ResourceScope
A single resource scope entry within an AccessGrant. Associates a resource type with optional ARN patterns, tag conditions, and row-level filters.
Contents
- resourceType
-
Resource type name (e.g., "DataSet", "OmniDashboard").
Type: String
Required: Yes
- resourceArns
-
Specific resource ARNs or ARN patterns. When set, actions are limited to these resources. When absent, defaults to "*".
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 5 items.
Required: No
- rowScopeGroups
-
Row-level filters for this scope, as an OR of AND-groups: a row is visible when it matches every filter in any one group. Requires signalTypes.
Row filters are additive across a principal's matching grants. A signal type with no matching group is unrestricted, and when rowScopeGroups is omitted all rows are visible for all signal types.
Type: Array of arrays of RowScope objects
Array Members: Minimum number of 1 item. Maximum number of 20 items.
Array Members: Minimum number of 1 item. Maximum number of 20 items.
Required: No
- signalTypes
-
Signal types this scope's row filtering applies to. Required when rowScopeGroups is set.
Type: Array of strings
Array Members: Minimum number of 1 item. Maximum number of 3 items.
Valid Values:
LOGS | TRACESRequired: No
-
Tag-based conditions for dynamic resource scoping. Access applies only to resources carrying all of the specified tag key/value pairs.
Type: String to string map
Map Entries: Minimum number of 0 items. Maximum number of 3 items.
Required: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following: