# Actions, resources, and condition keys for Amazon WorkSpaces Secure Browser
<a name="list_workspaces-web"></a>

Amazon WorkSpaces Secure Browser (service prefix: `workspaces-web`) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:
+ Learn how to [configure this service](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/).
+ View a list of the [API operations available for this service](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/).
+ Learn how to secure this service and its resources by [using IAM](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/security-iam.html) permission policies.
+ View the [programmatic service authorization reference](https://servicereference.us-east-1.amazonaws.com/v1/workspaces-web/workspaces-web.json) for this service.

**Topics**
+ [API operations defined by Amazon WorkSpaces Secure Browser](#list_workspaces-web-operations)
+ [Actions defined by Amazon WorkSpaces Secure Browser](#list_workspaces-web-actions-as-permissions)
+ [Resource types defined by Amazon WorkSpaces Secure Browser](#list_workspaces-web-resources-for-iam-policies)
+ [Condition keys for Amazon WorkSpaces Secure Browser](#list_workspaces-web-policy-keys)

## API operations defined by Amazon WorkSpaces Secure Browser
<a name="list_workspaces-web-operations"></a>

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the [Actions table](#list_workspaces-web-actions-as-permissions).




- **   AssociateBrowserSettings  **
  - **IAM action:**  [workspaces-web:AssociateBrowserSettings](#list_workspaces-web-action-AssociateBrowserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   AssociateDataProtectionSettings  **
  - **IAM action:**  [workspaces-web:AssociateDataProtectionSettings](#list_workspaces-web-action-AssociateDataProtectionSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   AssociateIpAccessSettings  **
  - **IAM action:**  [workspaces-web:AssociateIpAccessSettings](#list_workspaces-web-action-AssociateIpAccessSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   AssociateNetworkSettings  **
  - **IAM action:**  [workspaces-web:AssociateNetworkSettings](#list_workspaces-web-action-AssociateNetworkSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   AssociateSessionLogger  **
  - **IAM action:**  [workspaces-web:AssociateSessionLogger](#list_workspaces-web-action-AssociateSessionLogger) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   AssociateTrustStore  **
  - **IAM action:**  [workspaces-web:AssociateTrustStore](#list_workspaces-web-action-AssociateTrustStore) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   AssociateUserAccessLoggingSettings  **
  - **IAM action:**  [workspaces-web:AssociateUserAccessLoggingSettings](#list_workspaces-web-action-AssociateUserAccessLoggingSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   AssociateUserSettings  **
  - **IAM action:**  [workspaces-web:AssociateUserSettings](#list_workspaces-web-action-AssociateUserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   CreateBrowserSettings  **
  - **IAM action:**  [workspaces-web:CreateBrowserSettings](#list_workspaces-web-action-CreateBrowserSettings)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateDataProtectionSettings  **
  - **IAM action:**  [workspaces-web:CreateDataProtectionSettings](#list_workspaces-web-action-CreateDataProtectionSettings)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateIdentityProvider  **
  - **IAM action:**  [workspaces-web:CreateIdentityProvider](#list_workspaces-web-action-CreateIdentityProvider)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateIpAccessSettings  **
  - **IAM action:**  [workspaces-web:CreateIpAccessSettings](#list_workspaces-web-action-CreateIpAccessSettings)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateNetworkSettings  **
  - **IAM action:**  [workspaces-web:CreateNetworkSettings](#list_workspaces-web-action-CreateNetworkSettings)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreatePortal  **
  - **IAM action:**  [workspaces-web:CreatePortal](#list_workspaces-web-action-CreatePortal)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateSessionLogger  **
  - **IAM action:**  [workspaces-web:CreateSessionLogger](#list_workspaces-web-action-CreateSessionLogger)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateTrustStore  **
  - **IAM action:**  [workspaces-web:CreateTrustStore](#list_workspaces-web-action-CreateTrustStore)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateUserAccessLoggingSettings  **
  - **IAM action:**  [workspaces-web:CreateUserAccessLoggingSettings](#list_workspaces-web-action-CreateUserAccessLoggingSettings)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateUserSettings  **
  - **IAM action:**  [workspaces-web:CreateUserSettings](#list_workspaces-web-action-CreateUserSettings)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   DeleteBrowserSettings  **
  - **IAM action:**  [workspaces-web:DeleteBrowserSettings](#list_workspaces-web-action-DeleteBrowserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteDataProtectionSettings  **
  - **IAM action:**  [workspaces-web:DeleteDataProtectionSettings](#list_workspaces-web-action-DeleteDataProtectionSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteIdentityProvider  **
  - **IAM action:**  [workspaces-web:DeleteIdentityProvider](#list_workspaces-web-action-DeleteIdentityProvider) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteIpAccessSettings  **
  - **IAM action:**  [workspaces-web:DeleteIpAccessSettings](#list_workspaces-web-action-DeleteIpAccessSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteNetworkSettings  **
  - **IAM action:**  [workspaces-web:DeleteNetworkSettings](#list_workspaces-web-action-DeleteNetworkSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeletePortal  **
  - **IAM action:**  [workspaces-web:DeletePortal](#list_workspaces-web-action-DeletePortal) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteSessionLogger  **
  - **IAM action:**  [workspaces-web:DeleteSessionLogger](#list_workspaces-web-action-DeleteSessionLogger) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteTrustStore  **
  - **IAM action:**  [workspaces-web:DeleteTrustStore](#list_workspaces-web-action-DeleteTrustStore) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteUserAccessLoggingSettings  **
  - **IAM action:**  [workspaces-web:DeleteUserAccessLoggingSettings](#list_workspaces-web-action-DeleteUserAccessLoggingSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteUserSettings  **
  - **IAM action:**  [workspaces-web:DeleteUserSettings](#list_workspaces-web-action-DeleteUserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateBrowserSettings  **
  - **IAM action:**  [workspaces-web:DisassociateBrowserSettings](#list_workspaces-web-action-DisassociateBrowserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateDataProtectionSettings  **
  - **IAM action:**  [workspaces-web:DisassociateDataProtectionSettings](#list_workspaces-web-action-DisassociateDataProtectionSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateIpAccessSettings  **
  - **IAM action:**  [workspaces-web:DisassociateIpAccessSettings](#list_workspaces-web-action-DisassociateIpAccessSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateNetworkSettings  **
  - **IAM action:**  [workspaces-web:DisassociateNetworkSettings](#list_workspaces-web-action-DisassociateNetworkSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateSessionLogger  **
  - **IAM action:**  [workspaces-web:DisassociateSessionLogger](#list_workspaces-web-action-DisassociateSessionLogger) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateTrustStore  **
  - **IAM action:**  [workspaces-web:DisassociateTrustStore](#list_workspaces-web-action-DisassociateTrustStore) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateUserAccessLoggingSettings  **
  - **IAM action:**  [workspaces-web:DisassociateUserAccessLoggingSettings](#list_workspaces-web-action-DisassociateUserAccessLoggingSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DisassociateUserSettings  **
  - **IAM action:**  [workspaces-web:DisassociateUserSettings](#list_workspaces-web-action-DisassociateUserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   ExpireSession  **
  - **IAM action:**  [workspaces-web:ExpireSession](#list_workspaces-web-action-ExpireSession) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   GetBrowserSettings  **
  - **IAM action:**  [workspaces-web:GetBrowserSettings](#list_workspaces-web-action-GetBrowserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetDataProtectionSettings  **
  - **IAM action:**  [workspaces-web:GetDataProtectionSettings](#list_workspaces-web-action-GetDataProtectionSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetIdentityProvider  **
  - **IAM action:**  [workspaces-web:GetIdentityProvider](#list_workspaces-web-action-GetIdentityProvider) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetIpAccessSettings  **
  - **IAM action:**  [workspaces-web:GetIpAccessSettings](#list_workspaces-web-action-GetIpAccessSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetNetworkSettings  **
  - **IAM action:**  [workspaces-web:GetNetworkSettings](#list_workspaces-web-action-GetNetworkSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetPortal  **
  - **IAM action:**  [workspaces-web:GetPortal](#list_workspaces-web-action-GetPortal) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetPortalServiceProviderMetadata  **
  - **IAM action:**  [workspaces-web:GetPortalServiceProviderMetadata](#list_workspaces-web-action-GetPortalServiceProviderMetadata) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetSession  **
  - **IAM action:**  [workspaces-web:GetSession](#list_workspaces-web-action-GetSession) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetSessionLogger  **
  - **IAM action:**  [workspaces-web:GetSessionLogger](#list_workspaces-web-action-GetSessionLogger) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetTrustStore  **
  - **IAM action:**  [workspaces-web:GetTrustStore](#list_workspaces-web-action-GetTrustStore) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetTrustStoreCertificate  **
  - **IAM action:**  [workspaces-web:GetTrustStoreCertificate](#list_workspaces-web-action-GetTrustStoreCertificate) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetUserAccessLoggingSettings  **
  - **IAM action:**  [workspaces-web:GetUserAccessLoggingSettings](#list_workspaces-web-action-GetUserAccessLoggingSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetUserSettings  **
  - **IAM action:**  [workspaces-web:GetUserSettings](#list_workspaces-web-action-GetUserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListBrowserSettings  **
  - **IAM action:**  [workspaces-web:ListBrowserSettings](#list_workspaces-web-action-ListBrowserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListDataProtectionSettings  **
  - **IAM action:**  [workspaces-web:ListDataProtectionSettings](#list_workspaces-web-action-ListDataProtectionSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListIdentityProviders  **
  - **IAM action:**  [workspaces-web:ListIdentityProviders](#list_workspaces-web-action-ListIdentityProviders) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListIpAccessSettings  **
  - **IAM action:**  [workspaces-web:ListIpAccessSettings](#list_workspaces-web-action-ListIpAccessSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListNetworkSettings  **
  - **IAM action:**  [workspaces-web:ListNetworkSettings](#list_workspaces-web-action-ListNetworkSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListPortals  **
  - **IAM action:**  [workspaces-web:ListPortals](#list_workspaces-web-action-ListPortals) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListSessionLoggers  **
  - **IAM action:**  [workspaces-web:ListSessionLoggers](#list_workspaces-web-action-ListSessionLoggers) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListSessions  **
  - **IAM action:**  [workspaces-web:ListSessions](#list_workspaces-web-action-ListSessions) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListTagsForResource  **
  - **IAM action:**  [workspaces-web:ListTagsForResource](#list_workspaces-web-action-ListTagsForResource) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListTrustStoreCertificates  **
  - **IAM action:**  [workspaces-web:ListTrustStoreCertificates](#list_workspaces-web-action-ListTrustStoreCertificates) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListTrustStores  **
  - **IAM action:**  [workspaces-web:ListTrustStores](#list_workspaces-web-action-ListTrustStores) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListUserAccessLoggingSettings  **
  - **IAM action:**  [workspaces-web:ListUserAccessLoggingSettings](#list_workspaces-web-action-ListUserAccessLoggingSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListUserSettings  **
  - **IAM action:**  [workspaces-web:ListUserSettings](#list_workspaces-web-action-ListUserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   TagResource  **
  - **IAM action:**  [workspaces-web:TagResource](#list_workspaces-web-action-TagResource) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Tagging, Write

- **   UntagResource  **
  - **IAM action:**  [workspaces-web:UntagResource](#list_workspaces-web-action-UntagResource) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Tagging, Write

- **   UpdateBrowserSettings  **
  - **IAM action:**  [workspaces-web:UpdateBrowserSettings](#list_workspaces-web-action-UpdateBrowserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateDataProtectionSettings  **
  - **IAM action:**  [workspaces-web:UpdateDataProtectionSettings](#list_workspaces-web-action-UpdateDataProtectionSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateIdentityProvider  **
  - **IAM action:**  [workspaces-web:UpdateIdentityProvider](#list_workspaces-web-action-UpdateIdentityProvider) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateIpAccessSettings  **
  - **IAM action:**  [workspaces-web:UpdateIpAccessSettings](#list_workspaces-web-action-UpdateIpAccessSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateNetworkSettings  **
  - **IAM action:**  [workspaces-web:UpdateNetworkSettings](#list_workspaces-web-action-UpdateNetworkSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdatePortal  **
  - **IAM action:**  [workspaces-web:UpdatePortal](#list_workspaces-web-action-UpdatePortal) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateSessionLogger  **
  - **IAM action:**  [workspaces-web:UpdateSessionLogger](#list_workspaces-web-action-UpdateSessionLogger) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateTrustStore  **
  - **IAM action:**  [workspaces-web:UpdateTrustStore](#list_workspaces-web-action-UpdateTrustStore) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateUserAccessLoggingSettings  **
  - **IAM action:**  [workspaces-web:UpdateUserAccessLoggingSettings](#list_workspaces-web-action-UpdateUserAccessLoggingSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateUserSettings  **
  - **IAM action:**  [workspaces-web:UpdateUserSettings](#list_workspaces-web-action-UpdateUserSettings) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write



## Actions defined by Amazon WorkSpaces Secure Browser
<a name="list_workspaces-web-actions-as-permissions"></a>

You can specify the following actions in the `Action` element of an IAM policy statement. For each action, the table lists the resource types and condition keys supported by that action. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.




- **   [AssociateBrowserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateBrowserSettings.html)  **
  - **Description:** Grants permission to associate browser settings to web portals
  - **Resource types (\*required):** [browserSettings\*](#list_workspaces-web-resource-browserSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [AssociateDataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateDataProtectionSettings.html)  **
  - **Description:** Grants permission to associate data protection settings with web portals
  - **Resource types (\*required):** [dataProtectionSettings\*](#list_workspaces-web-resource-dataProtectionSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [AssociateIpAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateIpAccessSettings.html)  **
  - **Description:** Grants permission to associate ip access settings with web portals
  - **Resource types (\*required):** [ipAccessSettings\*](#list_workspaces-web-resource-ipAccessSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [AssociateNetworkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateNetworkSettings.html)  **
  - **Description:** Grants permission to associate network settings to web portals
  - **Resource types (\*required):** [networkSettings\*](#list_workspaces-web-resource-networkSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [AssociateSessionLogger](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateSessionLogger.html)  **
  - **Description:** Grants permission to associate session logger with web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [sessionLogger\*](#list_workspaces-web-resource-sessionLogger) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [AssociateTrustStore](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateTrustStore.html)  **
  - **Description:** Grants permission to associate trust stores with web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [trustStore\*](#list_workspaces-web-resource-trustStore) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [AssociateUserAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateUserAccessLoggingSettings.html)  **
  - **Description:** Grants permission to associate user access logging settings with web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [userAccessLoggingSettings\*](#list_workspaces-web-resource-userAccessLoggingSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [AssociateUserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_AssociateUserSettings.html)  **
  - **Description:** Grants permission to associate user settings with web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [userSettings\*](#list_workspaces-web-resource-userSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [CreateBrowserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateBrowserSettings.html)  **
  - **Description:** Grants permission to create browser settings
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateDataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateDataProtectionSettings.html)  **
  - **Description:** Grants permission to create data protection settings
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateIdentityProvider](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateIdentityProvider.html)  **
  - **Description:** Grants permission to create identity providers
  - **Resource types (\*required):** [identityProvider\*](#list_workspaces-web-resource-identityProvider) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateIpAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateIpAccessSettings.html)  **
  - **Description:** Grants permission to create ip access settings
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateNetworkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateNetworkSettings.html)  **
  - **Description:** Grants permission to create network settings
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreatePortal](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreatePortal.html)  **
  - **Description:** Grants permission to create web portals
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateSessionLogger](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateSessionLogger.html)  **
  - **Description:** Grants permission to create session logger
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateTrustStore](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateTrustStore.html)  **
  - **Description:** Grants permission to create trust stores
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateUserAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserAccessLoggingSettings.html)  **
  - **Description:** Grants permission to create user access logging settings
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [CreateUserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserSettings.html)  **
  - **Description:** Grants permission to create user settings
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Write

- **   [DeleteBrowserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteBrowserSettings.html)  **
  - **Description:** Grants permission to delete browser settings
  - **Resource types (\*required):** [browserSettings\*](#list_workspaces-web-resource-browserSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteDataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteDataProtectionSettings.html)  **
  - **Description:** Grants permission to delete data protection settings
  - **Resource types (\*required):** [dataProtectionSettings\*](#list_workspaces-web-resource-dataProtectionSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteIdentityProvider](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteIdentityProvider.html)  **
  - **Description:** Grants permission to delete identity providers
  - **Resource types (\*required):** [identityProvider\*](#list_workspaces-web-resource-identityProvider) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteIpAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteIpAccessSettings.html)  **
  - **Description:** Grants permission to delete ip access settings
  - **Resource types (\*required):** [ipAccessSettings\*](#list_workspaces-web-resource-ipAccessSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteNetworkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteNetworkSettings.html)  **
  - **Description:** Grants permission to delete network settings
  - **Resource types (\*required):** [networkSettings\*](#list_workspaces-web-resource-networkSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeletePortal](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeletePortal.html)  **
  - **Description:** Grants permission to delete web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteSessionLogger](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteSessionLogger.html)  **
  - **Description:** Grants permission to delete session logger
  - **Resource types (\*required):** [sessionLogger\*](#list_workspaces-web-resource-sessionLogger)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteTrustStore](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteTrustStore.html)  **
  - **Description:** Grants permission to delete trust stores
  - **Resource types (\*required):** [trustStore\*](#list_workspaces-web-resource-trustStore)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteUserAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteUserAccessLoggingSettings.html)  **
  - **Description:** Grants permission to delete user access logging settings
  - **Resource types (\*required):** [userAccessLoggingSettings\*](#list_workspaces-web-resource-userAccessLoggingSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteUserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DeleteUserSettings.html)  **
  - **Description:** Grants permission to delete user settings
  - **Resource types (\*required):** [userSettings\*](#list_workspaces-web-resource-userSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateBrowserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateBrowserSettings.html)  **
  - **Description:** Grants permission to disassociate browser settings from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateDataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateDataProtectionSettings.html)  **
  - **Description:** Grants permission to disassociate data protection logging from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateIpAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateIpAccessSettings.html)  **
  - **Description:** Grants permission to disassociate ip access logging from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateNetworkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateNetworkSettings.html)  **
  - **Description:** Grants permission to disassociate network settings from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateSessionLogger](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateSessionLogger.html)  **
  - **Description:** Grants permission to disassociate session logger from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateTrustStore](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateTrustStore.html)  **
  - **Description:** Grants permission to disassociate trust stores from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateUserAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateUserAccessLoggingSettings.html)  **
  - **Description:** Grants permission to disassociate user access logging settings from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DisassociateUserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_DisassociateUserSettings.html)  **
  - **Description:** Grants permission to disassociate user settings from web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [ExpireSession](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ExpireSession.html)  **
  - **Description:** Grants permission to expire a session from a specific portal
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [GetBrowserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetBrowserSettings.html)  **
  - **Description:** Grants permission to get details on browser settings
  - **Resource types (\*required):** [browserSettings\*](#list_workspaces-web-resource-browserSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetDataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetDataProtectionSettings.html)  **
  - **Description:** Grants permission to get details on data protection settings
  - **Resource types (\*required):** [dataProtectionSettings\*](#list_workspaces-web-resource-dataProtectionSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetIdentityProvider](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetIdentityProvider.html)  **
  - **Description:** Grants permission to get details on identity providers
  - **Resource types (\*required):** [identityProvider\*](#list_workspaces-web-resource-identityProvider)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetIpAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetIpAccessSettings.html)  **
  - **Description:** Grants permission to get details on ip access settings
  - **Resource types (\*required):** [ipAccessSettings\*](#list_workspaces-web-resource-ipAccessSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetNetworkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetNetworkSettings.html)  **
  - **Description:** Grants permission to get details on network settings
  - **Resource types (\*required):** [networkSettings\*](#list_workspaces-web-resource-networkSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetPortal](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetPortal.html)  **
  - **Description:** Grants permission to get details on web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetPortalServiceProviderMetadata](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetPortalServiceProviderMetadata.html)  **
  - **Description:** Grants permission to get service provider metadata information for web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetSession](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetSession.html)  **
  - **Description:** Grants permission to get information about a particular session for a portal
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetSessionLogger](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetSessionLogger.html)  **
  - **Description:** Grants permission to get details on session logger
  - **Resource types (\*required):** [sessionLogger\*](#list_workspaces-web-resource-sessionLogger)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetTrustStore](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetTrustStore.html)  **
  - **Description:** Grants permission to get details on trust stores
  - **Resource types (\*required):** [trustStore\*](#list_workspaces-web-resource-trustStore)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetTrustStoreCertificate](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetTrustStoreCertificate.html)  **
  - **Description:** Grants permission to get certificates from trust stores
  - **Resource types (\*required):** [trustStore\*](#list_workspaces-web-resource-trustStore)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetUserAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetUserAccessLoggingSettings.html)  **
  - **Description:** Grants permission to get details on user access logging settings
  - **Resource types (\*required):** [userAccessLoggingSettings\*](#list_workspaces-web-resource-userAccessLoggingSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetUserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_GetUserSettings.html)  **
  - **Description:** Grants permission to get details on user settings
  - **Resource types (\*required):** [userSettings\*](#list_workspaces-web-resource-userSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListBrowserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListBrowserSettings.html)  **
  - **Description:** Grants permission to list browser settings
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListDataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListDataProtectionSettings.html)  **
  - **Description:** Grants permission to list data protection settings
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListIdentityProviders](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListIdentityProviders.html)  **
  - **Description:** Grants permission to list identity providers
  - **Resource types (\*required):** [identityProvider\*](#list_workspaces-web-resource-identityProvider)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListIpAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListIpAccessSettings.html)  **
  - **Description:** Grants permission to list ip access settings
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListNetworkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListNetworkSettings.html)  **
  - **Description:** Grants permission to list network settings
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListPortals](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListPortals.html)  **
  - **Description:** Grants permission to list web portals
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListSessionLoggers](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListSessionLoggers.html)  **
  - **Description:** Grants permission to list session loggers
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListSessions](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListSessions.html)  **
  - **Description:** Grants permission to list sessions for a Portal using optional filters
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListTagsForResource](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListTagsForResource.html)  **
  - **Description:** Grants permission to list tags for a resource
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListTrustStoreCertificates](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListTrustStoreCertificates.html)  **
  - **Description:** Grants permission to list certificates in a trust store
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListTrustStores](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListTrustStores.html)  **
  - **Description:** Grants permission to list trust stores
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListUserAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListUserAccessLoggingSettings.html)  **
  - **Description:** Grants permission to list user access logging settings
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListUserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_ListUserSettings.html)  **
  - **Description:** Grants permission to list user settings
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [TagResource](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_TagResource.html)  **
  - **Description:** Grants permission to add one or more tags to a resource
  - **Resource types (\*required):** [browserSettings](#list_workspaces-web-resource-browserSettings) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [dataProtectionSettings](#list_workspaces-web-resource-dataProtectionSettings) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [identityProvider](#list_workspaces-web-resource-identityProvider) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [ipAccessSettings](#list_workspaces-web-resource-ipAccessSettings) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [networkSettings](#list_workspaces-web-resource-networkSettings) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [portal](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [sessionLogger](#list_workspaces-web-resource-sessionLogger) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [trustStore](#list_workspaces-web-resource-trustStore) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [userAccessLoggingSettings](#list_workspaces-web-resource-userAccessLoggingSettings) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [userSettings](#list_workspaces-web-resource-userSettings) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_workspaces-web-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Tagging, Write

- **   [UntagResource](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UntagResource.html)  **
  - **Description:** Grants permission to remove one or more tags from a resource
  - **Resource types (\*required):** [browserSettings](#list_workspaces-web-resource-browserSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [dataProtectionSettings](#list_workspaces-web-resource-dataProtectionSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [identityProvider](#list_workspaces-web-resource-identityProvider) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [ipAccessSettings](#list_workspaces-web-resource-ipAccessSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [networkSettings](#list_workspaces-web-resource-networkSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [portal](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [sessionLogger](#list_workspaces-web-resource-sessionLogger) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [trustStore](#list_workspaces-web-resource-trustStore) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [userAccessLoggingSettings](#list_workspaces-web-resource-userAccessLoggingSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Resource types (\*required):** [userSettings](#list_workspaces-web-resource-userSettings) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_workspaces-web-aws_TagKeys)
  - **Access level:** Tagging, Write

- **   [UpdateBrowserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateBrowserSettings.html)  **
  - **Description:** Grants permission to update browser settings
  - **Resource types (\*required):** [browserSettings\*](#list_workspaces-web-resource-browserSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateDataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateDataProtectionSettings.html)  **
  - **Description:** Grants permission to update data protection settings
  - **Resource types (\*required):** [dataProtectionSettings\*](#list_workspaces-web-resource-dataProtectionSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateIdentityProvider](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateIdentityProvider.html)  **
  - **Description:** Grants permission to update identity provider
  - **Resource types (\*required):** [identityProvider\*](#list_workspaces-web-resource-identityProvider) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateIpAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateIpAccessSettings.html)  **
  - **Description:** Grants permission to update ip access settings
  - **Resource types (\*required):** [ipAccessSettings\*](#list_workspaces-web-resource-ipAccessSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateNetworkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateNetworkSettings.html)  **
  - **Description:** Grants permission to update network settings
  - **Resource types (\*required):** [networkSettings\*](#list_workspaces-web-resource-networkSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdatePortal](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdatePortal.html)  **
  - **Description:** Grants permission to update web portals
  - **Resource types (\*required):** [portal\*](#list_workspaces-web-resource-portal)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateSessionLogger](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateSessionLogger.html)  **
  - **Description:** Grants permission to update session logger
  - **Resource types (\*required):** [sessionLogger\*](#list_workspaces-web-resource-sessionLogger)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateTrustStore](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateTrustStore.html)  **
  - **Description:** Grants permission to update trust stores
  - **Resource types (\*required):** [trustStore\*](#list_workspaces-web-resource-trustStore)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateUserAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateUserAccessLoggingSettings.html)  **
  - **Description:** Grants permission to update user access logging settings
  - **Resource types (\*required):** [userAccessLoggingSettings\*](#list_workspaces-web-resource-userAccessLoggingSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateUserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_UpdateUserSettings.html)  **
  - **Description:** Grants permission to update user settings
  - **Resource types (\*required):** [userSettings\*](#list_workspaces-web-resource-userSettings)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_)
  - **Access level:** Write



## Resource types defined by Amazon WorkSpaces Secure Browser
<a name="list_workspaces-web-resources-for-iam-policies"></a>

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements.



| Resource types | ARN | Condition keys | 
| --- | --- | --- | 
|  [browserSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateBrowserSettings.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:browserSettings/${BrowserSettingsId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [dataProtectionSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateDataProtectionSettings.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:dataProtectionSettings/${DataProtectionSettingsId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [identityProvider](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateIdentityProvider.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:identityProvider/${PortalId}/${IdentityProviderId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [ipAccessSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateIpAccessSettings.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:ipAccessSettings/${IpAccessSettingsId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [networkSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateNetworkSettings.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:networkSettings/${NetworkSettingsId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [portal](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreatePortal.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:portal/${PortalId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [sessionLogger](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateSessionLogger.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:sessionLogger/${SessionLoggerId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [trustStore](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateTrustStore.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:trustStore/${TrustStoreId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [userAccessLoggingSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserAccessLoggingSettings.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:userAccessLoggingSettings/${UserAccessLoggingSettingsId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 
|  [userSettings](https://docs.aws.amazon.com/workspaces-web/latest/APIReference/API_CreateUserSettings.html)  | arn:${Partition}:workspaces-web:${Region}:${Account}:userSettings/${UserSettingsId} | [aws:ResourceTag/${TagKey}](#list_workspaces-web-aws_ResourceTag___TagKey_) | 

## Condition keys for Amazon WorkSpaces Secure Browser
<a name="list_workspaces-web-policy-keys"></a>

Amazon WorkSpaces Secure Browser defines the following condition keys that can be used in the `Condition` element of an IAM policy.



| Condition keys | Description | Type | 
| --- | --- | --- | 
|   [aws:RequestTag/${TagKey}](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag)  | Filters access by the tags that are passed in the request | String | 
|   [aws:ResourceTag/${TagKey}](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag)  | Filters access by the tags associated with the resource | String | 
|   [aws:TagKeys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys)  | Filters access by the tag keys that are passed in the request | ArrayOfString |