcessingJob
StopTrainingJob
StopTransformJob
UpdateAction
Show Description Updates an action.
UpdateAppImageConfig
Show Description Updates the properties of an AppImageConfig.
UpdateArtifact
Show Description Updates an artifact.
UpdateCodeRepository
Show Description Updates the specified Git repository with the specified values.
UpdateContext
Show Description Updates a context.
UpdateDeviceFleet
UpdateDevices
UpdateDomain
Show Description Updates the default settings for new user profiles in the domain.
UpdateEndpoint
Show Description Deploys the new EndpointConfig specified in the request, switches to using newly created endpoint, and then deletes resources provisioned for the endpoint using the previous EndpointConfig (there is no availability loss). When Amazon SageMaker receives the request, it sets the endpoint status to Updating. After updating the endpoint, it sets the status to InService. To check the status of an endpoint, use the DescribeEndpoint API. You must not delete an EndpointConfig in use by an endpoint that is live or while the UpdateEndpoint or CreateEndpoint operations are being performed on the endpoint. To update an endpoint, you must create a new EndpointConfig. If you delete the EndpointConfig of an endpoint that is active or being created or updated you may lose visibility into the instance type the endpoint is using. The endpoint must be deleted in order to stop incurring charges.
UpdateEndpointWeightsAndCapacities
Show Description Updates variant weight of one or more variants associated with an existing endpoint, or capacity of one variant associated with an existing endpoint. When it receives the request, Amazon SageMaker sets the endpoint status to Updating. After updating the endpoint, it sets the status to InService. To check the status of an endpoint, use the DescribeEndpoint API.
UpdateExperiment
Show Description Adds, updates, or removes the description of an experiment. Updates the display name of an experiment.
UpdateImage
Show Description Updates the properties of a SageMaker image. To change the image's tags, use the AddTags and DeleteTags APIs.
UpdateModelPackage
Show Description Updates a versioned model.
UpdateMonitoringSchedule
Show Description Updates a previously created schedule.
UpdateNotebookInstance
Show Description Updates a notebook instance. NotebookInstance updates include upgrading or downgrading the ML compute instance used for your notebook instance to accommodate changes in your workload requirements.
UpdateNotebookInstanceLifecycleConfig
Show Description Updates a notebook instance lifecycle configuration created with the CreateNotebookInstanceLifecycleConfig API.
UpdatePipeline
Show Description Updates a pipeline.
UpdatePipelineExecution
Show Description Updates a pipeline execution.
UpdateProject
Show Description Updates a machine learning (ML) project that is created from a template that sets up an ML pipeline from training to deploying an approved model. You must not update a project that is in use. If you update the ServiceCatalogProvisioningUpdateDetails of a project that is active or being created, or updated, you may lose resources already created by the project.
UpdateTrainingJob
Show Description Update a model training job to request a new Debugger profiling configuration.
UpdateTrial
Show Description Updates the display name of a trial.
UpdateTrialComponent
Show Description Updates one or more properties of a trial component.
UpdateUserProfile
Show Description Updates a user profile.
UpdateWorkforce
Show Description Use this operation to update your workforce. You can use this operation to require that workers use specific IP addresses to work on tasks and to update your OpenID Connect (OIDC) Identity Provider (IdP) workforce configuration. Use SourceIpConfig to restrict worker access to tasks to a specific range of IP addresses. You specify allowed IP addresses by creating a list of up to ten CIDRs. By default, a workforce isn't restricted to specific IP addresses. If you specify a range of IP addresses, workers who attempt to access tasks using any IP address outside the specified range are denied and get a Not Found error message on the worker portal. Use OidcConfig to update the configuration of a workforce created using your own OIDC IdP. You can only update your OIDC IdP configuration when there are no work teams associated with your workforce. You can delete work teams using the operation. After restricting access to a range of IP addresses or updating your OIDC IdP configuration with this operation, you can view details about your update workforce using the operation. This operation only applies to private workforces.
## Savingsplans Events
Service Event Name Description
savingsplans CreateSavingsPlan
Show Description Creates a Savings Plan.
DeleteQueuedSavingsPlan
Show Description Deletes the queued purchase for the specified Savings Plan.
DescribeSavingsPlanRates
Show Description Describes the specified Savings Plans rates.
DescribeSavingsPlans
Show Description Describes the specified Savings Plans.
DescribeSavingsPlansOfferingRates
Show Description Describes the specified Savings Plans offering rates.
DescribeSavingsPlansOfferings
Show Description Describes the specified Savings Plans offerings.
ListTagsForResource
Show Description Lists the tags for the specified resource.
TagResource
Show Description Adds the specified tags to the specified resource.
## Schemas Events
Service Event Name Description
schemas CreateDiscoverer
Show Description Creates a discoverer.
CreateRegistry
Show Description Creates a registry.
CreateSchema
Show Description Creates a schema definition. Inactive schemas will be deleted after two years.
DeleteDiscoverer
DeleteRegistry
DeleteResourcePolicy
DeleteSchema
DeleteSchemaVersion
DescribeCodeBinding
Show Description Describe the code binding URI.
DescribeDiscoverer
Show Description Describes the discoverer.
DescribeRegistry
Show Description Describes the registry.
DescribeSchema
Show Description Retrieve the schema definition.
ExportSchema
Show Description None
GetCodeBindingSource
Show Description Get the code binding source URI.
GetDiscoveredSchema
Show Description Get the discovered schema that was generated based on sampled events.
GetResourcePolicy
Show Description Retrieves the resource-based policy attached to a given registry.
ListDiscoverers
Show Description List the discoverers.
ListRegistries
Show Description List the registries.
ListSchemaVersions
Show Description Provides a list of the schema versions and related information.
ListSchemas
Show Description List the schemas.
ListTagsForResource
Show Description Get tags for resource.
PutCodeBinding
Show Description Put code binding URI
PutResourcePolicy
Show Description The name of the policy.
SearchSchemas
Show Description Search the schemas
StartDiscoverer
Show Description Starts the discoverer
StopDiscoverer
Show Description Stops the discoverer
TagResource
UntagResource
UpdateDiscoverer
Show Description Updates the discoverer
UpdateRegistry
Show Description Updates a registry.
## Sdb Events
Service Event Name Description
sdb BatchDeleteAttributes
BatchPutAttributes
CreateDomain
DeleteAttributes
DeleteDomain
DomainMetadata
Show Description Returns information about the domain, including when the domain was created, the number of items and attributes in the domain, and the size of the attribute names and values.
GetAttributes
Show Description Returns all of the attributes associated with the specified item. Optionally, the attributes returned can be limited to one or more attributes by specifying an attribute name parameter. If the item does not exist on the replica that was accessed for this operation, an empty set is returned. The system does not return an error as it cannot guarantee the item does not exist on other replicas.
ListDomains
Show Description The ListDomains operation lists all domains associated with the Access Key ID. It returns domain names up to the limit set by MaxNumberOfDomains. A NextToken is returned if there are more than MaxNumberOfDomains domains. Calling ListDomains successive times with the NextToken provided by the operation returns up to MaxNumberOfDomains more domain names with each successive operation call.
PutAttributes
## Secretsmanager Events
Service Event Name Description
secretsmanager CancelRotateSecret
Show Description Disables automatic scheduled rotation and cancels the rotation of a secret if currently in progress. To re-enable scheduled rotation, call RotateSecret with AutomaticallyRotateAfterDays set to a value greater than 0. This immediately rotates your secret and then enables the automatic schedule. If you cancel a rotation while in progress, it can leave the VersionStage labels in an unexpected state. Depending on the step of the rotation in progress, you might need to remove the staging label AWSPENDING from the partially created version, specified by the VersionId response value. You should also evaluate the partially rotated new version to see if it should be deleted, which you can do by removing all staging labels from the new version VersionStage field. To successfully start a rotation, the staging label AWSPENDING must be in one of the following states:
  • Not attached to any version at all
  • Attached to the same version as the staging label AWSCURRENT
If the staging label AWSPENDING attached to a different version than the version with AWSCURRENT then the attempt to rotate fails. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:CancelRotateSecret
Related operations
  • To configure rotation for a secret or to manually trigger a rotation, use RotateSecret.
  • To get the rotation configuration details for a secret, use DescribeSecret.
  • To list all of the currently available secrets, use ListSecrets.
  • To list all of the versions currently associated with a secret, use ListSecretVersionIds.
CreateSecret
Show Description Creates a new secret. A secret in Secrets Manager consists of both the protected secret data and the important information needed to manage the secret. Secrets Manager stores the encrypted secret data in one of a collection of "versions" associated with the secret. Each version contains a copy of the encrypted secret data. Each version is associated with one or more "staging labels" that identify where the version is in the rotation cycle. The SecretVersionsToStages field of the secret contains the mapping of staging labels to the active versions of the secret. Versions without a staging label are considered deprecated and not included in the list. You provide the secret data to be encrypted by putting text in either the SecretString parameter or binary data in the SecretBinary parameter, but not both. If you include SecretString or SecretBinary then Secrets Manager also creates an initial secret version and automatically attaches the staging label AWSCURRENT to the new version.
  • If you call an operation to encrypt or decrypt the SecretString or SecretBinary for a secret in the same account as the calling user and that secret doesn't specify a Amazon Web Services KMS encryption key, Secrets Manager uses the account's default Amazon Web Services managed customer master key (CMK) with the alias aws/secretsmanager. If this key doesn't already exist in your account then Secrets Manager creates it for you automatically. All users and roles in the same Amazon Web Services account automatically have access to use the default CMK. Note that if an Secrets Manager API call results in Amazon Web Services creating the account's Amazon Web Services-managed CMK, it can result in a one-time significant delay in returning the result.
  • If the secret resides in a different Amazon Web Services account from the credentials calling an API that requires encryption or decryption of the secret value then you must create and use a custom Amazon Web Services KMS CMK because you can't access the default CMK for the account using credentials from a different Amazon Web Services account. Store the ARN of the CMK in the secret when you create the secret or when you update it by including it in the KMSKeyId. If you call an API that must encrypt or decrypt SecretString or SecretBinary using credentials from a different account then the Amazon Web Services KMS key policy must grant cross-account access to that other account's user or role for both the kms:GenerateDataKey and kms:Decrypt operations.
Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:CreateSecret
  • kms:GenerateDataKey - needed only if you use a customer-managed Amazon Web Services KMS key to encrypt the secret. You do not need this permission to use the account default Amazon Web Services managed CMK for Secrets Manager.
  • kms:Decrypt - needed only if you use a customer-managed Amazon Web Services KMS key to encrypt the secret. You do not need this permission to use the account default Amazon Web Services managed CMK for Secrets Manager.
  • secretsmanager:TagResource - needed only if you include the Tags parameter.
Related operations
  • To delete a secret, use DeleteSecret.
  • To modify an existing secret, use UpdateSecret.
  • To create a new version of a secret, use PutSecretValue.
  • To retrieve the encrypted secure string and secure binary values, use GetSecretValue.
  • To retrieve all other details for a secret, use DescribeSecret. This does not include the encrypted secure string and secure binary values.
  • To retrieve the list of secret versions associated with the current secret, use DescribeSecret and examine the SecretVersionsToStages response value.
DeleteResourcePolicy
Show Description Deletes the resource-based permission policy attached to the secret. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:DeleteResourcePolicy
Related operations
DeleteSecret
Show Description Deletes an entire secret and all of the versions. You can optionally include a recovery window during which you can restore the secret. If you don't specify a recovery window value, the operation defaults to 30 days. Secrets Manager attaches a DeletionDate stamp to the secret that specifies the end of the recovery window. At the end of the recovery window, Secrets Manager deletes the secret permanently. At any time before recovery window ends, you can use RestoreSecret to remove the DeletionDate and cancel the deletion of the secret. You cannot access the encrypted secret information in any secret scheduled for deletion. If you need to access that information, you must cancel the deletion with RestoreSecret and then retrieve the information.
  • There is no explicit operation to delete a version of a secret. Instead, remove all staging labels from the VersionStage field of a version. That marks the version as deprecated and allows Secrets Manager to delete it as needed. Versions without any staging labels do not show up in ListSecretVersionIds unless you specify IncludeDeprecated.
  • The permanent secret deletion at the end of the waiting period is performed as a background task with low priority. There is no guarantee of a specific time after the recovery window for the actual delete operation to occur.
Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:DeleteSecret
Related operations
  • To create a secret, use CreateSecret.
  • To cancel deletion of a version of a secret before the recovery window has expired, use RestoreSecret.
DescribeSecret
Show Description Retrieves the details of a secret. It does not include the encrypted fields. Secrets Manager only returns fields populated with a value in the response. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:DescribeSecret
Related operations
  • To create a secret, use CreateSecret.
  • To modify a secret, use UpdateSecret.
  • To retrieve the encrypted secret information in a version of the secret, use GetSecretValue.
  • To list all of the secrets in the Amazon Web Services account, use ListSecrets.
GetRandomPassword
Show Description Generates a random password of the specified complexity. This operation is intended for use in the Lambda rotation function. Per best practice, we recommend that you specify the maximum length and include every character type that the system you are generating a password for can support. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:GetRandomPassword
GetResourcePolicy
Show Description Retrieves the JSON text of the resource-based policy document attached to the specified secret. The JSON request string input and response output displays formatted code with white space and line breaks for better readability. Submit your input as a single line JSON string. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:GetResourcePolicy
Related operations
GetSecretValue
Show Description Retrieves the contents of the encrypted fields SecretString or SecretBinary from the specified version of a secret, whichever contains content. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:GetSecretValue
  • kms:Decrypt - required only if you use a customer-managed Amazon Web Services KMS key to encrypt the secret. You do not need this permission to use the account's default Amazon Web Services managed CMK for Secrets Manager.
Related operations
  • To create a new version of the secret with different encrypted information, use PutSecretValue.
  • To retrieve the non-encrypted details for the secret, use DescribeSecret.
ListSecretVersionIds
Show Description Lists all of the versions attached to the specified secret. The output does not include the SecretString or SecretBinary fields. By default, the list includes only versions that have at least one staging label in VersionStage attached. Always check the NextToken response parameter when calling any of the List* operations. These operations can occasionally return an empty or shorter than expected list of results even when there more results become available. When this happens, the NextToken response parameter contains a value to pass to the next call to the same API to request the next part of the list. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:ListSecretVersionIds
Related operations
ListSecrets
Show Description Lists all of the secrets that are stored by Secrets Manager in the Amazon Web Services account. To list the versions currently stored for a specific secret, use ListSecretVersionIds. The encrypted fields SecretString and SecretBinary are not included in the output. To get that information, call the GetSecretValue operation. Always check the NextToken response parameter when calling any of the List* operations. These operations can occasionally return an empty or shorter than expected list of results even when there more results become available. When this happens, the NextToken response parameter contains a value to pass to the next call to the same API to request the next part of the list. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:ListSecrets
Related operations
PutResourcePolicy
Show Description Attaches the contents of the specified resource-based permission policy to a secret. A resource-based policy is optional. Alternatively, you can use IAM identity-based policies that specify the secret's Amazon Resource Name (ARN) in the policy statement's Resources element. You can also use a combination of both identity-based and resource-based policies. The affected users and roles receive the permissions that are permitted by all of the relevant policies. For more information, see Using Resource-Based Policies for Amazon Web Services Secrets Manager. For the complete description of the Amazon Web Services policy syntax and grammar, see IAM JSON Policy Reference in the IAM User Guide. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:PutResourcePolicy
Related operations
PutSecretValue
Show Description Stores a new encrypted secret value in the specified secret. To do this, the operation creates a new version and attaches it to the secret. The version can contain a new SecretString value or a new SecretBinary value. You can also specify the staging labels that are initially attached to the new version. We recommend you avoid calling PutSecretValue at a sustained rate of more than once every 10 minutes. When you update the secret value, Secrets Manager creates a new version of the secret. Secrets Manager removes outdated versions when there are more than 100, but it does not remove versions created less than 24 hours ago. If you call PutSecretValue more than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach the quota for secret versions.
  • If this operation creates the first version for the secret then Secrets Manager automatically attaches the staging label AWSCURRENT to the new version.
  • If you do not specify a value for VersionStages then Secrets Manager automatically moves the staging label AWSCURRENT to this new version.
  • If this operation moves the staging label AWSCURRENT from another version to this version, then Secrets Manager also automatically moves the staging label AWSPREVIOUS to the version that AWSCURRENT was removed from.
  • This operation is idempotent. If a version with a VersionId with the same value as the ClientRequestToken parameter already exists and you specify the same secret data, the operation succeeds but does nothing. However, if the secret data is different, then the operation fails because you cannot modify an existing version; you can only create new ones.
  • If you call an operation to encrypt or decrypt the SecretString or SecretBinary for a secret in the same account as the calling user and that secret doesn't specify a Amazon Web Services KMS encryption key, Secrets Manager uses the account's default Amazon Web Services managed customer master key (CMK) with the alias aws/secretsmanager. If this key doesn't already exist in your account then Secrets Manager creates it for you automatically. All users and roles in the same Amazon Web Services account automatically have access to use the default CMK. Note that if an Secrets Manager API call results in Amazon Web Services creating the account's Amazon Web Services-managed CMK, it can result in a one-time significant delay in returning the result.
  • If the secret resides in a different Amazon Web Services account from the credentials calling an API that requires encryption or decryption of the secret value then you must create and use a custom Amazon Web Services KMS CMK because you can't access the default CMK for the account using credentials from a different Amazon Web Services account. Store the ARN of the CMK in the secret when you create the secret or when you update it by including it in the KMSKeyId. If you call an API that must encrypt or decrypt SecretString or SecretBinary using credentials from a different account then the Amazon Web Services KMS key policy must grant cross-account access to that other account's user or role for both the kms:GenerateDataKey and kms:Decrypt operations.
Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:PutSecretValue
  • kms:GenerateDataKey - needed only if you use a customer-managed Amazon Web Services KMS key to encrypt the secret. You do not need this permission to use the account's default Amazon Web Services managed CMK for Secrets Manager.
Related operations
RemoveRegionsFromReplication
Show Description Remove regions from replication.
ReplicateSecretToRegions
Show Description Converts an existing secret to a multi-Region secret and begins replication the secret to a list of new regions.
RestoreSecret
Show Description Cancels the scheduled deletion of a secret by removing the DeletedDate time stamp. This makes the secret accessible to query once again. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:RestoreSecret
Related operations
RotateSecret
Show Description Configures and starts the asynchronous process of rotating this secret. If you include the configuration parameters, the operation sets those values for the secret and then immediately starts a rotation. If you do not include the configuration parameters, the operation starts a rotation with the values already stored in the secret. After the rotation completes, the protected service and its clients all use the new version of the secret. This required configuration information includes the ARN of an Amazon Web Services Lambda function and optionally, the time between scheduled rotations. The Lambda rotation function creates a new version of the secret and creates or updates the credentials on the protected service to match. After testing the new credentials, the function marks the new secret with the staging label AWSCURRENT so that your clients all immediately begin to use the new version. For more information about rotating secrets and how to configure a Lambda function to rotate the secrets for your protected service, see Rotating Secrets in Amazon Web Services Secrets Manager in the Amazon Web Services Secrets Manager User Guide. Secrets Manager schedules the next rotation when the previous one completes. Secrets Manager schedules the date by adding the rotation interval (number of days) to the actual date of the last rotation. The service chooses the hour within that 24-hour date window randomly. The minute is also chosen somewhat randomly, but weighted towards the top of the hour and influenced by a variety of factors that help distribute load. The rotation function must end with the versions of the secret in one of two states:
  • The AWSPENDING and AWSCURRENT staging labels are attached to the same version of the secret, or
  • The AWSPENDING staging label is not attached to any version of the secret.
If the AWSPENDING staging label is present but not attached to the same version as AWSCURRENT then any later invocation of RotateSecret assumes that a previous rotation request is still in progress and returns an error. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:RotateSecret
  • lambda:InvokeFunction (on the function specified in the secret's metadata)
Related operations
StopReplicationToReplica
Show Description Removes the secret from replication and promotes the secret to a regional secret in the replica Region.
TagResource
UntagResource
UpdateSecret
Show Description Modifies many of the details of the specified secret. To change the secret value, you can also use PutSecretValue. To change the rotation configuration of a secret, use RotateSecret instead. We recommend you avoid calling UpdateSecret at a sustained rate of more than once every 10 minutes. When you call UpdateSecret to update the secret value, Secrets Manager creates a new version of the secret. Secrets Manager removes outdated versions when there are more than 100, but it does not remove versions created less than 24 hours ago. If you update the secret value more than once every 10 minutes, you create more versions than Secrets Manager removes, and you will reach the quota for secret versions. The Secrets Manager console uses only the SecretString parameter and therefore limits you to encrypting and storing only a text string. To encrypt and store binary data as part of the version of a secret, you must use either the Amazon Web Services CLI or one of the Amazon Web Services SDKs.
  • If a version with a VersionId with the same value as the ClientRequestToken parameter already exists, the operation results in an error. You cannot modify an existing version, you can only create a new version.
  • If you include SecretString or SecretBinary to create a new secret version, Secrets Manager automatically attaches the staging label AWSCURRENT to the new version.
  • If you call an operation to encrypt or decrypt the SecretString or SecretBinary for a secret in the same account as the calling user and that secret doesn't specify a Amazon Web Services KMS encryption key, Secrets Manager uses the account's default Amazon Web Services managed customer master key (CMK) with the alias aws/secretsmanager. If this key doesn't already exist in your account then Secrets Manager creates it for you automatically. All users and roles in the same Amazon Web Services account automatically have access to use the default CMK. Note that if an Secrets Manager API call results in Amazon Web Services creating the account's Amazon Web Services-managed CMK, it can result in a one-time significant delay in returning the result.
  • If the secret resides in a different Amazon Web Services account from the credentials calling an API that requires encryption or decryption of the secret value then you must create and use a custom Amazon Web Services KMS CMK because you can't access the default CMK for the account using credentials from a different Amazon Web Services account. Store the ARN of the CMK in the secret when you create the secret or when you update it by including it in the KMSKeyId. If you call an API that must encrypt or decrypt SecretString or SecretBinary using credentials from a different account then the Amazon Web Services KMS key policy must grant cross-account access to that other account's user or role for both the kms:GenerateDataKey and kms:Decrypt operations.
Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:UpdateSecret
  • kms:GenerateDataKey - needed only if you use a custom Amazon Web Services KMS key to encrypt the secret. You do not need this permission to use the account's Amazon Web Services managed CMK for Secrets Manager.
  • kms:Decrypt - needed only if you use a custom Amazon Web Services KMS key to encrypt the secret. You do not need this permission to use the account's Amazon Web Services managed CMK for Secrets Manager.
Related operations
UpdateSecretVersionStage
Show Description Modifies the staging labels attached to a version of a secret. Staging labels are used to track a version as it progresses through the secret rotation process. You can attach a staging label to only one version of a secret at a time. If a staging label to be added is already attached to another version, then it is moved--removed from the other version first and then attached to this one. For more information about staging labels, see Staging Labels in the Amazon Web Services Secrets Manager User Guide. The staging labels that you specify in the VersionStage parameter are added to the existing list of staging labels--they don't replace it. You can move the AWSCURRENT staging label to this version by including it in this call. Whenever you move AWSCURRENT, Secrets Manager automatically moves the label AWSPREVIOUS to the version that AWSCURRENT was removed from. If this action results in the last label being removed from a version, then the version is considered to be 'deprecated' and can be deleted by Secrets Manager. Minimum permissions To run this command, you must have the following permissions:
  • secretsmanager:UpdateSecretVersionStage
Related operations
  • To get the list of staging labels that are currently associated with a version of a secret, use DescribeSecret and examine the SecretVersionsToStages response value.
## Securityhub Events
Service Event Name Description
securityhub AcceptAdministratorInvitation
Show Description Accepts the invitation to be a member account and be monitored by the Security Hub administrator account that the invitation was sent from. This operation is only used by member accounts that are not added through Organizations. When the member account accepts the invitation, permission is granted to the administrator account to view findings generated in the member account.
AcceptInvitation
Show Description This method is deprecated. Instead, use AcceptAdministratorInvitation. The Security Hub console continues to use AcceptInvitation. It will eventually change to use AcceptAdministratorInvitation. Any IAM policies that specifically control access to this function must continue to use AcceptInvitation. You should also add AcceptAdministratorInvitation to your policies to ensure that the correct permissions are in place after the console begins to use AcceptAdministratorInvitation. Accepts the invitation to be a member account and be monitored by the Security Hub administrator account that the invitation was sent from. This operation is only used by member accounts that are not added through Organizations. When the member account accepts the invitation, permission is granted to the administrator account to view findings generated in the member account.
BatchDisableStandards
Show Description Disables the standards specified by the provided StandardsSubscriptionArns. For more information, see Security Standards section of the Security Hub User Guide.
BatchEnableStandards
Show Description Enables the standards specified by the provided StandardsArn. To obtain the ARN for a standard, use the DescribeStandards operation. For more information, see the Security Standards section of the Security Hub User Guide.
BatchImportFindings
Show Description Imports security findings generated from an integrated product into Security Hub. This action is requested by the integrated product to import its findings into Security Hub. The maximum allowed size for a finding is 240 Kb. An error is returned for any finding larger than 240 Kb. After a finding is created, BatchImportFindings cannot be used to update the following finding fields and objects, which Security Hub customers use to manage their investigation workflow.
  • Note
  • UserDefinedFields
  • VerificationState
  • Workflow
Finding providers also should not use BatchImportFindings to update the following attributes.
  • Confidence
  • Criticality
  • RelatedFindings
  • Severity
  • Types
Instead, finding providers use FindingProviderFields to provide values for these attributes.
BatchUpdateFindings
Show Description Used by Security Hub customers to update information about their investigation into a finding. Requested by administrator accounts or member accounts. Administrator accounts can update findings for their account and their member accounts. Member accounts can update findings for their account. Updates from BatchUpdateFindings do not affect the value of UpdatedAt for a finding. Administrator and member accounts can use BatchUpdateFindings to update the following finding fields and objects.
  • Confidence
  • Criticality
  • Note
  • RelatedFindings
  • Severity
  • Types
  • UserDefinedFields
  • VerificationState
  • Workflow
You can configure IAM policies to restrict access to fields and field values. For example, you might not want member accounts to be able to suppress findings or change the finding severity. See Configuring access to BatchUpdateFindings in the Security Hub User Guide.
CreateActionTarget
Show Description Creates a custom action target in Security Hub. You can use custom actions on findings and insights in Security Hub to trigger target actions in Amazon CloudWatch Events.
CreateFindingAggregator
Show Description Used to enable finding aggregation. Must be called from the aggregation Region. For more details about cross-Region replication, see Configuring finding aggregation in the Security Hub User Guide.
CreateInsight
Show Description Creates a custom insight in Security Hub. An insight is a consolidation of findings that relate to a security issue that requires attention or remediation. To group the related findings in the insight, use the GroupByAttribute.
CreateMembers
Show Description Creates a member association in Security Hub between the specified accounts and the account used to make the request, which is the administrator account. If you are integrated with Organizations, then the administrator account is designated by the organization management account. CreateMembers is always used to add accounts that are not organization members. For accounts that are managed using Organizations, CreateMembers is only used in the following cases:
  • Security Hub is not configured to automatically add new organization accounts.
  • The account was disassociated or deleted in Security Hub.
This action can only be used by an account that has Security Hub enabled. To enable Security Hub, you can use the EnableSecurityHub operation. For accounts that are not organization members, you create the account association and then send an invitation to the member account. To send the invitation, you use the InviteMembers operation. If the account owner accepts the invitation, the account becomes a member account in Security Hub. Accounts that are managed using Organizations do not receive an invitation. They automatically become a member account in Security Hub.
  • If the organization account does not have Security Hub enabled, then Security Hub and the default standards are automatically enabled. Note that Security Hub cannot be enabled automatically for the organization management account. The organization management account must enable Security Hub before the administrator account enables it as a member account.
  • For organization accounts that already have Security Hub enabled, Security Hub does not make any other changes to those accounts. It does not change their enabled standards or controls.
A permissions policy is added that permits the administrator account to view the findings generated in the member account. To remove the association between the administrator and member accounts, use the DisassociateFromMasterAccount or DisassociateMembers operation.
DeclineInvitations
Show Description Declines invitations to become a member account. This operation is only used by accounts that are not part of an organization. Organization accounts do not receive invitations.
DeleteActionTarget
Show Description Deletes a custom action target from Security Hub. Deleting a custom action target does not affect any findings or insights that were already sent to Amazon CloudWatch Events using the custom action.
DeleteFindingAggregator
Show Description Deletes a finding aggregator. When you delete the finding aggregator, you stop finding aggregation. When you stop finding aggregation, findings that were already aggregated to the aggregation Region are still visible from the aggregation Region. New findings and finding updates are not aggregated.
DeleteInsight
Show Description Deletes the insight specified by the InsightArn.
DeleteInvitations
Show Description Deletes invitations received by the Amazon Web Services account to become a member account. This operation is only used by accounts that are not part of an organization. Organization accounts do not receive invitations.
DeleteMembers
Show Description Deletes the specified member accounts from Security Hub. Can be used to delete member accounts that belong to an organization as well as member accounts that were invited manually.
DescribeActionTargets
Show Description Returns a list of the custom action targets in Security Hub in your account.
DescribeHub
Show Description Returns details about the Hub resource in your account, including the HubArn and the time when you enabled Security Hub.
DescribeOrganizationConfiguration
Show Description Returns information about the Organizations configuration for Security Hub. Can only be called from a Security Hub administrator account.
DescribeProducts
Show Description Returns information about product integrations in Security Hub. You can optionally provide an integration ARN. If you provide an integration ARN, then the results only include that integration. If you do not provide an integration ARN, then the results include all of the available product integrations.
DescribeStandards
Show Description Returns a list of the available standards in Security Hub. For each standard, the results include the standard ARN, the name, and a description.
DescribeStandardsControls
Show Description Returns a list of security standards controls. For each control, the results include information about whether it is currently enabled, the severity, and a link to remediation information.
DisableImportFindingsForProduct
Show Description Disables the integration of the specified product with Security Hub. After the integration is disabled, findings from that product are no longer sent to Security Hub.
DisableOrganizationAdminAccount
Show Description Disables a Security Hub administrator account. Can only be called by the organization management account.
DisableSecurityHub
Show Description Disables Security Hub in your account only in the current Region. To disable Security Hub in all Regions, you must submit one request per Region where you have enabled Security Hub. When you disable Security Hub for an administrator account, it doesn't disable Security Hub for any associated member accounts. When you disable Security Hub, your existing findings and insights and any Security Hub configuration settings are deleted after 90 days and cannot be recovered. Any standards that were enabled are disabled, and your administrator and member account associations are removed. If you want to save your existing findings, you must export them before you disable Security Hub.
DisassociateFromAdministratorAccount
Show Description Disassociates the current Security Hub member account from the associated administrator account. This operation is only used by accounts that are not part of an organization. For organization accounts, only the administrator account can disassociate a member account.
DisassociateFromMasterAccount
Show Description This method is deprecated. Instead, use DisassociateFromAdministratorAccount. The Security Hub console continues to use DisassociateFromMasterAccount. It will eventually change to use DisassociateFromAdministratorAccount. Any IAM policies that specifically control access to this function must continue to use DisassociateFromMasterAccount. You should also add DisassociateFromAdministratorAccount to your policies to ensure that the correct permissions are in place after the console begins to use DisassociateFromAdministratorAccount. Disassociates the current Security Hub member account from the associated administrator account. This operation is only used by accounts that are not part of an organization. For organization accounts, only the administrator account can disassociate a member account.
DisassociateMembers
Show Description Disassociates the specified member accounts from the associated administrator account. Can be used to disassociate both accounts that are managed using Organizations and accounts that were invited manually.
EnableImportFindingsForProduct
Show Description Enables the integration of a partner product with Security Hub. Integrated products send findings to Security Hub. When you enable a product integration, a permissions policy that grants permission for the product to send findings to Security Hub is applied.
EnableOrganizationAdminAccount
Show Description Designates the Security Hub administrator account for an organization. Can only be called by the organization management account.
EnableSecurityHub
Show Description Enables Security Hub for your account in the current Region or the Region you specify in the request. When you enable Security Hub, you grant to Security Hub the permissions necessary to gather findings from other services that are integrated with Security Hub. When you use the EnableSecurityHub operation to enable Security Hub, you also automatically enable the following standards.
  • CIS Amazon Web Services Foundations
  • Amazon Web Services Foundational Security Best Practices
You do not enable the Payment Card Industry Data Security Standard (PCI DSS) standard. To not enable the automatically enabled standards, set EnableDefaultStandards to false. After you enable Security Hub, to enable a standard, use the BatchEnableStandards operation. To disable a standard, use the BatchDisableStandards operation. To learn more, see the setup information in the Security Hub User Guide.
GetAdministratorAccount
Show Description Provides the details for the Security Hub administrator account for the current member account. Can be used by both member accounts that are managed using Organizations and accounts that were invited manually.
GetEnabledStandards
Show Description Returns a list of the standards that are currently enabled.
GetFindingAggregator
Show Description Returns the current finding aggregation configuration.
GetFindings
Show Description Returns a list of findings that match the specified criteria. If finding aggregation is enabled, then when you call GetFindings from the aggregation Region, the results include all of the matching findings from both the aggregation Region and the linked Regions.
GetInsightResults
Show Description Lists the results of the Security Hub insight specified by the insight ARN.
GetInsights
Show Description Lists and describes insights for the specified insight ARNs.
GetInvitationsCount
Show Description Returns the count of all Security Hub membership invitations that were sent to the current member account, not including the currently accepted invitation.
GetMasterAccount
Show Description This method is deprecated. Instead, use GetAdministratorAccount. The Security Hub console continues to use GetMasterAccount. It will eventually change to use GetAdministratorAccount. Any IAM policies that specifically control access to this function must continue to use GetMasterAccount. You should also add GetAdministratorAccount to your policies to ensure that the correct permissions are in place after the console begins to use GetAdministratorAccount. Provides the details for the Security Hub administrator account for the current member account. Can be used by both member accounts that are managed using Organizations and accounts that were invited manually.
GetMembers
Show Description Returns the details for the Security Hub member accounts for the specified account IDs. An administrator account can be either the delegated Security Hub administrator account for an organization or an administrator account that enabled Security Hub manually. The results include both member accounts that are managed using Organizations and accounts that were invited manually.
InviteMembers
Show Description Invites other Amazon Web Services accounts to become member accounts for the Security Hub administrator account that the invitation is sent from. This operation is only used to invite accounts that do not belong to an organization. Organization accounts do not receive invitations. Before you can use this action to invite a member, you must first use the CreateMembers action to create the member account in Security Hub. When the account owner enables Security Hub and accepts the invitation to become a member account, the administrator account can view the findings generated from the member account.
ListEnabledProductsForImport
Show Description Lists all findings-generating solutions (products) that you are subscribed to receive findings from in Security Hub.
ListFindingAggregators
Show Description If finding aggregation is enabled, then ListFindingAggregators returns the ARN of the finding aggregator. You can run this operation from any Region.
ListInvitations
Show Description Lists all Security Hub membership invitations that were sent to the current Amazon Web Services account. This operation is only used by accounts that are managed by invitation. Accounts that are managed using the integration with Organizations do not receive invitations.
ListMembers
Show Description Lists details about all member accounts for the current Security Hub administrator account. The results include both member accounts that belong to an organization and member accounts that were invited manually.
ListOrganizationAdminAccounts
Show Description Lists the Security Hub administrator accounts. Can only be called by the organization management account.
ListTagsForResource
Show Description Returns a list of tags associated with a resource.
TagResource
Show Description Adds one or more tags to a resource.
UntagResource
Show Description Removes one or more tags from a resource.
UpdateActionTarget
Show Description Updates the name and description of a custom action target in Security Hub.
UpdateFindingAggregator
Show Description Updates the finding aggregation configuration. Used to update the Region linking mode and the list of included or excluded Regions. You cannot use UpdateFindingAggregator to change the aggregation Region. You must run UpdateFindingAggregator from the current aggregation Region.
UpdateFindings
Show Description UpdateFindings is deprecated. Instead of UpdateFindings, use BatchUpdateFindings. Updates the Note and RecordState of the Security Hub-aggregated findings that the filter attributes specify. Any member account that can view the finding also sees the update to the finding.
UpdateInsight
Show Description Updates the Security Hub insight identified by the specified insight ARN.
UpdateOrganizationConfiguration
Show Description Used to update the configuration related to Organizations. Can only be called from a Security Hub administrator account.
UpdateSecurityHubConfiguration
Show Description Updates configuration options for Security Hub.
## Serverlessrepo Events
Service Event Name Description
serverlessrepo CreateApplication
Show Description Creates an application, optionally including an AWS SAM file to create the first application version in the same call.
CreateApplicationVersion
Show Description Creates an application version.
CreateCloudFormationChangeSet
Show Description Creates an AWS CloudFormation change set for the given application.
CreateCloudFormationTemplate
Show Description Creates an AWS CloudFormation template.
DeleteApplication
GetApplication
Show Description Gets the specified application.
GetApplicationPolicy
Show Description Retrieves the policy for the application.
GetCloudFormationTemplate
Show Description Gets the specified AWS CloudFormation template.
ListApplicationDependencies
Show Description Retrieves the list of applications nested in the containing application.
ListApplicationVersions
Show Description Lists versions for the specified application.
ListApplications
Show Description Lists applications owned by the requester.
PutApplicationPolicy
Show Description Sets the permission policy for an application. For the list of actions supported for this operation, see
UnshareApplication
## Service-quotas Events
Service Event Name Description
service-quotas AssociateServiceQuotaTemplate
Show Description Associates your quota request template with your organization. When a new account is created in your organization, the quota increase requests in the template are automatically applied to the account. You can add a quota increase request for any adjustable quota to your template.
DeleteServiceQuotaIncreaseRequestFromTemplate
Show Description Deletes the quota increase request for the specified quota from your quota request template.
DisassociateServiceQuotaTemplate
Show Description Disables your quota request template. After a template is disabled, the quota increase requests in the template are not applied to new accounts in your organization. Disabling a quota request template does not apply its quota increase requests.
GetAWSDefaultServiceQuota
Show Description Retrieves the default value for the specified quota. The default value does not reflect any quota increases.
GetAssociationForServiceQuotaTemplate
Show Description Retrieves the status of the association for the quota request template.
GetRequestedServiceQuotaChange
Show Description Retrieves information about the specified quota increase request.
GetServiceQuota
Show Description Retrieves the applied quota value for the specified quota. For some quotas, only the default values are available. If the applied quota value is not available for a quota, the quota is not retrieved.
GetServiceQuotaIncreaseRequestFromTemplate
Show Description Retrieves information about the specified quota increase request in your quota request template.
ListAWSDefaultServiceQuotas
Show Description Lists the default values for the quotas for the specified AWS service. A default value does not reflect any quota increases.
ListRequestedServiceQuotaChangeHistory
Show Description Retrieves the quota increase requests for the specified service.
ListRequestedServiceQuotaChangeHistoryByQuota
Show Description Retrieves the quota increase requests for the specified quota.
ListServiceQuotaIncreaseRequestsInTemplate
Show Description Lists the quota increase requests in the specified quota request template.
ListServiceQuotas
Show Description Lists the applied quota values for the specified AWS service. For some quotas, only the default values are available. If the applied quota value is not available for a quota, the quota is not retrieved.
ListServices
Show Description Lists the names and codes for the services integrated with Service Quotas.
ListTagsForResource
Show Description Returns a list of the tags assigned to the specified applied quota.
PutServiceQuotaIncreaseRequestIntoTemplate
Show Description Adds a quota increase request to your quota request template.
RequestServiceQuotaIncrease
Show Description Submits a quota increase request for the specified quota.
TagResource
Show Description Adds tags to the specified applied quota. You can include one or more tags to add to the quota.
## Servicecatalog-appregistry Events
Service Event Name Description
servicecatalog-appregistry AssociateAttributeGroup
Show Description Associates an attribute group with an application to augment the application's metadata with the group's attributes. This feature enables applications to be described with user-defined details that are machine-readable, such as third-party integrations.
AssociateResource
Show Description Associates a resource with an application. Both the resource and the application can be specified either by ID or name.
CreateApplication
Show Description Creates a new application that is the top-level node in a hierarchy of related cloud resource abstractions.
CreateAttributeGroup
Show Description Creates a new attribute group as a container for user-defined attributes. This feature enables users to have full control over their cloud application's metadata in a rich machine-readable format to facilitate integration with automated workflows and third-party tools.
DeleteApplication
Show Description Deletes an application that is specified either by its application ID or name. All associated attribute groups and resources must be disassociated from it before deleting an application.
DeleteAttributeGroup
Show Description Deletes an attribute group, specified either by its attribute group ID or name.
DisassociateAttributeGroup
Show Description Disassociates an attribute group from an application to remove the extra attributes contained in the attribute group from the application's metadata. This operation reverts AssociateAttributeGroup.
DisassociateResource
Show Description Disassociates a resource from application. Both the resource and the application can be specified either by ID or name.
GetApplication
Show Description Retrieves metadata information about one of your applications. The application can be specified either by its unique ID or by its name (which is unique within one account in one region at a given point in time). Specify by ID in automated workflows if you want to make sure that the exact same application is returned or a ResourceNotFoundException is thrown, avoiding the ABA addressing problem.
GetAssociatedResource
Show Description Gets the resource associated with the application.
GetAttributeGroup
Show Description Retrieves an attribute group, either by its name or its ID. The attribute group can be specified either by its unique ID or by its name.
ListApplications
Show Description Retrieves a list of all of your applications. Results are paginated.
ListAssociatedAttributeGroups
Show Description Lists all attribute groups that are associated with specified application. Results are paginated.
ListAssociatedResources
Show Description Lists all resources that are associated with specified application. Results are paginated.
ListAttributeGroups
Show Description Lists all attribute groups which you have access to. Results are paginated.
ListTagsForResource
Show Description Lists all of the tags on the resource.
SyncResource
Show Description Syncs the resource with current AppRegistry records. Specifically, the resource’s AppRegistry system tags sync with its associated application. We remove the resource's AppRegistry system tags if it does not associate with the application. The caller must have permissions to read and update the resource.
TagResource
Show Description Assigns one or more tags (key-value pairs) to the specified resource. Each tag consists of a key and an optional value. If a tag with the same key is already associated with the resource, this action updates its value. This operation returns an empty response if the call was successful.
UntagResource
Show Description Removes tags from a resource. This operation returns an empty response if the call was successful.
UpdateApplication
Show Description Updates an existing application with new attributes.
## Servicecatalog Events
Service Event Name Description
servicecatalog AcceptPortfolioShare
Show Description Accepts an offer to share the specified portfolio.
AssociateBudgetWithResource
Show Description Associates the specified budget with the specified resource.
AssociatePrincipalWithPortfolio
Show Description Associates the specified principal ARN with the specified portfolio.
AssociateProductWithPortfolio
Show Description Associates the specified product with the specified portfolio. A delegated admin is authorized to invoke this command.
AssociateServiceActionWithProvisioningArtifact
Show Description Associates a self-service action with a provisioning artifact.
AssociateTagOptionWithResource
Show Description Associate the specified TagOption with the specified portfolio or product.
BatchAssociateServiceActionWithProvisioningArtifact
Show Description Associates multiple self-service actions with provisioning artifacts.
BatchDisassociateServiceActionFromProvisioningArtifact
Show Description Disassociates a batch of self-service actions from the specified provisioning artifact.
CopyProduct
Show Description Copies the specified source product to the specified target product or a new product. You can copy a product to the same account or another account. You can copy a product to the same region or another region. This operation is performed asynchronously. To track the progress of the operation, use DescribeCopyProductStatus.
CreateConstraint
Show Description Creates a constraint. A delegated admin is authorized to invoke this command.
CreatePortfolio
Show Description Creates a portfolio. A delegated admin is authorized to invoke this command.
CreatePortfolioShare
Show Description Shares the specified portfolio with the specified account or organization node. Shares to an organization node can only be created by the management account of an organization or by a delegated administrator. You can share portfolios to an organization, an organizational unit, or a specific account. Note that if a delegated admin is de-registered, they can no longer create portfolio shares. AWSOrganizationsAccess must be enabled in order to create a portfolio share to an organization node. You can't share a shared resource, including portfolios that contain a shared product. If the portfolio share with the specified account or organization node already exists, this action will have no effect and will not return an error. To update an existing share, you must use the UpdatePortfolioShare API instead.
CreateProduct
Show Description Creates a product. A delegated admin is authorized to invoke this command. The user or role that performs this operation must have the cloudformation:GetTemplate IAM policy permission. This policy permission is required when using the ImportFromPhysicalId template source in the information data section.
CreateProvisionedProductPlan
Show Description Creates a plan. A plan includes the list of resources to be created (when provisioning a new product) or modified (when updating a provisioned product) when the plan is executed. You can create one plan per provisioned product. To create a plan for an existing provisioned product, the product status must be AVAILBLE or TAINTED. To view the resource changes in the change set, use DescribeProvisionedProductPlan. To create or modify the provisioned product, use ExecuteProvisionedProductPlan.
CreateProvisioningArtifact
Show Description Creates a provisioning artifact (also known as a version) for the specified product. You cannot create a provisioning artifact for a product that was shared with you. The user or role that performs this operation must have the cloudformation:GetTemplate IAM policy permission. This policy permission is required when using the ImportFromPhysicalId template source in the information data section.
CreateServiceAction
Show Description Creates a self-service action.
CreateTagOption
Show Description Creates a TagOption.
DeleteConstraint
Show Description Deletes the specified constraint. A delegated admin is authorized to invoke this command.
DeletePortfolio
Show Description Deletes the specified portfolio. You cannot delete a portfolio if it was shared with you or if it has associated products, users, constraints, or shared accounts. A delegated admin is authorized to invoke this command.
DeletePortfolioShare
Show Description Stops sharing the specified portfolio with the specified account or organization node. Shares to an organization node can only be deleted by the management account of an organization or by a delegated administrator. Note that if a delegated admin is de-registered, portfolio shares created from that account are removed.
DeleteProduct
Show Description Deletes the specified product. You cannot delete a product if it was shared with you or is associated with a portfolio. A delegated admin is authorized to invoke this command.
DeleteProvisionedProductPlan
Show Description Deletes the specified plan.
DeleteProvisioningArtifact
Show Description Deletes the specified provisioning artifact (also known as a version) for the specified product. You cannot delete a provisioning artifact associated with a product that was shared with you. You cannot delete the last provisioning artifact for a product, because a product must have at least one provisioning artifact.
DeleteServiceAction
Show Description Deletes a self-service action.
DeleteTagOption
Show Description Deletes the specified TagOption. You cannot delete a TagOption if it is associated with a product or portfolio.
DescribeConstraint
Show Description Gets information about the specified constraint.
DescribeCopyProductStatus
Show Description Gets the status of the specified copy product operation.
DescribePortfolio
Show Description Gets information about the specified portfolio. A delegated admin is authorized to invoke this command.
DescribePortfolioShareStatus
Show Description Gets the status of the specified portfolio share operation. This API can only be called by the management account in the organization or by a delegated admin.
DescribePortfolioShares
Show Description Returns a summary of each of the portfolio shares that were created for the specified portfolio. You can use this API to determine which accounts or organizational nodes this portfolio have been shared, whether the recipient entity has imported the share, and whether TagOptions are included with the share. The PortfolioId and Type parameters are both required.
DescribeProduct
Show Description Gets information about the specified product.
DescribeProductAsAdmin
Show Description Gets information about the specified product. This operation is run with administrator access.
DescribeProductView
Show Description Gets information about the specified product.
DescribeProvisionedProduct
Show Description Gets information about the specified provisioned product.
DescribeProvisionedProductPlan
Show Description Gets information about the resource changes for the specified plan.
DescribeProvisioningArtifact
Show Description Gets information about the specified provisioning artifact (also known as a version) for the specified product.
DescribeProvisioningParameters
Show Description Gets information about the configuration required to provision the specified product using the specified provisioning artifact. If the output contains a TagOption key with an empty list of values, there is a TagOption conflict for that key. The end user cannot take action to fix the conflict, and launch is not blocked. In subsequent calls to ProvisionProduct, do not include conflicted TagOption keys as tags, or this causes the error "Parameter validation failed: Missing required parameter in Tags[N]:Value". Tag the provisioned product with the value sc-tagoption-conflict-portfolioId-productId.
DescribeRecord
Show Description Gets information about the specified request operation. Use this operation after calling a request operation (for example, ProvisionProduct, TerminateProvisionedProduct, or UpdateProvisionedProduct). If a provisioned product was transferred to a new owner using UpdateProvisionedProductProperties, the new owner will be able to describe all past records for that product. The previous owner will no longer be able to describe the records, but will be able to use ListRecordHistory to see the product's history from when he was the owner.
DescribeServiceAction
Show Description Describes a self-service action.
DescribeServiceActionExecutionParameters
Show Description Finds the default parameters for a specific self-service action on a specific provisioned product and returns a map of the results to the user.
DescribeTagOption
Show Description Gets information about the specified TagOption.
DisableAWSOrganizationsAccess
Show Description Disable portfolio sharing through AWS Organizations feature. This feature will not delete your current shares but it will prevent you from creating new shares throughout your organization. Current shares will not be in sync with your organization structure if it changes after calling this API. This API can only be called by the management account in the organization. This API can't be invoked if there are active delegated administrators in the organization. Note that a delegated administrator is not authorized to invoke DisableAWSOrganizationsAccess.
DisassociateBudgetFromResource
Show Description Disassociates the specified budget from the specified resource.
DisassociatePrincipalFromPortfolio
Show Description Disassociates a previously associated principal ARN from a specified portfolio.
DisassociateProductFromPortfolio
Show Description Disassociates the specified product from the specified portfolio. A delegated admin is authorized to invoke this command.
DisassociateServiceActionFromProvisioningArtifact
Show Description Disassociates the specified self-service action association from the specified provisioning artifact.
DisassociateTagOptionFromResource
Show Description Disassociates the specified TagOption from the specified resource.
EnableAWSOrganizationsAccess
Show Description Enable portfolio sharing feature through AWS Organizations. This API will allow Service Catalog to receive updates on your organization in order to sync your shares with the current structure. This API can only be called by the management account in the organization. By calling this API Service Catalog will make a call to organizations:EnableAWSServiceAccess on your behalf so that your shares can be in sync with any changes in your AWS Organizations structure. Note that a delegated administrator is not authorized to invoke EnableAWSOrganizationsAccess.
ExecuteProvisionedProductPlan
Show Description Provisions or modifies a product based on the resource changes for the specified plan.
ExecuteProvisionedProductServiceAction
Show Description Executes a self-service action against a provisioned product.
GetAWSOrganizationsAccessStatus
Show Description Get the Access Status for AWS Organization portfolio share feature. This API can only be called by the management account in the organization or by a delegated admin.
GetProvisionedProductOutputs
Show Description This API takes either a ProvisonedProductId or a ProvisionedProductName, along with a list of one or more output keys, and responds with the key/value pairs of those outputs.
ImportAsProvisionedProduct
Show Description Requests the import of a resource as a Service Catalog provisioned product that is associated to a Service Catalog product and provisioning artifact. Once imported, all supported Service Catalog governance actions are supported on the provisioned product. Resource import only supports CloudFormation stack ARNs. CloudFormation StackSets and non-root nested stacks are not supported. The CloudFormation stack must have one of the following statuses to be imported: CREATE_COMPLETE, UPDATE_COMPLETE, UPDATE_ROLLBACK_COMPLETE, IMPORT_COMPLETE, IMPORT_ROLLBACK_COMPLETE. Import of the resource requires that the CloudFormation stack template matches the associated Service Catalog product provisioning artifact. The user or role that performs this operation must have the cloudformation:GetTemplate and cloudformation:DescribeStacks IAM policy permissions.
ListAcceptedPortfolioShares
Show Description Lists all portfolios for which sharing was accepted by this account.
ListBudgetsForResource
Show Description Lists all the budgets associated to the specified resource.
ListConstraintsForPortfolio
Show Description Lists the constraints for the specified portfolio and product.
ListLaunchPaths
Show Description Lists the paths to the specified product. A path is how the user has access to a specified product, and is necessary when provisioning a product. A path also determines the constraints put on the product.
ListOrganizationPortfolioAccess
Show Description Lists the organization nodes that have access to the specified portfolio. This API can only be called by the management account in the organization or by a delegated admin. If a delegated admin is de-registered, they can no longer perform this operation.
ListPortfolioAccess
Show Description Lists the account IDs that have access to the specified portfolio. A delegated admin can list the accounts that have access to the shared portfolio. Note that if a delegated admin is de-registered, they can no longer perform this operation.
ListPortfolios
Show Description Lists all portfolios in the catalog.
ListPortfoliosForProduct
Show Description Lists all portfolios that the specified product is associated with.
ListPrincipalsForPortfolio
Show Description Lists all principal ARNs associated with the specified portfolio.
ListProvisionedProductPlans
Show Description Lists the plans for the specified provisioned product or all plans to which the user has access.
ListProvisioningArtifacts
Show Description Lists all provisioning artifacts (also known as versions) for the specified product.
ListProvisioningArtifactsForServiceAction
Show Description Lists all provisioning artifacts (also known as versions) for the specified self-service action.
ListRecordHistory
Show Description Lists the specified requests or all performed requests.
ListResourcesForTagOption
Show Description Lists the resources associated with the specified TagOption.
ListServiceActions
Show Description Lists all self-service actions.
ListServiceActionsForProvisioningArtifact
Show Description Returns a paginated list of self-service actions associated with the specified Product ID and Provisioning Artifact ID.
ListStackInstancesForProvisionedProduct
Show Description Returns summary information about stack instances that are associated with the specified CFN_STACKSET type provisioned product. You can filter for stack instances that are associated with a specific AWS account name or region.
ListTagOptions
Show Description Lists the specified TagOptions or all TagOptions.
ProvisionProduct
Show Description Provisions the specified product. A provisioned product is a resourced instance of a product. For example, provisioning a product based on a CloudFormation template launches a CloudFormation stack and its underlying resources. You can check the status of this request using DescribeRecord. If the request contains a tag key with an empty list of values, there is a tag conflict for that key. Do not include conflicted keys as tags, or this causes the error "Parameter validation failed: Missing required parameter in Tags[N]:Value".
RejectPortfolioShare
Show Description Rejects an offer to share the specified portfolio.
ScanProvisionedProducts
Show Description Lists the provisioned products that are available (not terminated). To use additional filtering, see SearchProvisionedProducts.
SearchProducts
Show Description Gets information about the products to which the caller has access.
SearchProductsAsAdmin
Show Description Gets information about the products for the specified portfolio or all products.
SearchProvisionedProducts
Show Description Gets information about the provisioned products that meet the specified criteria.
TerminateProvisionedProduct
Show Description Terminates the specified provisioned product. This operation does not delete any records associated with the provisioned product. You can check the status of this request using DescribeRecord.
UpdateConstraint
Show Description Updates the specified constraint.
UpdatePortfolio
Show Description Updates the specified portfolio. You cannot update a product that was shared with you.
UpdatePortfolioShare
Show Description Updates the specified portfolio share. You can use this API to enable or disable TagOptions sharing for an existing portfolio share. The portfolio share cannot be updated if the CreatePortfolioShare operation is IN_PROGRESS, as the share is not available to recipient entities. In this case, you must wait for the portfolio share to be COMPLETED. You must provide the accountId or organization node in the input, but not both. If the portfolio is shared to both an external account and an organization node, and both shares need to be updated, you must invoke UpdatePortfolioShare separately for each share type. This API cannot be used for removing the portfolio share. You must use DeletePortfolioShare API for that action.
UpdateProduct
Show Description Updates the specified product.
UpdateProvisionedProduct
Show Description Requests updates to the configuration of the specified provisioned product. If there are tags associated with the object, they cannot be updated or added. Depending on the specific updates requested, this operation can update with no interruption, with some interruption, or replace the provisioned product entirely. You can check the status of this request using DescribeRecord.
UpdateProvisionedProductProperties
Show Description Requests updates to the properties of the specified provisioned product.
UpdateProvisioningArtifact
Show Description Updates the specified provisioning artifact (also known as a version) for the specified product. You cannot update a provisioning artifact for a product that was shared with you.
UpdateServiceAction
Show Description Updates a self-service action.
## Servicediscovery Events
Service Event Name Description
servicediscovery CreateHttpNamespace
Show Description Creates an HTTP namespace. Service instances registered using an HTTP namespace can be discovered using a DiscoverInstances request but can't be discovered using DNS. For the current quota on the number of namespaces that you can create using the same account, see Cloud Map quotas in the Cloud Map Developer Guide.
CreatePrivateDnsNamespace
Show Description Creates a private namespace based on DNS, which is visible only inside a specified Amazon VPC. The namespace defines your service naming scheme. For example, if you name your namespace example.com and name your service backend, the resulting DNS name for the service is backend.example.com. Service instances that are registered using a private DNS namespace can be discovered using either a DiscoverInstances request or using DNS. For the current quota on the number of namespaces that you can create using the same account, see Cloud Map quotas in the Cloud Map Developer Guide.
CreatePublicDnsNamespace
Show Description Creates a public namespace based on DNS, which is visible on the internet. The namespace defines your service naming scheme. For example, if you name your namespace example.com and name your service backend, the resulting DNS name for the service is backend.example.com. You can discover instances that were registered with a public DNS namespace by using either a DiscoverInstances request or using DNS. For the current quota on the number of namespaces that you can create using the same account, see Cloud Map quotas in the Cloud Map Developer Guide.
CreateService
Show Description Creates a service. This action defines the configuration for the following entities:
  • For public and private DNS namespaces, one of the following combinations of DNS records in Amazon Route 53:
    • A
    • AAAA
    • A and AAAA
    • SRV
    • CNAME
  • Optionally, a health check
After you create the service, you can submit a RegisterInstance request, and Cloud Map uses the values in the configuration to create the specified entities. For the current quota on the number of instances that you can register using the same namespace and using the same service, see Cloud Map quotas in the Cloud Map Developer Guide.
DeleteNamespace
Show Description Deletes a namespace from the current account. If the namespace still contains one or more services, the request fails.
DeleteService
Show Description Deletes a specified service. If the service still contains one or more registered instances, the request fails.
DeregisterInstance
Show Description Deletes the Amazon Route 53 DNS records and health check, if any, that Cloud Map created for the specified instance.
DiscoverInstances
Show Description Discovers registered instances for a specified namespace and service. You can use DiscoverInstances to discover instances for any type of namespace. For public and private DNS namespaces, you can also use DNS queries to discover instances.
GetInstance
Show Description Gets information about a specified instance.
GetInstancesHealthStatus
Show Description Gets the current health status (Healthy, Unhealthy, or Unknown) of one or more instances that are associated with a specified service. There's a brief delay between when you register an instance and when the health status for the instance is available.
GetNamespace
Show Description Gets information about a namespace.
GetOperation
Show Description Gets information about any operation that returns an operation ID in the response, such as a CreateService request. To get a list of operations that match specified criteria, see ListOperations.
GetService
Show Description Gets the settings for a specified service.
ListInstances
Show Description Lists summary information about the instances that you registered by using a specified service.
ListNamespaces
Show Description Lists summary information about the namespaces that were created by the current account.
ListOperations
Show Description Lists operations that match the criteria that you specify.
ListServices
Show Description Lists summary information for all the services that are associated with one or more specified namespaces.
ListTagsForResource
Show Description Lists tags for the specified resource.
RegisterInstance
Show Description Creates or updates one or more records and, optionally, creates a health check based on the settings in a specified service. When you submit a RegisterInstance request, the following occurs:
  • For each DNS record that you define in the service that's specified by ServiceId, a record is created or updated in the hosted zone that's associated with the corresponding namespace.
  • If the service includes HealthCheckConfig, a health check is created based on the settings in the health check configuration.
  • The health check, if any, is associated with each of the new or updated records.
One RegisterInstance request must complete before you can submit another request and specify the same service ID and instance ID. For more information, see CreateService. When Cloud Map receives a DNS query for the specified DNS name, it returns the applicable value:
  • If the health check is healthy: returns all the records
  • If the health check is unhealthy: returns the applicable value for the last healthy instance
  • If you didn't specify a health check configuration: returns all the records
For the current quota on the number of instances that you can register using the same namespace and using the same service, see Cloud Map quotas in the Cloud Map Developer Guide.
TagResource
Show Description Adds one or more tags to the specified resource.
UntagResource
Show Description Removes one or more tags from the specified resource.
UpdateHttpNamespace
Show Description Updates an HTTP namespace.
UpdateInstanceCustomHealthStatus
UpdatePrivateDnsNamespace
Show Description Updates a private DNS namespace.
UpdatePublicDnsNamespace
Show Description Updates a public DNS namespace.
## Ses Events
Service Event Name Description
ses CloneReceiptRuleSet
Show Description Creates a receipt rule set by cloning an existing one. All receipt rules and configurations are copied to the new receipt rule set and are completely independent of the source rule set. For information about setting up rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateConfigurationSet
Show Description Creates a configuration set. Configuration sets enable you to publish email sending events. For information about using configuration sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateConfigurationSetEventDestination
Show Description Creates a configuration set event destination. When you create or update an event destination, you must provide one, and only one, destination. The destination can be CloudWatch, Amazon Kinesis Firehose, or Amazon Simple Notification Service (Amazon SNS). An event destination is the AWS service to which Amazon SES publishes the email sending events associated with a configuration set. For information about using configuration sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateConfigurationSetTrackingOptions
Show Description Creates an association between a configuration set and a custom domain for open and click event tracking. By default, images and links used for tracking open and click events are hosted on domains operated by Amazon SES. You can configure a subdomain of your own to handle these events. For information about using custom domains, see the Amazon SES Developer Guide.
CreateCustomVerificationEmailTemplate
CreateReceiptFilter
Show Description Creates a new IP address filter. For information about setting up IP address filters, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateReceiptRule
Show Description Creates a receipt rule. For information about setting up receipt rules, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateReceiptRuleSet
Show Description Creates an empty receipt rule set. For information about setting up receipt rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateTemplate
Show Description Creates an email template. Email templates enable you to send personalized email to one or more destinations in a single API operation. For more information, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteConfigurationSet
Show Description Deletes a configuration set. Configuration sets enable you to publish email sending events. For information about using configuration sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteConfigurationSetEventDestination
Show Description Deletes a configuration set event destination. Configuration set event destinations are associated with configuration sets, which enable you to publish email sending events. For information about using configuration sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteConfigurationSetTrackingOptions
Show Description Deletes an association between a configuration set and a custom domain for open and click event tracking. By default, images and links used for tracking open and click events are hosted on domains operated by Amazon SES. You can configure a subdomain of your own to handle these events. For information about using custom domains, see the Amazon SES Developer Guide. Deleting this kind of association will result in emails sent using the specified configuration set to capture open and click events using the standard, Amazon SES-operated domains.
DeleteCustomVerificationEmailTemplate
DeleteIdentity
Show Description Deletes the specified identity (an email address or a domain) from the list of verified identities. You can execute this operation no more than once per second.
DeleteIdentityPolicy
Show Description Deletes the specified sending authorization policy for the given identity (an email address or a domain). This API returns successfully even if a policy with the specified name does not exist. This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteReceiptFilter
Show Description Deletes the specified IP address filter. For information about managing IP address filters, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteReceiptRule
Show Description Deletes the specified receipt rule. For information about managing receipt rules, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteReceiptRuleSet
Show Description Deletes the specified receipt rule set and all of the receipt rules it contains. The currently active rule set cannot be deleted. For information about managing receipt rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteTemplate
Show Description Deletes an email template. You can execute this operation no more than once per second.
DeleteVerifiedEmailAddress
DescribeActiveReceiptRuleSet
Show Description Returns the metadata and receipt rules for the receipt rule set that is currently active. For information about setting up receipt rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DescribeConfigurationSet
Show Description Returns the details of the specified configuration set. For information about using configuration sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DescribeReceiptRule
Show Description Returns the details of the specified receipt rule. For information about setting up receipt rules, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DescribeReceiptRuleSet
Show Description Returns the details of the specified receipt rule set. For information about managing receipt rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
GetAccountSendingEnabled
Show Description Returns the email sending status of the Amazon SES account for the current region. You can execute this operation no more than once per second.
GetCustomVerificationEmailTemplate
Show Description Returns the custom email verification template for the template name you specify. For more information about custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
GetIdentityDkimAttributes
Show Description Returns the current status of Easy DKIM signing for an entity. For domain name identities, this operation also returns the DKIM tokens that are required for Easy DKIM signing, and whether Amazon SES has successfully verified that these tokens have been published. This operation takes a list of identities as input and returns the following information for each:
  • Whether Easy DKIM signing is enabled or disabled.
  • A set of DKIM tokens that represent the identity. If the identity is an email address, the tokens represent the domain of that address.
  • Whether Amazon SES has successfully verified the DKIM tokens published in the domain's DNS. This information is only returned for domain name identities, not for email addresses.
This operation is throttled at one request per second and can only get DKIM attributes for up to 100 identities at a time. For more information about creating DNS records using DKIM tokens, go to the Amazon SES Developer Guide.
GetIdentityMailFromDomainAttributes
Show Description Returns the custom MAIL FROM attributes for a list of identities (email addresses : domains). This operation is throttled at one request per second and can only get custom MAIL FROM attributes for up to 100 identities at a time.
GetIdentityNotificationAttributes
Show Description Given a list of verified identities (email addresses and/or domains), returns a structure describing identity notification attributes. This operation is throttled at one request per second and can only get notification attributes for up to 100 identities at a time. For more information about using notifications with Amazon SES, see the Amazon SES Developer Guide.
GetIdentityPolicies
Show Description Returns the requested sending authorization policies for the given identity (an email address or a domain). The policies are returned as a map of policy names to policy contents. You can retrieve a maximum of 20 policies at a time. This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
GetIdentityVerificationAttributes
Show Description Given a list of identities (email addresses and/or domains), returns the verification status and (for domain identities) the verification token for each identity. The verification status of an email address is "Pending" until the email address owner clicks the link within the verification email that Amazon SES sent to that address. If the email address owner clicks the link within 24 hours, the verification status of the email address changes to "Success". If the link is not clicked within 24 hours, the verification status changes to "Failed." In that case, if you still want to verify the email address, you must restart the verification process from the beginning. For domain identities, the domain's verification status is "Pending" as Amazon SES searches for the required TXT record in the DNS settings of the domain. When Amazon SES detects the record, the domain's verification status changes to "Success". If Amazon SES is unable to detect the record within 72 hours, the domain's verification status changes to "Failed." In that case, if you still want to verify the domain, you must restart the verification process from the beginning. This operation is throttled at one request per second and can only get verification attributes for up to 100 identities at a time.
GetSendQuota
Show Description Provides the sending limits for the Amazon SES account. You can execute this operation no more than once per second.
GetSendStatistics
Show Description Provides sending statistics for the current AWS Region. The result is a list of data points, representing the last two weeks of sending activity. Each data point in the list contains statistics for a 15-minute period of time. You can execute this operation no more than once per second.
GetTemplate
Show Description Displays the template object (which includes the Subject line, HTML part and text part) for the template you specify. You can execute this operation no more than once per second.
ListConfigurationSets
Show Description Provides a list of the configuration sets associated with your Amazon SES account in the current AWS Region. For information about using configuration sets, see Monitoring Your Amazon SES Sending Activity in the Amazon SES Developer Guide. You can execute this operation no more than once per second. This operation will return up to 1,000 configuration sets each time it is run. If your Amazon SES account has more than 1,000 configuration sets, this operation will also return a NextToken element. You can then execute the ListConfigurationSets operation again, passing the NextToken parameter and the value of the NextToken element to retrieve additional results.
ListCustomVerificationEmailTemplates
Show Description Lists the existing custom verification email templates for your account in the current AWS Region. For more information about custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
ListIdentities
Show Description Returns a list containing all of the identities (email addresses and domains) for your AWS account in the current AWS Region, regardless of verification status. You can execute this operation no more than once per second.
ListIdentityPolicies
Show Description Returns a list of sending authorization policies that are attached to the given identity (an email address or a domain). This API returns only a list. If you want the actual policy content, you can use GetIdentityPolicies. This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
ListReceiptFilters
Show Description Lists the IP address filters associated with your AWS account in the current AWS Region. For information about managing IP address filters, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
ListReceiptRuleSets
Show Description Lists the receipt rule sets that exist under your AWS account in the current AWS Region. If there are additional receipt rule sets to be retrieved, you will receive a NextToken that you can provide to the next call to ListReceiptRuleSets to retrieve the additional entries. For information about managing receipt rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
ListTemplates
Show Description Lists the email templates present in your Amazon SES account in the current AWS Region. You can execute this operation no more than once per second.
ListVerifiedEmailAddresses
Show Description Deprecated. Use the ListIdentities operation to list the email addresses and domains associated with your account.
PutConfigurationSetDeliveryOptions
Show Description Adds or updates the delivery options for a configuration set.
PutIdentityPolicy
Show Description Adds or updates a sending authorization policy for the specified identity (an email address or a domain). This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
ReorderReceiptRuleSet
Show Description Reorders the receipt rules within a receipt rule set. All of the rules in the rule set must be represented in this request. That is, this API will return an error if the reorder request doesn't explicitly position all of the rules. For information about managing receipt rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
SendBounce
Show Description Generates and sends a bounce message to the sender of an email you received through Amazon SES. You can only use this API on an email up to 24 hours after you receive it. You cannot use this API to send generic bounces for mail that was not received by Amazon SES. For information about receiving email through Amazon SES, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
SendBulkTemplatedEmail
Show Description Composes an email message to multiple destinations. The message body is created using an email template. In order to send email using the SendBulkTemplatedEmail operation, your call to the API must meet the following requirements:
  • The call must refer to an existing email template. You can create email templates using the CreateTemplate operation.
  • The message must be sent from a verified email address or domain.
  • If your account is still in the Amazon SES sandbox, you may only send to verified addresses or domains, or to email addresses associated with the Amazon SES Mailbox Simulator. For more information, see Verifying Email Addresses and Domains in the Amazon SES Developer Guide.
  • The maximum message size is 10 MB.
  • Each Destination parameter must include at least one recipient email address. The recipient address can be a To: address, a CC: address, or a BCC: address. If a recipient email address is invalid (that is, it is not in the format UserName@[SubDomain.]Domain.TopLevelDomain), the entire message will be rejected, even if the message contains other recipients that are valid.
  • The message may not include more than 50 recipients, across the To:, CC: and BCC: fields. If you need to send an email message to a larger audience, you can divide your recipient list into groups of 50 or fewer, and then call the SendBulkTemplatedEmail operation several times to send the message to each group.
  • The number of destinations you can contact in a single call to the API may be limited by your account's maximum sending rate.
SendCustomVerificationEmail
Show Description Adds an email address to the list of identities for your Amazon SES account in the current AWS Region and attempts to verify it. As a result of executing this operation, a customized verification email is sent to the specified address. To use this operation, you must first create a custom verification email template. For more information about creating and using custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
SendEmail
Show Description Composes an email message and immediately queues it for sending. In order to send email using the SendEmail operation, your message must meet the following requirements:
  • The message must be sent from a verified email address or domain. If you attempt to send email using a non-verified address or domain, the operation will result in an "Email address not verified" error.
  • If your account is still in the Amazon SES sandbox, you may only send to verified addresses or domains, or to email addresses associated with the Amazon SES Mailbox Simulator. For more information, see Verifying Email Addresses and Domains in the Amazon SES Developer Guide.
  • The maximum message size is 10 MB.
  • The message must include at least one recipient email address. The recipient address can be a To: address, a CC: address, or a BCC: address. If a recipient email address is invalid (that is, it is not in the format UserName@[SubDomain.]Domain.TopLevelDomain), the entire message will be rejected, even if the message contains other recipients that are valid.
  • The message may not include more than 50 recipients, across the To:, CC: and BCC: fields. If you need to send an email message to a larger audience, you can divide your recipient list into groups of 50 or fewer, and then call the SendEmail operation several times to send the message to each group.
For every message that you send, the total number of recipients (including each recipient in the To:, CC: and BCC: fields) is counted against the maximum number of emails you can send in a 24-hour period (your sending quota). For more information about sending quotas in Amazon SES, see Managing Your Amazon SES Sending Limits in the Amazon SES Developer Guide.
SendRawEmail
Show Description Composes an email message and immediately queues it for sending. This operation is more flexible than the SendEmail API operation. When you use the SendRawEmail operation, you can specify the headers of the message as well as its content. This flexibility is useful, for example, when you want to send a multipart MIME email (such a message that contains both a text and an HTML version). You can also use this operation to send messages that include attachments. The SendRawEmail operation has the following requirements:
  • You can only send email from verified email addresses or domains. If you try to send email from an address that isn't verified, the operation results in an "Email address not verified" error.
  • If your account is still in the Amazon SES sandbox, you can only send email to other verified addresses in your account, or to addresses that are associated with the Amazon SES mailbox simulator.
  • The maximum message size, including attachments, is 10 MB.
  • Each message has to include at least one recipient address. A recipient address includes any address on the To:, CC:, or BCC: lines.
  • If you send a single message to more than one recipient address, and one of the recipient addresses isn't in a valid format (that is, it's not in the format UserName@[SubDomain.]Domain.TopLevelDomain), Amazon SES rejects the entire message, even if the other addresses are valid.
  • Each message can include up to 50 recipient addresses across the To:, CC:, or BCC: lines. If you need to send a single message to more than 50 recipients, you have to split the list of recipient addresses into groups of less than 50 recipients, and send separate messages to each group.
  • Amazon SES allows you to specify 8-bit Content-Transfer-Encoding for MIME message parts. However, if Amazon SES has to modify the contents of your message (for example, if you use open and click tracking), 8-bit content isn't preserved. For this reason, we highly recommend that you encode all content that isn't 7-bit ASCII. For more information, see MIME Encoding in the Amazon SES Developer Guide.
Additionally, keep the following considerations in mind when using the SendRawEmail operation:
  • Although you can customize the message headers when using the SendRawEmail operation, Amazon SES will automatically apply its own Message-ID and Date headers; if you passed these headers when creating the message, they will be overwritten by the values that Amazon SES provides.
  • If you are using sending authorization to send on behalf of another user, SendRawEmail enables you to specify the cross-account identity for the email's Source, From, and Return-Path parameters in one of two ways: you can pass optional parameters SourceArn, FromArn, and/or ReturnPathArn to the API, or you can include the following X-headers in the header of your raw email:
    • X-SES-SOURCE-ARN
    • X-SES-FROM-ARN
    • X-SES-RETURN-PATH-ARN
    Don't include these X-headers in the DKIM signature. Amazon SES removes these before it sends the email. If you only specify the SourceIdentityArn parameter, Amazon SES sets the From and Return-Path addresses to the same identity that you specified. For more information about sending authorization, see the Using Sending Authorization with Amazon SES in the Amazon SES Developer Guide.
  • For every message that you send, the total number of recipients (including each recipient in the To:, CC: and BCC: fields) is counted against the maximum number of emails you can send in a 24-hour period (your sending quota). For more information about sending quotas in Amazon SES, see Managing Your Amazon SES Sending Limits in the Amazon SES Developer Guide.
SendTemplatedEmail
Show Description Composes an email message using an email template and immediately queues it for sending. In order to send email using the SendTemplatedEmail operation, your call to the API must meet the following requirements:
  • The call must refer to an existing email template. You can create email templates using the CreateTemplate operation.
  • The message must be sent from a verified email address or domain.
  • If your account is still in the Amazon SES sandbox, you may only send to verified addresses or domains, or to email addresses associated with the Amazon SES Mailbox Simulator. For more information, see Verifying Email Addresses and Domains in the Amazon SES Developer Guide.
  • The maximum message size is 10 MB.
  • Calls to the SendTemplatedEmail operation may only include one Destination parameter. A destination is a set of recipients who will receive the same version of the email. The Destination parameter can include up to 50 recipients, across the To:, CC: and BCC: fields.
  • The Destination parameter must include at least one recipient email address. The recipient address can be a To: address, a CC: address, or a BCC: address. If a recipient email address is invalid (that is, it is not in the format UserName@[SubDomain.]Domain.TopLevelDomain), the entire message will be rejected, even if the message contains other recipients that are valid.
If your call to the SendTemplatedEmail operation includes all of the required parameters, Amazon SES accepts it and returns a Message ID. However, if Amazon SES can't render the email because the template contains errors, it doesn't send the email. Additionally, because it already accepted the message, Amazon SES doesn't return a message stating that it was unable to send the email. For these reasons, we highly recommend that you set up Amazon SES to send you notifications when Rendering Failure events occur. For more information, see Sending Personalized Email Using the Amazon SES API in the Amazon Simple Email Service Developer Guide.
SetActiveReceiptRuleSet
Show Description Sets the specified receipt rule set as the active receipt rule set. To disable your email-receiving through Amazon SES completely, you can call this API with RuleSetName set to null. For information about managing receipt rule sets, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
SetIdentityDkimEnabled
Show Description Enables or disables Easy DKIM signing of email sent from an identity. If Easy DKIM signing is enabled for a domain, then Amazon SES uses DKIM to sign all email that it sends from addresses on that domain. If Easy DKIM signing is enabled for an email address, then Amazon SES uses DKIM to sign all email it sends from that address. For email addresses (for example, user@example.com), you can only enable DKIM signing if the corresponding domain (in this case, example.com) has been set up to use Easy DKIM. You can enable DKIM signing for an identity at any time after you start the verification process for the identity, even if the verification process isn't complete. You can execute this operation no more than once per second. For more information about Easy DKIM signing, go to the Amazon SES Developer Guide.
SetIdentityFeedbackForwardingEnabled
Show Description Given an identity (an email address or a domain), enables or disables whether Amazon SES forwards bounce and complaint notifications as email. Feedback forwarding can only be disabled when Amazon Simple Notification Service (Amazon SNS) topics are specified for both bounces and complaints. Feedback forwarding does not apply to delivery notifications. Delivery notifications are only available through Amazon SNS. You can execute this operation no more than once per second. For more information about using notifications with Amazon SES, see the Amazon SES Developer Guide.
SetIdentityHeadersInNotificationsEnabled
Show Description Given an identity (an email address or a domain), sets whether Amazon SES includes the original email headers in the Amazon Simple Notification Service (Amazon SNS) notifications of a specified type. You can execute this operation no more than once per second. For more information about using notifications with Amazon SES, see the Amazon SES Developer Guide.
SetIdentityMailFromDomain
Show Description Enables or disables the custom MAIL FROM domain setup for a verified identity (an email address or a domain). To send emails using the specified MAIL FROM domain, you must add an MX record to your MAIL FROM domain's DNS settings. If you want your emails to pass Sender Policy Framework (SPF) checks, you must also add or update an SPF record. For more information, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
SetIdentityNotificationTopic
Show Description Sets an Amazon Simple Notification Service (Amazon SNS) topic to use when delivering notifications. When you use this operation, you specify a verified identity, such as an email address or domain. When you send an email that uses the chosen identity in the Source field, Amazon SES sends notifications to the topic you specified. You can send bounce, complaint, or delivery notifications (or any combination of the three) to the Amazon SNS topic that you specify. You can execute this operation no more than once per second. For more information about feedback notification, see the Amazon SES Developer Guide.
SetReceiptRulePosition
Show Description Sets the position of the specified receipt rule in the receipt rule set. For information about managing receipt rules, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
TestRenderTemplate
Show Description Creates a preview of the MIME content of an email when provided with a template and a set of replacement data. You can execute this operation no more than once per second.
UpdateAccountSendingEnabled
UpdateConfigurationSetEventDestination
Show Description Updates the event destination of a configuration set. Event destinations are associated with configuration sets, which enable you to publish email sending events to Amazon CloudWatch, Amazon Kinesis Firehose, or Amazon Simple Notification Service (Amazon SNS). For information about using configuration sets, see Monitoring Your Amazon SES Sending Activity in the Amazon SES Developer Guide. When you create or update an event destination, you must provide one, and only one, destination. The destination can be Amazon CloudWatch, Amazon Kinesis Firehose, or Amazon Simple Notification Service (Amazon SNS). You can execute this operation no more than once per second.
UpdateConfigurationSetReputationMetricsEnabled
UpdateConfigurationSetSendingEnabled
UpdateConfigurationSetTrackingOptions
Show Description Modifies an association between a configuration set and a custom domain for open and click event tracking. By default, images and links used for tracking open and click events are hosted on domains operated by Amazon SES. You can configure a subdomain of your own to handle these events. For information about using custom domains, see the Amazon SES Developer Guide.
UpdateCustomVerificationEmailTemplate
UpdateReceiptRule
Show Description Updates a receipt rule. For information about managing receipt rules, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
UpdateTemplate
Show Description Updates an email template. Email templates enable you to send personalized email to one or more destinations in a single API operation. For more information, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
VerifyDomainDkim
Show Description Returns a set of DKIM tokens for a domain identity. When you execute the VerifyDomainDkim operation, the domain that you specify is added to the list of identities that are associated with your account. This is true even if you haven't already associated the domain with your account by using the VerifyDomainIdentity operation. However, you can't send email from the domain until you either successfully verify it or you successfully set up DKIM for it. You use the tokens that are generated by this operation to create CNAME records. When Amazon SES detects that you've added these records to the DNS configuration for a domain, you can start sending email from that domain. You can start sending email even if you haven't added the TXT record provided by the VerifyDomainIdentity operation to the DNS configuration for your domain. All email that you send from the domain is authenticated using DKIM. To create the CNAME records for DKIM authentication, use the following values:
  • Name: token._domainkey.example.com
  • Type: CNAME
  • Value: token.dkim.amazonses.com
In the preceding example, replace token with one of the tokens that are generated when you execute this operation. Replace example.com with your domain. Repeat this process for each token that's generated by this operation. You can execute this operation no more than once per second.
VerifyDomainIdentity
Show Description Adds a domain to the list of identities for your Amazon SES account in the current AWS Region and attempts to verify it. For more information about verifying domains, see Verifying Email Addresses and Domains in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
VerifyEmailAddress
## Sesv2 Events
Service Event Name Description
sesv2 CreateConfigurationSet
Show Description Create a configuration set. Configuration sets are groups of rules that you can apply to the emails that you send. You apply a configuration set to an email by specifying the name of the configuration set when you call the Amazon SES API v2. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
CreateConfigurationSetEventDestination
Show Description Create an event destination. Events include message sends, deliveries, opens, clicks, bounces, and complaints. Event destinations are places that you can send information about these events to. For example, you can send event data to Amazon SNS to receive notifications when you receive bounces or complaints, or you can use Amazon Kinesis Data Firehose to stream data to Amazon S3 for long-term storage. A single configuration set can include more than one event destination.
CreateContact
Show Description Creates a contact, which is an end-user who is receiving the email, and adds them to a contact list.
CreateContactList
Show Description Creates a contact list.
CreateCustomVerificationEmailTemplate
Show Description Creates a new custom verification email template. For more information about custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateDedicatedIpPool
Show Description Create a new pool of dedicated IP addresses. A pool can include one or more dedicated IP addresses that are associated with your Amazon Web Services account. You can associate a pool with a configuration set. When you send an email that uses that configuration set, the message is sent from one of the addresses in the associated pool.
CreateDeliverabilityTestReport
Show Description Create a new predictive inbox placement test. Predictive inbox placement tests can help you predict how your messages will be handled by various email providers around the world. When you perform a predictive inbox placement test, you provide a sample message that contains the content that you plan to send to your customers. Amazon SES then sends that message to special email addresses spread across several major email providers. After about 24 hours, the test is complete, and you can use the GetDeliverabilityTestReport operation to view the results of the test.
CreateEmailIdentity
Show Description Starts the process of verifying an email identity. An identity is an email address or domain that you use when you send email. Before you can use an identity to send email, you first have to verify it. By verifying an identity, you demonstrate that you're the owner of the identity, and that you've given Amazon SES API v2 permission to send email from the identity. When you verify an email address, Amazon SES sends an email to the address. Your email address is verified as soon as you follow the link in the verification email. When you verify a domain without specifying the DkimSigningAttributes object, this operation provides a set of DKIM tokens. You can convert these tokens into CNAME records, which you then add to the DNS configuration for your domain. Your domain is verified when Amazon SES detects these records in the DNS configuration for your domain. This verification method is known as Easy DKIM. Alternatively, you can perform the verification process by providing your own public-private key pair. This verification method is known as Bring Your Own DKIM (BYODKIM). To use BYODKIM, your call to the CreateEmailIdentity operation has to include the DkimSigningAttributes object. When you specify this object, you provide a selector (a component of the DNS record name that identifies the public key to use for DKIM authentication) and a private key. When you verify a domain, this operation provides a set of DKIM tokens, which you can convert into CNAME tokens. You add these CNAME tokens to the DNS configuration for your domain. Your domain is verified when Amazon SES detects these records in the DNS configuration for your domain. For some DNS providers, it can take 72 hours or more to complete the domain verification process. Additionally, you can associate an existing configuration set with the email identity that you're verifying.
CreateEmailIdentityPolicy
Show Description Creates the specified sending authorization policy for the given identity (an email address or a domain). This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateEmailTemplate
Show Description Creates an email template. Email templates enable you to send personalized email to one or more destinations in a single API operation. For more information, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
CreateImportJob
Show Description Creates an import job for a data destination.
DeleteConfigurationSet
Show Description Delete an existing configuration set. Configuration sets are groups of rules that you can apply to the emails you send. You apply a configuration set to an email by including a reference to the configuration set in the headers of the email. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
DeleteConfigurationSetEventDestination
Show Description Delete an event destination. Events include message sends, deliveries, opens, clicks, bounces, and complaints. Event destinations are places that you can send information about these events to. For example, you can send event data to Amazon SNS to receive notifications when you receive bounces or complaints, or you can use Amazon Kinesis Data Firehose to stream data to Amazon S3 for long-term storage.
DeleteContact
Show Description Removes a contact from a contact list.
DeleteContactList
Show Description Deletes a contact list and all of the contacts on that list.
DeleteCustomVerificationEmailTemplate
Show Description Deletes an existing custom verification email template. For more information about custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteDedicatedIpPool
Show Description Delete a dedicated IP pool.
DeleteEmailIdentity
Show Description Deletes an email identity. An identity can be either an email address or a domain name.
DeleteEmailIdentityPolicy
Show Description Deletes the specified sending authorization policy for the given identity (an email address or a domain). This API returns successfully even if a policy with the specified name does not exist. This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
DeleteEmailTemplate
Show Description Deletes an email template. You can execute this operation no more than once per second.
DeleteSuppressedDestination
Show Description Removes an email address from the suppression list for your account.
GetAccount
Show Description Obtain information about the email-sending status and capabilities of your Amazon SES account in the current Amazon Web Services Region.
GetBlacklistReports
Show Description Retrieve a list of the blacklists that your dedicated IP addresses appear on.
GetConfigurationSet
Show Description Get information about an existing configuration set, including the dedicated IP pool that it's associated with, whether or not it's enabled for sending email, and more. Configuration sets are groups of rules that you can apply to the emails you send. You apply a configuration set to an email by including a reference to the configuration set in the headers of the email. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
GetConfigurationSetEventDestinations
Show Description Retrieve a list of event destinations that are associated with a configuration set. Events include message sends, deliveries, opens, clicks, bounces, and complaints. Event destinations are places that you can send information about these events to. For example, you can send event data to Amazon SNS to receive notifications when you receive bounces or complaints, or you can use Amazon Kinesis Data Firehose to stream data to Amazon S3 for long-term storage.
GetContact
Show Description Returns a contact from a contact list.
GetContactList
Show Description Returns contact list metadata. It does not return any information about the contacts present in the list.
GetCustomVerificationEmailTemplate
Show Description Returns the custom email verification template for the template name you specify. For more information about custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
GetDedicatedIp
Show Description Get information about a dedicated IP address, including the name of the dedicated IP pool that it's associated with, as well information about the automatic warm-up process for the address.
GetDedicatedIps
Show Description List the dedicated IP addresses that are associated with your Amazon Web Services account.
GetDeliverabilityDashboardOptions
Show Description Retrieve information about the status of the Deliverability dashboard for your account. When the Deliverability dashboard is enabled, you gain access to reputation, deliverability, and other metrics for the domains that you use to send email. You also gain the ability to perform predictive inbox placement tests. When you use the Deliverability dashboard, you pay a monthly subscription charge, in addition to any other fees that you accrue by using Amazon SES and other Amazon Web Services services. For more information about the features and cost of a Deliverability dashboard subscription, see Amazon SES Pricing.
GetDeliverabilityTestReport
Show Description Retrieve the results of a predictive inbox placement test.
GetDomainDeliverabilityCampaign
Show Description Retrieve all the deliverability data for a specific campaign. This data is available for a campaign only if the campaign sent email by using a domain that the Deliverability dashboard is enabled for.
GetDomainStatisticsReport
Show Description Retrieve inbox placement and engagement rates for the domains that you use to send email.
GetEmailIdentity
Show Description Provides information about a specific identity, including the identity's verification status, sending authorization policies, its DKIM authentication status, and its custom Mail-From settings.
GetEmailIdentityPolicies
Show Description Returns the requested sending authorization policies for the given identity (an email address or a domain). The policies are returned as a map of policy names to policy contents. You can retrieve a maximum of 20 policies at a time. This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
GetEmailTemplate
Show Description Displays the template object (which includes the subject line, HTML part and text part) for the template you specify. You can execute this operation no more than once per second.
GetImportJob
Show Description Provides information about an import job.
GetSuppressedDestination
Show Description Retrieves information about a specific email address that's on the suppression list for your account.
ListConfigurationSets
Show Description List all of the configuration sets associated with your account in the current region. Configuration sets are groups of rules that you can apply to the emails you send. You apply a configuration set to an email by including a reference to the configuration set in the headers of the email. When you apply a configuration set to an email, all of the rules in that configuration set are applied to the email.
ListContactLists
Show Description Lists all of the contact lists available.
ListContacts
Show Description Lists the contacts present in a specific contact list.
ListCustomVerificationEmailTemplates
Show Description Lists the existing custom verification email templates for your account in the current Amazon Web Services Region. For more information about custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
ListDedicatedIpPools
Show Description List all of the dedicated IP pools that exist in your Amazon Web Services account in the current Region.
ListDeliverabilityTestReports
Show Description Show a list of the predictive inbox placement tests that you've performed, regardless of their statuses. For predictive inbox placement tests that are complete, you can use the GetDeliverabilityTestReport operation to view the results.
ListDomainDeliverabilityCampaigns
Show Description Retrieve deliverability data for all the campaigns that used a specific domain to send email during a specified time range. This data is available for a domain only if you enabled the Deliverability dashboard for the domain.
ListEmailIdentities
Show Description Returns a list of all of the email identities that are associated with your Amazon Web Services account. An identity can be either an email address or a domain. This operation returns identities that are verified as well as those that aren't. This operation returns identities that are associated with Amazon SES and Amazon Pinpoint.
ListEmailTemplates
Show Description Lists the email templates present in your Amazon SES account in the current Amazon Web Services Region. You can execute this operation no more than once per second.
ListImportJobs
Show Description Lists all of the import jobs.
ListSuppressedDestinations
Show Description Retrieves a list of email addresses that are on the suppression list for your account.
ListTagsForResource
Show Description Retrieve a list of the tags (keys and values) that are associated with a specified resource. A tag is a label that you optionally define and associate with a resource. Each tag consists of a required tag key and an optional associated tag value. A tag key is a general label that acts as a category for more specific tag values. A tag value acts as a descriptor within a tag key.
PutAccountDedicatedIpWarmupAttributes
Show Description Enable or disable the automatic warm-up feature for dedicated IP addresses.
PutAccountDetails
Show Description Update your Amazon SES account details.
PutAccountSendingAttributes
Show Description Enable or disable the ability of your account to send email.
PutAccountSuppressionAttributes
Show Description Change the settings for the account-level suppression list.
PutConfigurationSetDeliveryOptions
Show Description Associate a configuration set with a dedicated IP pool. You can use dedicated IP pools to create groups of dedicated IP addresses for sending specific types of email.
PutConfigurationSetReputationOptions
Show Description Enable or disable collection of reputation metrics for emails that you send using a particular configuration set in a specific Amazon Web Services Region.
PutConfigurationSetSendingOptions
Show Description Enable or disable email sending for messages that use a particular configuration set in a specific Amazon Web Services Region.
PutConfigurationSetSuppressionOptions
Show Description Specify the account suppression list preferences for a configuration set.
PutConfigurationSetTrackingOptions
Show Description Specify a custom domain to use for open and click tracking elements in email that you send.
PutDedicatedIpInPool
Show Description Move a dedicated IP address to an existing dedicated IP pool. The dedicated IP address that you specify must already exist, and must be associated with your Amazon Web Services account. The dedicated IP pool you specify must already exist. You can create a new pool by using the CreateDedicatedIpPool operation.
PutDedicatedIpWarmupAttributes
Show Description

PutDeliverabilityDashboardOption
Show Description Enable or disable the Deliverability dashboard. When you enable the Deliverability dashboard, you gain access to reputation, deliverability, and other metrics for the domains that you use to send email. You also gain the ability to perform predictive inbox placement tests. When you use the Deliverability dashboard, you pay a monthly subscription charge, in addition to any other fees that you accrue by using Amazon SES and other Amazon Web Services services. For more information about the features and cost of a Deliverability dashboard subscription, see Amazon SES Pricing.
PutEmailIdentityConfigurationSetAttributes
Show Description Used to associate a configuration set with an email identity.
PutEmailIdentityDkimAttributes
Show Description Used to enable or disable DKIM authentication for an email identity.
PutEmailIdentityDkimSigningAttributes
Show Description Used to configure or change the DKIM authentication settings for an email domain identity. You can use this operation to do any of the following:
  • Update the signing attributes for an identity that uses Bring Your Own DKIM (BYODKIM).
  • Update the key length that should be used for Easy DKIM.
  • Change from using no DKIM authentication to using Easy DKIM.
  • Change from using no DKIM authentication to using BYODKIM.
  • Change from using Easy DKIM to using BYODKIM.
  • Change from using BYODKIM to using Easy DKIM.
PutEmailIdentityFeedbackAttributes
Show Description Used to enable or disable feedback forwarding for an identity. This setting determines what happens when an identity is used to send an email that results in a bounce or complaint event. If the value is true, you receive email notifications when bounce or complaint events occur. These notifications are sent to the address that you specified in the Return-Path header of the original email. You're required to have a method of tracking bounces and complaints. If you haven't set up another mechanism for receiving bounce or complaint notifications (for example, by setting up an event destination), you receive an email notification when these events occur (even if this setting is disabled).
PutEmailIdentityMailFromAttributes
Show Description Used to enable or disable the custom Mail-From domain configuration for an email identity.
PutSuppressedDestination
Show Description Adds an email address to the suppression list for your account.
SendBulkEmail
Show Description Composes an email message to multiple destinations.
SendCustomVerificationEmail
Show Description Adds an email address to the list of identities for your Amazon SES account in the current Amazon Web Services Region and attempts to verify it. As a result of executing this operation, a customized verification email is sent to the specified address. To use this operation, you must first create a custom verification email template. For more information about creating and using custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
SendEmail
Show Description Sends an email message. You can use the Amazon SES API v2 to send the following types of messages:
  • Simple – A standard email message. When you create this type of message, you specify the sender, the recipient, and the message body, and Amazon SES assembles the message for you.
  • Raw – A raw, MIME-formatted email message. When you send this type of email, you have to specify all of the message headers, as well as the message body. You can use this message type to send messages that contain attachments. The message that you specify has to be a valid MIME message.
  • Templated – A message that contains personalization tags. When you send this type of email, Amazon SES API v2 automatically replaces the tags with values that you specify.
TagResource
Show Description Add one or more tags (keys and values) to a specified resource. A tag is a label that you optionally define and associate with a resource. Tags can help you categorize and manage resources in different ways, such as by purpose, owner, environment, or other criteria. A resource can have as many as 50 tags. Each tag consists of a required tag key and an associated tag value, both of which you define. A tag key is a general label that acts as a category for more specific tag values. A tag value acts as a descriptor within a tag key.
TestRenderEmailTemplate
Show Description Creates a preview of the MIME content of an email when provided with a template and a set of replacement data. You can execute this operation no more than once per second.
UntagResource
Show Description Remove one or more tags (keys and values) from a specified resource.
UpdateConfigurationSetEventDestination
Show Description Update the configuration of an event destination for a configuration set. Events include message sends, deliveries, opens, clicks, bounces, and complaints. Event destinations are places that you can send information about these events to. For example, you can send event data to Amazon SNS to receive notifications when you receive bounces or complaints, or you can use Amazon Kinesis Data Firehose to stream data to Amazon S3 for long-term storage.
UpdateContact
Show Description Updates a contact's preferences for a list. It is not necessary to specify all existing topic preferences in the TopicPreferences object, just the ones that need updating.
UpdateContactList
Show Description Updates contact list metadata. This operation does a complete replacement.
UpdateCustomVerificationEmailTemplate
Show Description Updates an existing custom verification email template. For more information about custom verification email templates, see Using Custom Verification Email Templates in the Amazon SES Developer Guide. You can execute this operation no more than once per second.
UpdateEmailIdentityPolicy
Show Description Updates the specified sending authorization policy for the given identity (an email address or a domain). This API returns successfully even if a policy with the specified name does not exist. This API is for the identity owner only. If you have not verified the identity, this API will return an error. Sending authorization is a feature that enables an identity owner to authorize other senders to use its identities. For information about using sending authorization, see the Amazon SES Developer Guide. You can execute this operation no more than once per second.
## Shield Events
Service Event Name Description
shield AssociateDRTLogBucket
Show Description Authorizes the Shield Response Team (SRT) to access the specified Amazon S3 bucket containing log data such as Application Load Balancer access logs, CloudFront logs, or logs from third party sources. You can associate up to 10 Amazon S3 buckets with your subscription. To use the services of the SRT and make an AssociateDRTLogBucket request, you must be subscribed to the Business Support plan or the Enterprise Support plan.
AssociateDRTRole
Show Description Authorizes the Shield Response Team (SRT) using the specified role, to access your Amazon Web Services account to assist with DDoS attack mitigation during potential attacks. This enables the SRT to inspect your WAF configuration and create or update WAF rules and web ACLs. You can associate only one RoleArn with your subscription. If you submit an AssociateDRTRole request for an account that already has an associated role, the new RoleArn will replace the existing RoleArn. Prior to making the AssociateDRTRole request, you must attach the AWSShieldDRTAccessPolicy managed policy to the role you will specify in the request. For more information see Attaching and Detaching IAM Policies. The role must also trust the service principal drt.shield.amazonaws.com. For more information, see IAM JSON Policy Elements: Principal. The SRT will have access only to your WAF and Shield resources. By submitting this request, you authorize the SRT to inspect your WAF and Shield configuration and create and update WAF rules and web ACLs on your behalf. The SRT takes these actions only if explicitly authorized by you. You must have the iam:PassRole permission to make an AssociateDRTRole request. For more information, see Granting a User Permissions to Pass a Role to an Amazon Web Services Service. To use the services of the SRT and make an AssociateDRTRole request, you must be subscribed to the Business Support plan or the Enterprise Support plan.
AssociateHealthCheck
Show Description Adds health-based detection to the Shield Advanced protection for a resource. Shield Advanced health-based detection uses the health of your Amazon Web Services resource to improve responsiveness and accuracy in attack detection and mitigation. You define the health check in Route 53 and then associate it with your Shield Advanced protection. For more information, see Shield Advanced Health-Based Detection in the WAF Developer Guide.
AssociateProactiveEngagementDetails
Show Description Initializes proactive engagement and sets the list of contacts for the Shield Response Team (SRT) to use. You must provide at least one phone number in the emergency contact list. After you have initialized proactive engagement using this call, to disable or enable proactive engagement, use the calls DisableProactiveEngagement and EnableProactiveEngagement. This call defines the list of email addresses and phone numbers that the SRT can use to contact you for escalations to the SRT and to initiate proactive customer support. The contacts that you provide in the request replace any contacts that were already defined. If you already have contacts defined and want to use them, retrieve the list using DescribeEmergencyContactSettings and then provide it to this call.
CreateProtection
Show Description Enables Shield Advanced for a specific Amazon Web Services resource. The resource can be an Amazon CloudFront distribution, Elastic Load Balancing load balancer, Global Accelerator accelerator, Elastic IP Address, or an Amazon Route 53 hosted zone. You can add protection to only a single resource with each CreateProtection request. If you want to add protection to multiple resources at once, use the WAF console. For more information see Getting Started with Shield Advanced and Add Shield Advanced Protection to more Amazon Web Services Resources.
CreateProtectionGroup
Show Description Creates a grouping of protected resources so they can be handled as a collective. This resource grouping improves the accuracy of detection and reduces false positives.
CreateSubscription
Show Description Activates Shield Advanced for an account. When you initally create a subscription, your subscription is set to be automatically renewed at the end of the existing subscription period. You can change this by submitting an UpdateSubscription request.
DeleteProtection
Show Description Deletes an Shield Advanced Protection.
DeleteProtectionGroup
Show Description Removes the specified protection group.
DeleteSubscription
Show Description Removes Shield Advanced from an account. Shield Advanced requires a 1-year subscription commitment. You cannot delete a subscription prior to the completion of that commitment.
DescribeAttack
Show Description Describes the details of a DDoS attack.
DescribeAttackStatistics
Show Description Provides information about the number and type of attacks Shield has detected in the last year for all resources that belong to your account, regardless of whether you've defined Shield protections for them. This operation is available to Shield customers as well as to Shield Advanced customers. The operation returns data for the time range of midnight UTC, one year ago, to midnight UTC, today. For example, if the current time is 2020-10-26 15:39:32 PDT, equal to 2020-10-26 22:39:32 UTC, then the time range for the attack data returned is from 2019-10-26 00:00:00 UTC to 2020-10-26 00:00:00 UTC. The time range indicates the period covered by the attack statistics data items.
DescribeDRTAccess
Show Description Returns the current role and list of Amazon S3 log buckets used by the Shield Response Team (SRT) to access your Amazon Web Services account while assisting with attack mitigation.
DescribeEmergencyContactSettings
Show Description A list of email addresses and phone numbers that the Shield Response Team (SRT) can use to contact you if you have proactive engagement enabled, for escalations to the SRT and to initiate proactive customer support.
DescribeProtection
Show Description Lists the details of a Protection object.
DescribeProtectionGroup
Show Description Returns the specification for the specified protection group.
DescribeSubscription
Show Description Provides details about the Shield Advanced subscription for an account.
DisableProactiveEngagement
Show Description Removes authorization from the Shield Response Team (SRT) to notify contacts about escalations to the SRT and to initiate proactive customer support.
DisassociateDRTLogBucket
Show Description Removes the Shield Response Team's (SRT) access to the specified Amazon S3 bucket containing the logs that you shared previously. To make a DisassociateDRTLogBucket request, you must be subscribed to the Business Support plan or the Enterprise Support plan. However, if you are not subscribed to one of these support plans, but had been previously and had granted the SRT access to your account, you can submit a DisassociateDRTLogBucket request to remove this access.
DisassociateDRTRole
Show Description Removes the Shield Response Team's (SRT) access to your Amazon Web Services account. To make a DisassociateDRTRole request, you must be subscribed to the Business Support plan or the Enterprise Support plan. However, if you are not subscribed to one of these support plans, but had been previously and had granted the SRT access to your account, you can submit a DisassociateDRTRole request to remove this access.
DisassociateHealthCheck
Show Description Removes health-based detection from the Shield Advanced protection for a resource. Shield Advanced health-based detection uses the health of your Amazon Web Services resource to improve responsiveness and accuracy in attack detection and mitigation. You define the health check in Route 53 and then associate or disassociate it with your Shield Advanced protection. For more information, see Shield Advanced Health-Based Detection in the WAF Developer Guide.
EnableProactiveEngagement
Show Description Authorizes the Shield Response Team (SRT) to use email and phone to notify contacts about escalations to the SRT and to initiate proactive customer support.
GetSubscriptionState
Show Description Returns the SubscriptionState, either Active or Inactive.
ListAttacks
Show Description Returns all ongoing DDoS attacks or all DDoS attacks during a specified time period.
ListProtectionGroups
Show Description Retrieves the ProtectionGroup objects for the account.
ListProtections
Show Description Lists all Protection objects for the account.
ListResourcesInProtectionGroup
Show Description Retrieves the resources that are included in the protection group.
ListTagsForResource
Show Description Gets information about Amazon Web Services tags for a specified Amazon Resource Name (ARN) in Shield.
TagResource
Show Description Adds or updates tags for a resource in Shield.
UntagResource
Show Description Removes tags from a resource in Shield.
UpdateEmergencyContactSettings
Show Description Updates the details of the list of email addresses and phone numbers that the Shield Response Team (SRT) can use to contact you if you have proactive engagement enabled, for escalations to the SRT and to initiate proactive customer support.
UpdateProtectionGroup
Show Description Updates an existing protection group. A protection group is a grouping of protected resources so they can be handled as a collective. This resource grouping improves the accuracy of detection and reduces false positives.
## Signer Events
Service Event Name Description
signer AddProfilePermission
Show Description Adds cross-account permissions to a signing profile.
CancelSigningProfile
DescribeSigningJob
Show Description Returns information about a specific code signing job. You specify the job by using the jobId value that is returned by the StartSigningJob operation.
GetSigningPlatform
Show Description Returns information on a specific signing platform.
GetSigningProfile
Show Description Returns information on a specific signing profile.
ListProfilePermissions
Show Description Lists the cross-account permissions associated with a signing profile.
ListSigningJobs
Show Description Lists all your signing jobs. You can use the maxResults parameter to limit the number of signing jobs that are returned in the response. If additional jobs remain to be listed, code signing returns a nextToken value. Use this value in subsequent calls to ListSigningJobs to fetch the remaining values. You can continue calling ListSigningJobs with your maxResults parameter and with new values that code signing returns in the nextToken parameter until all of your signing jobs have been returned.
ListSigningPlatforms
Show Description Lists all signing platforms available in code signing that match the request parameters. If additional jobs remain to be listed, code signing returns a nextToken value. Use this value in subsequent calls to ListSigningJobs to fetch the remaining values. You can continue calling ListSigningJobs with your maxResults parameter and with new values that code signing returns in the nextToken parameter until all of your signing jobs have been returned.
ListSigningProfiles
Show Description Lists all available signing profiles in your AWS account. Returns only profiles with an ACTIVE status unless the includeCanceled request field is set to true. If additional jobs remain to be listed, code signing returns a nextToken value. Use this value in subsequent calls to ListSigningJobs to fetch the remaining values. You can continue calling ListSigningJobs with your maxResults parameter and with new values that code signing returns in the nextToken parameter until all of your signing jobs have been returned.
ListTagsForResource
Show Description Returns a list of the tags associated with a signing profile resource.
PutSigningProfile
Show Description Creates a signing profile. A signing profile is a code signing template that can be used to carry out a pre-defined signing job. For more information, see http://docs.aws.amazon.com/signer/latest/developerguide/gs-profile.html
RemoveProfilePermission
Show Description Removes cross-account permissions from a signing profile.
RevokeSignature
RevokeSigningProfile
StartSigningJob
Show Description Initiates a signing job to be performed on the code provided. Signing jobs are viewable by the ListSigningJobs operation for two years after they are performed. Note the following requirements:
  • You must create an Amazon S3 source bucket. For more information, see Create a Bucket in the Amazon S3 Getting Started Guide.
  • Your S3 source bucket must be version enabled.
  • You must create an S3 destination bucket. Code signing uses your S3 destination bucket to write your signed code.
  • You specify the name of the source and destination buckets when calling the StartSigningJob operation.
  • You must also specify a request token that identifies your request to code signing.
You can call the DescribeSigningJob and the ListSigningJobs actions after you call StartSigningJob. For a Java example that shows how to use this action, see http://docs.aws.amazon.com/acm/latest/userguide/
TagResource
Show Description Adds one or more tags to a signing profile. Tags are labels that you can use to identify and organize your AWS resources. Each tag consists of a key and an optional value. To specify the signing profile, use its Amazon Resource Name (ARN). To specify the tag, use a key-value pair.
## Sms-voice Events
Service Event Name Description
sms-voice CreateConfigurationSet
Show Description Create a new configuration set. After you create the configuration set, you can add one or more event destinations to it.
CreateConfigurationSetEventDestination
Show Description Create a new event destination in a configuration set.
DeleteConfigurationSet
Show Description Deletes an existing configuration set.
DeleteConfigurationSetEventDestination
Show Description Deletes an event destination in a configuration set.
GetConfigurationSetEventDestinations
Show Description Obtain information about an event destination, including the types of events it reports, the Amazon Resource Name (ARN) of the destination, and the name of the event destination.
ListConfigurationSets
Show Description List all of the configuration sets associated with your Amazon Pinpoint account in the current region.
SendVoiceMessage
Show Description Create a new voice message and send it to a recipient's phone number.
## Sms Events
Service Event Name Description
sms CreateApp
Show Description Creates an application. An application consists of one or more server groups. Each server group contain one or more servers.
CreateReplicationJob
Show Description Creates a replication job. The replication job schedules periodic replication runs to replicate your server to AWS. Each replication run creates an Amazon Machine Image (AMI).
DeleteApp
Show Description Deletes the specified application. Optionally deletes the launched stack associated with the application and all AWS SMS replication jobs for servers in the application.
DeleteAppLaunchConfiguration
Show Description Deletes the launch configuration for the specified application.
DeleteAppReplicationConfiguration
Show Description Deletes the replication configuration for the specified application.
DeleteAppValidationConfiguration
Show Description Deletes the validation configuration for the specified application.
DeleteReplicationJob
Show Description Deletes the specified replication job. After you delete a replication job, there are no further replication runs. AWS deletes the contents of the Amazon S3 bucket used to store AWS SMS artifacts. The AMIs created by the replication runs are not deleted.
DeleteServerCatalog
Show Description Deletes all servers from your server catalog.
DisassociateConnector
Show Description Disassociates the specified connector from AWS SMS. After you disassociate a connector, it is no longer available to support replication jobs.
GenerateChangeSet
Show Description Generates a target change set for a currently launched stack and writes it to an Amazon S3 object in the customer’s Amazon S3 bucket.
GenerateTemplate
Show Description Generates an AWS CloudFormation template based on the current launch configuration and writes it to an Amazon S3 object in the customer’s Amazon S3 bucket.
GetApp
Show Description Retrieve information about the specified application.
GetAppLaunchConfiguration
Show Description Retrieves the application launch configuration associated with the specified application.
GetAppReplicationConfiguration
Show Description Retrieves the application replication configuration associated with the specified application.
GetAppValidationConfiguration
Show Description Retrieves information about a configuration for validating an application.
GetAppValidationOutput
Show Description Retrieves output from validating an application.
GetConnectors
Show Description Describes the connectors registered with the AWS SMS.
GetReplicationJobs
Show Description Describes the specified replication job or all of your replication jobs.
GetReplicationRuns
Show Description Describes the replication runs for the specified replication job.
GetServers
Show Description Describes the servers in your server catalog. Before you can describe your servers, you must import them using ImportServerCatalog.
ImportAppCatalog
Show Description Allows application import from AWS Migration Hub.
ImportServerCatalog
Show Description Gathers a complete list of on-premises servers. Connectors must be installed and monitoring all servers to import. This call returns immediately, but might take additional time to retrieve all the servers.
LaunchApp
Show Description Launches the specified application as a stack in AWS CloudFormation.
ListApps
Show Description Retrieves summaries for all applications.
NotifyAppValidationOutput
Show Description Provides information to AWS SMS about whether application validation is successful.
PutAppLaunchConfiguration
Show Description Creates or updates the launch configuration for the specified application.
PutAppReplicationConfiguration
Show Description Creates or updates the replication configuration for the specified application.
PutAppValidationConfiguration
Show Description Creates or updates a validation configuration for the specified application.
StartAppReplication
Show Description Starts replicating the specified application by creating replication jobs for each server in the application.
StartOnDemandAppReplication
Show Description Starts an on-demand replication run for the specified application.
StartOnDemandReplicationRun
Show Description Starts an on-demand replication run for the specified replication job. This replication run starts immediately. This replication run is in addition to the ones already scheduled. There is a limit on the number of on-demand replications runs that you can request in a 24-hour period.
StopAppReplication
Show Description Stops replicating the specified application by deleting the replication job for each server in the application.
TerminateApp
Show Description Terminates the stack for the specified application.
UpdateApp
Show Description Updates the specified application.
## Snow-device-management Events
Service Event Name Description
snow-device-management CancelTask
Show Description Sends a cancel request for a specified task. You can cancel a task only if it's still in a QUEUED state. Tasks that are already running can't be cancelled. A task might still run if it's processed from the queue before the CancelTask operation changes the task's state.
CreateTask
Show Description Instructs one or more devices to start a task, such as unlocking or rebooting.
DescribeDevice
Show Description Checks device-specific information, such as the device type, software version, IP addresses, and lock status.
DescribeDeviceEc2Instances
Show Description Checks the current state of the Amazon EC2 instances. The output is similar to describeDevice, but the results are sourced from the device cache in the Amazon Web Services Cloud and include a subset of the available fields.
DescribeExecution
Show Description Checks the status of a remote task running on one or more target devices.
DescribeTask
Show Description Checks the metadata for a given task on a device.
ListDeviceResources
Show Description Returns a list of the Amazon Web Services resources available for a device. Currently, Amazon EC2 instances are the only supported resource type.
ListDevices
Show Description Returns a list of all devices on your Amazon Web Services account that have Amazon Web Services Snow Device Management enabled in the Amazon Web Services Region where the command is run.
ListExecutions
Show Description Returns the status of tasks for one or more target devices.
ListTagsForResource
Show Description Returns a list of tags for a managed device or task.
ListTasks
Show Description Returns a list of tasks that can be filtered by state.
TagResource
## Snowball Events
</tbody> </table> ## Sns Events
Service Event Name Description
snowball CancelCluster
Show Description Cancels a cluster job. You can only cancel a cluster job while it's in the AwaitingQuorum status. You'll have at least an hour after creating a cluster job to cancel it.
CancelJob
Show Description Cancels the specified job. You can only cancel a job before its JobState value changes to PreparingAppliance. Requesting the ListJobs or DescribeJob action returns a job's JobState as part of the response element data returned.
CreateAddress
Show Description Creates an address for a Snow device to be shipped to. In most regions, addresses are validated at the time of creation. The address you provide must be located within the serviceable area of your region. If the address is invalid or unsupported, then an exception is thrown.
CreateCluster
Show Description Creates an empty cluster. Each cluster supports five nodes. You use the CreateJob action separately to create the jobs for each of these nodes. The cluster does not ship until these five node jobs have been created.
CreateJob
Show Description Creates a job to import or export data between Amazon S3 and your on-premises data center. Your AWS account must have the right trust policies and permissions in place to create a job for a Snow device. If you're creating a job for a node in a cluster, you only need to provide the clusterId value; the other job attributes are inherited from the cluster. Only the Snowball; Edge device type is supported when ordering clustered jobs. The device capacity is optional. Availability of device types differ by AWS Region. For more information about Region availability, see AWS Regional Services.

AWS Snow Family device types and their capacities.

  • Snow Family device type: SNC1_SSD
    • Capacity: T14
    • Description: Snowcone

  • Snow Family device type: SNC1_HDD
    • Capacity: T8
    • Description: Snowcone

  • Device type: EDGE_S
    • Capacity: T98
    • Description: Snowball Edge Storage Optimized for data transfer only

  • Device type: EDGE_CG
    • Capacity: T42
    • Description: Snowball Edge Compute Optimized with GPU

  • Device type: EDGE_C
    • Capacity: T42
    • Description: Snowball Edge Compute Optimized without GPU

  • Device type: EDGE
    • Capacity: T100
    • Description: Snowball Edge Storage Optimized with EC2 Compute

  • Device type: STANDARD
    • Capacity: T50
    • Description: Original Snowball device This device is only available in the Ningxia, Beijing, and Singapore AWS Regions.

  • Device type: STANDARD
    • Capacity: T80
    • Description: Original Snowball device This device is only available in the Ningxia, Beijing, and Singapore AWS Regions.

</details> </td> </tr>
CreateLongTermPricing
Show Description Creates a job with the long-term usage option for a device. The long-term usage is a 1-year or 3-year long-term pricing type for the device. You are billed upfront, and AWS provides discounts for long-term pricing.
CreateReturnShippingLabel
Show Description Creates a shipping label that will be used to return the Snow device to AWS.
DescribeAddress
Show Description Takes an AddressId and returns specific details about that address in the form of an Address object.
DescribeAddresses
Show Description Returns a specified number of ADDRESS objects. Calling this API in one of the US regions will return addresses from the list of all addresses associated with this account in all US regions.
DescribeCluster
Show Description Returns information about a specific cluster including shipping information, cluster status, and other important metadata.
DescribeJob
Show Description Returns information about a specific job including shipping information, job status, and other important metadata.
DescribeReturnShippingLabel
Show Description Information on the shipping label of a Snow device that is being returned to AWS.
GetJobManifest
Show Description Returns a link to an Amazon S3 presigned URL for the manifest file associated with the specified JobId value. You can access the manifest file for up to 60 minutes after this request has been made. To access the manifest file after 60 minutes have passed, you'll have to make another call to the GetJobManifest action. The manifest is an encrypted file that you can download after your job enters the WithCustomer status. The manifest is decrypted by using the UnlockCode code value, when you pass both values to the Snow device through the Snowball client when the client is started for the first time. As a best practice, we recommend that you don't save a copy of an UnlockCode value in the same location as the manifest file for that job. Saving these separately helps prevent unauthorized parties from gaining access to the Snow device associated with that job. The credentials of a given job, including its manifest file and unlock code, expire 360 days after the job is created.
GetJobUnlockCode
Show Description Returns the UnlockCode code value for the specified job. A particular UnlockCode value can be accessed for up to 360 days after the associated job has been created. The UnlockCode value is a 29-character code with 25 alphanumeric characters and 4 hyphens. This code is used to decrypt the manifest file when it is passed along with the manifest to the Snow device through the Snowball client when the client is started for the first time. As a best practice, we recommend that you don't save a copy of the UnlockCode in the same location as the manifest file for that job. Saving these separately helps prevent unauthorized parties from gaining access to the Snow device associated with that job.
GetSnowballUsage
Show Description Returns information about the Snow Family service limit for your account, and also the number of Snow devices your account has in use. The default service limit for the number of Snow devices that you can have at one time is 1. If you want to increase your service limit, contact AWS Support.
GetSoftwareUpdates
Show Description Returns an Amazon S3 presigned URL for an update file associated with a specified JobId.
ListClusterJobs
Show Description Returns an array of JobListEntry objects of the specified length. Each JobListEntry object is for a job in the specified cluster and contains a job's state, a job's ID, and other information.
ListClusters
Show Description Returns an array of ClusterListEntry objects of the specified length. Each ClusterListEntry object contains a cluster's state, a cluster's ID, and other important status information.
ListCompatibleImages
Show Description This action returns a list of the different Amazon EC2 Amazon Machine Images (AMIs) that are owned by your AWS account that would be supported for use on a Snow device. Currently, supported AMIs are based on the CentOS 7 (x86_64) - with Updates HVM, Ubuntu Server 14.04 LTS (HVM), and Ubuntu 16.04 LTS - Xenial (HVM) images, available on the AWS Marketplace.
ListJobs
Show Description Returns an array of JobListEntry objects of the specified length. Each JobListEntry object contains a job's state, a job's ID, and a value that indicates whether the job is a job part, in the case of export jobs. Calling this API action in one of the US regions will return jobs from the list of all jobs associated with this account in all US regions.
ListLongTermPricing
Show Description Lists all long-term pricing types.
UpdateCluster
Show Description While a cluster's ClusterState value is in the AwaitingQuorum state, you can update some of the information associated with a cluster. Once the cluster changes to a different job state, usually 60 minutes after the cluster being created, this action is no longer available.
UpdateJob
Show Description While a job's JobState value is New, you can update some of the information associated with a job. Once the job changes to a different job state, usually within 60 minutes of the job being created, this action is no longer available.
UpdateJobShipmentState
Show Description Updates the state when a shipment state changes to a different state.
Service Event Name Description
sns AddPermission
CheckIfPhoneNumberIsOptedOut
Show Description Accepts a phone number and indicates whether the phone holder has opted out of receiving SMS messages from your account. You cannot send SMS messages to a number that is opted out. To resume sending messages, you can opt in the number by using the OptInPhoneNumber action.
ConfirmSubscription
Show Description Verifies an endpoint owner's intent to receive messages by validating the token sent to the endpoint by an earlier Subscribe action. If the token is valid, the action creates a new subscription and returns its Amazon Resource Name (ARN). This call requires an AWS signature only when the AuthenticateOnUnsubscribe flag is set to "true".
CreatePlatformApplication
Show Description Creates a platform application object for one of the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging), to which devices and mobile apps may register. You must specify PlatformPrincipal and PlatformCredential attributes when using the CreatePlatformApplication action. PlatformPrincipal and PlatformCredential are received from the notification service.
  • For ADM, PlatformPrincipal is client id and PlatformCredential is client secret.
  • For Baidu, PlatformPrincipal is API key and PlatformCredential is secret key.
  • For APNS and APNS_SANDBOX, PlatformPrincipal is SSL certificate and PlatformCredential is private key.
  • For GCM (Firebase Cloud Messaging), there is no PlatformPrincipal and the PlatformCredential is API key.
  • For MPNS, PlatformPrincipal is TLS certificate and PlatformCredential is private key.
  • For WNS, PlatformPrincipal is Package Security Identifier and PlatformCredential is secret key.
You can use the returned PlatformApplicationArn as an attribute for the CreatePlatformEndpoint action.
CreatePlatformEndpoint
Show Description Creates an endpoint for a device and mobile app on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS. CreatePlatformEndpoint requires the PlatformApplicationArn that is returned from CreatePlatformApplication. You can use the returned EndpointArn to send a message to a mobile app or by the Subscribe action for subscription to a topic. The CreatePlatformEndpoint action is idempotent, so if the requester already owns an endpoint with the same device token and attributes, that endpoint's ARN is returned without creating a new endpoint. For more information, see Using Amazon SNS Mobile Push Notifications. When using CreatePlatformEndpoint with Baidu, two attributes must be provided: ChannelId and UserId. The token field must also contain the ChannelId. For more information, see Creating an Amazon SNS Endpoint for Baidu.
CreateSMSSandboxPhoneNumber
Show Description Adds a destination phone number to an account in the SMS sandbox and sends a one-time password (OTP) to that phone number. When you start using Amazon SNS to send SMS messages, your account is in the SMS sandbox. The SMS sandbox provides a safe environment for you to try Amazon SNS features without risking your reputation as an SMS sender. While your account is in the SMS sandbox, you can use all of the features of Amazon SNS. However, you can send SMS messages only to verified destination phone numbers. For more information, including how to move out of the sandbox to send messages without restrictions, see SMS sandbox in the Amazon SNS Developer Guide.
CreateTopic
Show Description Creates a topic to which notifications can be published. Users can create at most 100,000 standard topics (at most 1,000 FIFO topics). For more information, see Creating an Amazon SNS topic in the Amazon SNS Developer Guide. This action is idempotent, so if the requester already owns a topic with the specified name, that topic's ARN is returned without creating a new topic.
DeleteEndpoint
DeletePlatformApplication
DeleteSMSSandboxPhoneNumber
Show Description Deletes an account's verified or pending phone number from the SMS sandbox. When you start using Amazon SNS to send SMS messages, your account is in the SMS sandbox. The SMS sandbox provides a safe environment for you to try Amazon SNS features without risking your reputation as an SMS sender. While your account is in the SMS sandbox, you can use all of the features of Amazon SNS. However, you can send SMS messages only to verified destination phone numbers. For more information, including how to move out of the sandbox to send messages without restrictions, see SMS sandbox in the Amazon SNS Developer Guide.
DeleteTopic
GetEndpointAttributes
Show Description Retrieves the endpoint attributes for a device on one of the supported push notification services, such as GCM (Firebase Cloud Messaging) and APNS. For more information, see Using Amazon SNS Mobile Push Notifications.
GetPlatformApplicationAttributes
Show Description Retrieves the attributes of the platform application object for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging). For more information, see Using Amazon SNS Mobile Push Notifications.
GetSMSAttributes
Show Description Returns the settings for sending SMS messages from your account. These settings are set with the SetSMSAttributes action.
GetSMSSandboxAccountStatus
Show Description Retrieves the SMS sandbox status for the calling account in the target Region. When you start using Amazon SNS to send SMS messages, your account is in the SMS sandbox. The SMS sandbox provides a safe environment for you to try Amazon SNS features without risking your reputation as an SMS sender. While your account is in the SMS sandbox, you can use all of the features of Amazon SNS. However, you can send SMS messages only to verified destination phone numbers. For more information, including how to move out of the sandbox to send messages without restrictions, see SMS sandbox in the Amazon SNS Developer Guide.
GetSubscriptionAttributes
Show Description Returns all of the properties of a subscription.
GetTopicAttributes
Show Description Returns all of the properties of a topic. Topic properties returned might differ based on the authorization of the user.
ListEndpointsByPlatformApplication
Show Description Lists the endpoints and endpoint attributes for devices in a supported push notification service, such as GCM (Firebase Cloud Messaging) and APNS. The results for ListEndpointsByPlatformApplication are paginated and return a limited list of endpoints, up to 100. If additional records are available after the first page results, then a NextToken string will be returned. To receive the next page, you call ListEndpointsByPlatformApplication again using the NextToken string received from the previous call. When there are no more records to return, NextToken will be null. For more information, see Using Amazon SNS Mobile Push Notifications. This action is throttled at 30 transactions per second (TPS).
ListOriginationNumbers
Show Description Lists the calling account's dedicated origination numbers and their metadata. For more information about origination numbers, see Origination numbers in the Amazon SNS Developer Guide.
ListPhoneNumbersOptedOut
Show Description Returns a list of phone numbers that are opted out, meaning you cannot send SMS messages to them. The results for ListPhoneNumbersOptedOut are paginated, and each page returns up to 100 phone numbers. If additional phone numbers are available after the first page of results, then a NextToken string will be returned. To receive the next page, you call ListPhoneNumbersOptedOut again using the NextToken string received from the previous call. When there are no more records to return, NextToken will be null.
ListPlatformApplications
Show Description Lists the platform application objects for the supported push notification services, such as APNS and GCM (Firebase Cloud Messaging). The results for ListPlatformApplications are paginated and return a limited list of applications, up to 100. If additional records are available after the first page results, then a NextToken string will be returned. To receive the next page, you call ListPlatformApplications using the NextToken string received from the previous call. When there are no more records to return, NextToken will be null. For more information, see Using Amazon SNS Mobile Push Notifications. This action is throttled at 15 transactions per second (TPS).
ListSMSSandboxPhoneNumbers
Show Description Lists the calling account's current verified and pending destination phone numbers in the SMS sandbox. When you start using Amazon SNS to send SMS messages, your account is in the SMS sandbox. The SMS sandbox provides a safe environment for you to try Amazon SNS features without risking your reputation as an SMS sender. While your account is in the SMS sandbox, you can use all of the features of Amazon SNS. However, you can send SMS messages only to verified destination phone numbers. For more information, including how to move out of the sandbox to send messages without restrictions, see SMS sandbox in the Amazon SNS Developer Guide.
ListSubscriptions
Show Description Returns a list of the requester's subscriptions. Each call returns a limited list of subscriptions, up to 100. If there are more subscriptions, a NextToken is also returned. Use the NextToken parameter in a new ListSubscriptions call to get further results. This action is throttled at 30 transactions per second (TPS).
ListSubscriptionsByTopic
Show Description Returns a list of the subscriptions to a specific topic. Each call returns a limited list of subscriptions, up to 100. If there are more subscriptions, a NextToken is also returned. Use the NextToken parameter in a new ListSubscriptionsByTopic call to get further results. This action is throttled at 30 transactions per second (TPS).
ListTagsForResource
Show Description List all tags added to the specified Amazon SNS topic. For an overview, see Amazon SNS Tags in the Amazon Simple Notification Service Developer Guide.
ListTopics
Show Description Returns a list of the requester's topics. Each call returns a limited list of topics, up to 100. If there are more topics, a NextToken is also returned. Use the NextToken parameter in a new ListTopics call to get further results. This action is throttled at 30 transactions per second (TPS).
OptInPhoneNumber
Show Description Use this request to opt in a phone number that is opted out, which enables you to resume sending SMS messages to the number. You can opt in a phone number only once every 30 days.
Publish
Show Description Sends a message to an Amazon SNS topic, a text message (SMS message) directly to a phone number, or a message to a mobile platform endpoint (when you specify the TargetArn). If you send a message to a topic, Amazon SNS delivers the message to each endpoint that is subscribed to the topic. The format of the message depends on the notification protocol for each subscribed endpoint. When a messageId is returned, the message has been saved and Amazon SNS will attempt to deliver it shortly. To use the Publish action for sending a message to a mobile endpoint, such as an app on a Kindle device or mobile phone, you must specify the EndpointArn for the TargetArn parameter. The EndpointArn is returned when making a call with the CreatePlatformEndpoint action. For more information about formatting messages, see Send Custom Platform-Specific Payloads in Messages to Mobile Devices. You can publish messages only to topics and endpoints in the same Region.
RemovePermission
SetEndpointAttributes
SetPlatformApplicationAttributes
SetSMSAttributes
Show Description Use this request to set the default settings for sending SMS messages and receiving daily SMS usage reports. You can override some of these settings for a single message when you use the Publish action with the MessageAttributes.entry.N parameter. For more information, see Publishing to a mobile phone in the Amazon SNS Developer Guide. To use this operation, you must grant the Amazon SNS service principal (sns.amazonaws.com) permission to perform the s3:ListBucket action.
SetSubscriptionAttributes
SetTopicAttributes
Subscribe
Show Description Subscribes an endpoint to an Amazon SNS topic. If the endpoint type is HTTP/S or email, or if the endpoint and the topic are not in the same account, the endpoint owner must run the ConfirmSubscription action to confirm the subscription. You call the ConfirmSubscription action with the token from the subscription response. Confirmation tokens are valid for three days. This action is throttled at 100 transactions per second (TPS).
TagResource
Show Description Add tags to the specified Amazon SNS topic. For an overview, see Amazon SNS Tags in the Amazon SNS Developer Guide. When you use topic tags, keep the following guidelines in mind:
  • Adding more than 50 tags to a topic isn't recommended.
  • Tags don't have any semantic meaning. Amazon SNS interprets tags as character strings.
  • Tags are case-sensitive.
  • A new tag with a key identical to that of an existing tag overwrites the existing tag.
  • Tagging actions are limited to 10 TPS per account, per Region. If your application requires a higher throughput, file a technical support request.
Unsubscribe
UntagResource
Show Description Remove tags from the specified Amazon SNS topic. For an overview, see Amazon SNS Tags in the Amazon SNS Developer Guide.
## Sqs Events
</tbody> </table> ## Ssm-contacts Events
Service Event Name Description
sqs AddPermission
ChangeMessageVisibility
ChangeMessageVisibilityBatch
Show Description Changes the visibility timeout of multiple messages. This is a batch version of ChangeMessageVisibility. The result of the action on each message is reported individually in the response. You can send up to 10 ChangeMessageVisibility requests with each ChangeMessageVisibilityBatch action. Because the batch request can result in a combination of successful and unsuccessful actions, you should check for batch errors even when the call returns an HTTP status code of 200. Some actions take lists of parameters. These lists are specified using the param.n notation. Values of n are integers starting from 1. For example, a parameter list with two elements looks like this: &AttributeName.1=first &AttributeName.2=second
CreateQueue
Show Description Creates a new standard or FIFO queue. You can pass one or more attributes in the request. Keep the following in mind:
  • If you don't specify the FifoQueue attribute, Amazon SQS creates a standard queue. You can't change the queue type after you create it and you can't convert an existing standard queue into a FIFO queue. You must either create a new FIFO queue for your application or delete your existing standard queue and recreate it as a FIFO queue. For more information, see Moving From a Standard Queue to a FIFO Queue in the Amazon SQS Developer Guide.
  • If you don't provide a value for an attribute, the queue is created with the default value for the attribute.
  • If you delete a queue, you must wait at least 60 seconds before creating a queue with the same name.
To successfully create a new queue, you must provide a queue name that adheres to the limits related to queues and is unique within the scope of your queues. After you create a queue, you must wait at least one second after the queue is created to be able to use the queue. To get the queue URL, use the GetQueueUrl action. GetQueueUrl requires only the QueueName parameter. be aware of existing queue names:
  • If you provide the name of an existing queue along with the exact names and values of all the queue's attributes, CreateQueue returns the queue URL for the existing queue.
  • If the queue name, attribute names, or attribute values don't match an existing queue, CreateQueue returns an error.
Some actions take lists of parameters. These lists are specified using the param.n notation. Values of n are integers starting from 1. For example, a parameter list with two elements looks like this: &AttributeName.1=first &AttributeName.2=second Cross-account permissions don't apply to this action. For more information, see Grant cross-account permissions to a role and a user name in the Amazon SQS Developer Guide.
DeleteMessage
DeleteMessageBatch
Show Description Deletes up to ten messages from the specified queue. This is a batch version of DeleteMessage. The result of the action on each message is reported individually in the response. Because the batch request can result in a combination of successful and unsuccessful actions, you should check for batch errors even when the call returns an HTTP status code of 200. Some actions take lists of parameters. These lists are specified using the param.n notation. Values of n are integers starting from 1. For example, a parameter list with two elements looks like this: &AttributeName.1=first &AttributeName.2=second
DeleteQueue
GetQueueAttributes
Show Description Gets attributes for the specified queue. To determine whether a queue is FIFO, you can check whether QueueName ends with the .fifo suffix.
GetQueueUrl
Show Description Returns the URL of an existing Amazon SQS queue. To access a queue that belongs to another AWS account, use the QueueOwnerAWSAccountId parameter to specify the account ID of the queue's owner. The queue's owner must grant you permission to access the queue. For more information about shared queue access, see AddPermission or see Allow Developers to Write Messages to a Shared Queue in the Amazon SQS Developer Guide.
ListDeadLetterSourceQueues
Show Description Returns a list of your queues that have the RedrivePolicy queue attribute configured with a dead-letter queue. The ListDeadLetterSourceQueues methods supports pagination. Set parameter MaxResults in the request to specify the maximum number of results to be returned in the response. If you do not set MaxResults, the response includes a maximum of 1,000 results. If you set MaxResults and there are additional results to display, the response includes a value for NextToken. Use NextToken as a parameter in your next request to ListDeadLetterSourceQueues to receive the next page of results. For more information about using dead-letter queues, see Using Amazon SQS Dead-Letter Queues in the Amazon SQS Developer Guide.
ListQueueTags
Show Description List all cost allocation tags added to the specified Amazon SQS queue. For an overview, see Tagging Your Amazon SQS Queues in the Amazon SQS Developer Guide. Cross-account permissions don't apply to this action. For more information, see Grant cross-account permissions to a role and a user name in the Amazon SQS Developer Guide.
ListQueues
Show Description Returns a list of your queues in the current region. The response includes a maximum of 1,000 results. If you specify a value for the optional QueueNamePrefix parameter, only queues with a name that begins with the specified value are returned. The listQueues methods supports pagination. Set parameter MaxResults in the request to specify the maximum number of results to be returned in the response. If you do not set MaxResults, the response includes a maximum of 1,000 results. If you set MaxResults and there are additional results to display, the response includes a value for NextToken. Use NextToken as a parameter in your next request to listQueues to receive the next page of results. Cross-account permissions don't apply to this action. For more information, see Grant cross-account permissions to a role and a user name in the Amazon SQS Developer Guide.
PurgeQueue
ReceiveMessage
Show Description Retrieves one or more messages (up to 10), from the specified queue. Using the WaitTimeSeconds parameter enables long-poll support. For more information, see Amazon SQS Long Polling in the Amazon SQS Developer Guide. Short poll is the default behavior where a weighted random set of machines is sampled on a ReceiveMessage call. Thus, only the messages on the sampled machines are returned. If the number of messages in the queue is small (fewer than 1,000), you most likely get fewer messages than you requested per ReceiveMessage call. If the number of messages in the queue is extremely small, you might not receive any messages in a particular ReceiveMessage response. If this happens, repeat the request. For each message returned, the response includes the following:
  • The message body.
  • An MD5 digest of the message body. For information about MD5, see RFC1321.
  • The MessageId you received when you sent the message to the queue.
  • The receipt handle.
  • The message attributes.
  • An MD5 digest of the message attributes.
The receipt handle is the identifier you must provide when deleting the message. For more information, see Queue and Message Identifiers in the Amazon SQS Developer Guide. You can provide the VisibilityTimeout parameter in your request. The parameter is applied to the messages that Amazon SQS returns in the response. If you don't include the parameter, the overall visibility timeout for the queue is used for the returned messages. For more information, see Visibility Timeout in the Amazon SQS Developer Guide. A message that isn't deleted or a message whose visibility isn't extended before the visibility timeout expires counts as a failed receive. Depending on the configuration of the queue, the message might be sent to the dead-letter queue. In the future, new attributes might be added. If you write code that calls this action, we recommend that you structure your code so that it can handle new attributes gracefully.
RemovePermission
SendMessage
Show Description Delivers a message to the specified queue. A message can include only XML, JSON, and unformatted text. The following Unicode characters are allowed: #x9 </details> </td> </tr>
SendMessageBatch
Show Description Delivers up to ten messages to the specified queue. This is a batch version of SendMessage. For a FIFO queue, multiple messages within a single batch are enqueued in the order they are sent. The result of sending each message is reported individually in the response. Because the batch request can result in a combination of successful and unsuccessful actions, you should check for batch errors even when the call returns an HTTP status code of 200. The maximum allowed individual message size and the maximum total payload size (the sum of the individual lengths of all of the batched messages) are both 256 KB (262,144 bytes). A message can include only XML, JSON, and unformatted text. The following Unicode characters are allowed: #x9 </details> </td> </tr>
SetQueueAttributes
TagQueue
Service Event Name Description
ssm-contacts AcceptPage
Show Description Used to acknowledge an engagement to a contact channel during an incident.
ActivateContactChannel
Show Description Activates a contact's contact channel. Incident Manager can't engage a contact until the contact channel has been activated.
CreateContact
Show Description Contacts are either the contacts that Incident Manager engages during an incident or the escalation plans that Incident Manager uses to engage contacts in phases during an incident.
CreateContactChannel
Show Description A contact channel is the method that Incident Manager uses to engage your contact.
DeactivateContactChannel
Show Description To no longer receive Incident Manager engagements to a contact channel, you can deactivate the channel.
DeleteContact
Show Description To remove a contact from Incident Manager, you can delete the contact. Deleting a contact removes them from all escalation plans and related response plans. Deleting an escalation plan removes it from all related response plans. You will have to recreate the contact and its contact channels before you can use it again.
DeleteContactChannel
Show Description To no longer receive engagements on a contact channel, you can delete the channel from a contact. Deleting the contact channel removes it from the contact's engagement plan. If you delete the only contact channel for a contact, you won't be able to engage that contact during an incident.
DescribeEngagement
Show Description Incident Manager uses engagements to engage contacts and escalation plans during an incident. Use this command to describe the engagement that occurred during an incident.
DescribePage
Show Description Lists details of the engagement to a contact channel.
GetContact
Show Description Retrieves information about the specified contact or escalation plan.
GetContactChannel
Show Description List details about a specific contact channel.
GetContactPolicy
Show Description Retrieves the resource policies attached to the specified contact or escalation plan.
ListContactChannels
Show Description Lists all contact channels for the specified contact.
ListContacts
Show Description Lists all contacts and escalation plans in Incident Manager.
ListEngagements
Show Description Lists all engagements that have happened in an incident.
ListPageReceipts
Show Description Lists all of the engagements to contact channels that have been acknowledged.
ListPagesByContact
Show Description Lists the engagements to a contact's contact channels.
ListPagesByEngagement
Show Description Lists the engagements to contact channels that occurred by engaging a contact.
ListTagsForResource
Show Description Lists the tags of an escalation plan or contact.
PutContactPolicy
Show Description Adds a resource to the specified contact or escalation plan.
SendActivationCode
Show Description Sends an activation code to a contact channel. The contact can use this code to activate the contact channel in the console or with the ActivateChannel operation. Incident Manager can't engage a contact channel until it has been activated.
StartEngagement
Show Description Starts an engagement to a contact or escalation plan. The engagement engages each contact specified in the incident.
StopEngagement
Show Description Stops an engagement before it finishes the final stage of the escalation plan or engagement plan. Further contacts aren't engaged.
TagResource
Show Description Tags a contact or escalation plan. You can tag only contacts and escalation plans in the first region of your replication set.
UntagResource
Show Description Removes tags from the specified resource.
UpdateContact
Show Description Updates the contact or escalation plan specified.
## Ssm-incidents Events
Service Event Name Description
ssm-incidents CreateReplicationSet
Show Description A replication set replicates and encrypts your data to the provided Regions with the provided KMS key.
CreateResponsePlan
Show Description Creates a response plan that automates the initial response to incidents. A response plan engages contacts, starts chat channel collaboration, and initiates runbooks at the beginning of an incident.
CreateTimelineEvent
Show Description Creates a custom timeline event on the incident details page of an incident record. Timeline events are automatically created by Incident Manager, marking key moment during an incident. You can create custom timeline events to mark important events that are automatically detected by Incident Manager.
DeleteIncidentRecord
Show Description Delete an incident record from Incident Manager.
DeleteReplicationSet
Show Description Deletes all Regions in your replication set. Deleting the replication set deletes all Incident Manager data.
DeleteResourcePolicy
Show Description Deletes the resource policy that Resource Access Manager uses to share your Incident Manager resource.
DeleteResponsePlan
Show Description Deletes the specified response plan. Deleting a response plan stops all linked CloudWatch alarms and EventBridge events from creating an incident with this response plan.
DeleteTimelineEvent
Show Description Deletes a timeline event from an incident.
GetIncidentRecord
Show Description Returns the details for the specified incident record.
GetReplicationSet
Show Description Retrieve your Incident Manager replication set.
GetResourcePolicies
Show Description Retrieves the resource policies attached to the specified response plan.
GetResponsePlan
Show Description Retrieves the details of the specified response plan.
GetTimelineEvent
Show Description Retrieves a timeline event based on its ID and incident record.
ListIncidentRecords
Show Description Lists all incident records in your account. Use this command to retrieve the Amazon Resource Name (ARN) of the incident record you want to update.
ListRelatedItems
Show Description List all related items for an incident record.
ListReplicationSets
Show Description Lists details about the replication set configured in your account.
ListResponsePlans
Show Description Lists all response plans in your account.
ListTagsForResource
Show Description Lists the tags that are attached to the specified response plan.
ListTimelineEvents
Show Description Lists timeline events for the specified incident record.
PutResourcePolicy
Show Description Adds a resource policy to the specified response plan.
StartIncident
Show Description Used to start an incident from CloudWatch alarms, EventBridge events, or manually.
TagResource
Show Description Adds a tag to a response plan.
UntagResource
Show Description Removes a tag from a resource.
UpdateDeletionProtection
Show Description Update deletion protection to either allow or deny deletion of the final Region in a replication set.
UpdateIncidentRecord
Show Description Update the details of an incident record. You can use this operation to update an incident record from the defined chat channel. For more information about using actions in chat channels, see Interacting through chat.
UpdateRelatedItems
Show Description Add or remove related items from the related items tab of an incident record.
UpdateReplicationSet
Show Description Add or delete Regions from your replication set.
UpdateResponsePlan
Show Description Updates the specified response plan.
## Ssm Events
</tbody> </table> ## Sso-admin Events
Service Event Name Description
ssm AddTagsToResource
Show Description Adds or overwrites one or more tags for the specified resource. Tags are metadata that you can assign to your documents, managed instances, maintenance windows, Parameter Store parameters, and patch baselines. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment. Each tag consists of a key and an optional value, both of which you define. For example, you could define a set of tags for your account's managed instances that helps you track each instance's owner and stack level. For example:
  • Key=Owner,Value=DbAdmin
  • Key=Owner,Value=SysAdmin
  • Key=Owner,Value=Dev
  • Key=Stack,Value=Production
  • Key=Stack,Value=Pre-Production
  • Key=Stack,Value=Test
Each resource can have a maximum of 50 tags. We recommend that you devise a set of tag keys that meets your needs for each resource type. Using a consistent set of tag keys makes it easier for you to manage your resources. You can search and filter the resources based on the tags you add. Tags don't have any semantic meaning to and are interpreted strictly as a string of characters. For more information about using tags with Amazon Elastic Compute Cloud (Amazon EC2) instances, see Tagging your Amazon EC2 resources in the Amazon EC2 User Guide.
AssociateOpsItemRelatedItem
Show Description Associates a related item to a Systems Manager OpsCenter OpsItem. For example, you can associate an Incident Manager incident or analysis with an OpsItem. Incident Manager and OpsCenter are capabilities of Amazon Web Services Systems Manager.
CancelCommand
Show Description Attempts to cancel the command specified by the Command ID. There is no guarantee that the command will be terminated and the underlying process stopped.
CancelMaintenanceWindowExecution
Show Description Stops a maintenance window execution that is already in progress and cancels any tasks in the window that haven't already starting running. Tasks already in progress will continue to completion.
CreateActivation
Show Description Generates an activation code and activation ID you can use to register your on-premises server or virtual machine (VM) with Amazon Web Services Systems Manager. Registering these machines with Systems Manager makes it possible to manage them using Systems Manager capabilities. You use the activation code and ID when installing SSM Agent on machines in your hybrid environment. For more information about requirements for managing on-premises instances and VMs using Systems Manager, see Setting up Amazon Web Services Systems Manager for hybrid environments in the Amazon Web Services Systems Manager User Guide. On-premises servers or VMs that are registered with Systems Manager and Amazon Elastic Compute Cloud (Amazon EC2) instances that you manage with Systems Manager are all called managed instances.
CreateAssociation
Show Description A State Manager association defines the state that you want to maintain on your instances. For example, an association can specify that anti-virus software must be installed and running on your instances, or that certain ports must be closed. For static targets, the association specifies a schedule for when the configuration is reapplied. For dynamic targets, such as an Amazon Web Services resource group or an Amazon Web Services autoscaling group, State Manager, a capability of Amazon Web Services Systems Manager applies the configuration when new instances are added to the group. The association also specifies actions to take when applying the configuration. For example, an association for anti-virus software might run once a day. If the software isn't installed, then State Manager installs it. If the software is installed, but the service isn't running, then the association might instruct State Manager to start the service.
CreateAssociationBatch
Show Description Associates the specified Amazon Web Services Systems Manager document (SSM document) with the specified instances or targets. When you associate a document with one or more instances using instance IDs or tags, Amazon Web Services Systems Manager Agent (SSM Agent) running on the instance processes the document and configures the instance as specified. If you associate a document with an instance that already has an associated document, the system returns the AssociationAlreadyExists exception.
CreateDocument
Show Description Creates a Amazon Web Services Systems Manager (SSM document). An SSM document defines the actions that Systems Manager performs on your managed instances. For more information about SSM documents, including information about supported schemas, features, and syntax, see Amazon Web Services Systems Manager Documents in the Amazon Web Services Systems Manager User Guide.
CreateMaintenanceWindow
Show Description Creates a new maintenance window. The value you specify for Duration determines the specific end time for the maintenance window based on the time it begins. No maintenance window tasks are permitted to start after the resulting endtime minus the number of hours you specify for Cutoff. For example, if the maintenance window starts at 3 PM, the duration is three hours, and the value you specify for Cutoff is one hour, no maintenance window tasks can start after 5 PM.
CreateOpsItem
Show Description Creates a new OpsItem. You must have permission in Identity and Access Management (IAM) to create a new OpsItem. For more information, see Getting started with OpsCenter in the Amazon Web Services Systems Manager User Guide. Operations engineers and IT professionals use Amazon Web Services Systems Manager OpsCenter to view, investigate, and remediate operational issues impacting the performance and health of their Amazon Web Services resources. For more information, see Amazon Web Services Systems Manager OpsCenter in the Amazon Web Services Systems Manager User Guide.
CreateOpsMetadata
Show Description If you create a new application in Application Manager, Amazon Web Services Systems Manager calls this API operation to specify information about the new application, including the application type.
CreatePatchBaseline
Show Description Creates a patch baseline. For information about valid key-value pairs in PatchFilters for each supported operating system type, see PatchFilter.
CreateResourceDataSync
Show Description A resource data sync helps you view data from multiple sources in a single location. Amazon Web Services Systems Manager offers two types of resource data sync: SyncToDestination and SyncFromSource. You can configure Systems Manager Inventory to use the SyncToDestination type to synchronize Inventory data from multiple Amazon Web Services Regions to a single Amazon Simple Storage Service (Amazon S3) bucket. For more information, see Configuring resource data sync for Inventory in the Amazon Web Services Systems Manager User Guide. You can configure Systems Manager Explorer to use the SyncFromSource type to synchronize operational work items (OpsItems) and operational data (OpsData) from multiple Amazon Web Services Regions to a single Amazon S3 bucket. This type can synchronize OpsItems and OpsData from multiple Amazon Web Services accounts and Amazon Web Services Regions or EntireOrganization by using Organizations. For more information, see Setting up Systems Manager Explorer to display data from multiple accounts and Regions in the Amazon Web Services Systems Manager User Guide. A resource data sync is an asynchronous operation that returns immediately. After a successful initial sync is completed, the system continuously syncs data. To check the status of a sync, use the ListResourceDataSync. By default, data isn't encrypted in Amazon S3. We strongly recommend that you enable encryption in Amazon S3 to ensure secure data storage. We also recommend that you secure access to the Amazon S3 bucket by creating a restrictive bucket policy.
DeleteActivation
Show Description Deletes an activation. You aren't required to delete an activation. If you delete an activation, you can no longer use it to register additional managed instances. Deleting an activation doesn't de-register managed instances. You must manually de-register managed instances.
DeleteAssociation
Show Description Disassociates the specified Amazon Web Services Systems Manager document (SSM document) from the specified instance. If you created the association by using the Targets parameter, then you must delete the association by using the association ID. When you disassociate a document from an instance, it doesn't change the configuration of the instance. To change the configuration state of an instance after you disassociate a document, you must create a new document with the desired configuration and associate it with the instance.
DeleteDocument
Show Description Deletes the Amazon Web Services Systems Manager document (SSM document) and all instance associations to the document. Before you delete the document, we recommend that you use DeleteAssociation to disassociate all instances that are associated with the document.
DeleteInventory
Show Description Delete a custom inventory type or the data associated with a custom Inventory type. Deleting a custom inventory type is also referred to as deleting a custom inventory schema.
DeleteMaintenanceWindow
Show Description Deletes a maintenance window.
DeleteOpsMetadata
Show Description Delete OpsMetadata related to an application.
DeleteParameter
Show Description Delete a parameter from the system. After deleting a parameter, wait for at least 30 seconds to create a parameter with the same name.
DeleteParameters
Show Description Delete a list of parameters. After deleting a parameter, wait for at least 30 seconds to create a parameter with the same name.
DeletePatchBaseline
Show Description Deletes a patch baseline.
DeleteResourceDataSync
Show Description Deletes a resource data sync configuration. After the configuration is deleted, changes to data on managed instances are no longer synced to or from the target. Deleting a sync configuration doesn't delete data.
DeregisterManagedInstance
Show Description Removes the server or virtual machine from the list of registered servers. You can reregister the instance again at any time. If you don't plan to use Run Command on the server, we suggest uninstalling SSM Agent first.
DeregisterPatchBaselineForPatchGroup
Show Description Removes a patch group from a patch baseline.
DeregisterTargetFromMaintenanceWindow
Show Description Removes a target from a maintenance window.
DeregisterTaskFromMaintenanceWindow
Show Description Removes a task from a maintenance window.
DescribeActivations
Show Description Describes details about the activation, such as the date and time the activation was created, its expiration date, the Identity and Access Management (IAM) role assigned to the instances in the activation, and the number of instances registered by using this activation.
DescribeAssociation
Show Description Describes the association for the specified target or instance. If you created the association by using the Targets parameter, then you must retrieve the association by using the association ID.
DescribeAssociationExecutionTargets
Show Description Views information about a specific execution of a specific association.
DescribeAssociationExecutions
Show Description Views all executions for a specific association ID.
DescribeAutomationExecutions
Show Description Provides details about all active and terminated Automation executions.
DescribeAutomationStepExecutions
Show Description Information about all active and terminated step executions in an Automation workflow.
DescribeAvailablePatches
Show Description Lists all patches eligible to be included in a patch baseline.
DescribeDocument
Show Description Describes the specified Amazon Web Services Systems Manager document (SSM document).
DescribeDocumentPermission
Show Description Describes the permissions for a Amazon Web Services Systems Manager document (SSM document). If you created the document, you are the owner. If a document is shared, it can either be shared privately (by specifying a user's Amazon Web Services account ID) or publicly (All).
DescribeEffectiveInstanceAssociations
Show Description All associations for the instance(s).
DescribeEffectivePatchesForPatchBaseline
Show Description Retrieves the current effective patches (the patch and the approval state) for the specified patch baseline. Applies to patch baselines for Windows only.
DescribeInstanceAssociationsStatus
Show Description The status of the associations for the instance(s).
DescribeInstanceInformation
Show Description Describes one or more of your instances, including information about the operating system platform, the version of SSM Agent installed on the instance, instance status, and so on. If you specify one or more instance IDs, it returns information for those instances. If you don't specify instance IDs, it returns information for all your instances. If you specify an instance ID that isn't valid or an instance that you don't own, you receive an error. The IamRole field for this API operation is the Identity and Access Management (IAM) role assigned to on-premises instances. This call doesn't return the IAM role for EC2 instances.
DescribeInstancePatchStates
Show Description Retrieves the high-level patch state of one or more instances.
DescribeInstancePatchStatesForPatchGroup
Show Description Retrieves the high-level patch state for the instances in the specified patch group.
DescribeInstancePatches
Show Description Retrieves information about the patches on the specified instance and their state relative to the patch baseline being used for the instance.
DescribeInventoryDeletions
Show Description Describes a specific delete inventory operation.
DescribeMaintenanceWindowExecutionTaskInvocations
Show Description Retrieves the individual task executions (one per target) for a particular task run as part of a maintenance window execution.
DescribeMaintenanceWindowExecutionTasks
Show Description For a given maintenance window execution, lists the tasks that were run.
DescribeMaintenanceWindowExecutions
Show Description Lists the executions of a maintenance window. This includes information about when the maintenance window was scheduled to be active, and information about tasks registered and run with the maintenance window.
DescribeMaintenanceWindowSchedule
Show Description Retrieves information about upcoming executions of a maintenance window.
DescribeMaintenanceWindowTargets
Show Description Lists the targets registered with the maintenance window.
DescribeMaintenanceWindowTasks
Show Description Lists the tasks in a maintenance window. For maintenance window tasks without a specified target, you can't supply values for --max-errors and --max-concurrency. Instead, the system inserts a placeholder value of 1, which may be reported in the response to this command. These values don't affect the running of your task and can be ignored.
DescribeMaintenanceWindows
Show Description Retrieves the maintenance windows in an Amazon Web Services account.
DescribeMaintenanceWindowsForTarget
Show Description Retrieves information about the maintenance window targets or tasks that an instance is associated with.
DescribeOpsItems
Show Description Query a set of OpsItems. You must have permission in Identity and Access Management (IAM) to query a list of OpsItems. For more information, see Getting started with OpsCenter in the Amazon Web Services Systems Manager User Guide. Operations engineers and IT professionals use Amazon Web Services Systems Manager OpsCenter to view, investigate, and remediate operational issues impacting the performance and health of their Amazon Web Services resources. For more information, see OpsCenter in the Amazon Web Services Systems Manager User Guide.
DescribeParameters
Show Description Get information about a parameter. Request results are returned on a best-effort basis. If you specify MaxResults in the request, the response includes information up to the limit specified. The number of items returned, however, can be between zero and the value of MaxResults. If the service reaches an internal limit while processing the results, it stops the operation and returns the matching values up to that point and a NextToken. You can specify the NextToken in a subsequent call to get the next set of results. If you change the KMS key alias for the KMS key used to encrypt a parameter, then you must also update the key alias the parameter uses to reference KMS. Otherwise, DescribeParameters retrieves whatever the original key alias was referencing.
DescribePatchBaselines
Show Description Lists the patch baselines in your Amazon Web Services account.
DescribePatchGroupState
Show Description Returns high-level aggregated patch compliance state information for a patch group.
DescribePatchGroups
Show Description Lists all patch groups that have been registered with patch baselines.
DescribePatchProperties
Show Description Lists the properties of available patches organized by product, product family, classification, severity, and other properties of available patches. You can use the reported properties in the filters you specify in requests for operations such as CreatePatchBaseline, UpdatePatchBaseline, DescribeAvailablePatches, and DescribePatchBaselines. The following section lists the properties that can be used in filters for each major operating system type:
AMAZON_LINUX
Valid properties: PRODUCT </details> </td> </tr>
DescribeSessions
Show Description Retrieves a list of all active sessions (both connected and disconnected) or terminated sessions from the past 30 days.
DisassociateOpsItemRelatedItem
Show Description Deletes the association between an OpsItem and a related item. For example, this API operation can delete an Incident Manager incident from an OpsItem. Incident Manager is a capability of Amazon Web Services Systems Manager.
GetAutomationExecution
Show Description Get detailed information about a particular Automation execution.
GetCalendarState
Show Description Gets the state of a Amazon Web Services Systems Manager change calendar at the current time or a specified time. If you specify a time, GetCalendarState returns the state of the calendar at that specific time, and returns the next time that the change calendar state will transition. If you don't specify a time, GetCalendarState uses the current time. Change Calendar entries have two possible states: OPEN or CLOSED. If you specify more than one calendar in a request, the command returns the status of OPEN only if all calendars in the request are open. If one or more calendars in the request are closed, the status returned is CLOSED. For more information about Change Calendar, a capability of Amazon Web Services Systems Manager, see Amazon Web Services Systems Manager Change Calendar in the Amazon Web Services Systems Manager User Guide.
GetCommandInvocation
Show Description Returns detailed information about command execution for an invocation or plugin. GetCommandInvocation only gives the execution status of a plugin in a document. To get the command execution status on a specific instance, use ListCommandInvocations. To get the command execution status across instances, use ListCommands.
GetConnectionStatus
Show Description Retrieves the Session Manager connection status for an instance to determine whether it is running and ready to receive Session Manager connections.
GetDefaultPatchBaseline
Show Description Retrieves the default patch baseline. Amazon Web Services Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system. If you don't specify an operating system value, the default patch baseline for Windows is returned.
GetDeployablePatchSnapshotForInstance
Show Description Retrieves the current snapshot for the patch baseline the instance uses. This API is primarily used by the AWS-RunPatchBaseline Systems Manager document (SSM document). If you run the command locally, such as with the Command Line Interface (CLI), the system attempts to use your local Amazon Web Services credentials and the operation fails. To avoid this, you can run the command in the Amazon Web Services Systems Manager console. Use Run Command, a capability of Amazon Web Services Systems Manager, with an SSM document that enables you to target an instance with a script or command. For example, run the command using the AWS-RunShellScript document or the AWS-RunPowerShellScript document.
GetDocument
Show Description Gets the contents of the specified Amazon Web Services Systems Manager document (SSM document).
GetInventory
Show Description Query inventory information. This includes instance status, such as Stopped or Terminated.
GetInventorySchema
Show Description Return a list of inventory type names for the account, or return a list of attribute names for a specific Inventory item type.
GetMaintenanceWindow
Show Description Retrieves a maintenance window.
GetMaintenanceWindowExecution
Show Description Retrieves details about a specific a maintenance window execution.
GetMaintenanceWindowExecutionTask
Show Description Retrieves the details about a specific task run as part of a maintenance window execution.
GetMaintenanceWindowExecutionTaskInvocation
Show Description Retrieves information about a specific task running on a specific target.
GetMaintenanceWindowTask
Show Description Lists the tasks in a maintenance window. For maintenance window tasks without a specified target, you can't supply values for --max-errors and --max-concurrency. Instead, the system inserts a placeholder value of 1, which may be reported in the response to this command. These values don't affect the running of your task and can be ignored.
GetOpsItem
Show Description Get information about an OpsItem by using the ID. You must have permission in Identity and Access Management (IAM) to view information about an OpsItem. For more information, see Getting started with OpsCenter in the Amazon Web Services Systems Manager User Guide. Operations engineers and IT professionals use Amazon Web Services Systems Manager OpsCenter to view, investigate, and remediate operational issues impacting the performance and health of their Amazon Web Services resources. For more information, see OpsCenter in the Amazon Web Services Systems Manager User Guide.
GetOpsMetadata
Show Description View operational metadata related to an application in Application Manager.
GetOpsSummary
Show Description View a summary of operations metadata (OpsData) based on specified filters and aggregators. OpsData can include information about Amazon Web Services Systems Manager OpsCenter operational workitems (OpsItems) as well as information about any Amazon Web Services resource or service configured to report OpsData to Amazon Web Services Systems Manager Explorer.
GetParameter
Show Description Get information about a single parameter by specifying the parameter name. To get information about more than one parameter at a time, use the GetParameters operation.
GetParameterHistory
Show Description Retrieves the history of all changes to a parameter. If you change the KMS key alias for the KMS key used to encrypt a parameter, then you must also update the key alias the parameter uses to reference KMS. Otherwise, GetParameterHistory retrieves whatever the original key alias was referencing.
GetParameters
Show Description Get information about one or more parameters by specifying multiple parameter names. To get information about a single parameter, you can use the GetParameter operation instead.
GetParametersByPath
Show Description Retrieve information about one or more parameters in a specific hierarchy. Request results are returned on a best-effort basis. If you specify MaxResults in the request, the response includes information up to the limit specified. The number of items returned, however, can be between zero and the value of MaxResults. If the service reaches an internal limit while processing the results, it stops the operation and returns the matching values up to that point and a NextToken. You can specify the NextToken in a subsequent call to get the next set of results.
GetPatchBaseline
Show Description Retrieves information about a patch baseline.
GetPatchBaselineForPatchGroup
Show Description Retrieves the patch baseline that should be used for the specified patch group.
GetServiceSetting
Show Description ServiceSetting is an account-level setting for an Amazon Web Services service. This setting defines how a user interacts with or uses a service or a feature of a service. For example, if an Amazon Web Services service charges money to the account based on feature or service usage, then the Amazon Web Services service team might create a default setting of false. This means the user can't use this feature unless they change the setting to true and intentionally opt in for a paid feature. Services map a SettingId object to a setting value. Amazon Web Services services teams define the default value for a SettingId. You can't create a new SettingId, but you can overwrite the default value if you have the ssm:UpdateServiceSetting permission for the setting. Use the UpdateServiceSetting API operation to change the default setting. Or use the ResetServiceSetting to change the value back to the original value defined by the Amazon Web Services service team. Query the current service setting for the Amazon Web Services account.
LabelParameterVersion
Show Description A parameter label is a user-defined alias to help you manage different versions of a parameter. When you modify a parameter, Amazon Web Services Systems Manager automatically saves a new version and increments the version number by one. A label can help you remember the purpose of a parameter when there are multiple versions. Parameter labels have the following requirements and restrictions.
  • A version of a parameter can have a maximum of 10 labels.
  • You can't attach the same label to different versions of the same parameter. For example, if version 1 has the label Production, then you can't attach Production to version 2.
  • You can move a label from one version of a parameter to another.
  • You can't create a label when you create a new parameter. You must attach a label to a specific version of a parameter.
  • If you no longer want to use a parameter label, then you can either delete it or move it to a different version of a parameter.
  • A label can have a maximum of 100 characters.
  • Labels can contain letters (case sensitive), numbers, periods (.), hyphens (-), or underscores (_).
  • Labels can't begin with a number, "aws" or "ssm" (not case sensitive). If a label fails to meet these requirements, then the label isn't associated with a parameter and the system displays it in the list of InvalidLabels.
ListAssociationVersions
Show Description Retrieves all versions of an association for a specific association ID.
ListAssociations
Show Description Returns all State Manager associations in the current Amazon Web Services account and Amazon Web Services Region. You can limit the results to a specific State Manager association document or instance by specifying a filter. State Manager is a capability of Amazon Web Services Systems Manager.
ListCommandInvocations
Show Description An invocation is copy of a command sent to a specific instance. A command can apply to one or more instances. A command invocation applies to one instance. For example, if a user runs SendCommand against three instances, then a command invocation is created for each requested instance ID. ListCommandInvocations provide status about command execution.
ListCommands
Show Description Lists the commands requested by users of the Amazon Web Services account.
ListComplianceItems
Show Description For a specified resource ID, this API operation returns a list of compliance statuses for different resource types. Currently, you can only specify one resource ID per call. List results depend on the criteria specified in the filter.
ListComplianceSummaries
Show Description Returns a summary count of compliant and non-compliant resources for a compliance type. For example, this call can return State Manager associations, patches, or custom compliance types according to the filter criteria that you specify.
ListDocumentMetadataHistory
Show Description Information about approval reviews for a version of a change template in Change Manager.
ListDocumentVersions
Show Description List all versions for a document.
ListDocuments
Show Description Returns all Systems Manager (SSM) documents in the current Amazon Web Services account and Amazon Web Services Region. You can limit the results of this request by using a filter.
ListInventoryEntries
Show Description A list of inventory items returned by the request.
ListOpsItemEvents
Show Description Returns a list of all OpsItem events in the current Amazon Web Services Region and Amazon Web Services account. You can limit the results to events associated with specific OpsItems by specifying a filter.
ListOpsItemRelatedItems
Show Description Lists all related-item resources associated with a Systems Manager OpsCenter OpsItem. OpsCenter is a capability of Amazon Web Services Systems Manager.
ListOpsMetadata
Show Description Amazon Web Services Systems Manager calls this API operation when displaying all Application Manager OpsMetadata objects or blobs.
ListResourceComplianceSummaries
Show Description Returns a resource-level summary count. The summary includes information about compliant and non-compliant statuses and detailed compliance-item severity counts, according to the filter criteria you specify.
ListResourceDataSync
Show Description Lists your resource data sync configurations. Includes information about the last time a sync attempted to start, the last sync status, and the last time a sync successfully completed. The number of sync configurations might be too large to return using a single call to ListResourceDataSync. You can limit the number of sync configurations returned by using the MaxResults parameter. To determine whether there are more sync configurations to list, check the value of NextToken in the output. If there are more sync configurations to list, you can request them by specifying the NextToken returned in the call to the parameter of a subsequent call.
ListTagsForResource
Show Description Returns a list of the tags assigned to the specified resource. For information about the ID format for each supported resource type, see AddTagsToResource.
ModifyDocumentPermission
Show Description Shares a Amazon Web Services Systems Manager document (SSM document)publicly or privately. If you share a document privately, you must specify the Amazon Web Services user account IDs for those people who can use the document. If you share a document publicly, you must specify All as the account ID.
PutComplianceItems
Show Description Registers a compliance type and other compliance details on a designated resource. This operation lets you register custom compliance details with a resource. This call overwrites existing compliance information on the resource, so you must provide a full list of compliance items each time that you send the request. ComplianceType can be one of the following:
  • ExecutionId: The execution ID when the patch, association, or custom compliance item was applied.
  • ExecutionType: Specify patch, association, or Custom:string.
  • ExecutionTime. The time the patch, association, or custom compliance item was applied to the instance.
  • Id: The patch, association, or custom compliance ID.
  • Title: A title.
  • Status: The status of the compliance item. For example, approved for patches, or Failed for associations.
  • Severity: A patch severity. For example, critical.
  • DocumentName: An SSM document name. For example, AWS-RunPatchBaseline.
  • DocumentVersion: An SSM document version number. For example, 4.
  • Classification: A patch classification. For example, security updates.
  • PatchBaselineId: A patch baseline ID.
  • PatchSeverity: A patch severity. For example, Critical.
  • PatchState: A patch state. For example, InstancesWithFailedPatches.
  • PatchGroup: The name of a patch group.
  • InstalledTime: The time the association, patch, or custom compliance item was applied to the resource. Specify the time by using the following format: yyyy-MM-dd'T'HH:mm:ss'Z'
PutInventory
Show Description Bulk update custom inventory items on one more instance. The request adds an inventory item, if it doesn't already exist, or updates an inventory item, if it does exist.
PutParameter
Show Description Add a parameter to the system.
RegisterDefaultPatchBaseline
Show Description Defines the default patch baseline for the relevant operating system. To reset the Amazon Web Services-predefined patch baseline as the default, specify the full patch baseline Amazon Resource Name (ARN) as the baseline ID value. For example, for CentOS, specify arn:aws:ssm:us-east-2:733109147000:patchbaseline/pb-0574b43a65ea646ed instead of pb-0574b43a65ea646ed.
RegisterPatchBaselineForPatchGroup
Show Description Registers a patch baseline for a patch group.
RegisterTargetWithMaintenanceWindow
Show Description Registers a target with a maintenance window.
RegisterTaskWithMaintenanceWindow
Show Description Adds a new task to a maintenance window.
RemoveTagsFromResource
Show Description Removes tag keys from the specified resource.
ResetServiceSetting
Show Description ServiceSetting is an account-level setting for an Amazon Web Services service. This setting defines how a user interacts with or uses a service or a feature of a service. For example, if an Amazon Web Services service charges money to the account based on feature or service usage, then the Amazon Web Services service team might create a default setting of "false". This means the user can't use this feature unless they change the setting to "true" and intentionally opt in for a paid feature. Services map a SettingId object to a setting value. Amazon Web Services services teams define the default value for a SettingId. You can't create a new SettingId, but you can overwrite the default value if you have the ssm:UpdateServiceSetting permission for the setting. Use the GetServiceSetting API operation to view the current value. Use the UpdateServiceSetting API operation to change the default setting. Reset the service setting for the account to the default value as provisioned by the Amazon Web Services service team.
ResumeSession
Show Description Reconnects a session to an instance after it has been disconnected. Connections can be resumed for disconnected sessions, but not terminated sessions. This command is primarily for use by client machines to automatically reconnect during intermittent network issues. It isn't intended for any other use.
SendAutomationSignal
Show Description Sends a signal to an Automation execution to change the current behavior or status of the execution.
SendCommand
Show Description Runs commands on one or more managed instances.
StartAssociationsOnce
Show Description Runs an association immediately and only one time. This operation can be helpful when troubleshooting associations.
StartAutomationExecution
Show Description Initiates execution of an Automation runbook.
StartChangeRequestExecution
Show Description Creates a change request for Change Manager. The Automation runbooks specified in the change request run only after all required approvals for the change request have been received.
StartSession
Show Description Initiates a connection to a target (for example, an instance) for a Session Manager session. Returns a URL and token that can be used to open a WebSocket connection for sending input and receiving outputs. Amazon Web Services CLI usage: start-session is an interactive command that requires the Session Manager plugin to be installed on the client machine making the call. For information, see Install the Session Manager plugin for the Amazon Web Services CLI in the Amazon Web Services Systems Manager User Guide. Amazon Web Services Tools for PowerShell usage: Start-SSMSession isn't currently supported by Amazon Web Services Tools for PowerShell on Windows local machines.
StopAutomationExecution
Show Description Stop an Automation that is currently running.
TerminateSession
Show Description Permanently ends a session and closes the data connection between the Session Manager client and SSM Agent on the instance. A terminated session isn't be resumed.
UnlabelParameterVersion
Show Description Remove a label or labels from a parameter.
UpdateAssociation
Show Description Updates an association. You can update the association name and version, the document version, schedule, parameters, and Amazon Simple Storage Service (Amazon S3) output. In order to call this API operation, your Identity and Access Management (IAM) user account, group, or role must be configured with permission to call the DescribeAssociation API operation. If you don't have permission to call DescribeAssociation, then you receive the following error: An error occurred (AccessDeniedException) when calling the UpdateAssociation operation: User: <user_arn> isn't authorized to perform: ssm:DescribeAssociation on resource: <resource_arn> When you update an association, the association immediately runs against the specified targets.
UpdateAssociationStatus
Show Description Updates the status of the Amazon Web Services Systems Manager document (SSM document) associated with the specified instance. UpdateAssociationStatus is primarily used by the Amazon Web Services Systems Manager Agent (SSM Agent) to report status updates about your associations and is only used for associations created with the InstanceId legacy parameter.
UpdateDocument
Show Description Updates one or more values for an SSM document.
UpdateDocumentDefaultVersion
Show Description Set the default version of a document.
UpdateDocumentMetadata
Show Description Updates information related to approval reviews for a specific version of a change template in Change Manager.
UpdateMaintenanceWindow
Show Description Updates an existing maintenance window. Only specified parameters are modified. The value you specify for Duration determines the specific end time for the maintenance window based on the time it begins. No maintenance window tasks are permitted to start after the resulting endtime minus the number of hours you specify for Cutoff. For example, if the maintenance window starts at 3 PM, the duration is three hours, and the value you specify for Cutoff is one hour, no maintenance window tasks can start after 5 PM.
UpdateMaintenanceWindowTarget
Show Description Modifies the target of an existing maintenance window. You can change the following:
  • Name
  • Description
  • Owner
  • IDs for an ID target
  • Tags for a Tag target
  • From any supported tag type to another. The three supported tag types are ID target, Tag target, and resource group. For more information, see Target.
If a parameter is null, then the corresponding field isn't modified.
UpdateMaintenanceWindowTask
Show Description Modifies a task assigned to a maintenance window. You can't change the task type, but you can change the following values:
  • TaskARN. For example, you can change a RUN_COMMAND task from AWS-RunPowerShellScript to AWS-RunShellScript.
  • ServiceRoleArn
  • TaskInvocationParameters
  • Priority
  • MaxConcurrency
  • MaxErrors
One or more targets must be specified for maintenance window Run Command-type tasks. Depending on the task, targets are optional for other maintenance window task types (Automation, Lambda, and Step Functions). For more information about running tasks that don't specify targets, see Registering maintenance window tasks without targets in the Amazon Web Services Systems Manager User Guide. If the value for a parameter in UpdateMaintenanceWindowTask is null, then the corresponding field isn't modified. If you set Replace to true, then all fields required by the RegisterTaskWithMaintenanceWindow operation are required for this request. Optional fields that aren't specified are set to null. When you update a maintenance window task that has options specified in TaskInvocationParameters, you must provide again all the TaskInvocationParameters values that you want to retain. The values you don't specify again are removed. For example, suppose that when you registered a Run Command task, you specified TaskInvocationParameters values for Comment, NotificationConfig, and OutputS3BucketName. If you update the maintenance window task and specify only a different OutputS3BucketName value, the values for Comment and NotificationConfig are removed.
UpdateManagedInstanceRole
Show Description Changes the Identity and Access Management (IAM) role that is assigned to the on-premises instance or virtual machines (VM). IAM roles are first assigned to these hybrid instances during the activation process. For more information, see CreateActivation.
UpdateOpsItem
Show Description Edit or change an OpsItem. You must have permission in Identity and Access Management (IAM) to update an OpsItem. For more information, see Getting started with OpsCenter in the Amazon Web Services Systems Manager User Guide. Operations engineers and IT professionals use Amazon Web Services Systems Manager OpsCenter to view, investigate, and remediate operational issues impacting the performance and health of their Amazon Web Services resources. For more information, see OpsCenter in the Amazon Web Services Systems Manager User Guide.
UpdateOpsMetadata
Show Description Amazon Web Services Systems Manager calls this API operation when you edit OpsMetadata in Application Manager.
UpdatePatchBaseline
Show Description Modifies an existing patch baseline. Fields not specified in the request are left unchanged. For information about valid key-value pairs in PatchFilters for each supported operating system type, see PatchFilter.
UpdateResourceDataSync
Show Description Update a resource data sync. After you create a resource data sync for a Region, you can't change the account options for that sync. For example, if you create a sync in the us-east-2 (Ohio) Region and you choose the Include only the current account option, you can't edit that sync later and choose the Include all accounts from my Organizations configuration option. Instead, you must delete the first resource data sync, and create a new one. This API operation only supports a resource data sync that was created with a SyncFromSource SyncType.
Service Event Name Description
sso-admin AttachManagedPolicyToPermissionSet
Show Description Attaches an IAM managed policy ARN to a permission set. If the permission set is already referenced by one or more account assignments, you will need to call ProvisionPermissionSet after this operation. Calling ProvisionPermissionSet applies the corresponding IAM policy updates to all assigned accounts.
CreateAccountAssignment
Show Description Assigns access to a principal for a specified Amazon Web Services account using a specified permission set. The term principal here refers to a user or group that is defined in Amazon Web Services SSO. As part of a successful CreateAccountAssignment call, the specified permission set will automatically be provisioned to the account in the form of an IAM policy. That policy is attached to the SSO-created IAM role. If the permission set is subsequently updated, the corresponding IAM policies attached to roles in your accounts will not be updated automatically. In this case, you must call ProvisionPermissionSet to make these updates.
CreateInstanceAccessControlAttributeConfiguration
Show Description Enables the attributes-based access control (ABAC) feature for the specified Amazon Web Services SSO instance. You can also specify new attributes to add to your ABAC configuration during the enabling process. For more information about ABAC, see Attribute-Based Access Control in the Amazon Web Services SSO User Guide.
CreatePermissionSet
Show Description Creates a permission set within a specified SSO instance. To grant users and groups access to Amazon Web Services account resources, use CreateAccountAssignment .
DeleteAccountAssignment
Show Description Deletes a principal's access from a specified Amazon Web Services account using a specified permission set.
DeleteInlinePolicyFromPermissionSet
Show Description Deletes the inline policy from a specified permission set.
DeleteInstanceAccessControlAttributeConfiguration
Show Description Disables the attributes-based access control (ABAC) feature for the specified Amazon Web Services SSO instance and deletes all of the attribute mappings that have been configured. Once deleted, any attributes that are received from an identity source and any custom attributes you have previously configured will not be passed. For more information about ABAC, see Attribute-Based Access Control in the Amazon Web Services SSO User Guide.
DeletePermissionSet
Show Description Deletes the specified permission set.
DescribeAccountAssignmentCreationStatus
Show Description Describes the status of the assignment creation request.
DescribeAccountAssignmentDeletionStatus
Show Description Describes the status of the assignment deletion request.
DescribeInstanceAccessControlAttributeConfiguration
Show Description Returns the list of Amazon Web Services SSO identity store attributes that have been configured to work with attributes-based access control (ABAC) for the specified Amazon Web Services SSO instance. This will not return attributes configured and sent by an external identity provider. For more information about ABAC, see Attribute-Based Access Control in the Amazon Web Services SSO User Guide.
DescribePermissionSet
Show Description Gets the details of the permission set.
DescribePermissionSetProvisioningStatus
Show Description Describes the status for the given permission set provisioning request.
DetachManagedPolicyFromPermissionSet
Show Description Detaches the attached IAM managed policy ARN from the specified permission set.
GetInlinePolicyForPermissionSet
Show Description Obtains the inline policy assigned to the permission set.
ListAccountAssignmentCreationStatus
Show Description Lists the status of the Amazon Web Services account assignment creation requests for a specified SSO instance.
ListAccountAssignmentDeletionStatus
Show Description Lists the status of the Amazon Web Services account assignment deletion requests for a specified SSO instance.
ListAccountAssignments
Show Description Lists the assignee of the specified Amazon Web Services account with the specified permission set.
ListAccountsForProvisionedPermissionSet
Show Description Lists all the Amazon Web Services accounts where the specified permission set is provisioned.
ListInstances
Show Description Lists the SSO instances that the caller has access to.
ListManagedPoliciesInPermissionSet
Show Description Lists the IAM managed policy that is attached to a specified permission set.
ListPermissionSetProvisioningStatus
Show Description Lists the status of the permission set provisioning requests for a specified SSO instance.
ListPermissionSets
Show Description Lists the PermissionSets in an SSO instance.
ListPermissionSetsProvisionedToAccount
Show Description Lists all the permission sets that are provisioned to a specified Amazon Web Services account.
ListTagsForResource
Show Description Lists the tags that are attached to a specified resource.
ProvisionPermissionSet
Show Description The process by which a specified permission set is provisioned to the specified target.
PutInlinePolicyToPermissionSet
Show Description Attaches an IAM inline policy to a permission set. If the permission set is already referenced by one or more account assignments, you will need to call ProvisionPermissionSet after this action to apply the corresponding IAM policy updates to all assigned accounts.
TagResource
Show Description Associates a set of tags with a specified resource.
UntagResource
Show Description Disassociates a set of tags from a specified resource.
UpdateInstanceAccessControlAttributeConfiguration
Show Description Updates the Amazon Web Services SSO identity store attributes that you can use with the Amazon Web Services SSO instance for attributes-based access control (ABAC). When using an external identity provider as an identity source, you can pass attributes through the SAML assertion as an alternative to configuring attributes from the Amazon Web Services SSO identity store. If a SAML assertion passes any of these attributes, Amazon Web Services SSO replaces the attribute value with the value from the Amazon Web Services SSO identity store. For more information about ABAC, see Attribute-Based Access Control in the Amazon Web Services SSO User Guide.
## Sso-oidc Events
Service Event Name Description
sso-oidc CreateToken
Show Description Creates and returns an access token for the authorized client. The access token issued will be used to fetch short-term credentials for the assigned roles in the AWS account.
RegisterClient
Show Description Registers a client with AWS SSO. This allows clients to initiate device authorization. The output should be persisted for reuse through many authentication requests.
## Sso Events
Service Event Name Description
sso GetRoleCredentials
Show Description Returns the STS short-term credentials for a given role name that is assigned to the user.
ListAccountRoles
Show Description Lists all roles that are assigned to the user for a given AWS account.
ListAccounts
Show Description Lists all AWS accounts assigned to the user. These AWS accounts are assigned by the administrator of the account. For more information, see Assign User Access in the AWS SSO User Guide. This operation returns a paginated response.
## Stepfunctions Events
Service Event Name Description
stepfunctions CreateActivity
Show Description Creates an activity. An activity is a task that you write in any programming language and host on any machine that has access to AWS Step Functions. Activities must poll Step Functions using the GetActivityTask API action and respond using SendTask* API actions. This function lets Step Functions know the existence of your activity and returns an identifier for use in a state machine and when polling from the activity. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes. CreateActivity is an idempotent API. Subsequent requests won’t create a duplicate resource if it was already created. CreateActivity's idempotency check is based on the activity name. If a following request has different tags values, Step Functions will ignore these differences and treat it as an idempotent request of the previous. In this case, tags will not be updated, even if they are different.
CreateStateMachine
Show Description Creates a state machine. A state machine consists of a collection of states that can do work (Task states), determine to which states to transition next (Choice states), stop an execution with an error (Fail states), and so on. State machines are specified using a JSON-based, structured language. For more information, see Amazon States Language in the AWS Step Functions User Guide. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes. CreateStateMachine is an idempotent API. Subsequent requests won’t create a duplicate resource if it was already created. CreateStateMachine's idempotency check is based on the state machine name, definition, type, LoggingConfiguration and TracingConfiguration. If a following request has a different roleArn or tags, Step Functions will ignore these differences and treat it as an idempotent request of the previous. In this case, roleArn and tags will not be updated, even if they are different.
DeleteActivity
Show Description Deletes an activity.
DeleteStateMachine
Show Description Deletes a state machine. This is an asynchronous operation: It sets the state machine's status to DELETING and begins the deletion process. For EXPRESSstate machines, the deletion will happen eventually (usually less than a minute). Running executions may emit logs after DeleteStateMachine API is called.
DescribeActivity
Show Description Describes an activity. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.
DescribeExecution
Show Description Describes an execution. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes. This API action is not supported by EXPRESS state machines.
DescribeStateMachine
Show Description Describes a state machine. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.
DescribeStateMachineForExecution
Show Description Describes the state machine associated with a specific execution. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes. This API action is not supported by EXPRESS state machines.
GetActivityTask
Show Description Used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine. This initiates a long poll, where the service holds the HTTP connection open and responds as soon as a task becomes available (i.e. an execution of a task of this type is needed.) The maximum time the service holds on to the request before responding is 60 seconds. If no task is available within 60 seconds, the poll returns a taskToken with a null string. Workers should set their client side socket timeout to at least 65 seconds (5 seconds higher than the maximum time the service may hold the poll request). Polling with GetActivityTask can cause latency in some implementations. See Avoid Latency When Polling for Activity Tasks in the Step Functions Developer Guide.
GetExecutionHistory
Show Description Returns the history of the specified execution as a list of events. By default, the results are returned in ascending order of the timeStamp of the events. Use the reverseOrder parameter to get the latest events first. If nextToken is returned, there are more results available. The value of nextToken is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an HTTP 400 InvalidToken error. This API action is not supported by EXPRESS state machines.
ListActivities
Show Description Lists the existing activities. If nextToken is returned, there are more results available. The value of nextToken is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an HTTP 400 InvalidToken error. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.
ListExecutions
Show Description Lists the executions of a state machine that meet the filtering criteria. Results are sorted by time, with the most recent execution first. If nextToken is returned, there are more results available. The value of nextToken is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an HTTP 400 InvalidToken error. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes. This API action is not supported by EXPRESS state machines.
ListStateMachines
Show Description Lists the existing state machines. If nextToken is returned, there are more results available. The value of nextToken is a unique pagination token for each page. Make the call again using the returned token to retrieve the next page. Keep all other arguments unchanged. Each pagination token expires after 24 hours. Using an expired pagination token will return an HTTP 400 InvalidToken error. This operation is eventually consistent. The results are best effort and may not reflect very recent updates and changes.
ListTagsForResource
Show Description List tags for a given resource. Tags may only contain Unicode letters, digits, white space, or these symbols: _ . : / = + - @.
SendTaskFailure
Show Description Used by activity workers and task states using the callback pattern to report that the task identified by the taskToken failed.
SendTaskHeartbeat
Show Description Used by activity workers and task states using the callback pattern to report to Step Functions that the task represented by the specified taskToken is still making progress. This action resets the Heartbeat clock. The Heartbeat threshold is specified in the state machine's Amazon States Language definition (HeartbeatSeconds). This action does not in itself create an event in the execution history. However, if the task times out, the execution history contains an ActivityTimedOut entry for activities, or a TaskTimedOut entry for for tasks using the job run or callback pattern. The Timeout of a task, defined in the state machine's Amazon States Language definition, is its maximum allowed duration, regardless of the number of SendTaskHeartbeat requests received. Use HeartbeatSeconds to configure the timeout interval for heartbeats.
SendTaskSuccess
Show Description Used by activity workers and task states using the callback pattern to report that the task identified by the taskToken completed successfully.
StartExecution
Show Description Starts a state machine execution. StartExecution is idempotent. If StartExecution is called with the same name and input as a running execution, the call will succeed and return the same response as the original request. If the execution is closed or if the input is different, it will return a 400 ExecutionAlreadyExists error. Names can be reused after 90 days.
StartSyncExecution
Show Description Starts a Synchronous Express state machine execution.
StopExecution
Show Description Stops an execution. This API action is not supported by EXPRESS state machines.
TagResource
Show Description Add a tag to a Step Functions resource. An array of key-value pairs. For more information, see Using Cost Allocation Tags in the AWS Billing and Cost Management User Guide, and Controlling Access Using IAM Tags. Tags may only contain Unicode letters, digits, white space, or these symbols: _ . : / = + - @.
UntagResource
Show Description Remove a tag from a Step Functions resource
## Sts Events
Service Event Name Description
sts AssumeRole
Show Description Returns a set of temporary security credentials that you can use to access Amazon Web Services resources that you might not normally have access to. These temporary credentials consist of an access key ID, a secret access key, and a security token. Typically, you use AssumeRole within your account or for cross-account access. For a comparison of AssumeRole with other API operations that produce temporary credentials, see Requesting Temporary Security Credentials and Comparing the STS API operations in the IAM User Guide. Permissions The temporary security credentials created by AssumeRole can be used to make API calls to any Amazon Web Services service with the following exception: You cannot call the STS GetFederationToken or GetSessionToken API operations. (Optional) You can pass inline or managed session policies to this operation. You can pass a single JSON policy document to use as an inline session policy. You can also specify up to 10 managed policies to use as managed session policies. The plaintext that you use for both inline and managed session policies can't exceed 2,048 characters. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the role's identity-based policy and the session policies. You can use the role's temporary credentials in subsequent Amazon Web Services API calls to access resources in the account that owns the role. You cannot use session policies to grant more permissions than those allowed by the identity-based policy of the role that is being assumed. For more information, see Session Policies in the IAM User Guide. To assume a role from a different account, your account must be trusted by the role. The trust relationship is defined in the role's trust policy when the role is created. That trust policy states which accounts are allowed to delegate that access to users in the account. A user who wants to access a role in a different account must also have permissions that are delegated from the user account administrator. The administrator must attach a policy that allows the user to call AssumeRole for the ARN of the role in the other account. If the user is in the same account as the role, then you can do either of the following:
  • Attach a policy to the user (identical to the previous user in a different account).
  • Add the user as a principal directly in the role's trust policy.
In this case, the trust policy acts as an IAM resource-based policy. Users in the same account as the role do not need explicit permission to assume the role. For more information about trust policies and resource-based policies, see IAM Policies in the IAM User Guide. Tags (Optional) You can pass tag key-value pairs to your session. These tags are called session tags. For more information about session tags, see Passing Session Tags in STS in the IAM User Guide. An administrator must grant you the permissions necessary to pass session tags. The administrator can also create granular permissions to allow you to pass only specific session tags. For more information, see Tutorial: Using Tags for Attribute-Based Access Control in the IAM User Guide. You can set the session tags as transitive. Transitive tags persist during role chaining. For more information, see Chaining Roles with Session Tags in the IAM User Guide. Using MFA with AssumeRole (Optional) You can include multi-factor authentication (MFA) information when you call AssumeRole. This is useful for cross-account scenarios to ensure that the user that assumes the role has been authenticated with an Amazon Web Services MFA device. In that scenario, the trust policy of the role being assumed includes a condition that tests for MFA authentication. If the caller does not include valid MFA information, the request to assume the role is denied. The condition in a trust policy that tests for MFA authentication might look like the following example. "Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}} For more information, see Configuring MFA-Protected API Access in the IAM User Guide guide. To use MFA with AssumeRole, you pass values for the SerialNumber and TokenCode parameters. The SerialNumber value identifies the user's hardware or virtual MFA device. The TokenCode is the time-based one-time password (TOTP) that the MFA device produces.
AssumeRoleWithSAML
Show Description Returns a set of temporary security credentials for users who have been authenticated via a SAML authentication response. This operation provides a mechanism for tying an enterprise identity store or directory to role-based Amazon Web Services access without user-specific credentials or configuration. For a comparison of AssumeRoleWithSAML with the other API operations that produce temporary credentials, see Requesting Temporary Security Credentials and Comparing the STS API operations in the IAM User Guide. The temporary security credentials returned by this operation consist of an access key ID, a secret access key, and a security token. Applications can use these temporary security credentials to sign calls to Amazon Web Services services. Session Duration By default, the temporary security credentials created by AssumeRoleWithSAML last for one hour. However, you can use the optional DurationSeconds parameter to specify the duration of your session. Your role session lasts for the duration that you specify, or until the time specified in the SAML authentication response's SessionNotOnOrAfter value, whichever is shorter. You can provide a DurationSeconds value from 900 seconds (15 minutes) up to the maximum session duration setting for the role. This setting can have a value from 1 hour to 12 hours. To learn how to view the maximum value for your role, see View the Maximum Session Duration Setting for a Role in the IAM User Guide. The maximum session duration limit applies when you use the AssumeRole* API operations or the assume-role* CLI commands. However the limit does not apply when you use those operations to create a console URL. For more information, see Using IAM Roles in the IAM User Guide. Role chaining limits your CLI or Amazon Web Services API role session to a maximum of one hour. When you use the AssumeRole API operation to assume a role, you can specify the duration of your role session with the DurationSeconds parameter. You can specify a parameter value of up to 43200 seconds (12 hours), depending on the maximum session duration setting for your role. However, if you assume a role using role chaining and provide a DurationSeconds parameter value greater than one hour, the operation fails. Permissions The temporary security credentials created by AssumeRoleWithSAML can be used to make API calls to any Amazon Web Services service with the following exception: you cannot call the STS GetFederationToken or GetSessionToken API operations. (Optional) You can pass inline or managed session policies to this operation. You can pass a single JSON policy document to use as an inline session policy. You can also specify up to 10 managed policies to use as managed session policies. The plaintext that you use for both inline and managed session policies can't exceed 2,048 characters. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the role's identity-based policy and the session policies. You can use the role's temporary credentials in subsequent Amazon Web Services API calls to access resources in the account that owns the role. You cannot use session policies to grant more permissions than those allowed by the identity-based policy of the role that is being assumed. For more information, see Session Policies in the IAM User Guide. Calling AssumeRoleWithSAML does not require the use of Amazon Web Services security credentials. The identity of the caller is validated by using keys in the metadata document that is uploaded for the SAML provider entity for your identity provider. Calling AssumeRoleWithSAML can result in an entry in your CloudTrail logs. The entry includes the value in the NameID element of the SAML assertion. We recommend that you use a NameIDType that is not associated with any personally identifiable information (PII). For example, you could instead use the persistent identifier (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent). Tags (Optional) You can configure your IdP to pass attributes into your SAML assertion as session tags. Each session tag consists of a key name and an associated value. For more information about session tags, see Passing Session Tags in STS in the IAM User Guide. You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128 characters and the values can’t exceed 256 characters. For these and additional limits, see IAM and STS Character Limits in the IAM User Guide. An Amazon Web Services conversion compresses the passed session policies and session tags into a packed binary format that has a separate limit. Your request can fail for this limit even if your plaintext meets the other requirements. The PackedPolicySize response element indicates by percentage how close the policies and tags for your request are to the upper size limit. You can pass a session tag with the same key as a tag that is attached to the role. When you do, session tags override the role's tags with the same key. An administrator must grant you the permissions necessary to pass session tags. The administrator can also create granular permissions to allow you to pass only specific session tags. For more information, see Tutorial: Using Tags for Attribute-Based Access Control in the IAM User Guide. You can set the session tags as transitive. Transitive tags persist during role chaining. For more information, see Chaining Roles with Session Tags in the IAM User Guide. SAML Configuration Before your application can call AssumeRoleWithSAML, you must configure your SAML identity provider (IdP) to issue the claims required by Amazon Web Services. Additionally, you must use Identity and Access Management (IAM) to create a SAML provider entity in your Amazon Web Services account that represents your identity provider. You must also create an IAM role that specifies this SAML provider in its trust policy. For more information, see the following resources:
AssumeRoleWithWebIdentity
Show Description Returns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider. Example providers include Amazon Cognito, Login with Amazon, Facebook, Google, or any OpenID Connect-compatible identity provider. For mobile applications, we recommend that you use Amazon Cognito. You can use Amazon Cognito with the Amazon Web Services SDK for iOS Developer Guide and the Amazon Web Services SDK for Android Developer Guide to uniquely identify a user. You can also supply the user with a consistent identity throughout the lifetime of an application. To learn more about Amazon Cognito, see Amazon Cognito Overview in Amazon Web Services SDK for Android Developer Guide and Amazon Cognito Overview in the Amazon Web Services SDK for iOS Developer Guide. Calling AssumeRoleWithWebIdentity does not require the use of Amazon Web Services security credentials. Therefore, you can distribute an application (for example, on mobile devices) that requests temporary security credentials without including long-term Amazon Web Services credentials in the application. You also don't need to deploy server-based proxy services that use long-term Amazon Web Services credentials. Instead, the identity of the caller is validated by using a token from the web identity provider. For a comparison of AssumeRoleWithWebIdentity with the other API operations that produce temporary credentials, see Requesting Temporary Security Credentials and Comparing the STS API operations in the IAM User Guide. The temporary security credentials returned by this API consist of an access key ID, a secret access key, and a security token. Applications can use these temporary security credentials to sign calls to Amazon Web Services service API operations. Session Duration By default, the temporary security credentials created by AssumeRoleWithWebIdentity last for one hour. However, you can use the optional DurationSeconds parameter to specify the duration of your session. You can provide a value from 900 seconds (15 minutes) up to the maximum session duration setting for the role. This setting can have a value from 1 hour to 12 hours. To learn how to view the maximum value for your role, see View the Maximum Session Duration Setting for a Role in the IAM User Guide. The maximum session duration limit applies when you use the AssumeRole* API operations or the assume-role* CLI commands. However the limit does not apply when you use those operations to create a console URL. For more information, see Using IAM Roles in the IAM User Guide. Permissions The temporary security credentials created by AssumeRoleWithWebIdentity can be used to make API calls to any Amazon Web Services service with the following exception: you cannot call the STS GetFederationToken or GetSessionToken API operations. (Optional) You can pass inline or managed session policies to this operation. You can pass a single JSON policy document to use as an inline session policy. You can also specify up to 10 managed policies to use as managed session policies. The plaintext that you use for both inline and managed session policies can't exceed 2,048 characters. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the role's identity-based policy and the session policies. You can use the role's temporary credentials in subsequent Amazon Web Services API calls to access resources in the account that owns the role. You cannot use session policies to grant more permissions than those allowed by the identity-based policy of the role that is being assumed. For more information, see Session Policies in the IAM User Guide. Tags (Optional) You can configure your IdP to pass attributes into your web identity token as session tags. Each session tag consists of a key name and an associated value. For more information about session tags, see Passing Session Tags in STS in the IAM User Guide. You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128 characters and the values can’t exceed 256 characters. For these and additional limits, see IAM and STS Character Limits in the IAM User Guide. An Amazon Web Services conversion compresses the passed session policies and session tags into a packed binary format that has a separate limit. Your request can fail for this limit even if your plaintext meets the other requirements. The PackedPolicySize response element indicates by percentage how close the policies and tags for your request are to the upper size limit. You can pass a session tag with the same key as a tag that is attached to the role. When you do, the session tag overrides the role tag with the same key. An administrator must grant you the permissions necessary to pass session tags. The administrator can also create granular permissions to allow you to pass only specific session tags. For more information, see Tutorial: Using Tags for Attribute-Based Access Control in the IAM User Guide. You can set the session tags as transitive. Transitive tags persist during role chaining. For more information, see Chaining Roles with Session Tags in the IAM User Guide. Identities Before your application can call AssumeRoleWithWebIdentity, you must have an identity token from a supported identity provider and create a role that the application can assume. The role that your application assumes must trust the identity provider that is associated with the identity token. In other words, the identity provider must be specified in the role's trust policy. Calling AssumeRoleWithWebIdentity can result in an entry in your CloudTrail logs. The entry includes the Subject of the provided web identity token. We recommend that you avoid using any personally identifiable information (PII) in this field. For example, you could instead use a GUID or a pairwise identifier, as suggested in the OIDC specification. For more information about how to use web identity federation and the AssumeRoleWithWebIdentity API, see the following resources:
DecodeAuthorizationMessage
Show Description Decodes additional information about the authorization status of a request from an encoded message returned in response to an Amazon Web Services request. For example, if a user is not authorized to perform an operation that he or she has requested, the request returns a Client.UnauthorizedOperation response (an HTTP 403 response). Some Amazon Web Services operations additionally return an encoded message that can provide details about this authorization failure. Only certain Amazon Web Services operations return an encoded authorization message. The documentation for an individual operation indicates whether that operation returns an encoded message in addition to returning an HTTP code. The message is encoded because the details of the authorization status can constitute privileged information that the user who requested the operation should not see. To decode an authorization status message, a user must be granted permissions via an IAM policy to request the DecodeAuthorizationMessage (sts:DecodeAuthorizationMessage) action. The decoded message includes the following type of information:
  • Whether the request was denied due to an explicit deny or due to the absence of an explicit allow. For more information, see Determining Whether a Request is Allowed or Denied in the IAM User Guide.
  • The principal who made the request.
  • The requested action.
  • The requested resource.
  • The values of condition keys in the context of the user's request.
GetAccessKeyInfo
Show Description Returns the account identifier for the specified access key ID. Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). For more information about access keys, see Managing Access Keys for IAM Users in the IAM User Guide. When you pass an access key ID to this operation, it returns the ID of the Amazon Web Services account to which the keys belong. Access key IDs beginning with AKIA are long-term credentials for an IAM user or the Amazon Web Services account root user. Access key IDs beginning with ASIA are temporary credentials that are created using STS operations. If the account in the response belongs to you, you can sign in as the root user and review your root user access keys. Then, you can pull a credentials report to learn which IAM user owns the keys. To learn who requested the temporary credentials for an ASIA access key, view the STS events in your CloudTrail logs in the IAM User Guide. This operation does not indicate the state of the access key. The key might be active, inactive, or deleted. Active keys might not have permissions to perform an operation. Providing a deleted access key might return an error that the key doesn't exist.
GetCallerIdentity
Show Description Returns details about the IAM user or role whose credentials are used to call the operation. No permissions are required to perform this operation. If an administrator adds a policy to your IAM user or role that explicitly denies access to the sts:GetCallerIdentity action, you can still perform this operation. Permissions are not required because the same information is returned when an IAM user or role is denied access. To view an example response, see I Am Not Authorized to Perform: iam:DeleteVirtualMFADevice in the IAM User Guide.
GetFederationToken
Show Description Returns a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user. A typical use is in a proxy application that gets temporary security credentials on behalf of distributed applications inside a corporate network. You must call the GetFederationToken operation using the long-term security credentials of an IAM user. As a result, this call is appropriate in contexts where those credentials can be safely stored, usually in a server-based application. For a comparison of GetFederationToken with the other API operations that produce temporary credentials, see Requesting Temporary Security Credentials and Comparing the STS API operations in the IAM User Guide. You can create a mobile-based or browser-based app that can authenticate users using a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible identity provider. In this case, we recommend that you use Amazon Cognito or AssumeRoleWithWebIdentity. For more information, see Federation Through a Web-based Identity Provider in the IAM User Guide. You can also call GetFederationToken using the security credentials of an Amazon Web Services account root user, but we do not recommend it. Instead, we recommend that you create an IAM user for the purpose of the proxy application. Then attach a policy to the IAM user that limits federated users to only the actions and resources that they need to access. For more information, see IAM Best Practices in the IAM User Guide. Session duration The temporary credentials are valid for the specified duration, from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration is 43,200 seconds (12 hours). Temporary credentials that are obtained by using Amazon Web Services account root user credentials have a maximum duration of 3,600 seconds (1 hour). Permissions You can use the temporary credentials created by GetFederationToken in any Amazon Web Services service except the following:
  • You cannot call any IAM operations using the CLI or the Amazon Web Services API.
  • You cannot call any STS operations except GetCallerIdentity.
You must pass an inline or managed session policy to this operation. You can pass a single JSON policy document to use as an inline session policy. You can also specify up to 10 managed policies to use as managed session policies. The plaintext that you use for both inline and managed session policies can't exceed 2,048 characters. Though the session policy parameters are optional, if you do not pass a policy, then the resulting federated user session has no permissions. When you pass session policies, the session permissions are the intersection of the IAM user policies and the session policies that you pass. This gives you a way to further restrict the permissions for a federated user. You cannot use session policies to grant more permissions than those that are defined in the permissions policy of the IAM user. For more information, see Session Policies in the IAM User Guide. For information about using GetFederationToken to create temporary security credentials, see GetFederationToken—Federation Through a Custom Identity Broker. You can use the credentials to access a resource that has a resource-based policy. If that policy specifically references the federated user session in the Principal element of the policy, the session has the permissions allowed by the policy. These permissions are granted in addition to the permissions granted by the session policies. Tags (Optional) You can pass tag key-value pairs to your session. These are called session tags. For more information about session tags, see Passing Session Tags in STS in the IAM User Guide. You can create a mobile-based or browser-based app that can authenticate users using a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible identity provider. In this case, we recommend that you use Amazon Cognito or AssumeRoleWithWebIdentity. For more information, see Federation Through a Web-based Identity Provider in the IAM User Guide. You can also call GetFederationToken using the security credentials of an Amazon Web Services account root user, but we do not recommend it. Instead, we recommend that you create an IAM user for the purpose of the proxy application. Then attach a policy to the IAM user that limits federated users to only the actions and resources that they need to access. For more information, see IAM Best Practices in the IAM User Guide. Session duration The temporary credentials are valid for the specified duration, from 900 seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration is 43,200 seconds (12 hours). Temporary credentials that are obtained by using Amazon Web Services account root user credentials have a maximum duration of 3,600 seconds (1 hour). Permissions You can use the temporary credentials created by GetFederationToken in any Amazon Web Services service except the following:
  • You cannot call any IAM operations using the CLI or the Amazon Web Services API.
  • You cannot call any STS operations except GetCallerIdentity.
You must pass an inline or managed session policy to this operation. You can pass a single JSON policy document to use as an inline session policy. You can also specify up to 10 managed policies to use as managed session policies. The plain text that you use for both inline and managed session policies can't exceed 2,048 characters. Though the session policy parameters are optional, if you do not pass a policy, then the resulting federated user session has no permissions. When you pass session policies, the session permissions are the intersection of the IAM user policies and the session policies that you pass. This gives you a way to further restrict the permissions for a federated user. You cannot use session policies to grant more permissions than those that are defined in the permissions policy of the IAM user. For more information, see Session Policies in the IAM User Guide. For information about using GetFederationToken to create temporary security credentials, see GetFederationToken—Federation Through a Custom Identity Broker. You can use the credentials to access a resource that has a resource-based policy. If that policy specifically references the federated user session in the Principal element of the policy, the session has the permissions allowed by the policy. These permissions are granted in addition to the permissions granted by the session policies. Tags (Optional) You can pass tag key-value pairs to your session. These are called session tags. For more information about session tags, see Passing Session Tags in STS in the IAM User Guide. An administrator must grant you the permissions necessary to pass session tags. The administrator can also create granular permissions to allow you to pass only specific session tags. For more information, see Tutorial: Using Tags for Attribute-Based Access Control in the IAM User Guide. Tag key–value pairs are not case sensitive, but case is preserved. This means that you cannot have separate Department and department tag keys. Assume that the user that you are federating has the Department=Marketing tag and you pass the department=engineering session tag. Department and department are not saved as separate tags, and the session tag passed in the request takes precedence over the user tag.
## Support Events
Service Event Name Description
support AddAttachmentsToSet
Show Description Adds one or more attachments to an attachment set. An attachment set is a temporary container for attachments that you add to a case or case communication. The set is available for 1 hour after it's created. The expiryTime returned in the response is when the set expires.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
AddCommunicationToCase
Show Description Adds additional customer communication to an AWS Support case. Use the caseId parameter to identify the case to which to add communication. You can list a set of email addresses to copy on the communication by using the ccEmailAddresses parameter. The communicationBody value contains the text of the communication.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
CreateCase
Show Description Creates a case in the AWS Support Center. This operation is similar to how you create a case in the AWS Support Center Create Case page. The AWS Support API doesn't support requesting service limit increases. You can submit a service limit increase in the following ways: A successful CreateCase request returns an AWS Support case number. You can use the DescribeCases operation and specify the case number to get existing AWS Support cases. After you create a case, use the AddCommunicationToCase operation to add additional communication or attachments to an existing case. The caseId is separate from the displayId that appears in the AWS Support Center. Use the DescribeCases operation to get the displayId.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeAttachment
Show Description Returns the attachment that has the specified ID. Attachments can include screenshots, error logs, or other files that describe your issue. Attachment IDs are generated by the case management system when you add an attachment to a case or case communication. Attachment IDs are returned in the AttachmentDetails objects that are returned by the DescribeCommunications operation.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeCases
Show Description Returns a list of cases that you specify by passing one or more case IDs. You can use the afterTime and beforeTime parameters to filter the cases by date. You can set values for the includeResolvedCases and includeCommunications parameters to specify how much information to return. The response returns the following in JSON format:
  • One or more CaseDetails data types.
  • One or more nextToken values, which specify where to paginate the returned records represented by the CaseDetails objects.
Case data is available for 12 months after creation. If a case was created more than 12 months ago, a request might return an error.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeCommunications
Show Description Returns communications and attachments for one or more support cases. Use the afterTime and beforeTime parameters to filter by date. You can use the caseId parameter to restrict the results to a specific case. Case data is available for 12 months after creation. If a case was created more than 12 months ago, a request for data might cause an error. You can use the maxResults and nextToken parameters to control the pagination of the results. Set maxResults to the number of cases that you want to display on each page, and use nextToken to specify the resumption of pagination.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeServices
Show Description Returns the current list of AWS services and a list of service categories for each service. You then use service names and categories in your CreateCase requests. Each AWS service has its own set of categories. The service codes and category codes correspond to the values that appear in the Service and Category lists on the AWS Support Center Create Case page. The values in those fields don't necessarily match the service codes and categories returned by the DescribeServices operation. Always use the service codes and categories that the DescribeServices operation returns, so that you have the most recent set of service and category codes.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeSeverityLevels
Show Description Returns the list of severity levels that you can assign to a support case. The severity level for a case is also a field in the CaseDetails data type that you include for a CreateCase request.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeTrustedAdvisorCheckRefreshStatuses
Show Description Returns the refresh status of the AWS Trusted Advisor checks that have the specified check IDs. You can get the check IDs by calling the DescribeTrustedAdvisorChecks operation. Some checks are refreshed automatically, and you can't return their refresh statuses by using the DescribeTrustedAdvisorCheckRefreshStatuses operation. If you call this operation for these checks, you might see an InvalidParameterValue error.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeTrustedAdvisorCheckResult
Show Description Returns the results of the AWS Trusted Advisor check that has the specified check ID. You can get the check IDs by calling the DescribeTrustedAdvisorChecks operation. The response contains a TrustedAdvisorCheckResult object, which contains these three objects: In addition, the response contains these fields:
  • status - The alert status of the check can be ok (green), warning (yellow), error (red), or not_available.
  • timestamp - The time of the last refresh of the check.
  • checkId - The unique identifier for the check.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeTrustedAdvisorCheckSummaries
Show Description Returns the results for the AWS Trusted Advisor check summaries for the check IDs that you specified. You can get the check IDs by calling the DescribeTrustedAdvisorChecks operation. The response contains an array of TrustedAdvisorCheckSummary objects.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
DescribeTrustedAdvisorChecks
Show Description Returns information about all available AWS Trusted Advisor checks, including the name, ID, category, description, and metadata. You must specify a language code. The AWS Support API currently supports English ("en") and Japanese ("ja"). The response contains a TrustedAdvisorCheckDescription object for each check. You must set the AWS Region to us-east-1.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
  • The names and descriptions for Trusted Advisor checks are subject to change. We recommend that you specify the check ID in your code to uniquely identify a check.
RefreshTrustedAdvisorCheck
Show Description Refreshes the AWS Trusted Advisor check that you specify using the check ID. You can get the check IDs by calling the DescribeTrustedAdvisorChecks operation. Some checks are refreshed automatically. If you call the RefreshTrustedAdvisorCheck operation to refresh them, you might see the InvalidParameterValue error. The response contains a TrustedAdvisorCheckRefreshStatus object.
  • You must have a Business or Enterprise Support plan to use the AWS Support API.
  • If you call the AWS Support API from an account that does not have a Business or Enterprise Support plan, the SubscriptionRequiredException error message appears. For information about changing your support plan, see AWS Support.
## Swf Events
Service Event Name Description
swf CountClosedWorkflowExecutions
Show Description Returns the number of closed workflow executions within the given domain that meet the specified filtering criteria. This operation is eventually consistent. The results are best effort and may not exactly reflect recent updates and changes. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the following parameters by using a Condition element with the appropriate keys.
    • tagFilter.tag: String constraint. The key is swf:tagFilter.tag.
    • typeFilter.name: String constraint. The key is swf:typeFilter.name.
    • typeFilter.version: String constraint. The key is swf:typeFilter.version.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
CountOpenWorkflowExecutions
Show Description Returns the number of open workflow executions within the given domain that meet the specified filtering criteria. This operation is eventually consistent. The results are best effort and may not exactly reflect recent updates and changes. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the following parameters by using a Condition element with the appropriate keys.
    • tagFilter.tag: String constraint. The key is swf:tagFilter.tag.
    • typeFilter.name: String constraint. The key is swf:typeFilter.name.
    • typeFilter.version: String constraint. The key is swf:typeFilter.version.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
CountPendingActivityTasks
Show Description Returns the estimated number of activity tasks in the specified task list. The count returned is an approximation and isn't guaranteed to be exact. If you specify a task list that no activity task was ever scheduled in then 0 is returned. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the taskList.name parameter by using a Condition element with the swf:taskList.name key to allow the action to access only certain task lists.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
CountPendingDecisionTasks
Show Description Returns the estimated number of decision tasks in the specified task list. The count returned is an approximation and isn't guaranteed to be exact. If you specify a task list that no decision task was ever scheduled in then 0 is returned. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the taskList.name parameter by using a Condition element with the swf:taskList.name key to allow the action to access only certain task lists.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
DeprecateActivityType
DeprecateDomain
DeprecateWorkflowType
DescribeActivityType
Show Description Returns information about the specified activity type. This includes configuration settings provided when the type was registered and other general information about the type. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the following parameters by using a Condition element with the appropriate keys.
    • activityType.name: String constraint. The key is swf:activityType.name.
    • activityType.version: String constraint. The key is swf:activityType.version.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
DescribeDomain
Show Description Returns information about the specified domain, including description and status. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • You cannot use an IAM policy to constrain this action's parameters.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
DescribeWorkflowExecution
Show Description Returns information about the specified workflow execution including its type and some statistics. This operation is eventually consistent. The results are best effort and may not exactly reflect recent updates and changes. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • You cannot use an IAM policy to constrain this action's parameters.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
DescribeWorkflowType
Show Description Returns information about the specified workflow type. This includes configuration settings specified when the type was registered and other information such as creation date, current status, etc. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the following parameters by using a Condition element with the appropriate keys.
    • workflowType.name: String constraint. The key is swf:workflowType.name.
    • workflowType.version: String constraint. The key is swf:workflowType.version.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
GetWorkflowExecutionHistory
Show Description Returns the history of the specified workflow execution. The results may be split into multiple pages. To retrieve subsequent pages, make the call again using the nextPageToken returned by the initial call. This operation is eventually consistent. The results are best effort and may not exactly reflect recent updates and changes. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • You cannot use an IAM policy to constrain this action's parameters.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
ListActivityTypes
Show Description Returns information about all activities registered in the specified domain that match the specified name and registration status. The result includes information like creation date, current status of the activity, etc. The results may be split into multiple pages. To retrieve subsequent pages, make the call again using the nextPageToken returned by the initial call. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • You cannot use an IAM policy to constrain this action's parameters.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
ListClosedWorkflowExecutions
Show Description Returns a list of closed workflow executions in the specified domain that meet the filtering criteria. The results may be split into multiple pages. To retrieve subsequent pages, make the call again using the nextPageToken returned by the initial call. This operation is eventually consistent. The results are best effort and may not exactly reflect recent updates and changes. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the following parameters by using a Condition element with the appropriate keys.
    • tagFilter.tag: String constraint. The key is swf:tagFilter.tag.
    • typeFilter.name: String constraint. The key is swf:typeFilter.name.
    • typeFilter.version: String constraint. The key is swf:typeFilter.version.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
ListDomains
Show Description Returns the list of domains registered in the account. The results may be split into multiple pages. To retrieve subsequent pages, make the call again using the nextPageToken returned by the initial call. This operation is eventually consistent. The results are best effort and may not exactly reflect recent updates and changes. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains. The element must be set to arn:aws:swf::AccountID:domain/*, where AccountID is the account ID, with no dashes.
  • Use an Action element to allow or deny permission to call this action.
  • You cannot use an IAM policy to constrain this action's parameters.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
ListOpenWorkflowExecutions
Show Description Returns a list of open workflow executions in the specified domain that meet the filtering criteria. The results may be split into multiple pages. To retrieve subsequent pages, make the call again using the nextPageToken returned by the initial call. This operation is eventually consistent. The results are best effort and may not exactly reflect recent updates and changes. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the following parameters by using a Condition element with the appropriate keys.
    • tagFilter.tag: String constraint. The key is swf:tagFilter.tag.
    • typeFilter.name: String constraint. The key is swf:typeFilter.name.
    • typeFilter.version: String constraint. The key is swf:typeFilter.version.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
ListTagsForResource
Show Description List tags for a given domain.
ListWorkflowTypes
Show Description Returns information about workflow types in the specified domain. The results may be split into multiple pages that can be retrieved by making the call repeatedly. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • You cannot use an IAM policy to constrain this action's parameters.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
PollForActivityTask
Show Description Used by workers to get an ActivityTask from the specified activity taskList. This initiates a long poll, where the service holds the HTTP connection open and responds as soon as a task becomes available. The maximum time the service holds on to the request before responding is 60 seconds. If no task is available within 60 seconds, the poll returns an empty result. An empty result, in this context, means that an ActivityTask is returned, but that the value of taskToken is an empty string. If a task is returned, the worker should use its type to identify and process it correctly. Workers should set their client side socket timeout to at least 70 seconds (10 seconds higher than the maximum time service may hold the poll request). Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the taskList.name parameter by using a Condition element with the swf:taskList.name key to allow the action to access only certain task lists.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
PollForDecisionTask
Show Description Used by deciders to get a DecisionTask from the specified decision taskList. A decision task may be returned for any open workflow execution that is using the specified task list. The task includes a paginated view of the history of the workflow execution. The decider should use the workflow type and the history to determine how to properly handle the task. This action initiates a long poll, where the service holds the HTTP connection open and responds as soon a task becomes available. If no decision task is available in the specified task list before the timeout of 60 seconds expires, an empty result is returned. An empty result, in this context, means that a DecisionTask is returned, but that the value of taskToken is an empty string. Deciders should set their client side socket timeout to at least 70 seconds (10 seconds higher than the timeout). Because the number of workflow history events for a single workflow execution might be very large, the result returned might be split up across a number of pages. To retrieve subsequent pages, make additional calls to PollForDecisionTask using the nextPageToken returned by the initial call. Note that you do not call GetWorkflowExecutionHistory with this nextPageToken. Instead, call PollForDecisionTask again. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the taskList.name parameter by using a Condition element with the swf:taskList.name key to allow the action to access only certain task lists.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
RecordActivityTaskHeartbeat
Show Description Used by activity workers to report to the service that the ActivityTask represented by the specified taskToken is still making progress. The worker can also specify details of the progress, for example percent complete, using the details parameter. This action can also be used by the worker as a mechanism to check if cancellation is being requested for the activity task. If a cancellation is being attempted for the specified task, then the boolean cancelRequested flag returned by the service is set to true. This action resets the taskHeartbeatTimeout clock. The taskHeartbeatTimeout is specified in RegisterActivityType. This action doesn't in itself create an event in the workflow execution history. However, if the task times out, the workflow execution history contains a ActivityTaskTimedOut event that contains the information from the last heartbeat generated by the activity worker. The taskStartToCloseTimeout of an activity type is the maximum duration of an activity task, regardless of the number of RecordActivityTaskHeartbeat requests received. The taskStartToCloseTimeout is also specified in RegisterActivityType. This operation is only useful for long-lived activities to report liveliness of the task and to determine if a cancellation is being attempted. If the cancelRequested flag returns true, a cancellation is being attempted. If the worker can cancel the activity, it should respond with RespondActivityTaskCanceled. Otherwise, it should ignore the cancellation request. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • You cannot use an IAM policy to constrain this action's parameters.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
RegisterActivityType
RegisterDomain
RegisterWorkflowType
RequestCancelWorkflowExecution
RespondActivityTaskCanceled
RespondActivityTaskCompleted
RespondActivityTaskFailed
RespondDecisionTaskCompleted
SignalWorkflowExecution
StartWorkflowExecution
Show Description Starts an execution of the workflow type in the specified domain using the provided workflowId and input data. This action returns the newly started workflow execution. Access Control You can use IAM policies to control this action's access to Amazon SWF resources as follows:
  • Use a Resource element with the domain name to limit the action to only specified domains.
  • Use an Action element to allow or deny permission to call this action.
  • Constrain the following parameters by using a Condition element with the appropriate keys.
    • tagList.member.0: The key is swf:tagList.member.0.
    • tagList.member.1: The key is swf:tagList.member.1.
    • tagList.member.2: The key is swf:tagList.member.2.
    • tagList.member.3: The key is swf:tagList.member.3.
    • tagList.member.4: The key is swf:tagList.member.4.
    • taskList: String constraint. The key is swf:taskList.name.
    • workflowType.name: String constraint. The key is swf:workflowType.name.
    • workflowType.version: String constraint. The key is swf:workflowType.version.
If the caller doesn't have sufficient permissions to invoke the action, or the parameter values fall outside the specified constraints, the action fails. The associated event attribute's cause parameter is set to OPERATION_NOT_PERMITTED. For details and example IAM policies, see Using IAM to Manage Access to Amazon SWF Workflows in the Amazon SWF Developer Guide.
TagResource
TerminateWorkflowExecution
UndeprecateActivityType
UndeprecateDomain
UndeprecateWorkflowType
## Synthetics Events
Service Event Name Description
synthetics CreateCanary
Show Description Creates a canary. Canaries are scripts that monitor your endpoints and APIs from the outside-in. Canaries help you check the availability and latency of your web services and troubleshoot anomalies by investigating load time data, screenshots of the UI, logs, and metrics. You can set up a canary to run continuously or just once. Do not use CreateCanary to modify an existing canary. Use UpdateCanary instead. To create canaries, you must have the CloudWatchSyntheticsFullAccess policy. If you are creating a new IAM role for the canary, you also need the the iam:CreateRole, iam:CreatePolicy and iam:AttachRolePolicy permissions. For more information, see Necessary Roles and Permissions. Do not include secrets or proprietary information in your canary names. The canary name makes up part of the Amazon Resource Name (ARN) for the canary, and the ARN is included in outbound calls over the internet. For more information, see Security Considerations for Synthetics Canaries.
DeleteCanary
Show Description Permanently deletes the specified canary. When you delete a canary, resources used and created by the canary are not automatically deleted. After you delete a canary that you do not intend to use again, you should also delete the following:
  • The Lambda functions and layers used by this canary. These have the prefix cwsyn-MyCanaryName .
  • The CloudWatch alarms created for this canary. These alarms have a name of Synthetics-SharpDrop-Alarm-MyCanaryName .
  • Amazon S3 objects and buckets, such as the canary's artifact location.
  • IAM roles created for the canary. If they were created in the console, these roles have the name role/service-role/CloudWatchSyntheticsRole-MyCanaryName .
  • CloudWatch Logs log groups created for the canary. These logs groups have the name /aws/lambda/cwsyn-MyCanaryName .
Before you delete a canary, you might want to use GetCanary to display the information about this canary. Make note of the information returned by this operation so that you can delete these resources after you delete the canary.
DescribeCanaries
Show Description This operation returns a list of the canaries in your account, along with full details about each canary. This operation does not have resource-level authorization, so if a user is able to use DescribeCanaries, the user can see all of the canaries in the account. A deny policy can only be used to restrict access to all canaries. It cannot be used on specific resources.
DescribeCanariesLastRun
Show Description Use this operation to see information from the most recent run of each canary that you have created.
DescribeRuntimeVersions
Show Description Returns a list of Synthetics canary runtime versions. For more information, see Canary Runtime Versions.
GetCanary
Show Description Retrieves complete information about one canary. You must specify the name of the canary that you want. To get a list of canaries and their names, use DescribeCanaries.
GetCanaryRuns
Show Description Retrieves a list of runs for a specified canary.
ListTagsForResource
Show Description Displays the tags associated with a canary.
StartCanary
Show Description Use this operation to run a canary that has already been created. The frequency of the canary runs is determined by the value of the canary's Schedule. To see a canary's schedule, use GetCanary.
StopCanary
Show Description Stops the canary to prevent all future runs. If the canary is currently running, Synthetics stops waiting for the current run of the specified canary to complete. The run that is in progress completes on its own, publishes metrics, and uploads artifacts, but it is not recorded in Synthetics as a completed run. You can use StartCanary to start it running again with the canary’s current schedule at any point in the future.
TagResource
Show Description Assigns one or more tags (key-value pairs) to the specified canary. Tags can help you organize and categorize your resources. You can also use them to scope user permissions, by granting a user permission to access or change only resources with certain tag values. Tags don't have any semantic meaning to Amazon Web Services and are interpreted strictly as strings of characters. You can use the TagResource action with a canary that already has tags. If you specify a new tag key for the alarm, this tag is appended to the list of tags associated with the alarm. If you specify a tag key that is already associated with the alarm, the new tag value that you specify replaces the previous value for that tag. You can associate as many as 50 tags with a canary.
UntagResource
Show Description Removes one or more tags from the specified canary.
## Textract Events
Service Event Name Description
textract AnalyzeDocument
Show Description Analyzes an input document for relationships between detected items. The types of information returned are as follows:
  • Form data (key-value pairs). The related information is returned in two Block objects, each of type KEY_VALUE_SET: a KEY Block object and a VALUE Block object. For example, Name: Ana Silva Carolina contains a key and value. Name: is the key. Ana Silva Carolina is the value.
  • Table and table cell data. A TABLE Block object contains information about a detected table. A CELL Block object is returned for each cell in a table.
  • Lines and words of text. A LINE Block object contains one or more WORD Block objects. All lines and words that are detected in the document are returned (including text that doesn't have a relationship with the value of FeatureTypes).
Selection elements such as check boxes and option buttons (radio buttons) can be detected in form data and in tables. A SELECTION_ELEMENT Block object contains information about a selection element, including the selection status. You can choose which type of analysis to perform by specifying the FeatureTypes list. The output is returned in a list of Block objects. AnalyzeDocument is a synchronous operation. To analyze documents asynchronously, use StartDocumentAnalysis. For more information, see Document Text Analysis.
AnalyzeExpense
Show Description Analyzes an input document for financially related relationships between text. Information is returned as ExpenseDocuments and seperated as follows.
  • LineItemGroups- A data set containing LineItems which store information about the lines of text, such as an item purchased and its price on a receipt.
  • SummaryFields- Contains all other information a receipt, such as header information or the vendors name.
DetectDocumentText
Show Description Detects text in the input document. Amazon Textract can detect lines of text and the words that make up a line of text. The input document must be an image in JPEG or PNG format. DetectDocumentText returns the detected text in an array of Block objects. Each document page has as an associated Block of type PAGE. Each PAGE Block object is the parent of LINE Block objects that represent the lines of detected text on a page. A LINE Block object is a parent for each word that makes up the line. Words are represented by Block objects of type WORD. DetectDocumentText is a synchronous operation. To analyze documents asynchronously, use StartDocumentTextDetection. For more information, see Document Text Detection.
GetDocumentAnalysis
Show Description Gets the results for an Amazon Textract asynchronous operation that analyzes text in a document. You start asynchronous text analysis by calling StartDocumentAnalysis, which returns a job identifier (JobId). When the text analysis operation finishes, Amazon Textract publishes a completion status to the Amazon Simple Notification Service (Amazon SNS) topic that's registered in the initial call to StartDocumentAnalysis. To get the results of the text-detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetDocumentAnalysis, and pass the job identifier (JobId) from the initial call to StartDocumentAnalysis. GetDocumentAnalysis returns an array of Block objects. The following types of information are returned:
  • Form data (key-value pairs). The related information is returned in two Block objects, each of type KEY_VALUE_SET: a KEY Block object and a VALUE Block object. For example, Name: Ana Silva Carolina contains a key and value. Name: is the key. Ana Silva Carolina is the value.
  • Table and table cell data. A TABLE Block object contains information about a detected table. A CELL Block object is returned for each cell in a table.
  • Lines and words of text. A LINE Block object contains one or more WORD Block objects. All lines and words that are detected in the document are returned (including text that doesn't have a relationship with the value of the StartDocumentAnalysis FeatureTypes input parameter).
Selection elements such as check boxes and option buttons (radio buttons) can be detected in form data and in tables. A SELECTION_ELEMENT Block object contains information about a selection element, including the selection status. Use the MaxResults parameter to limit the number of blocks that are returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetDocumentAnalysis, and populate the NextToken request parameter with the token value that's returned from the previous call to GetDocumentAnalysis. For more information, see Document Text Analysis.
GetDocumentTextDetection
Show Description Gets the results for an Amazon Textract asynchronous operation that detects text in a document. Amazon Textract can detect lines of text and the words that make up a line of text. You start asynchronous text detection by calling StartDocumentTextDetection, which returns a job identifier (JobId). When the text detection operation finishes, Amazon Textract publishes a completion status to the Amazon Simple Notification Service (Amazon SNS) topic that's registered in the initial call to StartDocumentTextDetection. To get the results of the text-detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetDocumentTextDetection, and pass the job identifier (JobId) from the initial call to StartDocumentTextDetection. GetDocumentTextDetection returns an array of Block objects. Each document page has as an associated Block of type PAGE. Each PAGE Block object is the parent of LINE Block objects that represent the lines of detected text on a page. A LINE Block object is a parent for each word that makes up the line. Words are represented by Block objects of type WORD. Use the MaxResults parameter to limit the number of blocks that are returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetDocumentTextDetection, and populate the NextToken request parameter with the token value that's returned from the previous call to GetDocumentTextDetection. For more information, see Document Text Detection.
GetExpenseAnalysis
Show Description Gets the results for an Amazon Textract asynchronous operation that analyzes invoices and receipts. Amazon Textract finds contact information, items purchased, and vendor name, from input invoices and receipts. You start asynchronous invoice/receipt analysis by calling StartExpenseAnalysis, which returns a job identifier (JobId). Upon completion of the invoice/receipt analysis, Amazon Textract publishes the completion status to the Amazon Simple Notification Service (Amazon SNS) topic. This topic must be registered in the initial call to StartExpenseAnalysis. To get the results of the invoice/receipt analysis operation, first ensure that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetExpenseAnalysis, and pass the job identifier (JobId) from the initial call to StartExpenseAnalysis. Use the MaxResults parameter to limit the number of blocks that are returned. If there are more results than specified in MaxResults, the value of NextToken in the operation response contains a pagination token for getting the next set of results. To get the next page of results, call GetExpenseAnalysis, and populate the NextToken request parameter with the token value that's returned from the previous call to GetExpenseAnalysis. For more information, see Analyzing Invoices and Receipts.
StartDocumentAnalysis
Show Description Starts the asynchronous analysis of an input document for relationships between detected items such as key-value pairs, tables, and selection elements. StartDocumentAnalysis can analyze text in documents that are in JPEG, PNG, TIFF, and PDF format. The documents are stored in an Amazon S3 bucket. Use DocumentLocation to specify the bucket name and file name of the document. StartDocumentAnalysis returns a job identifier (JobId) that you use to get the results of the operation. When text analysis is finished, Amazon Textract publishes a completion status to the Amazon Simple Notification Service (Amazon SNS) topic that you specify in NotificationChannel. To get the results of the text analysis operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetDocumentAnalysis, and pass the job identifier (JobId) from the initial call to StartDocumentAnalysis. For more information, see Document Text Analysis.
StartDocumentTextDetection
Show Description Starts the asynchronous detection of text in a document. Amazon Textract can detect lines of text and the words that make up a line of text. StartDocumentTextDetection can analyze text in documents that are in JPEG, PNG, TIFF, and PDF format. The documents are stored in an Amazon S3 bucket. Use DocumentLocation to specify the bucket name and file name of the document. StartTextDetection returns a job identifier (JobId) that you use to get the results of the operation. When text detection is finished, Amazon Textract publishes a completion status to the Amazon Simple Notification Service (Amazon SNS) topic that you specify in NotificationChannel. To get the results of the text detection operation, first check that the status value published to the Amazon SNS topic is SUCCEEDED. If so, call GetDocumentTextDetection, and pass the job identifier (JobId) from the initial call to StartDocumentTextDetection. For more information, see Document Text Detection.
## Timestream-query Events
Service Event Name Description
timestream-query CancelQuery
Show Description Cancels a query that has been issued. Cancellation is guaranteed only if the query has not completed execution before the cancellation request was issued. Because cancellation is an idempotent operation, subsequent cancellation requests will return a CancellationMessage, indicating that the query has already been canceled.
DescribeEndpoints
Show Description DescribeEndpoints returns a list of available endpoints to make Timestream API calls against. This API is available through both Write and Query. Because Timestream’s SDKs are designed to transparently work with the service’s architecture, including the management and mapping of the service endpoints, it is not recommended that you use this API unless:
  • Your application uses a programming language that does not yet have SDK support
  • You require better control over the client-side implementation
For detailed information on how to use DescribeEndpoints, see The Endpoint Discovery Pattern and REST APIs.
## Timestream-write Events
Service Event Name Description
timestream-write CreateDatabase
Show Description Creates a new Timestream database. If the KMS key is not specified, the database will be encrypted with a Timestream managed KMS key located in your account. Refer to AWS managed KMS keys for more info. Service quotas apply. For more information, see Access Management in the Timestream Developer Guide.
CreateTable
Show Description The CreateTable operation adds a new table to an existing database in your account. In an AWS account, table names must be at least unique within each Region if they are in the same database. You may have identical table names in the same Region if the tables are in seperate databases. While creating the table, you must specify the table name, database name, and the retention properties. Service quotas apply. For more information, see Access Management in the Timestream Developer Guide.
DeleteDatabase
DeleteTable
DescribeDatabase
Show Description Returns information about the database, including the database name, time that the database was created, and the total number of tables found within the database. Service quotas apply. For more information, see Access Management in the Timestream Developer Guide.
DescribeEndpoints
Show Description DescribeEndpoints returns a list of available endpoints to make Timestream API calls against. This API is available through both Write and Query. Because Timestream’s SDKs are designed to transparently work with the service’s architecture, including the management and mapping of the service endpoints, it is not recommended that you use this API unless:
  • Your application uses a programming language that does not yet have SDK support
  • You require better control over the client-side implementation
For detailed information on how to use DescribeEndpoints, see The Endpoint Discovery Pattern and REST APIs.
DescribeTable
Show Description Returns information about the table, including the table name, database name, retention duration of the memory store and the magnetic store. Service quotas apply. For more information, see Access Management in the Timestream Developer Guide.
ListDatabases
Show Description Returns a list of your Timestream databases. Service quotas apply. For more information, see Access Management in the Timestream Developer Guide.
ListTables
Show Description A list of tables, along with the name, status and retention properties of each table.
ListTagsForResource
Show Description List all tags on a Timestream resource.
TagResource
Show Description Associate a set of tags with a Timestream resource. You can then activate these user-defined tags so that they appear on the Billing and Cost Management console for cost allocation tracking.
UntagResource
Show Description Removes the association of tags from a Timestream resource.
UpdateDatabase
Show Description Modifies the KMS key for an existing database. While updating the database, you must specify the database name and the identifier of the new KMS key to be used (KmsKeyId). If there are any concurrent UpdateDatabase requests, first writer wins.
UpdateTable
Show Description Modifies the retention duration of the memory store and magnetic store for your Timestream table. Note that the change in retention duration takes effect immediately. For example, if the retention period of the memory store was initially set to 2 hours and then changed to 24 hours, the memory store will be capable of holding 24 hours of data, but will be populated with 24 hours of data 22 hours after this change was made. Timestream does not retrieve data from the magnetic store to populate the memory store. Service quotas apply. For more information, see Access Management in the Timestream Developer Guide.
## Transcribe Events
Service Event Name Description
transcribe CreateCallAnalyticsCategory
Show Description Creates an analytics category. Amazon Transcribe applies the conditions specified by your analytics categories to your call analytics jobs. For each analytics category, you specify one or more rules. For example, you can specify a rule that the customer sentiment was neutral or negative within that category. If you start a call analytics job, Amazon Transcribe applies the category to the analytics job that you've specified.
CreateLanguageModel
Show Description Creates a new custom language model. Use Amazon S3 prefixes to provide the location of your input files. The time it takes to create your model depends on the size of your training data.
CreateMedicalVocabulary
Show Description Creates a new custom vocabulary that you can use to modify how Amazon Transcribe Medical transcribes your audio file.
CreateVocabulary
Show Description Creates a new custom vocabulary that you can use to change the way Amazon Transcribe handles transcription of an audio file.
CreateVocabularyFilter
Show Description Creates a new vocabulary filter that you can use to filter words, such as profane words, from the output of a transcription job.
DeleteCallAnalyticsCategory
Show Description Deletes a call analytics category using its name.
DeleteCallAnalyticsJob
Show Description Deletes a call analytics job using its name.
DeleteLanguageModel
DeleteMedicalTranscriptionJob
DeleteMedicalVocabulary
DeleteTranscriptionJob
DeleteVocabulary
DeleteVocabularyFilter
DescribeLanguageModel
Show Description Gets information about a single custom language model. Use this information to see details about the language model in your Amazon Web Services account. You can also see whether the base language model used to create your custom language model has been updated. If Amazon Transcribe has updated the base model, you can create a new custom language model using the updated base model. If the language model wasn't created, you can use this operation to understand why Amazon Transcribe couldn't create it.
GetCallAnalyticsCategory
Show Description Retrieves information about a call analytics category.
GetCallAnalyticsJob
Show Description Returns information about a call analytics job. To see the status of the job, check the CallAnalyticsJobStatus field. If the status is COMPLETED, the job is finished and you can find the results at the location specified in the TranscriptFileUri field. If you enable personally identifiable information (PII) redaction, the redacted transcript appears in the RedactedTranscriptFileUri field.
GetMedicalTranscriptionJob
Show Description Returns information about a transcription job from Amazon Transcribe Medical. To see the status of the job, check the TranscriptionJobStatus field. If the status is COMPLETED, the job is finished. You find the results of the completed job in the TranscriptFileUri field.
GetMedicalVocabulary
Show Description Retrieves information about a medical vocabulary.
GetTranscriptionJob
Show Description Returns information about a transcription job. To see the status of the job, check the TranscriptionJobStatus field. If the status is COMPLETED, the job is finished and you can find the results at the location specified in the TranscriptFileUri field. If you enable content redaction, the redacted transcript appears in RedactedTranscriptFileUri.
GetVocabulary
Show Description Gets information about a vocabulary.
GetVocabularyFilter
Show Description Returns information about a vocabulary filter.
ListCallAnalyticsCategories
Show Description Provides more information about the call analytics categories that you've created. You can use the information in this list to find a specific category. You can then use the operation to get more information about it.
ListCallAnalyticsJobs
Show Description List call analytics jobs with a specified status or substring that matches their names.
ListLanguageModels
Show Description Provides more information about the custom language models you've created. You can use the information in this list to find a specific custom language model. You can then use the operation to get more information about it.
ListMedicalTranscriptionJobs
Show Description Lists medical transcription jobs with a specified status or substring that matches their names.
ListMedicalVocabularies
Show Description Returns a list of vocabularies that match the specified criteria. If you don't enter a value in any of the request parameters, returns the entire list of vocabularies.
ListTagsForResource
Show Description Lists all tags associated with a given transcription job, vocabulary, or resource.
ListTranscriptionJobs
Show Description Lists transcription jobs with the specified status.
ListVocabularies
Show Description Returns a list of vocabularies that match the specified criteria. If no criteria are specified, returns the entire list of vocabularies.
ListVocabularyFilters
Show Description Gets information about vocabulary filters.
StartCallAnalyticsJob
Show Description Starts an asynchronous analytics job that not only transcribes the audio recording of a caller and agent, but also returns additional insights. These insights include how quickly or loudly the caller or agent was speaking. To retrieve additional insights with your analytics jobs, create categories. A category is a way to classify analytics jobs based on attributes, such as a customer's sentiment or a particular phrase being used during the call. For more information, see the operation.
StartMedicalTranscriptionJob
Show Description Starts a batch job to transcribe medical speech to text.
StartTranscriptionJob
Show Description Starts an asynchronous job to transcribe speech to text.
TagResource
Show Description Tags an Amazon Transcribe resource with the given list of tags.
UntagResource
Show Description Removes specified tags from a specified Amazon Transcribe resource.
UpdateCallAnalyticsCategory
Show Description Updates the call analytics category with new values. The UpdateCallAnalyticsCategory operation overwrites all of the existing information with the values that you provide in the request.
UpdateMedicalVocabulary
Show Description Updates a vocabulary with new values that you provide in a different text file from the one you used to create the vocabulary. The UpdateMedicalVocabulary operation overwrites all of the existing information with the values that you provide in the request.
UpdateVocabulary
Show Description Updates an existing vocabulary with new values. The UpdateVocabulary operation overwrites all of the existing information with the values that you provide in the request.
## Transfer Events
Service Event Name Description
transfer CreateAccess
Show Description Used by administrators to choose which groups in the directory should have access to upload and download files over the enabled protocols using Amazon Web Services Transfer Family. For example, a Microsoft Active Directory might contain 50,000 users, but only a small fraction might need the ability to transfer files to the server. An administrator can use CreateAccess to limit the access to the correct set of users who need this ability.
CreateServer
Show Description Instantiates an auto-scaling virtual server based on the selected file transfer protocol in Amazon Web Services. When you make updates to your file transfer protocol-enabled server or when you work with users, use the service-generated ServerId property that is assigned to the newly created server.
CreateUser
Show Description Creates a user and associates them with an existing file transfer protocol-enabled server. You can only create and associate users with servers that have the IdentityProviderType set to SERVICE_MANAGED. Using parameters for CreateUser, you can specify the user name, set the home directory, store the user's public key, and assign the user's Amazon Web Services Identity and Access Management (IAM) role. You can also optionally add a session policy, and assign metadata with tags that can be used to group and search for users.
CreateWorkflow
Show Description Allows you to create a workflow with specified steps and step details the workflow invokes after file transfer completes. After creating a workflow, you can associate the workflow created with any transfer servers by specifying the workflow-details field in CreateServer and UpdateServer operations.
DeleteAccess
DeleteServer
DeleteSshPublicKey
DeleteUser
DeleteWorkflow
DescribeAccess
Show Description Describes the access that is assigned to the specific file transfer protocol-enabled server, as identified by its ServerId property and its ExternalID. The response from this call returns the properties of the access that is associated with the ServerId value that was specified.
DescribeExecution
Show Description You can use DescribeExecution to check the details of the execution of the specified workflow.
DescribeSecurityPolicy
Show Description Describes the security policy that is attached to your file transfer protocol-enabled server. The response contains a description of the security policy's properties. For more information about security policies, see Working with security policies.
DescribeServer
Show Description Describes a file transfer protocol-enabled server that you specify by passing the ServerId parameter. The response contains a description of a server's properties. When you set EndpointType to VPC, the response will contain the EndpointDetails.
DescribeUser
Show Description Describes the user assigned to the specific file transfer protocol-enabled server, as identified by its ServerId property. The response from this call returns the properties of the user associated with the ServerId value that was specified.
DescribeWorkflow
Show Description Describes the specified workflow.
ImportSshPublicKey
Show Description Adds a Secure Shell (SSH) public key to a user account identified by a UserName value assigned to the specific file transfer protocol-enabled server, identified by ServerId. The response returns the UserName value, the ServerId value, and the name of the SshPublicKeyId.
ListAccesses
Show Description Lists the details for all the accesses you have on your server.
ListExecutions
Show Description Lists all executions for the specified workflow.
ListSecurityPolicies
Show Description Lists the security policies that are attached to your file transfer protocol-enabled servers.
ListServers
Show Description Lists the file transfer protocol-enabled servers that are associated with your Amazon Web Services account.
ListTagsForResource
Show Description Lists all of the tags associated with the Amazon Resource Name (ARN) that you specify. The resource can be a user, server, or role.
ListUsers
Show Description Lists the users for a file transfer protocol-enabled server that you specify by passing the ServerId parameter.
ListWorkflows
Show Description Lists all of your workflows.
SendWorkflowStepState
Show Description Sends a callback for asynchronous custom steps. The ExecutionId, WorkflowId, and Token are passed to the target resource during execution of a custom step of a workflow. You must include those with their callback as well as providing a status.
StartServer
StopServer
TagResource
TestIdentityProvider
Show Description If the IdentityProviderType of a file transfer protocol-enabled server is AWS_DIRECTORY_SERVICE or API_Gateway, tests whether your identity provider is set up successfully. We highly recommend that you call this operation to test your authentication method as soon as you create your server. By doing so, you can troubleshoot issues with the identity provider integration to ensure that your users can successfully use the service. The ServerId and UserName parameters are required. The ServerProtocol, SourceIp, and UserPassword are all optional. You cannot use TestIdentityProvider if the IdentityProviderType of your server is SERVICE_MANAGED.
  • If you provide any incorrect values for any parameters, the Response field is empty.
  • If you provide a server ID for a server that uses service-managed users, you get an error: An error occurred (InvalidRequestException) when calling the TestIdentityProvider operation: s-server-ID not configured for external auth
  • If you enter a Server ID for the --server-id parameter that does not identify an actual Transfer server, you receive the following error: An error occurred (ResourceNotFoundException) when calling the TestIdentityProvider operation: Unknown server
UntagResource
UpdateAccess
Show Description Allows you to update parameters for the access specified in the ServerID and ExternalID parameters.
UpdateServer
Show Description Updates the file transfer protocol-enabled server's properties after that server has been created. The UpdateServer call returns the ServerId of the server you updated.
## Translate Events
Service Event Name Description
translate CreateParallelData
Show Description Creates a parallel data resource in Amazon Translate by importing an input file from Amazon S3. Parallel data files contain examples of source phrases and their translations from your translation memory. By adding parallel data, you can influence the style, tone, and word choice in your translation output.
DeleteParallelData
Show Description Deletes a parallel data resource in Amazon Translate.
DeleteTerminology
DescribeTextTranslationJob
Show Description Gets the properties associated with an asycnhronous batch translation job including name, ID, status, source and target languages, input/output S3 buckets, and so on.
GetParallelData
Show Description Provides information about a parallel data resource.
GetTerminology
Show Description Retrieves a custom terminology.
ImportTerminology
Show Description Creates or updates a custom terminology, depending on whether or not one already exists for the given terminology name. Importing a terminology with the same name as an existing one will merge the terminologies based on the chosen merge strategy. Currently, the only supported merge strategy is OVERWRITE, and so the imported terminology will overwrite an existing terminology of the same name. If you import a terminology that overwrites an existing one, the new terminology take up to 10 minutes to fully propagate and be available for use in a translation due to cache policies with the DataPlane service that performs the translations.
ListParallelData
Show Description Provides a list of your parallel data resources in Amazon Translate.
ListTerminologies
Show Description Provides a list of custom terminologies associated with your account.
ListTextTranslationJobs
Show Description Gets a list of the batch translation jobs that you have submitted.
StartTextTranslationJob
Show Description Starts an asynchronous batch translation job. Batch translation jobs can be used to translate large volumes of text across multiple documents at once. For more information, see async. Batch translation jobs can be described with the DescribeTextTranslationJob operation, listed with the ListTextTranslationJobs operation, and stopped with the StopTextTranslationJob operation. Amazon Translate does not support batch translation of multiple source languages at once.
StopTextTranslationJob
Show Description Stops an asynchronous batch translation job that is in progress. If the job's state is IN_PROGRESS, the job will be marked for termination and put into the STOP_REQUESTED state. If the job completes before it can be stopped, it is put into the COMPLETED state. Otherwise, the job is put into the STOPPED state. Asynchronous batch translation jobs are started with the StartTextTranslationJob operation. You can use the DescribeTextTranslationJob or ListTextTranslationJobs operations to get a batch translation job's JobId.
TranslateText
Show Description Translates input text from the source language to the target language. For a list of available languages and language codes, see what-is-languages.
## Voice-id Events
Service Event Name Description
voice-id CreateDomain
Show Description Creates a domain that contains all Amazon Connect Voice ID data, such as speakers, fraudsters, customer audio, and voiceprints.
DeleteDomain
DeleteFraudster
DeleteSpeaker
DescribeDomain
Show Description Describes the specified domain.
DescribeFraudster
Show Description Describes the specified fraudster.
DescribeFraudsterRegistrationJob
Show Description Describes the specified fraudster registration job.
DescribeSpeaker
Show Description Describes the specified speaker.
DescribeSpeakerEnrollmentJob
Show Description Describes the specified speaker enrollment job.
EvaluateSession
Show Description Evaluates a specified session based on audio data accumulated during a streaming Amazon Connect Voice ID call.
ListDomains
Show Description Lists all the domains in the Amazon Web Services account.
ListFraudsterRegistrationJobs
Show Description Lists all the fraudster registration jobs in the domain with the given JobStatus. If JobStatus is not provided, this lists all fraudster registration jobs in the given domain.
ListSpeakerEnrollmentJobs
Show Description Lists all the speaker enrollment jobs in the domain with the specified JobStatus. If JobStatus is not provided, this lists all jobs with all possible speaker enrollment job statuses.
ListSpeakers
Show Description Lists all speakers in a specified domain.
ListTagsForResource
Show Description Lists all tags associated with a specified Voice ID resource.
OptOutSpeaker
Show Description Opts out a speaker from Voice ID system. A speaker can be opted out regardless of whether or not they already exist in the system. If they don't yet exist, a new speaker is created in an opted out state. If they already exist, their existing status is overridden and they are opted out. Enrollment and evaluation authentication requests are rejected for opted out speakers, and opted out speakers have no voice embeddings stored in the system.
StartFraudsterRegistrationJob
Show Description Starts a new batch fraudster registration job using provided details.
StartSpeakerEnrollmentJob
Show Description Starts a new batch speaker enrollment job using specified details.
TagResource
Show Description Tags an Amazon Connect Voice ID resource with the provided list of tags.
UntagResource
Show Description Removes specified tags from a specified Amazon Connect Voice ID resource.
## Waf-regional Events
Service Event Name Description
waf-regional AssociateWebACL
Show Description This is AWS WAF Classic Regional documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Associates a web ACL with a resource, either an application load balancer or Amazon API Gateway stage.
CreateByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a ByteMatchSet. You then use UpdateByteMatchSet to identify the part of a web request that you want AWS WAF to inspect, such as the values of the User-Agent header or the query string. For example, you can create a ByteMatchSet that matches any requests with User-Agent headers that contain the string BadBot. You can then configure AWS WAF to reject those requests. To create and configure a ByteMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateByteMatchSet request.
  2. Submit a CreateByteMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateByteMatchSet request.
  4. Submit an UpdateByteMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates an GeoMatchSet, which you use to specify which web requests you want to allow or block based on the country that the requests originate from. For example, if you're receiving a lot of requests from one or more countries and you want to block the requests, you can create an GeoMatchSet that contains those countries and then configure AWS WAF to block the requests. To create and configure a GeoMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateGeoMatchSet request.
  2. Submit a CreateGeoMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateGeoMatchSet request.
  4. Submit an UpdateGeoMatchSetSet request to specify the countries that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates an IPSet, which you use to specify which web requests that you want to allow or block based on the IP addresses that the requests originate from. For example, if you're receiving a lot of requests from one or more individual IP addresses or one or more ranges of IP addresses and you want to block the requests, you can create an IPSet that contains those IP addresses and then configure AWS WAF to block the requests. To create and configure an IPSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateIPSet request.
  2. Submit a CreateIPSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateIPSet request.
  4. Submit an UpdateIPSet request to specify the IP addresses that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RateBasedRule. The RateBasedRule contains a RateLimit, which specifies the maximum number of requests that AWS WAF allows from a specified IP address in a five-minute period. The RateBasedRule also contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to count or block if these requests exceed the RateLimit. If you add more than one predicate to a RateBasedRule, a request not only must exceed the RateLimit, but it also must match all the conditions to be counted or blocked. For example, suppose you add the following to a RateBasedRule:
  • An IPSet that matches the IP address 192.0.2.44/32
  • A ByteMatchSet that matches BadBot in the User-Agent header
Further, you specify a RateLimit of 1,000. You then add the RateBasedRule to a WebACL and specify that you want to block requests that meet the conditions in the rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot. Further, requests that match these two conditions must be received at a rate of more than 1,000 requests every five minutes. If both conditions are met and the rate is exceeded, AWS WAF blocks the requests. If the rate drops below 1,000 for a five-minute period, AWS WAF no longer blocks the requests. As a second example, suppose you want to limit requests to a particular page on your site. To do this, you could add the following to a RateBasedRule:
  • A ByteMatchSet with FieldToMatch of URI
  • A PositionalConstraint of STARTS_WITH
  • A TargetString of login
Further, you specify a RateLimit of 1,000. By adding this RateBasedRule to a WebACL, you could limit requests to your login page without affecting the rest of your site. To create and configure a RateBasedRule, perform the following steps:
  1. Create and update the predicates that you want to include in the rule. For more information, see CreateByteMatchSet, CreateIPSet, and CreateSqlInjectionMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRule request.
  3. Submit a CreateRateBasedRule request.
  4. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
  5. Submit an UpdateRateBasedRule request to specify the predicates that you want to include in the rule.
  6. Create and update a WebACL that contains the RateBasedRule. For more information, see CreateWebACL.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RegexMatchSet. You then use UpdateRegexMatchSet to identify the part of a web request that you want AWS WAF to inspect, such as the values of the User-Agent header or the query string. For example, you can create a RegexMatchSet that contains a RegexMatchTuple that looks for any requests with User-Agent headers that match a RegexPatternSet with pattern B[a@]dB[o0]t. You can then configure AWS WAF to reject those requests. To create and configure a RegexMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRegexMatchSet request.
  2. Submit a CreateRegexMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexMatchSet request.
  4. Submit an UpdateRegexMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value, using a RegexPatternSet, that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RegexPatternSet. You then use UpdateRegexPatternSet to specify the regular expression (regex) pattern that you want AWS WAF to search for, such as B[a@]dB[o0]t. You can then configure AWS WAF to reject those requests. To create and configure a RegexPatternSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRegexPatternSet request.
  2. Submit a CreateRegexPatternSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexPatternSet request.
  4. Submit an UpdateRegexPatternSet request to specify the string that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a Rule, which contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to block. If you add more than one predicate to a Rule, a request must match all of the specifications to be allowed or blocked. For example, suppose that you add the following to a Rule:
  • An IPSet that matches the IP address 192.0.2.44/32
  • A ByteMatchSet that matches BadBot in the User-Agent header
You then add the Rule to a WebACL and specify that you want to blocks requests that satisfy the Rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot. To create and configure a Rule, perform the following steps:
  1. Create and update the predicates that you want to include in the Rule. For more information, see CreateByteMatchSet, CreateIPSet, and CreateSqlInjectionMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRule request.
  3. Submit a CreateRule request.
  4. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
  5. Submit an UpdateRule request to specify the predicates that you want to include in the Rule.
  6. Create and update a WebACL that contains the Rule. For more information, see CreateWebACL.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RuleGroup. A rule group is a collection of predefined rules that you add to a web ACL. You use UpdateRuleGroup to add rules to the rule group. Rule groups are subject to the following limits:
  • Three rule groups per account. You can request an increase to this limit by contacting customer support.
  • One rule group per web ACL.
  • Ten rules per rule group.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a SizeConstraintSet. You then use UpdateSizeConstraintSet to identify the part of a web request that you want AWS WAF to check for length, such as the length of the User-Agent header or the length of the query string. For example, you can create a SizeConstraintSet that matches any requests that have a query string that is longer than 100 bytes. You can then configure AWS WAF to reject those requests. To create and configure a SizeConstraintSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateSizeConstraintSet request.
  2. Submit a CreateSizeConstraintSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateSizeConstraintSet request.
  4. Submit an UpdateSizeConstraintSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests that contain snippets of SQL code in a specified part of web requests. AWS WAF searches for character sequences that are likely to be malicious strings. To create and configure a SqlInjectionMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateSqlInjectionMatchSet request.
  2. Submit a CreateSqlInjectionMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateSqlInjectionMatchSet request.
  4. Submit an UpdateSqlInjectionMatchSet request to specify the parts of web requests in which you want to allow, block, or count malicious SQL code.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a WebACL, which contains the Rules that identify the CloudFront web requests that you want to allow, block, or count. AWS WAF evaluates Rules in order based on the value of Priority for each Rule. You also specify a default action, either ALLOW or BLOCK. If a web request doesn't match any of the Rules in a WebACL, AWS WAF responds to the request with the default action. To create and configure a WebACL, perform the following steps:
  1. Create and update the ByteMatchSet objects and other predicates that you want to include in Rules. For more information, see CreateByteMatchSet, UpdateByteMatchSet, CreateIPSet, UpdateIPSet, CreateSqlInjectionMatchSet, and UpdateSqlInjectionMatchSet.
  2. Create and update the Rules that you want to include in the WebACL. For more information, see CreateRule and UpdateRule.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateWebACL request.
  4. Submit a CreateWebACL request.
  5. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateWebACL request.
  6. Submit an UpdateWebACL request to specify the Rules that you want to include in the WebACL, to specify the default action, and to associate the WebACL with a CloudFront distribution.
For more information about how to use the AWS WAF API, see the AWS WAF Developer Guide.
CreateWebACLMigrationStack
Show Description Creates an AWS CloudFormation WAFV2 template for the specified web ACL in the specified Amazon S3 bucket. Then, in CloudFormation, you create a stack from the template, to create the web ACL and its resources in AWS WAFV2. Use this to migrate your AWS WAF Classic web ACL to the latest version of AWS WAF. This is part of a larger migration procedure for web ACLs from AWS WAF Classic to the latest version of AWS WAF. For the full procedure, including caveats and manual steps to complete the migration and switch over to the new web ACL, see Migrating your AWS WAF Classic resources to AWS WAF in the AWS WAF Developer Guide.
CreateXssMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates an XssMatchSet, which you use to allow, block, or count requests that contain cross-site scripting attacks in the specified part of web requests. AWS WAF searches for character sequences that are likely to be malicious strings. To create and configure an XssMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateXssMatchSet request.
  2. Submit a CreateXssMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateXssMatchSet request.
  4. Submit an UpdateXssMatchSet request to specify the parts of web requests in which you want to allow, block, or count cross-site scripting attacks.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
DeleteByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a ByteMatchSet. You can't delete a ByteMatchSet if it's still used in any Rules or if it still includes any ByteMatchTuple objects (any filters). If you just want to remove a ByteMatchSet from a Rule, use UpdateRule. To permanently delete a ByteMatchSet, perform the following steps:
  1. Update the ByteMatchSet to remove filters, if any. For more information, see UpdateByteMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteByteMatchSet request.
  3. Submit a DeleteByteMatchSet request.
DeleteGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a GeoMatchSet. You can't delete a GeoMatchSet if it's still used in any Rules or if it still includes any countries. If you just want to remove a GeoMatchSet from a Rule, use UpdateRule. To permanently delete a GeoMatchSet from AWS WAF, perform the following steps:
  1. Update the GeoMatchSet to remove any countries. For more information, see UpdateGeoMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteGeoMatchSet request.
  3. Submit a DeleteGeoMatchSet request.
DeleteIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes an IPSet. You can't delete an IPSet if it's still used in any Rules or if it still includes any IP addresses. If you just want to remove an IPSet from a Rule, use UpdateRule. To permanently delete an IPSet from AWS WAF, perform the following steps:
  1. Update the IPSet to remove IP address ranges, if any. For more information, see UpdateIPSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteIPSet request.
  3. Submit a DeleteIPSet request.
DeleteLoggingConfiguration
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes the LoggingConfiguration from the specified web ACL.
DeletePermissionPolicy
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes an IAM policy from the specified RuleGroup. The user making the request must be the owner of the RuleGroup.
DeleteRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RateBasedRule. You can't delete a rule if it's still used in any WebACL objects or if it still includes any predicates, such as ByteMatchSet objects. If you just want to remove a rule from a WebACL, use UpdateWebACL. To permanently delete a RateBasedRule from AWS WAF, perform the following steps:
  1. Update the RateBasedRule to remove predicates, if any. For more information, see UpdateRateBasedRule.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRateBasedRule request.
  3. Submit a DeleteRateBasedRule request.
DeleteRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RegexMatchSet. You can't delete a RegexMatchSet if it's still used in any Rules or if it still includes any RegexMatchTuples objects (any filters). If you just want to remove a RegexMatchSet from a Rule, use UpdateRule. To permanently delete a RegexMatchSet, perform the following steps:
  1. Update the RegexMatchSet to remove filters, if any. For more information, see UpdateRegexMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRegexMatchSet request.
  3. Submit a DeleteRegexMatchSet request.
DeleteRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RegexPatternSet. You can't delete a RegexPatternSet if it's still used in any RegexMatchSet or if the RegexPatternSet is not empty.
DeleteRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a Rule. You can't delete a Rule if it's still used in any WebACL objects or if it still includes any predicates, such as ByteMatchSet objects. If you just want to remove a Rule from a WebACL, use UpdateWebACL. To permanently delete a Rule from AWS WAF, perform the following steps:
  1. Update the Rule to remove predicates, if any. For more information, see UpdateRule.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRule request.
  3. Submit a DeleteRule request.
DeleteRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RuleGroup. You can't delete a RuleGroup if it's still used in any WebACL objects or if it still includes any rules. If you just want to remove a RuleGroup from a WebACL, use UpdateWebACL. To permanently delete a RuleGroup from AWS WAF, perform the following steps:
  1. Update the RuleGroup to remove rules, if any. For more information, see UpdateRuleGroup.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRuleGroup request.
  3. Submit a DeleteRuleGroup request.
DeleteSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a SizeConstraintSet. You can't delete a SizeConstraintSet if it's still used in any Rules or if it still includes any SizeConstraint objects (any filters). If you just want to remove a SizeConstraintSet from a Rule, use UpdateRule. To permanently delete a SizeConstraintSet, perform the following steps:
  1. Update the SizeConstraintSet to remove filters, if any. For more information, see UpdateSizeConstraintSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteSizeConstraintSet request.
  3. Submit a DeleteSizeConstraintSet request.
DeleteSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a SqlInjectionMatchSet. You can't delete a SqlInjectionMatchSet if it's still used in any Rules or if it still contains any SqlInjectionMatchTuple objects. If you just want to remove a SqlInjectionMatchSet from a Rule, use UpdateRule. To permanently delete a SqlInjectionMatchSet from AWS WAF, perform the following steps:
  1. Update the SqlInjectionMatchSet to remove filters, if any. For more information, see UpdateSqlInjectionMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteSqlInjectionMatchSet request.
  3. Submit a DeleteSqlInjectionMatchSet request.
DeleteWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a WebACL. You can't delete a WebACL if it still contains any Rules. To delete a WebACL, perform the following steps:
  1. Update the WebACL to remove Rules, if any. For more information, see UpdateWebACL.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteWebACL request.
  3. Submit a DeleteWebACL request.
DeleteXssMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes an XssMatchSet. You can't delete an XssMatchSet if it's still used in any Rules or if it still contains any XssMatchTuple objects. If you just want to remove an XssMatchSet from a Rule, use UpdateRule. To permanently delete an XssMatchSet from AWS WAF, perform the following steps:
  1. Update the XssMatchSet to remove filters, if any. For more information, see UpdateXssMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteXssMatchSet request.
  3. Submit a DeleteXssMatchSet request.
DisassociateWebACL
Show Description This is AWS WAF Classic Regional documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Removes a web ACL from the specified resource, either an application load balancer or Amazon API Gateway stage.
GetByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the ByteMatchSet specified by ByteMatchSetId.
GetChangeToken
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. When you want to create, update, or delete AWS WAF objects, get a change token and include the change token in the create, update, or delete request. Change tokens ensure that your application doesn't submit conflicting requests to AWS WAF. Each create, update, or delete request must use a unique change token. If your application submits a GetChangeToken request and then submits a second GetChangeToken request before submitting a create, update, or delete request, the second GetChangeToken request returns the same value as the first GetChangeToken request. When you use a change token in a create, update, or delete request, the status of the change token changes to PENDING, which indicates that AWS WAF is propagating the change to all AWS WAF servers. Use GetChangeTokenStatus to determine the status of your change token.
GetChangeTokenStatus
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the status of a ChangeToken that you got by calling GetChangeToken. ChangeTokenStatus is one of the following values:
  • PROVISIONED: You requested the change token by calling GetChangeToken, but you haven't used it yet in a call to create, update, or delete an AWS WAF object.
  • PENDING: AWS WAF is propagating the create, update, or delete request to all AWS WAF servers.
  • INSYNC: Propagation is complete.
GetGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the GeoMatchSet that is specified by GeoMatchSetId.
GetIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the IPSet that is specified by IPSetId.
GetLoggingConfiguration
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the LoggingConfiguration for the specified web ACL.
GetPermissionPolicy
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the IAM policy attached to the RuleGroup.
GetRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RateBasedRule that is specified by the RuleId that you included in the GetRateBasedRule request.
GetRateBasedRuleManagedKeys
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of IP addresses currently being blocked by the RateBasedRule that is specified by the RuleId. The maximum number of managed keys that will be blocked is 10,000. If more than 10,000 addresses exceed the rate limit, the 10,000 addresses with the highest rates will be blocked.
GetRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RegexMatchSet specified by RegexMatchSetId.
GetRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RegexPatternSet specified by RegexPatternSetId.
GetRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the Rule that is specified by the RuleId that you included in the GetRule request.
GetRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RuleGroup that is specified by the RuleGroupId that you included in the GetRuleGroup request. To view the rules in a rule group, use ListActivatedRulesInRuleGroup.
GetSampledRequests
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Gets detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests that your AWS resource received during a time range that you choose. You can specify a sample size of up to 500 requests, and you can specify any time range in the previous three hours. GetSampledRequests returns a time range, which is usually the time range that you specified. However, if your resource (such as a CloudFront distribution) received 5,000 requests before the specified time range elapsed, GetSampledRequests returns an updated time range. This new time range indicates the actual period during which AWS WAF selected the requests in the sample.
GetSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the SizeConstraintSet specified by SizeConstraintSetId.
GetSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the SqlInjectionMatchSet that is specified by SqlInjectionMatchSetId.
GetWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the WebACL that is specified by WebACLId.
GetWebACLForResource
Show Description This is AWS WAF Classic Regional documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the web ACL for the specified resource, either an application load balancer or Amazon API Gateway stage.
GetXssMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the XssMatchSet that is specified by XssMatchSetId.
ListActivatedRulesInRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of ActivatedRule objects.
ListByteMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of ByteMatchSetSummary objects.
ListGeoMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of GeoMatchSetSummary objects in the response.
ListIPSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of IPSetSummary objects in the response.
ListLoggingConfigurations
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of LoggingConfiguration objects.
ListRateBasedRules
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleSummary objects.
ListRegexMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RegexMatchSetSummary objects.
ListRegexPatternSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RegexPatternSetSummary objects.
ListResourcesForWebACL
Show Description This is AWS WAF Classic Regional documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of resources associated with the specified web ACL.
ListRuleGroups
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleGroup objects.
ListRules
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleSummary objects.
ListSizeConstraintSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of SizeConstraintSetSummary objects.
ListSqlInjectionMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of SqlInjectionMatchSet objects.
ListSubscribedRuleGroups
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleGroup objects that you are subscribed to.
ListTagsForResource
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Retrieves the tags associated with the specified AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing. For example, you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource. Tagging is only available through the API, SDKs, and CLI. You can't manage or view tags through the AWS WAF Classic console. You can tag the AWS resources that you manage through AWS WAF Classic: web ACLs, rule groups, and rules.
ListWebACLs
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of WebACLSummary objects in the response.
ListXssMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of XssMatchSet objects.
PutLoggingConfiguration
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Associates a LoggingConfiguration with a specified web ACL. You can access information about all traffic that AWS WAF inspects using the following steps:
  1. Create an Amazon Kinesis Data Firehose. Create the data firehose with a PUT source and in the region that you are operating. However, if you are capturing logs for Amazon CloudFront, always create the firehose in US East (N. Virginia). Do not create the data firehose using a Kinesis stream as your source.
  2. Associate that firehose to your web ACL using a PutLoggingConfiguration request.
When you successfully enable logging using a PutLoggingConfiguration request, AWS WAF will create a service linked role with the necessary permissions to write logs to the Amazon Kinesis Data Firehose. For more information, see Logging Web ACL Traffic Information in the AWS WAF Developer Guide.
PutPermissionPolicy
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Attaches an IAM policy to the specified resource. The only supported use for this action is to share a RuleGroup across accounts. The PutPermissionPolicy is subject to the following restrictions:
  • You can attach only one policy with each PutPermissionPolicy request.
  • The policy must include an Effect, Action and Principal.
  • Effect must specify Allow.
  • The Action in the policy must be waf:UpdateWebACL, waf-regional:UpdateWebACL, waf:GetRuleGroup and waf-regional:GetRuleGroup . Any extra or wildcard actions in the policy will be rejected.
  • The policy cannot include a Resource parameter.
  • The ARN in the request must be a valid WAF RuleGroup ARN and the RuleGroup must exist in the same region.
  • The user making the request must be the owner of the RuleGroup.
  • Your policy must be composed using IAM Policy version 2012-10-17.
For more information, see IAM Policies. An example of a valid policy parameter is shown in the Examples section below.
TagResource
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Associates tags with the specified AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing. For example, you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource. Tagging is only available through the API, SDKs, and CLI. You can't manage or view tags through the AWS WAF Classic console. You can use this action to tag the AWS resources that you manage through AWS WAF Classic: web ACLs, rule groups, and rules.
UntagResource
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use.

UpdateByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet. For each ByteMatchTuple object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change a ByteMatchSetUpdate object, you delete the existing object and add a new one.
  • The part of a web request that you want AWS WAF to inspect, such as a query string or the value of the User-Agent header.
  • The bytes (typically a string that corresponds with ASCII characters) that you want AWS WAF to look for. For more information, including how you specify the values for the AWS WAF API and the AWS CLI or SDKs, see TargetString in the ByteMatchTuple data type.
  • Where to look, such as at the beginning or the end of a query string.
  • Whether to perform any conversions on the request, such as converting it to lowercase, before inspecting it for the specified string.
For example, you can add a ByteMatchSetUpdate object that matches web requests in which User-Agent headers contain the string BadBot. You can then configure AWS WAF to block those requests. To create and configure a ByteMatchSet, perform the following steps:
  1. Create a ByteMatchSet. For more information, see CreateByteMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateByteMatchSet request.
  3. Submit an UpdateByteMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes GeoMatchConstraint objects in an GeoMatchSet. For each GeoMatchConstraint object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change an GeoMatchConstraint object, you delete the existing object and add a new one.
  • The Type. The only valid value for Type is Country.
  • The Value, which is a two character code for the country to add to the GeoMatchConstraint object. Valid codes are listed in GeoMatchConstraint$Value.
To create and configure an GeoMatchSet, perform the following steps:
  1. Submit a CreateGeoMatchSet request.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateGeoMatchSet request.
  3. Submit an UpdateGeoMatchSet request to specify the country that you want AWS WAF to watch for.
When you update an GeoMatchSet, you specify the country that you want to add and/or the country that you want to delete. If you want to change a country, you delete the existing country and add the new one. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes IPSetDescriptor objects in an IPSet. For each IPSetDescriptor object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change an IPSetDescriptor object, you delete the existing object and add a new one.
  • The IP address version, IPv4 or IPv6.
  • The IP address in CIDR notation, for example, 192.0.2.0/24 (for the range of IP addresses from 192.0.2.0 to 192.0.2.255) or 192.0.2.44/32 (for the individual IP address 192.0.2.44).
AWS WAF supports IPv4 address ranges: /8 and any range between /16 through /32. AWS WAF supports IPv6 address ranges: /24, /32, /48, /56, /64, and /128. For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing. IPv6 addresses can be represented using any of the following formats:
  • 1111:0000:0000:0000:0000:0000:0000:0111/128
  • 1111:0:0:0:0:0:0:0111/128
  • 1111::0111/128
  • 1111::111/128
You use an IPSet to specify which web requests you want to allow or block based on the IP addresses that the requests originated from. For example, if you're receiving a lot of requests from one or a small number of IP addresses and you want to block the requests, you can create an IPSet that specifies those IP addresses, and then configure AWS WAF to block the requests. To create and configure an IPSet, perform the following steps:
  1. Submit a CreateIPSet request.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateIPSet request.
  3. Submit an UpdateIPSet request to specify the IP addresses that you want AWS WAF to watch for.
When you update an IPSet, you specify the IP addresses that you want to add and/or the IP addresses that you want to delete. If you want to change an IP address, you delete the existing IP address and add the new one. You can insert a maximum of 1000 addresses in a single request. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes Predicate objects in a rule and updates the RateLimit in the rule. Each Predicate object identifies a predicate, such as a ByteMatchSet or an IPSet, that specifies the web requests that you want to block or count. The RateLimit specifies the number of requests every five minutes that triggers the rule. If you add more than one predicate to a RateBasedRule, a request must match all the predicates and exceed the RateLimit to be counted or blocked. For example, suppose you add the following to a RateBasedRule:
  • An IPSet that matches the IP address 192.0.2.44/32
  • A ByteMatchSet that matches BadBot in the User-Agent header
Further, you specify a RateLimit of 1,000. You then add the RateBasedRule to a WebACL and specify that you want to block requests that satisfy the rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot. Further, requests that match these two conditions much be received at a rate of more than 1,000 every five minutes. If the rate drops below this limit, AWS WAF no longer blocks the requests. As a second example, suppose you want to limit requests to a particular page on your site. To do this, you could add the following to a RateBasedRule:
  • A ByteMatchSet with FieldToMatch of URI
  • A PositionalConstraint of STARTS_WITH
  • A TargetString of login
Further, you specify a RateLimit of 1,000. By adding this RateBasedRule to a WebACL, you could limit requests to your login page without affecting the rest of your site.
UpdateRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes RegexMatchTuple objects (filters) in a RegexMatchSet. For each RegexMatchSetUpdate object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change a RegexMatchSetUpdate object, you delete the existing object and add a new one.
  • The part of a web request that you want AWS WAF to inspectupdate, such as a query string or the value of the User-Agent header.
  • The identifier of the pattern (a regular expression) that you want AWS WAF to look for. For more information, see RegexPatternSet.
  • Whether to perform any conversions on the request, such as converting it to lowercase, before inspecting it for the specified string.
For example, you can create a RegexPatternSet that matches any requests with User-Agent headers that contain the string B[a@]dB[o0]t. You can then configure AWS WAF to reject those requests. To create and configure a RegexMatchSet, perform the following steps:
  1. Create a RegexMatchSet. For more information, see CreateRegexMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexMatchSet request.
  3. Submit an UpdateRegexMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the identifier of the RegexPatternSet that contain the regular expression patters you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes RegexPatternString objects in a RegexPatternSet. For each RegexPatternString object, you specify the following values:
  • Whether to insert or delete the RegexPatternString.
  • The regular expression pattern that you want to insert or delete. For more information, see RegexPatternSet.
For example, you can create a RegexPatternString such as B[a@]dB[o0]t. AWS WAF will match this RegexPatternString to:
  • BadBot
  • BadB0t
  • B@dBot
  • B@dB0t
To create and configure a RegexPatternSet, perform the following steps:
  1. Create a RegexPatternSet. For more information, see CreateRegexPatternSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexPatternSet request.
  3. Submit an UpdateRegexPatternSet request to specify the regular expression pattern that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes Predicate objects in a Rule. Each Predicate object identifies a predicate, such as a ByteMatchSet or an IPSet, that specifies the web requests that you want to allow, block, or count. If you add more than one predicate to a Rule, a request must match all of the specifications to be allowed, blocked, or counted. For example, suppose that you add the following to a Rule:
  • A ByteMatchSet that matches the value BadBot in the User-Agent header
  • An IPSet that matches the IP address 192.0.2.44
You then add the Rule to a WebACL and specify that you want to block requests that satisfy the Rule. For a request to be blocked, the User-Agent header in the request must contain the value BadBot and the request must originate from the IP address 192.0.2.44. To create and configure a Rule, perform the following steps:
  1. Create and update the predicates that you want to include in the Rule.
  2. Create the Rule. See CreateRule.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
  4. Submit an UpdateRule request to add predicates to the Rule.
  5. Create and update a WebACL that contains the Rule. See CreateWebACL.
If you want to replace one ByteMatchSet or IPSet with another, you delete the existing one and add the new one. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes ActivatedRule objects in a RuleGroup. You can only insert REGULAR rules into a rule group. You can have a maximum of ten rules per rule group. To create and configure a RuleGroup, perform the following steps:
  1. Create and update the Rules that you want to include in the RuleGroup. See CreateRule.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRuleGroup request.
  3. Submit an UpdateRuleGroup request to add Rules to the RuleGroup.
  4. Create and update a WebACL that contains the RuleGroup. See CreateWebACL.
If you want to replace one Rule with another, you delete the existing one and add the new one. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes SizeConstraint objects (filters) in a SizeConstraintSet. For each SizeConstraint object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change a SizeConstraintSetUpdate object, you delete the existing object and add a new one.
  • The part of a web request that you want AWS WAF to evaluate, such as the length of a query string or the length of the User-Agent header.
  • Whether to perform any transformations on the request, such as converting it to lowercase, before checking its length. Note that transformations of the request body are not supported because the AWS resource forwards only the first 8192 bytes of your request to AWS WAF. You can only specify a single type of TextTransformation.
  • A ComparisonOperator used for evaluating the selected part of the request against the specified Size, such as equals, greater than, less than, and so on.
  • The length, in bytes, that you want AWS WAF to watch for in selected part of the request. The length is computed after applying the transformation.
For example, you can add a SizeConstraintSetUpdate object that matches web requests in which the length of the User-Agent header is greater than 100 bytes. You can then configure AWS WAF to block those requests. To create and configure a SizeConstraintSet, perform the following steps:
  1. Create a SizeConstraintSet. For more information, see CreateSizeConstraintSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateSizeConstraintSet request.
  3. Submit an UpdateSizeConstraintSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes SqlInjectionMatchTuple objects (filters) in a SqlInjectionMatchSet. For each SqlInjectionMatchTuple object, you specify the following values:
  • Action: Whether to insert the object into or delete the object from the array. To change a SqlInjectionMatchTuple, you delete the existing object and add a new one.
  • FieldToMatch: The part of web requests that you want AWS WAF to inspect and, if you want AWS WAF to inspect a header or custom query parameter, the name of the header or parameter.
  • TextTransformation: Which text transformation, if any, to perform on the web request before inspecting the request for snippets of malicious SQL code. You can only specify a single type of TextTransformation.
You use SqlInjectionMatchSet objects to specify which CloudFront requests that you want to allow, block, or count. For example, if you're receiving requests that contain snippets of SQL code in the query string and you want to block the requests, you can create a SqlInjectionMatchSet with the applicable settings, and then configure AWS WAF to block the requests. To create and configure a SqlInjectionMatchSet, perform the following steps:
  1. Submit a CreateSqlInjectionMatchSet request.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateIPSet request.
  3. Submit an UpdateSqlInjectionMatchSet request to specify the parts of web requests that you want AWS WAF to inspect for snippets of SQL code.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes ActivatedRule objects in a WebACL. Each Rule identifies web requests that you want to allow, block, or count. When you update a WebACL, you specify the following values:
  • A default action for the WebACL, either ALLOW or BLOCK. AWS WAF performs the default action if a request doesn't match the criteria in any of the Rules in a WebACL.
  • The Rules that you want to add or delete. If you want to replace one Rule with another, you delete the existing Rule and add the new one.
  • For each Rule, whether you want AWS WAF to allow requests, block requests, or count requests that match the conditions in the Rule.
  • The order in which you want AWS WAF to evaluate the Rules in a WebACL. If you add more than one Rule to a WebACL, AWS WAF evaluates each request against the Rules in order based on the value of Priority. (The Rule that has the lowest value for Priority is evaluated first.) When a web request matches all the predicates (such as ByteMatchSets and IPSets) in a Rule, AWS WAF immediately takes the corresponding action, allow or block, and doesn't evaluate the request against the remaining Rules in the WebACL, if any.
To create and configure a WebACL, perform the following steps:
  1. Create and update the predicates that you want to include in Rules. For more information, see CreateByteMatchSet, UpdateByteMatchSet, CreateIPSet, UpdateIPSet, CreateSqlInjectionMatchSet, and UpdateSqlInjectionMatchSet.
  2. Create and update the Rules that you want to include in the WebACL. For more information, see CreateRule and UpdateRule.
  3. Create a WebACL. See CreateWebACL.
  4. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateWebACL request.
  5. Submit an UpdateWebACL request to specify the Rules that you want to include in the WebACL, to specify the default action, and to associate the WebACL with a CloudFront distribution. The ActivatedRule can be a rule group. If you specify a rule group as your ActivatedRule , you can exclude specific rules from that rule group. If you already have a rule group associated with a web ACL and want to submit an UpdateWebACL request to exclude certain rules from that rule group, you must first remove the rule group from the web ACL, the re-insert it again, specifying the excluded rules. For details, see ActivatedRule$ExcludedRules .
Be aware that if you try to add a RATE_BASED rule to a web ACL without setting the rule type when first creating the rule, the UpdateWebACL request will fail because the request tries to add a REGULAR rule (the default rule type) with the specified ID, which does not exist. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
## Waf Events
Service Event Name Description
waf CreateByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a ByteMatchSet. You then use UpdateByteMatchSet to identify the part of a web request that you want AWS WAF to inspect, such as the values of the User-Agent header or the query string. For example, you can create a ByteMatchSet that matches any requests with User-Agent headers that contain the string BadBot. You can then configure AWS WAF to reject those requests. To create and configure a ByteMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateByteMatchSet request.
  2. Submit a CreateByteMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateByteMatchSet request.
  4. Submit an UpdateByteMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates an GeoMatchSet, which you use to specify which web requests you want to allow or block based on the country that the requests originate from. For example, if you're receiving a lot of requests from one or more countries and you want to block the requests, you can create an GeoMatchSet that contains those countries and then configure AWS WAF to block the requests. To create and configure a GeoMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateGeoMatchSet request.
  2. Submit a CreateGeoMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateGeoMatchSet request.
  4. Submit an UpdateGeoMatchSetSet request to specify the countries that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates an IPSet, which you use to specify which web requests that you want to allow or block based on the IP addresses that the requests originate from. For example, if you're receiving a lot of requests from one or more individual IP addresses or one or more ranges of IP addresses and you want to block the requests, you can create an IPSet that contains those IP addresses and then configure AWS WAF to block the requests. To create and configure an IPSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateIPSet request.
  2. Submit a CreateIPSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateIPSet request.
  4. Submit an UpdateIPSet request to specify the IP addresses that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RateBasedRule. The RateBasedRule contains a RateLimit, which specifies the maximum number of requests that AWS WAF allows from a specified IP address in a five-minute period. The RateBasedRule also contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to count or block if these requests exceed the RateLimit. If you add more than one predicate to a RateBasedRule, a request not only must exceed the RateLimit, but it also must match all the conditions to be counted or blocked. For example, suppose you add the following to a RateBasedRule:
  • An IPSet that matches the IP address 192.0.2.44/32
  • A ByteMatchSet that matches BadBot in the User-Agent header
Further, you specify a RateLimit of 1,000. You then add the RateBasedRule to a WebACL and specify that you want to block requests that meet the conditions in the rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot. Further, requests that match these two conditions must be received at a rate of more than 1,000 requests every five minutes. If both conditions are met and the rate is exceeded, AWS WAF blocks the requests. If the rate drops below 1,000 for a five-minute period, AWS WAF no longer blocks the requests. As a second example, suppose you want to limit requests to a particular page on your site. To do this, you could add the following to a RateBasedRule:
  • A ByteMatchSet with FieldToMatch of URI
  • A PositionalConstraint of STARTS_WITH
  • A TargetString of login
Further, you specify a RateLimit of 1,000. By adding this RateBasedRule to a WebACL, you could limit requests to your login page without affecting the rest of your site. To create and configure a RateBasedRule, perform the following steps:
  1. Create and update the predicates that you want to include in the rule. For more information, see CreateByteMatchSet, CreateIPSet, and CreateSqlInjectionMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRule request.
  3. Submit a CreateRateBasedRule request.
  4. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
  5. Submit an UpdateRateBasedRule request to specify the predicates that you want to include in the rule.
  6. Create and update a WebACL that contains the RateBasedRule. For more information, see CreateWebACL.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RegexMatchSet. You then use UpdateRegexMatchSet to identify the part of a web request that you want AWS WAF to inspect, such as the values of the User-Agent header or the query string. For example, you can create a RegexMatchSet that contains a RegexMatchTuple that looks for any requests with User-Agent headers that match a RegexPatternSet with pattern B[a@]dB[o0]t. You can then configure AWS WAF to reject those requests. To create and configure a RegexMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRegexMatchSet request.
  2. Submit a CreateRegexMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexMatchSet request.
  4. Submit an UpdateRegexMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value, using a RegexPatternSet, that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RegexPatternSet. You then use UpdateRegexPatternSet to specify the regular expression (regex) pattern that you want AWS WAF to search for, such as B[a@]dB[o0]t. You can then configure AWS WAF to reject those requests. To create and configure a RegexPatternSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRegexPatternSet request.
  2. Submit a CreateRegexPatternSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexPatternSet request.
  4. Submit an UpdateRegexPatternSet request to specify the string that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a Rule, which contains the IPSet objects, ByteMatchSet objects, and other predicates that identify the requests that you want to block. If you add more than one predicate to a Rule, a request must match all of the specifications to be allowed or blocked. For example, suppose that you add the following to a Rule:
  • An IPSet that matches the IP address 192.0.2.44/32
  • A ByteMatchSet that matches BadBot in the User-Agent header
You then add the Rule to a WebACL and specify that you want to blocks requests that satisfy the Rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot. To create and configure a Rule, perform the following steps:
  1. Create and update the predicates that you want to include in the Rule. For more information, see CreateByteMatchSet, CreateIPSet, and CreateSqlInjectionMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateRule request.
  3. Submit a CreateRule request.
  4. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
  5. Submit an UpdateRule request to specify the predicates that you want to include in the Rule.
  6. Create and update a WebACL that contains the Rule. For more information, see CreateWebACL.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a RuleGroup. A rule group is a collection of predefined rules that you add to a web ACL. You use UpdateRuleGroup to add rules to the rule group. Rule groups are subject to the following limits:
  • Three rule groups per account. You can request an increase to this limit by contacting customer support.
  • One rule group per web ACL.
  • Ten rules per rule group.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a SizeConstraintSet. You then use UpdateSizeConstraintSet to identify the part of a web request that you want AWS WAF to check for length, such as the length of the User-Agent header or the length of the query string. For example, you can create a SizeConstraintSet that matches any requests that have a query string that is longer than 100 bytes. You can then configure AWS WAF to reject those requests. To create and configure a SizeConstraintSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateSizeConstraintSet request.
  2. Submit a CreateSizeConstraintSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateSizeConstraintSet request.
  4. Submit an UpdateSizeConstraintSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a SqlInjectionMatchSet, which you use to allow, block, or count requests that contain snippets of SQL code in a specified part of web requests. AWS WAF searches for character sequences that are likely to be malicious strings. To create and configure a SqlInjectionMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateSqlInjectionMatchSet request.
  2. Submit a CreateSqlInjectionMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateSqlInjectionMatchSet request.
  4. Submit an UpdateSqlInjectionMatchSet request to specify the parts of web requests in which you want to allow, block, or count malicious SQL code.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
CreateWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates a WebACL, which contains the Rules that identify the CloudFront web requests that you want to allow, block, or count. AWS WAF evaluates Rules in order based on the value of Priority for each Rule. You also specify a default action, either ALLOW or BLOCK. If a web request doesn't match any of the Rules in a WebACL, AWS WAF responds to the request with the default action. To create and configure a WebACL, perform the following steps:
  1. Create and update the ByteMatchSet objects and other predicates that you want to include in Rules. For more information, see CreateByteMatchSet, UpdateByteMatchSet, CreateIPSet, UpdateIPSet, CreateSqlInjectionMatchSet, and UpdateSqlInjectionMatchSet.
  2. Create and update the Rules that you want to include in the WebACL. For more information, see CreateRule and UpdateRule.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateWebACL request.
  4. Submit a CreateWebACL request.
  5. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateWebACL request.
  6. Submit an UpdateWebACL request to specify the Rules that you want to include in the WebACL, to specify the default action, and to associate the WebACL with a CloudFront distribution.
For more information about how to use the AWS WAF API, see the AWS WAF Developer Guide.
CreateWebACLMigrationStack
Show Description Creates an AWS CloudFormation WAFV2 template for the specified web ACL in the specified Amazon S3 bucket. Then, in CloudFormation, you create a stack from the template, to create the web ACL and its resources in AWS WAFV2. Use this to migrate your AWS WAF Classic web ACL to the latest version of AWS WAF. This is part of a larger migration procedure for web ACLs from AWS WAF Classic to the latest version of AWS WAF. For the full procedure, including caveats and manual steps to complete the migration and switch over to the new web ACL, see Migrating your AWS WAF Classic resources to AWS WAF in the AWS WAF Developer Guide.
CreateXssMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Creates an XssMatchSet, which you use to allow, block, or count requests that contain cross-site scripting attacks in the specified part of web requests. AWS WAF searches for character sequences that are likely to be malicious strings. To create and configure an XssMatchSet, perform the following steps:
  1. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a CreateXssMatchSet request.
  2. Submit a CreateXssMatchSet request.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateXssMatchSet request.
  4. Submit an UpdateXssMatchSet request to specify the parts of web requests in which you want to allow, block, or count cross-site scripting attacks.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
DeleteByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a ByteMatchSet. You can't delete a ByteMatchSet if it's still used in any Rules or if it still includes any ByteMatchTuple objects (any filters). If you just want to remove a ByteMatchSet from a Rule, use UpdateRule. To permanently delete a ByteMatchSet, perform the following steps:
  1. Update the ByteMatchSet to remove filters, if any. For more information, see UpdateByteMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteByteMatchSet request.
  3. Submit a DeleteByteMatchSet request.
DeleteGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a GeoMatchSet. You can't delete a GeoMatchSet if it's still used in any Rules or if it still includes any countries. If you just want to remove a GeoMatchSet from a Rule, use UpdateRule. To permanently delete a GeoMatchSet from AWS WAF, perform the following steps:
  1. Update the GeoMatchSet to remove any countries. For more information, see UpdateGeoMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteGeoMatchSet request.
  3. Submit a DeleteGeoMatchSet request.
DeleteIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes an IPSet. You can't delete an IPSet if it's still used in any Rules or if it still includes any IP addresses. If you just want to remove an IPSet from a Rule, use UpdateRule. To permanently delete an IPSet from AWS WAF, perform the following steps:
  1. Update the IPSet to remove IP address ranges, if any. For more information, see UpdateIPSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteIPSet request.
  3. Submit a DeleteIPSet request.
DeleteLoggingConfiguration
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes the LoggingConfiguration from the specified web ACL.
DeletePermissionPolicy
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes an IAM policy from the specified RuleGroup. The user making the request must be the owner of the RuleGroup.
DeleteRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RateBasedRule. You can't delete a rule if it's still used in any WebACL objects or if it still includes any predicates, such as ByteMatchSet objects. If you just want to remove a rule from a WebACL, use UpdateWebACL. To permanently delete a RateBasedRule from AWS WAF, perform the following steps:
  1. Update the RateBasedRule to remove predicates, if any. For more information, see UpdateRateBasedRule.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRateBasedRule request.
  3. Submit a DeleteRateBasedRule request.
DeleteRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RegexMatchSet. You can't delete a RegexMatchSet if it's still used in any Rules or if it still includes any RegexMatchTuples objects (any filters). If you just want to remove a RegexMatchSet from a Rule, use UpdateRule. To permanently delete a RegexMatchSet, perform the following steps:
  1. Update the RegexMatchSet to remove filters, if any. For more information, see UpdateRegexMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRegexMatchSet request.
  3. Submit a DeleteRegexMatchSet request.
DeleteRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RegexPatternSet. You can't delete a RegexPatternSet if it's still used in any RegexMatchSet or if the RegexPatternSet is not empty.
DeleteRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a Rule. You can't delete a Rule if it's still used in any WebACL objects or if it still includes any predicates, such as ByteMatchSet objects. If you just want to remove a Rule from a WebACL, use UpdateWebACL. To permanently delete a Rule from AWS WAF, perform the following steps:
  1. Update the Rule to remove predicates, if any. For more information, see UpdateRule.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRule request.
  3. Submit a DeleteRule request.
DeleteRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a RuleGroup. You can't delete a RuleGroup if it's still used in any WebACL objects or if it still includes any rules. If you just want to remove a RuleGroup from a WebACL, use UpdateWebACL. To permanently delete a RuleGroup from AWS WAF, perform the following steps:
  1. Update the RuleGroup to remove rules, if any. For more information, see UpdateRuleGroup.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteRuleGroup request.
  3. Submit a DeleteRuleGroup request.
DeleteSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a SizeConstraintSet. You can't delete a SizeConstraintSet if it's still used in any Rules or if it still includes any SizeConstraint objects (any filters). If you just want to remove a SizeConstraintSet from a Rule, use UpdateRule. To permanently delete a SizeConstraintSet, perform the following steps:
  1. Update the SizeConstraintSet to remove filters, if any. For more information, see UpdateSizeConstraintSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteSizeConstraintSet request.
  3. Submit a DeleteSizeConstraintSet request.
DeleteSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a SqlInjectionMatchSet. You can't delete a SqlInjectionMatchSet if it's still used in any Rules or if it still contains any SqlInjectionMatchTuple objects. If you just want to remove a SqlInjectionMatchSet from a Rule, use UpdateRule. To permanently delete a SqlInjectionMatchSet from AWS WAF, perform the following steps:
  1. Update the SqlInjectionMatchSet to remove filters, if any. For more information, see UpdateSqlInjectionMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteSqlInjectionMatchSet request.
  3. Submit a DeleteSqlInjectionMatchSet request.
DeleteWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes a WebACL. You can't delete a WebACL if it still contains any Rules. To delete a WebACL, perform the following steps:
  1. Update the WebACL to remove Rules, if any. For more information, see UpdateWebACL.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteWebACL request.
  3. Submit a DeleteWebACL request.
DeleteXssMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Permanently deletes an XssMatchSet. You can't delete an XssMatchSet if it's still used in any Rules or if it still contains any XssMatchTuple objects. If you just want to remove an XssMatchSet from a Rule, use UpdateRule. To permanently delete an XssMatchSet from AWS WAF, perform the following steps:
  1. Update the XssMatchSet to remove filters, if any. For more information, see UpdateXssMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of a DeleteXssMatchSet request.
  3. Submit a DeleteXssMatchSet request.
GetByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the ByteMatchSet specified by ByteMatchSetId.
GetChangeToken
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. When you want to create, update, or delete AWS WAF objects, get a change token and include the change token in the create, update, or delete request. Change tokens ensure that your application doesn't submit conflicting requests to AWS WAF. Each create, update, or delete request must use a unique change token. If your application submits a GetChangeToken request and then submits a second GetChangeToken request before submitting a create, update, or delete request, the second GetChangeToken request returns the same value as the first GetChangeToken request. When you use a change token in a create, update, or delete request, the status of the change token changes to PENDING, which indicates that AWS WAF is propagating the change to all AWS WAF servers. Use GetChangeTokenStatus to determine the status of your change token.
GetChangeTokenStatus
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the status of a ChangeToken that you got by calling GetChangeToken. ChangeTokenStatus is one of the following values:
  • PROVISIONED: You requested the change token by calling GetChangeToken, but you haven't used it yet in a call to create, update, or delete an AWS WAF object.
  • PENDING: AWS WAF is propagating the create, update, or delete request to all AWS WAF servers.
  • INSYNC: Propagation is complete.
GetGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the GeoMatchSet that is specified by GeoMatchSetId.
GetIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the IPSet that is specified by IPSetId.
GetLoggingConfiguration
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the LoggingConfiguration for the specified web ACL.
GetPermissionPolicy
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the IAM policy attached to the RuleGroup.
GetRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RateBasedRule that is specified by the RuleId that you included in the GetRateBasedRule request.
GetRateBasedRuleManagedKeys
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of IP addresses currently being blocked by the RateBasedRule that is specified by the RuleId. The maximum number of managed keys that will be blocked is 10,000. If more than 10,000 addresses exceed the rate limit, the 10,000 addresses with the highest rates will be blocked.
GetRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RegexMatchSet specified by RegexMatchSetId.
GetRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RegexPatternSet specified by RegexPatternSetId.
GetRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the Rule that is specified by the RuleId that you included in the GetRule request.
GetRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the RuleGroup that is specified by the RuleGroupId that you included in the GetRuleGroup request. To view the rules in a rule group, use ListActivatedRulesInRuleGroup.
GetSampledRequests
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Gets detailed information about a specified number of requests--a sample--that AWS WAF randomly selects from among the first 5,000 requests that your AWS resource received during a time range that you choose. You can specify a sample size of up to 500 requests, and you can specify any time range in the previous three hours. GetSampledRequests returns a time range, which is usually the time range that you specified. However, if your resource (such as a CloudFront distribution) received 5,000 requests before the specified time range elapsed, GetSampledRequests returns an updated time range. This new time range indicates the actual period during which AWS WAF selected the requests in the sample.
GetSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the SizeConstraintSet specified by SizeConstraintSetId.
GetSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the SqlInjectionMatchSet that is specified by SqlInjectionMatchSetId.
GetWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the WebACL that is specified by WebACLId.
GetXssMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns the XssMatchSet that is specified by XssMatchSetId.
ListActivatedRulesInRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of ActivatedRule objects.
ListByteMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of ByteMatchSetSummary objects.
ListGeoMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of GeoMatchSetSummary objects in the response.
ListIPSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of IPSetSummary objects in the response.
ListLoggingConfigurations
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of LoggingConfiguration objects.
ListRateBasedRules
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleSummary objects.
ListRegexMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RegexMatchSetSummary objects.
ListRegexPatternSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RegexPatternSetSummary objects.
ListRuleGroups
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleGroup objects.
ListRules
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleSummary objects.
ListSizeConstraintSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of SizeConstraintSetSummary objects.
ListSqlInjectionMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of SqlInjectionMatchSet objects.
ListSubscribedRuleGroups
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of RuleGroup objects that you are subscribed to.
ListTagsForResource
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Retrieves the tags associated with the specified AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing. For example, you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource. Tagging is only available through the API, SDKs, and CLI. You can't manage or view tags through the AWS WAF Classic console. You can tag the AWS resources that you manage through AWS WAF Classic: web ACLs, rule groups, and rules.
ListWebACLs
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of WebACLSummary objects in the response.
ListXssMatchSets
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Returns an array of XssMatchSet objects.
PutLoggingConfiguration
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Associates a LoggingConfiguration with a specified web ACL. You can access information about all traffic that AWS WAF inspects using the following steps:
  1. Create an Amazon Kinesis Data Firehose. Create the data firehose with a PUT source and in the region that you are operating. However, if you are capturing logs for Amazon CloudFront, always create the firehose in US East (N. Virginia). Do not create the data firehose using a Kinesis stream as your source.
  2. Associate that firehose to your web ACL using a PutLoggingConfiguration request.
When you successfully enable logging using a PutLoggingConfiguration request, AWS WAF will create a service linked role with the necessary permissions to write logs to the Amazon Kinesis Data Firehose. For more information, see Logging Web ACL Traffic Information in the AWS WAF Developer Guide.
PutPermissionPolicy
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Attaches an IAM policy to the specified resource. The only supported use for this action is to share a RuleGroup across accounts. The PutPermissionPolicy is subject to the following restrictions:
  • You can attach only one policy with each PutPermissionPolicy request.
  • The policy must include an Effect, Action and Principal.
  • Effect must specify Allow.
  • The Action in the policy must be waf:UpdateWebACL, waf-regional:UpdateWebACL, waf:GetRuleGroup and waf-regional:GetRuleGroup . Any extra or wildcard actions in the policy will be rejected.
  • The policy cannot include a Resource parameter.
  • The ARN in the request must be a valid WAF RuleGroup ARN and the RuleGroup must exist in the same region.
  • The user making the request must be the owner of the RuleGroup.
  • Your policy must be composed using IAM Policy version 2012-10-17.
For more information, see IAM Policies. An example of a valid policy parameter is shown in the Examples section below.
TagResource
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Associates tags with the specified AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing. For example, you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource. Tagging is only available through the API, SDKs, and CLI. You can't manage or view tags through the AWS WAF Classic console. You can use this action to tag the AWS resources that you manage through AWS WAF Classic: web ACLs, rule groups, and rules.
UntagResource
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use.

UpdateByteMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes ByteMatchTuple objects (filters) in a ByteMatchSet. For each ByteMatchTuple object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change a ByteMatchSetUpdate object, you delete the existing object and add a new one.
  • The part of a web request that you want AWS WAF to inspect, such as a query string or the value of the User-Agent header.
  • The bytes (typically a string that corresponds with ASCII characters) that you want AWS WAF to look for. For more information, including how you specify the values for the AWS WAF API and the AWS CLI or SDKs, see TargetString in the ByteMatchTuple data type.
  • Where to look, such as at the beginning or the end of a query string.
  • Whether to perform any conversions on the request, such as converting it to lowercase, before inspecting it for the specified string.
For example, you can add a ByteMatchSetUpdate object that matches web requests in which User-Agent headers contain the string BadBot. You can then configure AWS WAF to block those requests. To create and configure a ByteMatchSet, perform the following steps:
  1. Create a ByteMatchSet. For more information, see CreateByteMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateByteMatchSet request.
  3. Submit an UpdateByteMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateGeoMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes GeoMatchConstraint objects in an GeoMatchSet. For each GeoMatchConstraint object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change an GeoMatchConstraint object, you delete the existing object and add a new one.
  • The Type. The only valid value for Type is Country.
  • The Value, which is a two character code for the country to add to the GeoMatchConstraint object. Valid codes are listed in GeoMatchConstraint$Value.
To create and configure an GeoMatchSet, perform the following steps:
  1. Submit a CreateGeoMatchSet request.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateGeoMatchSet request.
  3. Submit an UpdateGeoMatchSet request to specify the country that you want AWS WAF to watch for.
When you update an GeoMatchSet, you specify the country that you want to add and/or the country that you want to delete. If you want to change a country, you delete the existing country and add the new one. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateIPSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes IPSetDescriptor objects in an IPSet. For each IPSetDescriptor object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change an IPSetDescriptor object, you delete the existing object and add a new one.
  • The IP address version, IPv4 or IPv6.
  • The IP address in CIDR notation, for example, 192.0.2.0/24 (for the range of IP addresses from 192.0.2.0 to 192.0.2.255) or 192.0.2.44/32 (for the individual IP address 192.0.2.44).
AWS WAF supports IPv4 address ranges: /8 and any range between /16 through /32. AWS WAF supports IPv6 address ranges: /24, /32, /48, /56, /64, and /128. For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing. IPv6 addresses can be represented using any of the following formats:
  • 1111:0000:0000:0000:0000:0000:0000:0111/128
  • 1111:0:0:0:0:0:0:0111/128
  • 1111::0111/128
  • 1111::111/128
You use an IPSet to specify which web requests you want to allow or block based on the IP addresses that the requests originated from. For example, if you're receiving a lot of requests from one or a small number of IP addresses and you want to block the requests, you can create an IPSet that specifies those IP addresses, and then configure AWS WAF to block the requests. To create and configure an IPSet, perform the following steps:
  1. Submit a CreateIPSet request.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateIPSet request.
  3. Submit an UpdateIPSet request to specify the IP addresses that you want AWS WAF to watch for.
When you update an IPSet, you specify the IP addresses that you want to add and/or the IP addresses that you want to delete. If you want to change an IP address, you delete the existing IP address and add the new one. You can insert a maximum of 1000 addresses in a single request. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRateBasedRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes Predicate objects in a rule and updates the RateLimit in the rule. Each Predicate object identifies a predicate, such as a ByteMatchSet or an IPSet, that specifies the web requests that you want to block or count. The RateLimit specifies the number of requests every five minutes that triggers the rule. If you add more than one predicate to a RateBasedRule, a request must match all the predicates and exceed the RateLimit to be counted or blocked. For example, suppose you add the following to a RateBasedRule:
  • An IPSet that matches the IP address 192.0.2.44/32
  • A ByteMatchSet that matches BadBot in the User-Agent header
Further, you specify a RateLimit of 1,000. You then add the RateBasedRule to a WebACL and specify that you want to block requests that satisfy the rule. For a request to be blocked, it must come from the IP address 192.0.2.44 and the User-Agent header in the request must contain the value BadBot. Further, requests that match these two conditions much be received at a rate of more than 1,000 every five minutes. If the rate drops below this limit, AWS WAF no longer blocks the requests. As a second example, suppose you want to limit requests to a particular page on your site. To do this, you could add the following to a RateBasedRule:
  • A ByteMatchSet with FieldToMatch of URI
  • A PositionalConstraint of STARTS_WITH
  • A TargetString of login
Further, you specify a RateLimit of 1,000. By adding this RateBasedRule to a WebACL, you could limit requests to your login page without affecting the rest of your site.
UpdateRegexMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes RegexMatchTuple objects (filters) in a RegexMatchSet. For each RegexMatchSetUpdate object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change a RegexMatchSetUpdate object, you delete the existing object and add a new one.
  • The part of a web request that you want AWS WAF to inspectupdate, such as a query string or the value of the User-Agent header.
  • The identifier of the pattern (a regular expression) that you want AWS WAF to look for. For more information, see RegexPatternSet.
  • Whether to perform any conversions on the request, such as converting it to lowercase, before inspecting it for the specified string.
For example, you can create a RegexPatternSet that matches any requests with User-Agent headers that contain the string B[a@]dB[o0]t. You can then configure AWS WAF to reject those requests. To create and configure a RegexMatchSet, perform the following steps:
  1. Create a RegexMatchSet. For more information, see CreateRegexMatchSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexMatchSet request.
  3. Submit an UpdateRegexMatchSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the identifier of the RegexPatternSet that contain the regular expression patters you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRegexPatternSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes RegexPatternString objects in a RegexPatternSet. For each RegexPatternString object, you specify the following values:
  • Whether to insert or delete the RegexPatternString.
  • The regular expression pattern that you want to insert or delete. For more information, see RegexPatternSet.
For example, you can create a RegexPatternString such as B[a@]dB[o0]t. AWS WAF will match this RegexPatternString to:
  • BadBot
  • BadB0t
  • B@dBot
  • B@dB0t
To create and configure a RegexPatternSet, perform the following steps:
  1. Create a RegexPatternSet. For more information, see CreateRegexPatternSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRegexPatternSet request.
  3. Submit an UpdateRegexPatternSet request to specify the regular expression pattern that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRule
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes Predicate objects in a Rule. Each Predicate object identifies a predicate, such as a ByteMatchSet or an IPSet, that specifies the web requests that you want to allow, block, or count. If you add more than one predicate to a Rule, a request must match all of the specifications to be allowed, blocked, or counted. For example, suppose that you add the following to a Rule:
  • A ByteMatchSet that matches the value BadBot in the User-Agent header
  • An IPSet that matches the IP address 192.0.2.44
You then add the Rule to a WebACL and specify that you want to block requests that satisfy the Rule. For a request to be blocked, the User-Agent header in the request must contain the value BadBot and the request must originate from the IP address 192.0.2.44. To create and configure a Rule, perform the following steps:
  1. Create and update the predicates that you want to include in the Rule.
  2. Create the Rule. See CreateRule.
  3. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRule request.
  4. Submit an UpdateRule request to add predicates to the Rule.
  5. Create and update a WebACL that contains the Rule. See CreateWebACL.
If you want to replace one ByteMatchSet or IPSet with another, you delete the existing one and add the new one. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateRuleGroup
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes ActivatedRule objects in a RuleGroup. You can only insert REGULAR rules into a rule group. You can have a maximum of ten rules per rule group. To create and configure a RuleGroup, perform the following steps:
  1. Create and update the Rules that you want to include in the RuleGroup. See CreateRule.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateRuleGroup request.
  3. Submit an UpdateRuleGroup request to add Rules to the RuleGroup.
  4. Create and update a WebACL that contains the RuleGroup. See CreateWebACL.
If you want to replace one Rule with another, you delete the existing one and add the new one. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateSizeConstraintSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes SizeConstraint objects (filters) in a SizeConstraintSet. For each SizeConstraint object, you specify the following values:
  • Whether to insert or delete the object from the array. If you want to change a SizeConstraintSetUpdate object, you delete the existing object and add a new one.
  • The part of a web request that you want AWS WAF to evaluate, such as the length of a query string or the length of the User-Agent header.
  • Whether to perform any transformations on the request, such as converting it to lowercase, before checking its length. Note that transformations of the request body are not supported because the AWS resource forwards only the first 8192 bytes of your request to AWS WAF. You can only specify a single type of TextTransformation.
  • A ComparisonOperator used for evaluating the selected part of the request against the specified Size, such as equals, greater than, less than, and so on.
  • The length, in bytes, that you want AWS WAF to watch for in selected part of the request. The length is computed after applying the transformation.
For example, you can add a SizeConstraintSetUpdate object that matches web requests in which the length of the User-Agent header is greater than 100 bytes. You can then configure AWS WAF to block those requests. To create and configure a SizeConstraintSet, perform the following steps:
  1. Create a SizeConstraintSet. For more information, see CreateSizeConstraintSet.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateSizeConstraintSet request.
  3. Submit an UpdateSizeConstraintSet request to specify the part of the request that you want AWS WAF to inspect (for example, the header or the URI) and the value that you want AWS WAF to watch for.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateSqlInjectionMatchSet
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes SqlInjectionMatchTuple objects (filters) in a SqlInjectionMatchSet. For each SqlInjectionMatchTuple object, you specify the following values:
  • Action: Whether to insert the object into or delete the object from the array. To change a SqlInjectionMatchTuple, you delete the existing object and add a new one.
  • FieldToMatch: The part of web requests that you want AWS WAF to inspect and, if you want AWS WAF to inspect a header or custom query parameter, the name of the header or parameter.
  • TextTransformation: Which text transformation, if any, to perform on the web request before inspecting the request for snippets of malicious SQL code. You can only specify a single type of TextTransformation.
You use SqlInjectionMatchSet objects to specify which CloudFront requests that you want to allow, block, or count. For example, if you're receiving requests that contain snippets of SQL code in the query string and you want to block the requests, you can create a SqlInjectionMatchSet with the applicable settings, and then configure AWS WAF to block the requests. To create and configure a SqlInjectionMatchSet, perform the following steps:
  1. Submit a CreateSqlInjectionMatchSet request.
  2. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateIPSet request.
  3. Submit an UpdateSqlInjectionMatchSet request to specify the parts of web requests that you want AWS WAF to inspect for snippets of SQL code.
For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
UpdateWebACL
Show Description This is AWS WAF Classic documentation. For more information, see AWS WAF Classic in the developer guide. For the latest version of AWS WAF, use the AWS WAFV2 API and see the AWS WAF Developer Guide. With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes ActivatedRule objects in a WebACL. Each Rule identifies web requests that you want to allow, block, or count. When you update a WebACL, you specify the following values:
  • A default action for the WebACL, either ALLOW or BLOCK. AWS WAF performs the default action if a request doesn't match the criteria in any of the Rules in a WebACL.
  • The Rules that you want to add or delete. If you want to replace one Rule with another, you delete the existing Rule and add the new one.
  • For each Rule, whether you want AWS WAF to allow requests, block requests, or count requests that match the conditions in the Rule.
  • The order in which you want AWS WAF to evaluate the Rules in a WebACL. If you add more than one Rule to a WebACL, AWS WAF evaluates each request against the Rules in order based on the value of Priority. (The Rule that has the lowest value for Priority is evaluated first.) When a web request matches all the predicates (such as ByteMatchSets and IPSets) in a Rule, AWS WAF immediately takes the corresponding action, allow or block, and doesn't evaluate the request against the remaining Rules in the WebACL, if any.
To create and configure a WebACL, perform the following steps:
  1. Create and update the predicates that you want to include in Rules. For more information, see CreateByteMatchSet, UpdateByteMatchSet, CreateIPSet, UpdateIPSet, CreateSqlInjectionMatchSet, and UpdateSqlInjectionMatchSet.
  2. Create and update the Rules that you want to include in the WebACL. For more information, see CreateRule and UpdateRule.
  3. Create a WebACL. See CreateWebACL.
  4. Use GetChangeToken to get the change token that you provide in the ChangeToken parameter of an UpdateWebACL request.
  5. Submit an UpdateWebACL request to specify the Rules that you want to include in the WebACL, to specify the default action, and to associate the WebACL with a CloudFront distribution. The ActivatedRule can be a rule group. If you specify a rule group as your ActivatedRule , you can exclude specific rules from that rule group. If you already have a rule group associated with a web ACL and want to submit an UpdateWebACL request to exclude certain rules from that rule group, you must first remove the rule group from the web ACL, the re-insert it again, specifying the excluded rules. For details, see ActivatedRule$ExcludedRules .
Be aware that if you try to add a RATE_BASED rule to a web ACL without setting the rule type when first creating the rule, the UpdateWebACL request will fail because the request tries to add a REGULAR rule (the default rule type) with the specified ID, which does not exist. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the AWS WAF Developer Guide.
## Wafv2 Events
Service Event Name Description
wafv2 AssociateWebACL
Show Description Associates a web ACL with a regional application resource, to protect the resource. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, or an AppSync GraphQL API. For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To associate a web ACL, in the CloudFront call UpdateDistribution, set the web ACL ID to the Amazon Resource Name (ARN) of the web ACL. For information, see UpdateDistribution.
CheckCapacity
Show Description Returns the web ACL capacity unit (WCU) requirements for a specified scope and set of rules. You can use this to check the capacity requirements for the rules you want to use in a RuleGroup or WebACL. WAF uses WCUs to calculate and control the operating resources that are used to run your rules, rule groups, and web ACLs. WAF calculates capacity differently for each rule type, to reflect the relative cost of each rule. Simple rules that cost little to run use fewer WCUs than more complex rules that use more processing power. Rule group capacity is fixed at creation, which helps users plan their web ACL WCU usage when they use a rule group. The WCU limit for web ACLs is 1,500.
CreateIPSet
Show Description Creates an IPSet, which you use to identify web requests that originate from specific IP addresses or ranges of IP addresses. For example, if you're receiving a lot of requests from a ranges of IP addresses, you can configure WAF to block them using an IPSet that lists those IP addresses.
CreateRegexPatternSet
Show Description Creates a RegexPatternSet, which you reference in a RegexPatternSetReferenceStatement, to have WAF inspect a web request component for the specified patterns.
CreateRuleGroup
Show Description Creates a RuleGroup per the specifications provided. A rule group defines a collection of rules to inspect and control web requests that you can use in a WebACL. When you create a rule group, you define an immutable capacity limit. If you update a rule group, you must stay within the capacity. This allows others to reuse the rule group with confidence in its capacity requirements.
CreateWebACL
Show Description Creates a WebACL per the specifications provided. A web ACL defines a collection of rules to use to inspect and control web requests. Each rule has an action defined (allow, block, or count) for requests that match the statement of the rule. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types Rule, RuleGroup, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, or an AppSync GraphQL API.
DeleteFirewallManagerRuleGroups
Show Description Deletes all rule groups that are managed by Firewall Manager for the specified web ACL. You can only use this if ManagedByFirewallManager is false in the specified WebACL.
DeleteIPSet
Show Description Deletes the specified IPSet.
DeleteLoggingConfiguration
Show Description Deletes the LoggingConfiguration from the specified web ACL.
DeletePermissionPolicy
Show Description Permanently deletes an IAM policy from the specified rule group. You must be the owner of the rule group to perform this operation.
DeleteRegexPatternSet
Show Description Deletes the specified RegexPatternSet.
DeleteRuleGroup
Show Description Deletes the specified RuleGroup.
DeleteWebACL
Show Description Deletes the specified WebACL. You can only use this if ManagedByFirewallManager is false in the specified WebACL.
DescribeManagedRuleGroup
Show Description Provides high-level information for a managed rule group, including descriptions of the rules.
DisassociateWebACL
Show Description Disassociates a web ACL from a regional application resource. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, or an AppSync GraphQL API. For Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To disassociate a web ACL, provide an empty web ACL ID in the CloudFront call UpdateDistribution. For information, see UpdateDistribution.
GetIPSet
Show Description Retrieves the specified IPSet.
GetLoggingConfiguration
Show Description Returns the LoggingConfiguration for the specified web ACL.
GetManagedRuleSet
Show Description Retrieves the specified managed rule set. This is intended for use only by vendors of managed rule sets. Vendors are Amazon Web Services and Amazon Web Services Marketplace sellers. Vendors, you can use the managed rule set APIs to provide controlled rollout of your versioned managed rule group offerings for your customers. The APIs are ListManagedRuleSets, GetManagedRuleSet, PutManagedRuleSetVersions, and UpdateManagedRuleSetVersionExpiryDate.
GetPermissionPolicy
Show Description Returns the IAM policy that is attached to the specified rule group. You must be the owner of the rule group to perform this operation.
GetRateBasedStatementManagedKeys
Show Description Retrieves the keys that are currently blocked by a rate-based rule instance. The maximum number of managed keys that can be blocked for a single rate-based rule instance is 10,000. If more than 10,000 addresses exceed the rate limit, those with the highest rates are blocked. For a rate-based rule that you've defined inside a rule group, provide the name of the rule group reference statement in your request, in addition to the rate-based rule name and the web ACL name. WAF monitors web requests and manages keys independently for each unique combination of web ACL, optional rule group, and rate-based rule. For example, if you define a rate-based rule inside a rule group, and then use the rule group in a web ACL, WAF monitors web requests and manages keys for that web ACL, rule group reference statement, and rate-based rule instance. If you use the same rule group in a second web ACL, WAF monitors web requests and manages keys for this second usage completely independent of your first.
GetRegexPatternSet
Show Description Retrieves the specified RegexPatternSet.
GetRuleGroup
Show Description Retrieves the specified RuleGroup.
GetSampledRequests
Show Description Gets detailed information about a specified number of requests--a sample--that WAF randomly selects from among the first 5,000 requests that your Amazon Web Services resource received during a time range that you choose. You can specify a sample size of up to 500 requests, and you can specify any time range in the previous three hours. GetSampledRequests returns a time range, which is usually the time range that you specified. However, if your resource (such as a CloudFront distribution) received 5,000 requests before the specified time range elapsed, GetSampledRequests returns an updated time range. This new time range indicates the actual period during which WAF selected the requests in the sample.
GetWebACL
Show Description Retrieves the specified WebACL.
GetWebACLForResource
Show Description Retrieves the WebACL for the specified resource.
ListAvailableManagedRuleGroupVersions
Show Description Returns a list of the available versions for the specified managed rule group.
ListAvailableManagedRuleGroups
Show Description Retrieves an array of managed rule groups that are available for you to use. This list includes all Amazon Web Services Managed Rules rule groups and all of the Amazon Web Services Marketplace managed rule groups that you're subscribed to.
ListIPSets
Show Description Retrieves an array of IPSetSummary objects for the IP sets that you manage.
ListLoggingConfigurations
Show Description Retrieves an array of your LoggingConfiguration objects.
ListManagedRuleSets
Show Description Retrieves the managed rule sets that you own. This is intended for use only by vendors of managed rule sets. Vendors are Amazon Web Services and Amazon Web Services Marketplace sellers. Vendors, you can use the managed rule set APIs to provide controlled rollout of your versioned managed rule group offerings for your customers. The APIs are ListManagedRuleSets, GetManagedRuleSet, PutManagedRuleSetVersions, and UpdateManagedRuleSetVersionExpiryDate.
ListRegexPatternSets
Show Description Retrieves an array of RegexPatternSetSummary objects for the regex pattern sets that you manage.
ListResourcesForWebACL
Show Description Retrieves an array of the Amazon Resource Names (ARNs) for the regional resources that are associated with the specified web ACL. If you want the list of Amazon CloudFront resources, use the CloudFront call ListDistributionsByWebACLId.
ListRuleGroups
Show Description Retrieves an array of RuleGroupSummary objects for the rule groups that you manage.
ListTagsForResource
Show Description Retrieves the TagInfoForResource for the specified resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing. For example, you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each Amazon Web Services resource, up to 50 tags for a resource. You can tag the Amazon Web Services resources that you manage through WAF: web ACLs, rule groups, IP sets, and regex pattern sets. You can't manage or view tags through the WAF console.
ListWebACLs
Show Description Retrieves an array of WebACLSummary objects for the web ACLs that you manage.
PutLoggingConfiguration
Show Description Enables the specified LoggingConfiguration, to start logging from a web ACL, according to the configuration provided. You can access information about all traffic that WAF inspects using the following steps:
  1. Create an Amazon Kinesis Data Firehose. Create the data firehose with a PUT source and in the Region that you are operating. If you are capturing logs for Amazon CloudFront, always create the firehose in US East (N. Virginia). Give the data firehose a name that starts with the prefix aws-waf-logs-. For example, aws-waf-logs-us-east-2-analytics. Do not create the data firehose using a Kinesis stream as your source.
  2. Associate that firehose to your web ACL using a PutLoggingConfiguration request.
When you successfully enable logging using a PutLoggingConfiguration request, WAF will create a service linked role with the necessary permissions to write logs to the Amazon Kinesis Data Firehose. For more information, see Logging Web ACL Traffic Information in the WAF Developer Guide. This operation completely replaces the mutable specifications that you already have for the logging configuration with the ones that you provide to this call. To modify the logging configuration, retrieve it by calling GetLoggingConfiguration, update the settings as needed, and then provide the complete logging configuration specification to this call.
PutManagedRuleSetVersions
Show Description Defines the versions of your managed rule set that you are offering to the customers. Customers see your offerings as managed rule groups with versioning. This is intended for use only by vendors of managed rule sets. Vendors are Amazon Web Services and Amazon Web Services Marketplace sellers. Vendors, you can use the managed rule set APIs to provide controlled rollout of your versioned managed rule group offerings for your customers. The APIs are ListManagedRuleSets, GetManagedRuleSet, PutManagedRuleSetVersions, and UpdateManagedRuleSetVersionExpiryDate. Customers retrieve their managed rule group list by calling ListAvailableManagedRuleGroups. The name that you provide here for your managed rule set is the name the customer sees for the corresponding managed rule group. Customers can retrieve the available versions for a managed rule group by calling ListAvailableManagedRuleGroupVersions. You provide a rule group specification for each version. For each managed rule set, you must specify a version that you recommend using. To initiate the expiration of a managed rule group version, use UpdateManagedRuleSetVersionExpiryDate.
PutPermissionPolicy
Show Description Attaches an IAM policy to the specified resource. Use this to share a rule group across accounts. You must be the owner of the rule group to perform this operation. This action is subject to the following restrictions:
  • You can attach only one policy with each PutPermissionPolicy request.
  • The ARN in the request must be a valid WAF RuleGroup ARN and the rule group must exist in the same Region.
  • The user making the request must be the owner of the rule group.
TagResource
Show Description Associates tags with the specified Amazon Web Services resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing. For example, you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each Amazon Web Services resource, up to 50 tags for a resource. You can tag the Amazon Web Services resources that you manage through WAF: web ACLs, rule groups, IP sets, and regex pattern sets. You can't manage or view tags through the WAF console.
UntagResource
Show Description Disassociates tags from an Amazon Web Services resource. Tags are key:value pairs that you can associate with Amazon Web Services resources. For example, the tag key might be "customer" and the tag value might be "companyA." You can specify one or more tags to add to each container. You can add up to 50 tags to each Amazon Web Services resource.
UpdateIPSet
Show Description Updates the specified IPSet. This operation completely replaces the mutable specifications that you already have for the IP set with the ones that you provide to this call. To modify the IP set, retrieve it by calling GetIPSet, update the settings as needed, and then provide the complete IP set specification to this call.
UpdateManagedRuleSetVersionExpiryDate
Show Description Updates the expiration information for your managed rule set. Use this to initiate the expiration of a managed rule group version. After you initiate expiration for a version, WAF excludes it from the reponse to ListAvailableManagedRuleGroupVersions for the managed rule group. This is intended for use only by vendors of managed rule sets. Vendors are Amazon Web Services and Amazon Web Services Marketplace sellers. Vendors, you can use the managed rule set APIs to provide controlled rollout of your versioned managed rule group offerings for your customers. The APIs are ListManagedRuleSets, GetManagedRuleSet, PutManagedRuleSetVersions, and UpdateManagedRuleSetVersionExpiryDate.
UpdateRegexPatternSet
Show Description Updates the specified RegexPatternSet. This operation completely replaces the mutable specifications that you already have for the regex pattern set with the ones that you provide to this call. To modify the regex pattern set, retrieve it by calling GetRegexPatternSet, update the settings as needed, and then provide the complete regex pattern set specification to this call.
UpdateRuleGroup
Show Description Updates the specified RuleGroup. This operation completely replaces the mutable specifications that you already have for the rule group with the ones that you provide to this call. To modify the rule group, retrieve it by calling GetRuleGroup, update the settings as needed, and then provide the complete rule group specification to this call. A rule group defines a collection of rules to inspect and control web requests that you can use in a WebACL. When you create a rule group, you define an immutable capacity limit. If you update a rule group, you must stay within the capacity. This allows others to reuse the rule group with confidence in its capacity requirements.
## Wellarchitected Events
Service Event Name Description
wellarchitected AssociateLenses
CreateMilestone
Show Description Create a milestone for an existing workload.
CreateWorkload
Show Description Create a new workload. The owner of a workload can share the workload with other AWS accounts and IAM users in the same AWS Region. Only the owner of a workload can delete it. For more information, see Defining a Workload in the AWS Well-Architected Tool User Guide.
CreateWorkloadShare
Show Description Create a workload share. The owner of a workload can share it with other AWS accounts and IAM users in the same AWS Region. Shared access to a workload is not removed until the workload invitation is deleted. For more information, see Sharing a Workload in the AWS Well-Architected Tool User Guide.
DeleteWorkload
DeleteWorkloadShare
DisassociateLenses
GetAnswer
Show Description Get the answer to a specific question in a workload review.
GetLensReview
Show Description Get lens review.
GetLensReviewReport
Show Description Get lens review report.
GetLensVersionDifference
Show Description Get lens version differences.
GetMilestone
Show Description Get a milestone for an existing workload.
GetWorkload
Show Description Get an existing workload.
ListAnswers
Show Description List of answers.
ListLensReviewImprovements
Show Description List lens review improvements.
ListLensReviews
Show Description List lens reviews.
ListLenses
Show Description List the available lenses.
ListMilestones
Show Description List all milestones for an existing workload.
ListNotifications
Show Description List lens notifications.
ListShareInvitations
Show Description List the workload invitations.
ListTagsForResource
Show Description List the tags for a resource.
ListWorkloadShares
Show Description List the workload shares associated with the workload.
ListWorkloads
Show Description List workloads. Paginated.
TagResource
Show Description Adds one or more tags to the specified resource.
UntagResource
Show Description Deletes specified tags from a resource. To specify multiple tags, use separate tagKeys parameters, for example: DELETE /tags/WorkloadArn?tagKeys=key1&tagKeys=key2
UpdateAnswer
Show Description Update the answer to a specific question in a workload review.
UpdateLensReview
Show Description Update lens review.
UpdateShareInvitation
Show Description Update a workload invitation.
UpdateWorkload
Show Description Update an existing workload.
UpdateWorkloadShare
Show Description Update a workload share.
## Wisdom Events
</tbody> </table> ## Workdocs Events
Service Event Name Description
wisdom CreateAssistant
Show Description Creates an Amazon Connect Wisdom assistant.
CreateAssistantAssociation
Show Description Creates an association between an Amazon Connect Wisdom assistant and another resource. Currently, the only supported association is with a knowledge base. An assistant can have only a single association.
CreateContent
Show Description Creates Wisdom content. Before to calling this API, use StartContentUpload to upload an asset.
CreateKnowledgeBase
Show Description Creates a knowledge base. When using this API, you cannot reuse Amazon AppIntegrations DataIntegrations with external knowledge bases such as Salesforce and ServiceNow. If you do, you'll get an InvalidRequestException error. 
 <p>For example, you're programmatically managing your external knowledge base, and you want to add or remove one of the fields that is being ingested from Salesforce. Do the following:</p> <ol> <li> <p>Call <a href="https://docs.aws.amazon.com/wisdom/latest/APIReference/API_DeleteKnowledgeBase.html">DeleteKnowledgeBase</a>.</p> </li> <li> <p>Call <a href="https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_DeleteDataIntegration.html">DeleteDataIntegration</a>.</p> </li> <li> <p>Call <a href="https://docs.aws.amazon.com/appintegrations/latest/APIReference/API_CreateDataIntegration.html">CreateDataIntegration</a> to recreate the DataIntegration or a create different one.</p> </li> <li> <p>Call CreateKnowledgeBase.</p> </li> </ol> </note>
</details> </td> </tr>
CreateSession
Show Description Creates a session. A session is a contextual container used for generating recommendations. Amazon Connect creates a new Wisdom session for each contact on which Wisdom is enabled.
DeleteAssistant
Show Description Deletes an assistant.
DeleteAssistantAssociation
Show Description Deletes an assistant association.
DeleteContent
Show Description Deletes the content.
DeleteKnowledgeBase
Show Description Deletes the knowledge base. When you use this API to delete an external knowledge base such as Salesforce or ServiceNow, you must also delete the Amazon AppIntegrations DataIntegration. This is because you can't reuse the DataIntegration after it's been associated with an external knowledge base. However, you can delete and recreate it. See DeleteDataIntegration and CreateDataIntegration in the Amazon AppIntegrations API Reference.
GetAssistant
Show Description Retrieves information about an assistant.
GetAssistantAssociation
Show Description Retrieves information about an assistant association.
GetContent
Show Description Retrieves content, including a pre-signed URL to download the content.
GetContentSummary
Show Description Retrieves summary information about the content.
GetKnowledgeBase
Show Description Retrieves information about the knowledge base.
GetRecommendations
Show Description Retrieves recommendations for the specified session. To avoid retrieving the same recommendations in subsequent calls, use NotifyRecommendationsReceived. This API supports long-polling behavior with the waitTimeSeconds parameter. Short poll is the default behavior and only returns recommendations already available. To perform a manual query against an assistant, use QueryAssistant.
GetSession
Show Description Retrieves information for a specified session.
ListAssistantAssociations
Show Description Lists information about assistant associations.
ListAssistants
Show Description Lists information about assistants.
ListContents
Show Description Lists the content.
ListKnowledgeBases
Show Description Lists the knowledge bases.
ListTagsForResource
Show Description Lists the tags for the specified resource.
NotifyRecommendationsReceived
Show Description Removes the specified recommendations from the specified assistant's queue of newly available recommendations. You can use this API in conjunction with GetRecommendations and a waitTimeSeconds input for long-polling behavior and avoiding duplicate recommendations.
QueryAssistant
Show Description Performs a manual search against the specified assistant. To retrieve recommendations for an assistant, use GetRecommendations.
RemoveKnowledgeBaseTemplateUri
Show Description Removes a URI template from a knowledge base.
SearchContent
Show Description Searches for content in a specified knowledge base. Can be used to get a specific content resource by its name.
SearchSessions
Show Description Searches for sessions.
StartContentUpload
Show Description Get a URL to upload content to a knowledge base. To upload content, first make a PUT request to the returned URL with your file, making sure to include the required headers. Then use CreateContent to finalize the content creation process or UpdateContent to modify an existing resource. You can only upload content to a knowledge base of type CUSTOM.
TagResource
Show Description Adds the specified tags to the specified resource.
UntagResource
Show Description Removes the specified tags from the specified resource.
UpdateContent
Show Description Updates information about the content.
Service Event Name Description
workdocs AbortDocumentVersionUpload
ActivateUser
Show Description Activates the specified user. Only active users can access Amazon WorkDocs.
AddResourcePermissions
Show Description Creates a set of permissions for the specified folder or document. The resource permissions are overwritten if the principals already have different permissions.
CreateComment
Show Description Adds a new comment to the specified document version.
CreateCustomMetadata
Show Description Adds one or more custom properties to the specified resource (a folder, document, or version).
CreateFolder
Show Description Creates a folder with the specified name and parent folder.
CreateLabels
Show Description Adds the specified list of labels to the given resource (a document or folder)
CreateNotificationSubscription
Show Description Configure Amazon WorkDocs to use Amazon SNS notifications. The endpoint receives a confirmation message, and must confirm the subscription. For more information, see Subscribe to Notifications in the Amazon WorkDocs Developer Guide.
CreateUser
Show Description Creates a user in a Simple AD or Microsoft AD directory. The status of a newly created user is "ACTIVE". New users can access Amazon WorkDocs.
DeactivateUser
DeleteComment
DeleteCustomMetadata
Show Description Deletes custom metadata from the specified resource.
DeleteDocument
DeleteFolder
DeleteFolderContents
DeleteLabels
Show Description Deletes the specified list of labels from a resource.
DeleteNotificationSubscription
DeleteUser
DescribeActivities
Show Description Describes the user activities in a specified time period.
DescribeComments
Show Description List all the comments for the specified document version.
DescribeDocumentVersions
Show Description Retrieves the document versions for the specified document. By default, only active versions are returned.
DescribeFolderContents
Show Description Describes the contents of the specified folder, including its documents and subfolders. By default, Amazon WorkDocs returns the first 100 active document and folder metadata items. If there are more results, the response includes a marker that you can use to request the next set of results. You can also request initialized documents.
DescribeGroups
Show Description Describes the groups specified by the query. Groups are defined by the underlying Active Directory.
DescribeNotificationSubscriptions
Show Description Lists the specified notification subscriptions.
DescribeResourcePermissions
Show Description Describes the permissions of a specified resource.
DescribeRootFolders
Show Description Describes the current user's special folders; the RootFolder and the RecycleBin. RootFolder is the root of user's files and folders and RecycleBin is the root of recycled items. This is not a valid action for SigV4 (administrative API) clients. This action requires an authentication token. To get an authentication token, register an application with Amazon WorkDocs. For more information, see Authentication and Access Control for User Applications in the Amazon WorkDocs Developer Guide.
DescribeUsers
Show Description Describes the specified users. You can describe all users or filter the results (for example, by status or organization). By default, Amazon WorkDocs returns the first 24 active or pending users. If there are more results, the response includes a marker that you can use to request the next set of results.
GetCurrentUser
Show Description Retrieves details of the current user for whom the authentication token was generated. This is not a valid action for SigV4 (administrative API) clients. This action requires an authentication token. To get an authentication token, register an application with Amazon WorkDocs. For more information, see Authentication and Access Control for User Applications in the Amazon WorkDocs Developer Guide.
GetDocument
Show Description Retrieves details of a document.
GetDocumentPath
Show Description Retrieves the path information (the hierarchy from the root folder) for the requested document. By default, Amazon WorkDocs returns a maximum of 100 levels upwards from the requested document and only includes the IDs of the parent folders in the path. You can limit the maximum number of levels. You can also request the names of the parent folders.
GetDocumentVersion
Show Description Retrieves version metadata for the specified document.
GetFolder
Show Description Retrieves the metadata of the specified folder.
GetFolderPath
Show Description Retrieves the path information (the hierarchy from the root folder) for the specified folder. By default, Amazon WorkDocs returns a maximum of 100 levels upwards from the requested folder and only includes the IDs of the parent folders in the path. You can limit the maximum number of levels. You can also request the parent folder names.
GetResources
Show Description Retrieves a collection of resources, including folders and documents. The only CollectionType supported is SHARED_WITH_ME.
InitiateDocumentVersionUpload
Show Description Creates a new document object and version object. The client specifies the parent folder ID and name of the document to upload. The ID is optionally specified when creating a new version of an existing document. This is the first step to upload a document. Next, upload the document to the URL returned from the call, and then call UpdateDocumentVersion. To cancel the document upload, call AbortDocumentVersionUpload.
RemoveAllResourcePermissions
RemoveResourcePermission
UpdateDocument
UpdateDocumentVersion
UpdateFolder
## Worklink Events
Service Event Name Description
worklink AssociateDomain
Show Description Specifies a domain to be associated to Amazon WorkLink.
AssociateWebsiteAuthorizationProvider
Show Description Associates a website authorization provider with a specified fleet. This is used to authorize users against associated websites in the company network.
AssociateWebsiteCertificateAuthority
Show Description Imports the root certificate of a certificate authority (CA) used to obtain TLS certificates used by associated websites within the company network.
CreateFleet
Show Description Creates a fleet. A fleet consists of resources and the configuration that delivers associated websites to authorized users who download and set up the Amazon WorkLink app.
DeleteFleet
Show Description Deletes a fleet. Prevents users from accessing previously associated websites.
DescribeAuditStreamConfiguration
Show Description Describes the configuration for delivering audit streams to the customer account.
DescribeCompanyNetworkConfiguration
Show Description Describes the networking configuration to access the internal websites associated with the specified fleet.
DescribeDevice
Show Description Provides information about a user's device.
DescribeDevicePolicyConfiguration
Show Description Describes the device policy configuration for the specified fleet.
DescribeDomain
Show Description Provides information about the domain.
DescribeFleetMetadata
Show Description Provides basic information for the specified fleet, excluding identity provider, networking, and device configuration details.
DescribeIdentityProviderConfiguration
Show Description Describes the identity provider configuration of the specified fleet.
DescribeWebsiteCertificateAuthority
Show Description Provides information about the certificate authority.
DisassociateDomain
Show Description Disassociates a domain from Amazon WorkLink. End users lose the ability to access the domain with Amazon WorkLink.
DisassociateWebsiteAuthorizationProvider
Show Description Disassociates a website authorization provider from a specified fleet. After the disassociation, users can't load any associated websites that require this authorization provider.
DisassociateWebsiteCertificateAuthority
Show Description Removes a certificate authority (CA).
ListDevices
Show Description Retrieves a list of devices registered with the specified fleet.
ListDomains
Show Description Retrieves a list of domains associated to a specified fleet.
ListFleets
Show Description Retrieves a list of fleets for the current account and Region.
ListTagsForResource
Show Description Retrieves a list of tags for the specified resource.
ListWebsiteAuthorizationProviders
Show Description Retrieves a list of website authorization providers associated with a specified fleet.
ListWebsiteCertificateAuthorities
Show Description Retrieves a list of certificate authorities added for the current account and Region.
RestoreDomainAccess
Show Description Moves a domain to ACTIVE status if it was in the INACTIVE status.
RevokeDomainAccess
Show Description Moves a domain to INACTIVE status if it was in the ACTIVE status.
SignOutUser
Show Description Signs the user out from all of their devices. The user can sign in again if they have valid credentials.
TagResource
Show Description Adds or overwrites one or more tags for the specified resource, such as a fleet. Each tag consists of a key and an optional value. If a resource already has a tag with the same key, this operation updates its value.
UntagResource
Show Description Removes one or more tags from the specified resource.
UpdateAuditStreamConfiguration
Show Description Updates the audit stream configuration for the fleet.
UpdateCompanyNetworkConfiguration
Show Description Updates the company network configuration for the fleet.
UpdateDevicePolicyConfiguration
Show Description Updates the device policy configuration for the fleet.
UpdateDomainMetadata
Show Description Updates domain metadata, such as DisplayName.
UpdateFleetMetadata
Show Description Updates fleet metadata, such as DisplayName.
## Workmailmessageflow Events
Service Event Name Description
workmailmessageflow GetRawMessageContent
Show Description Retrieves the raw content of an in-transit email message, in MIME format.
## Workspaces Events
Service Event Name Description
workspaces AssociateConnectionAlias
Show Description Associates the specified connection alias with the specified directory to enable cross-Region redirection. For more information, see Cross-Region Redirection for Amazon WorkSpaces. Before performing this operation, call DescribeConnectionAliases to make sure that the current state of the connection alias is CREATED.
AssociateIpGroups
Show Description Associates the specified IP access control group with the specified directory.
AuthorizeIpRules
Show Description Adds one or more rules to the specified IP access control group. This action gives users permission to access their WorkSpaces from the CIDR address ranges specified in the rules.
CopyWorkspaceImage
Show Description Copies the specified image from the specified Region to the current Region. For more information about copying images, see Copy a Custom WorkSpaces Image. In the China (Ningxia) Region, you can copy images only within the same Region. In Amazon Web Services GovCloud (US), to copy images to and from other Regions, contact Amazon Web Services Support. Before copying a shared image, be sure to verify that it has been shared from the correct Amazon Web Services account. To determine if an image has been shared and to see the ID of the Amazon Web Services account that owns an image, use the DescribeWorkSpaceImages and DescribeWorkspaceImagePermissions API operations.
CreateConnectionAlias
Show Description Creates the specified connection alias for use with cross-Region redirection. For more information, see Cross-Region Redirection for Amazon WorkSpaces.
CreateIpGroup
Show Description Creates an IP access control group. An IP access control group provides you with the ability to control the IP addresses from which users are allowed to access their WorkSpaces. To specify the CIDR address ranges, add rules to your IP access control group and then associate the group with your directory. You can add rules when you create the group or at any time using AuthorizeIpRules. There is a default IP access control group associated with your directory. If you don't associate an IP access control group with your directory, the default group is used. The default group includes a default rule that allows users to access their WorkSpaces from anywhere. You cannot modify the default IP access control group for your directory.
CreateTags
Show Description Creates the specified tags for the specified WorkSpaces resource.
CreateUpdatedWorkspaceImage
Show Description Creates a new updated WorkSpace image based on the specified source image. The new updated WorkSpace image has the latest drivers and other updates required by the Amazon WorkSpaces components. To determine which WorkSpace images need to be updated with the latest Amazon WorkSpaces requirements, use DescribeWorkspaceImages.
  • Only Windows 10 WorkSpace images can be programmatically updated at this time.
  • Microsoft Windows updates and other application updates are not included in the update process.
  • The source WorkSpace image is not deleted. You can delete the source image after you've verified your new updated image and created a new bundle.
CreateWorkspaceBundle
Show Description Creates the specified WorkSpace bundle. For more information about creating WorkSpace bundles, see Create a Custom WorkSpaces Image and Bundle.
CreateWorkspaces
Show Description Creates one or more WorkSpaces. This operation is asynchronous and returns before the WorkSpaces are created.
DeleteConnectionAlias
Show Description Deletes the specified connection alias. For more information, see Cross-Region Redirection for Amazon WorkSpaces. If you will no longer be using a fully qualified domain name (FQDN) as the registration code for your WorkSpaces users, you must take certain precautions to prevent potential security issues. For more information, see Security Considerations if You Stop Using Cross-Region Redirection. To delete a connection alias that has been shared, the shared account must first disassociate the connection alias from any directories it has been associated with. Then you must unshare the connection alias from the account it has been shared with. You can delete a connection alias only after it is no longer shared with any accounts or associated with any directories.
DeleteIpGroup
Show Description Deletes the specified IP access control group. You cannot delete an IP access control group that is associated with a directory.
DeleteTags
Show Description Deletes the specified tags from the specified WorkSpaces resource.
DeleteWorkspaceBundle
Show Description Deletes the specified WorkSpace bundle. For more information about deleting WorkSpace bundles, see Delete a Custom WorkSpaces Bundle or Image.
DeleteWorkspaceImage
Show Description Deletes the specified image from your account. To delete an image, you must first delete any bundles that are associated with the image and unshare the image if it is shared with other accounts.
DeregisterWorkspaceDirectory
Show Description Deregisters the specified directory. This operation is asynchronous and returns before the WorkSpace directory is deregistered. If any WorkSpaces are registered to this directory, you must remove them before you can deregister the directory. Simple AD and AD Connector are made available to you free of charge to use with WorkSpaces. If there are no WorkSpaces being used with your Simple AD or AD Connector directory for 30 consecutive days, this directory will be automatically deregistered for use with Amazon WorkSpaces, and you will be charged for this directory as per the Directory Service pricing terms. To delete empty directories, see Delete the Directory for Your WorkSpaces. If you delete your Simple AD or AD Connector directory, you can always create a new one when you want to start using WorkSpaces again.
DescribeAccount
Show Description Retrieves a list that describes the configuration of Bring Your Own License (BYOL) for the specified account.
DescribeAccountModifications
Show Description Retrieves a list that describes modifications to the configuration of Bring Your Own License (BYOL) for the specified account.
DescribeClientProperties
Show Description Retrieves a list that describes one or more specified Amazon WorkSpaces clients.
DescribeConnectionAliasPermissions
Show Description Describes the permissions that the owner of a connection alias has granted to another Amazon Web Services account for the specified connection alias. For more information, see Cross-Region Redirection for Amazon WorkSpaces.
DescribeConnectionAliases
Show Description Retrieves a list that describes the connection aliases used for cross-Region redirection. For more information, see Cross-Region Redirection for Amazon WorkSpaces.
DescribeIpGroups
Show Description Describes one or more of your IP access control groups.
DescribeTags
Show Description Describes the specified tags for the specified WorkSpaces resource.
DescribeWorkspaceBundles
Show Description Retrieves a list that describes the available WorkSpace bundles. You can filter the results using either bundle ID or owner, but not both.
DescribeWorkspaceDirectories
Show Description Describes the available directories that are registered with Amazon WorkSpaces.
DescribeWorkspaceImagePermissions
Show Description Describes the permissions that the owner of an image has granted to other Amazon Web Services accounts for an image.
DescribeWorkspaceImages
Show Description Retrieves a list that describes one or more specified images, if the image identifiers are provided. Otherwise, all images in the account are described.
DescribeWorkspaceSnapshots
Show Description Describes the snapshots for the specified WorkSpace.
DescribeWorkspaces
Show Description Describes the specified WorkSpaces. You can filter the results by using the bundle identifier, directory identifier, or owner, but you can specify only one filter at a time.
DescribeWorkspacesConnectionStatus
Show Description Describes the connection status of the specified WorkSpaces.
DisassociateConnectionAlias
Show Description Disassociates a connection alias from a directory. Disassociating a connection alias disables cross-Region redirection between two directories in different Regions. For more information, see Cross-Region Redirection for Amazon WorkSpaces. Before performing this operation, call DescribeConnectionAliases to make sure that the current state of the connection alias is CREATED.
DisassociateIpGroups
Show Description Disassociates the specified IP access control group from the specified directory.
ImportWorkspaceImage
Show Description Imports the specified Windows 10 Bring Your Own License (BYOL) image into Amazon WorkSpaces. The image must be an already licensed Amazon EC2 image that is in your Amazon Web Services account, and you must own the image. For more information about creating BYOL images, see Bring Your Own Windows Desktop Licenses.
ListAvailableManagementCidrRanges
Show Description Retrieves a list of IP address ranges, specified as IPv4 CIDR blocks, that you can use for the network management interface when you enable Bring Your Own License (BYOL). This operation can be run only by Amazon Web Services accounts that are enabled for BYOL. If your account isn't enabled for BYOL, you'll receive an AccessDeniedException error. The management network interface is connected to a secure Amazon WorkSpaces management network. It is used for interactive streaming of the WorkSpace desktop to Amazon WorkSpaces clients, and to allow Amazon WorkSpaces to manage the WorkSpace.
MigrateWorkspace
Show Description Migrates a WorkSpace from one operating system or bundle type to another, while retaining the data on the user volume. The migration process recreates the WorkSpace by using a new root volume from the target bundle image and the user volume from the last available snapshot of the original WorkSpace. During migration, the original D:\Users\%USERNAME% user profile folder is renamed to D:\Users\%USERNAME%MMddyyTHHmmss%.NotMigrated. A new D:\Users\%USERNAME%\ folder is generated by the new OS. Certain files in the old user profile are moved to the new user profile. For available migration scenarios, details about what happens during migration, and best practices, see Migrate a WorkSpace.
ModifyAccount
Show Description Modifies the configuration of Bring Your Own License (BYOL) for the specified account.
ModifyClientProperties
Show Description Modifies the properties of the specified Amazon WorkSpaces clients.
ModifySelfservicePermissions
Show Description Modifies the self-service WorkSpace management capabilities for your users. For more information, see Enable Self-Service WorkSpace Management Capabilities for Your Users.
ModifyWorkspaceAccessProperties
Show Description Specifies which devices and operating systems users can use to access their WorkSpaces. For more information, see Control Device Access.
ModifyWorkspaceCreationProperties
Show Description Modify the default properties used to create WorkSpaces.
ModifyWorkspaceProperties
Show Description Modifies the specified WorkSpace properties. For important information about how to modify the size of the root and user volumes, see Modify a WorkSpace.
ModifyWorkspaceState
Show Description Sets the state of the specified WorkSpace. To maintain a WorkSpace without being interrupted, set the WorkSpace state to ADMIN_MAINTENANCE. WorkSpaces in this state do not respond to requests to reboot, stop, start, rebuild, or restore. An AutoStop WorkSpace in this state is not stopped. Users cannot log into a WorkSpace in the ADMIN_MAINTENANCE state.
RebootWorkspaces
Show Description Reboots the specified WorkSpaces. You cannot reboot a WorkSpace unless its state is AVAILABLE or UNHEALTHY. This operation is asynchronous and returns before the WorkSpaces have rebooted.
RebuildWorkspaces
Show Description Rebuilds the specified WorkSpace. You cannot rebuild a WorkSpace unless its state is AVAILABLE, ERROR, UNHEALTHY, STOPPED, or REBOOTING. Rebuilding a WorkSpace is a potentially destructive action that can result in the loss of data. For more information, see Rebuild a WorkSpace. This operation is asynchronous and returns before the WorkSpaces have been completely rebuilt.
RegisterWorkspaceDirectory
Show Description Registers the specified directory. This operation is asynchronous and returns before the WorkSpace directory is registered. If this is the first time you are registering a directory, you will need to create the workspaces_DefaultRole role before you can register a directory. For more information, see Creating the workspaces_DefaultRole Role.
RestoreWorkspace
Show Description Restores the specified WorkSpace to its last known healthy state. You cannot restore a WorkSpace unless its state is AVAILABLE, ERROR, UNHEALTHY, or STOPPED. Restoring a WorkSpace is a potentially destructive action that can result in the loss of data. For more information, see Restore a WorkSpace. This operation is asynchronous and returns before the WorkSpace is completely restored.
RevokeIpRules
Show Description Removes one or more rules from the specified IP access control group.
StartWorkspaces
Show Description Starts the specified WorkSpaces. You cannot start a WorkSpace unless it has a running mode of AutoStop and a state of STOPPED.
StopWorkspaces
Show Description Stops the specified WorkSpaces. You cannot stop a WorkSpace unless it has a running mode of AutoStop and a state of AVAILABLE, IMPAIRED, UNHEALTHY, or ERROR.
TerminateWorkspaces
Show Description Terminates the specified WorkSpaces. Terminating a WorkSpace is a permanent action and cannot be undone. The user's data is destroyed. If you need to archive any user data, contact Amazon Web Services Support before terminating the WorkSpace. You can terminate a WorkSpace that is in any state except SUSPENDED. This operation is asynchronous and returns before the WorkSpaces have been completely terminated. After a WorkSpace is terminated, the TERMINATED state is returned only briefly before the WorkSpace directory metadata is cleaned up, so this state is rarely returned. To confirm that a WorkSpace is terminated, check for the WorkSpace ID by using DescribeWorkSpaces. If the WorkSpace ID isn't returned, then the WorkSpace has been successfully terminated. Simple AD and AD Connector are made available to you free of charge to use with WorkSpaces. If there are no WorkSpaces being used with your Simple AD or AD Connector directory for 30 consecutive days, this directory will be automatically deregistered for use with Amazon WorkSpaces, and you will be charged for this directory as per the Directory Service pricing terms. To delete empty directories, see Delete the Directory for Your WorkSpaces. If you delete your Simple AD or AD Connector directory, you can always create a new one when you want to start using WorkSpaces again.
UpdateConnectionAliasPermission
Show Description Shares or unshares a connection alias with one account by specifying whether that account has permission to associate the connection alias with a directory. If the association permission is granted, the connection alias is shared with that account. If the association permission is revoked, the connection alias is unshared with the account. For more information, see Cross-Region Redirection for Amazon WorkSpaces.
  • Before performing this operation, call DescribeConnectionAliases to make sure that the current state of the connection alias is CREATED.
  • To delete a connection alias that has been shared, the shared account must first disassociate the connection alias from any directories it has been associated with. Then you must unshare the connection alias from the account it has been shared with. You can delete a connection alias only after it is no longer shared with any accounts or associated with any directories.
UpdateRulesOfIpGroup
Show Description Replaces the current rules of the specified IP access control group with the specified rules.
UpdateWorkspaceBundle
Show Description Updates a WorkSpace bundle with a new image. For more information about updating WorkSpace bundles, see Update a Custom WorkSpaces Bundle. Existing WorkSpaces aren't automatically updated when you update the bundle that they're based on. To update existing WorkSpaces that are based on a bundle that you've updated, you must either rebuild the WorkSpaces or delete and recreate them.
## Xray Events
</tbody> </table>

Service Event Name Description
xray BatchGetTraces
Show Description Retrieves a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs.
CreateGroup
Show Description Creates a group resource with a name and a filter expression.
CreateSamplingRule
Show Description Creates a rule to control sampling behavior for instrumented applications. Services retrieve rules with GetSamplingRules, and evaluate each rule in ascending order of priority for each request. If a rule matches, the service records a trace, borrowing it from the reservoir size. After 10 seconds, the service reports back to X-Ray with GetSamplingTargets to get updated versions of each in-use rule. The updated rule contains a trace quota that the service can use instead of borrowing from the reservoir.
DeleteGroup
Show Description Deletes a group resource.
DeleteSamplingRule
Show Description Deletes a sampling rule.
GetEncryptionConfig
Show Description Retrieves the current encryption configuration for X-Ray data.
GetGroup
Show Description Retrieves group resource details.
GetGroups
Show Description Retrieves all active group details.
GetInsight
Show Description Retrieves the summary information of an insight. This includes impact to clients and root cause services, the top anomalous services, the category, the state of the insight, and the start and end time of the insight.
GetInsightEvents
Show Description X-Ray reevaluates insights periodically until they're resolved, and records each intermediate state as an event. You can review an insight's events in the Impact Timeline on the Inspect page in the X-Ray console.
GetInsightImpactGraph
Show Description Retrieves a service graph structure filtered by the specified insight. The service graph is limited to only structural information. For a complete service graph, use this API with the GetServiceGraph API.
GetInsightSummaries
Show Description Retrieves the summaries of all insights in the specified group matching the provided filter values.
GetSamplingRules
Show Description Retrieves all sampling rules.
GetSamplingStatisticSummaries
Show Description Retrieves information about recent sampling results for all sampling rules.
GetSamplingTargets
Show Description Requests a sampling quota for rules that the service is using to sample requests.
GetServiceGraph
Show Description Retrieves a document that describes services that process incoming requests, and downstream services that they call as a result. Root services process incoming requests and make calls to downstream services. Root services are applications that use the Amazon Web Services X-Ray SDK. Downstream services can be other applications, Amazon Web Services resources, HTTP web APIs, or SQL databases.
GetTimeSeriesServiceStatistics
Show Description Get an aggregation of service statistics defined by a specific time range.
GetTraceGraph
Show Description Retrieves a service graph for one or more specific trace IDs.
GetTraceSummaries
Show Description Retrieves IDs and annotations for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces. A filter expression can target traced requests that hit specific service nodes or edges, have errors, or come from a known user. For example, the following filter expression targets traces that pass through api.example.com: service("api.example.com") This filter expression finds traces that have an annotation named account with the value 12345: annotation.account = "12345" For a full list of indexed fields and keywords that you can use in filter expressions, see Using Filter Expressions in the Amazon Web Services X-Ray Developer Guide.
ListTagsForResource
Show Description Returns a list of tags that are applied to the specified Amazon Web Services X-Ray group or sampling rule.
PutEncryptionConfig
Show Description Updates the encryption configuration for X-Ray data.
PutTelemetryRecords
Show Description Used by the Amazon Web Services X-Ray daemon to upload telemetry.
PutTraceSegments
Show Description Uploads segment documents to Amazon Web Services X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches. A segment document can be a completed segment, an in-progress segment, or an array of subsegments. Segments must include the following fields. For the full segment document schema, see Amazon Web Services X-Ray Segment Documents in the Amazon Web Services X-Ray Developer Guide.

Required segment document fields

  • name - The name of the service that handled the request.
  • id - A 64-bit identifier for the segment, unique among segments in the same trace, in 16 hexadecimal digits.
  • trace_id - A unique identifier that connects all segments and subsegments originating from a single client request.
  • start_time - Time the segment or subsegment was created, in floating point seconds in epoch time, accurate to milliseconds. For example, 1480615200.010 or 1.480615200010E9.
  • end_time - Time the segment or subsegment was closed. For example, 1480615200.090 or 1.480615200090E9. Specify either an end_time or in_progress.
  • in_progress - Set to true instead of specifying an end_time to record that a segment has been started, but is not complete. Send an in-progress segment when your application receives a request that will take a long time to serve, to trace that the request was received. When the response is sent, send the complete segment to overwrite the in-progress segment.
A trace_id consists of three numbers separated by hyphens. For example, 1-58406520-a006649127e371903a2de979. This includes:

Trace ID Format

  • The version number, for instance, 1.
  • The time of the original request, in Unix epoch time, in 8 hexadecimal digits. For example, 10:00AM December 2nd, 2016 PST in epoch time is 1480615200 seconds, or 58406520 in hexadecimal.
  • A 96-bit identifier for the trace, globally unique, in 24 hexadecimal digits.
</details> </td> </tr>
TagResource
Show Description Applies tags to an existing Amazon Web Services X-Ray group or sampling rule.
UntagResource
Show Description Removes tags from an Amazon Web Services X-Ray group or sampling rule. You cannot edit or delete system tags (those with an aws: prefix).
UpdateGroup
Show Description Updates a group resource.

Cheatsheet
This post is licensed under CC BY 4.0 by the author.