aoss:TagResource

Tagging

aoss:TagResource is a Tagging access-level action in the aoss service. Grants permission to add tags to a collection, collection group, ingestion job, or ingestion stream

Resource types

ARNs that aoss:TagResource can be scoped to in an IAM policy.

arn:${Partition}:aoss:${Region}:${Account}:collection/${CollectionId} required
Collection
arn:${Partition}:aoss:${Region}:${Account}:collection-group/${CollectionGroupId} required
CollectionGroup
arn:${Partition}:aoss:${Region}:${Account}:collection/${CollectionId}/ingestion-job/${IngestionJobId} required
IngestionJob
arn:${Partition}:aoss:${Region}:${Account}:collection/${CollectionId}/ingestion-stream/${IngestionStreamId} required
IngestionStream

Condition keys

Keys you can use in the Condition block of a policy that grants aoss:TagResource.

aws:RequestTag/${TagKey} String

Filters access based on the tags that are passed in the request

aws:ResourceTag/${TagKey} String

Filters access based on the tags associated with the resource

aws:TagKeys ArrayOfString

Filters access based on the tag keys that are passed in the request

Example IAM policy

A minimal policy that allows aoss:TagResource. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAossTagResource",
      "Effect": "Allow",
      "Action": "aoss:TagResource",
      "Resource": "*"
    }
  ]
}

Related actions in aoss

aoss:AddCollectionToCollectionGroup Write aoss:APIAccessAll Write aoss:BatchGetCollection Read aoss:BatchGetCollectionGroup Read aoss:BatchGetEffectiveLifecyclePolicy Read aoss:BatchGetLifecyclePolicy Read aoss:BatchGetVpcEndpoint Read aoss:CancelIngestionJob Write aoss:CreateAccessPolicy Write aoss:CreateCollection Write aoss:CreateCollectionGroup Write aoss:CreateIndex Write

View all aoss actions →