AWS Assurance (assurance)

Additions

Actions

• AcceptInvitation
  
  • Description:  Grants permission to accept an invitation to connect an account to an environment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• AssignPermissionSet
  
  • Description:  Grants permission to assign a permission set to a principal
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• BatchGetComment
  
  • Description:  Grants permission to retrieve multiple comments in a single request
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• BatchGetControl
  
  • Description:  Grants permission to retrieve multiple controls in a single request
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• BatchGetTask
  
  • Description:  Grants permission to retrieve multiple tasks in a single request
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• Chat
  
  • Description:  Grants permission to start a streaming chat session with the AI Governance agent
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateAnnotation
  
  • Description:  Grants permission to create an annotation on a piece of evidence
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateComment
  
  • Description:  Grants permission to add a new comment to a specific control
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateControl
  
  • Description:  Grants permission to create a leaf control within a custom framework
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateControlGroup
  
  • Description:  Grants permission to create a control group within a custom framework
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateEnvironment
  
  • Description:  Grants permission to create a new governance environment
  • Access:  Write
  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• CreateEnvironmentConnection
  
  • Description:  Grants permission to create an environment connection
  • Access:  Write
• CreateFramework
  
  • Description:  Grants permission to create a custom customer-owned framework
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateInvitation
  
  • Description:  Grants permission to invite an account to connect to an environment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreatePermissionSet
  
  • Description:  Grants permission to create a permission set in an environment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateProject
  
  • Description:  Grants permission to create a project
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• CreateTask
  
  • Description:  Grants permission to create a new task for a specific control and assessment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteAnnotation
  
  • Description:  Grants permission to delete an annotation from a piece of evidence
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteComment
  
  • Description:  Grants permission to delete a specific comment by its identifying fields
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteControl
  
  • Description:  Grants permission to delete a custom control
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteControlGroup
  
  • Description:  Grants permission to delete a control group
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteEnvironment
  
  • Description:  Grants permission to delete a governance environment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteEnvironmentConnection
  
  • Description:  Grants permission to delete an environment connection
  • Access:  Write
• DeleteEvidence
  
  • Description:  Grants permission to remove an evidence item
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteFramework
  
  • Description:  Grants permission to delete a custom framework
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteInvitation
  
  • Description:  Grants permission to delete an invitation or unlink a connected account
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeletePermissionSet
  
  • Description:  Grants permission to delete a permission set
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeleteProject
  
  • Description:  Grants permission to delete a project and all its associated resources
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DeregisterOrganizationDelegatedAdmin
  
  • Description:  Grants permission to deregister the delegated administrator for AWS Assurance in the caller's organization
  • Access:  Write
• DisableFramework
  
  • Description:  Grants permission to disable a previously enabled framework for a specific project
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• DownloadEvidence
  
  • Description:  Grants permission to retrieve the content of an evidence item
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• EnableFramework
  
  • Description:  Grants permission to enable a framework for a project
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• GetAnnotation
  
  • Description:  Grants permission to retrieve the annotation for a specific piece of evidence
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetAssessment
  
  • Description:  Grants permission to retrieve a single assessment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetAssessmentReportContent
  
  • Description:  Grants permission to retrieve the content of a prepared assessment report
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetAssessmentReportExport
  
  • Description:  Grants permission to retrieve the state of an assessment report export
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetChatMessages
  
  • Description:  Grants permission to get messages for a chat session in chronological order
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetComment
  
  • Description:  Grants permission to retrieve a specific comment by its identifying fields
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetControl
  
  • Description:  Grants permission to retrieve a single leaf control within a framework version
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetControlGroup
  
  • Description:  Grants permission to retrieve a single control group within a framework version
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetControlStatus
  
  • Description:  Grants permission to retrieve the effective compliance status of a control
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetEnvironment
  
  • Description:  Grants permission to retrieve a governance environment by ARN or domain
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetEvidence
  
  • Description:  Grants permission to retrieve metadata for an evidence item
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetEvidenceContent
  
  • Description:  Grants permission to retrieve the content of an evidence item
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetFramework
  
  • Description:  Grants permission to retrieve a framework resource by type and key fields
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetInvitation
  
  • Description:  Grants permission to retrieve an invitation
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetPermissionSet
  
  • Description:  Grants permission to retrieve a permission set
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetProject
  
  • Description:  Grants permission to retrieve a project
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• GetTask
  
  • Description:  Grants permission to retrieve a specific task by its identifying fields
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListAssessmentAnnotations
  
  • Description:  Grants permission to list the annotations on one assessment, paginated
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListAssessmentJournalRecords
  
  • Description:  Grants permission to list assessment journal records, paginated
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListAssessmentOutcomes
  
  • Description:  Grants permission to list a compliance score over time
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListAssessments
  
  • Description:  Grants permission to list assessments, paginated
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListChatSessions
  
  • Description:  Grants permission to list chat sessions for the calling user in a governance environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListComments
  
  • Description:  Grants permission to list comments in a governance environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListConnectionItems
  
  • Description:  Grants permission to list the contents of an environment connection
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListControlGroups
  
  • Description:  Grants permission to list control groups in a framework version
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListControlResources
  
  • Description:  Grants permission to list in-scope resources for a control
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListControls
  
  • Description:  Grants permission to list controls within a control group
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListDiscoveredResources
  
  • Description:  Grants permission to list the resources found by a discovery job (paginated)
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListEnabledFrameworks
  
  • Description:  Grants permission to list enabled frameworks for a governance environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListEnvironmentConnections
  
  • Description:  Grants permission to list environment connections in a governance environment
  • Access:  Read
• ListEnvironments
  
  • Description:  Grants permission to list all governance environments with optional pagination
  • Access:  Read
• ListEvidence
  
  • Description:  Grants permission to list evidence items (paginated)
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListEvidenceAnnotations
  
  • Description:  Grants permission to list the annotations on one version of a piece of evidence within a project, paginated
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListFrameworks
  
  • Description:  Grants permission to list frameworks
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListInboundInvitations
  
  • Description:  Grants permission to list invitations addressed to the caller's account
  • Access:  Read
• ListOutboundInvitations
  
  • Description:  Grants permission to list invitations extended from an owned environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListPermissionSetAssignments
  
  • Description:  Grants permission to list permission set assignments in an environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListPermissionSets
  
  • Description:  Grants permission to list permission sets in an environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListProjects
  
  • Description:  Grants permission to list all projects within a governance environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListResourcesForControl
  
  • Description:  Grants permission to list in-scope resources for a control
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListTagsForResource
  
  • Description:  Grants permission to list tags for a resource
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListTaskHistory
  
  • Description:  Grants permission to list task history for a task
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• ListTasks
  
  • Description:  Grants permission to list all tasks within a governance environment
  • Access:  Read
  • Resources: 

    Name: environment

    Required: Yes

• PublishFramework
  
  • Description:  Grants permission to publish a custom framework
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• PutControlStatusOverride
  
  • Description:  Grants permission to declare or remove an applicability override on a control or requirement
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• PutEvidence
  
  • Description:  Grants permission to add evidence, or a new version of existing evidence, to support a compliance assessment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• RegisterOrganizationDelegatedAdmin
  
  • Description:  Grants permission to register a delegated administrator for AWS Assurance in the caller's organization
  • Access:  Write
• RejectInvitation
  
  • Description:  Grants permission to reject an invitation
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• RevokePermissionSet
  
  • Description:  Grants permission to revoke a permission set assignment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• StartAssessment
  
  • Description:  Grants permission to begin a new assessment for a control or framework
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• StartAssessmentReportExport
  
  • Description:  Grants permission to start preparing an assessment report
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• StartResourceDiscovery
  
  • Description:  Grants permission to start discovery of in-scope resources
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• TagResource
  
  • Description:  Grants permission to add or overwrite tags on a resource
  • Access:  Tagging
  • Resources: 

    Name: environment

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

• UntagResource
  
  • Description:  Grants permission to remove tags from a resource
  • Access:  Tagging
  • Resources: 

    Name: environment

    Required: Yes

  • Conditions: 

    aws:TagKeys

• UpdateAnnotation
  
  • Description:  Grants permission to update the reviewer notes on an existing annotation
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateAssessment
  
  • Description:  Grants permission to update an assessment's status and result
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateComment
  
  • Description:  Grants permission to modify the content of an existing comment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateControl
  
  • Description:  Grants permission to update a custom control
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateControlGroup
  
  • Description:  Grants permission to update a control group's mutable attributes
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateEnvironment
  
  • Description:  Grants permission to update a governance environment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateEvidence
  
  • Description:  Grants permission to update evidence metadata and manage control links
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateFramework
  
  • Description:  Grants permission to update a custom framework
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdatePermissionSet
  
  • Description:  Grants permission to update a permission set
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateProject
  
  • Description:  Grants permission to update a project
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UpdateTask
  
  • Description:  Grants permission to update an existing task's mutable fields
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• UploadEvidence
  
  • Description:  Grants permission to upload new evidence to support a compliance assessment
  • Access:  Write
  • Resources: 

    Name: environment

    Required: Yes

• VendConnectionAccessToken
  
  • Description:  Grants permission to retrieve a short-lived access token for a third-party connection in an environment
  • Access:  Write

Resources

• environment
  
  • Arn:  arn:${Partition}:assurance:${Region}:${Account}:environment/${Environment}
  • Conditions: 

    aws:ResourceTag/${TagKey}

Conditions

• aws:RequestTag/${TagKey}
  
  • Description:  Filters access by the tags that are passed in the request
  • Type:  String
• aws:ResourceTag/${TagKey}
  
  • Description:  Filters access by a tag key and value pair of a resource
  • Type:  String
• aws:TagKeys
  
  • Description:  Filters access by the tag keys that are passed in the request
  • Type:  ArrayOfString