# IAM Reference

## Administration

service: **administration**

**Resource Syntax**

* `administration:connection:${Environment}/${ConnectionType}/${Connection}`
* `administration:license:${Environment}`
* `administration:lenses-logs:${Environment}`
* `administration:lenses-configuration:${Environment}`
* `administration:setting:${Setting}`

<table data-full-width="false"><thead><tr><th>Operation</th><th width="194">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateConnection</td><td>connection</td><td></td></tr><tr><td>ListConnections</td><td>connection</td><td></td></tr><tr><td>GetConnectionDetails</td><td>connection</td><td></td></tr><tr><td>UpdateConnection</td><td>connection</td><td></td></tr><tr><td>DeleteConnection</td><td>connection</td><td></td></tr><tr><td>ListLicenses</td><td>license</td><td></td></tr><tr><td>GetLicenseDetails</td><td>license</td><td></td></tr><tr><td>UpdateLicense</td><td>license</td><td></td></tr><tr><td>GetLensesLogs</td><td>lenses-logs</td><td></td></tr><tr><td>GetLensesConfiguration</td><td>lenses-configuration</td><td></td></tr><tr><td>ListAgents</td><td>agent</td><td></td></tr><tr><td>GetAgentDetails</td><td>agent</td><td></td></tr><tr><td>UpdateAgent</td><td>agent</td><td></td></tr><tr><td>DeleteAgent</td><td>agent</td><td></td></tr><tr><td>GetSetting</td><td>setting</td><td></td></tr><tr><td>UpdateSetting</td><td>setting</td><td></td></tr></tbody></table>

## Applications

service: **applications**

**Resource Syntax**

<table data-full-width="false"><thead><tr><th>Operation</th><th width="194">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>RegisterApplication</td><td>external-application</td><td></td></tr><tr><td>UnregisterApplication</td><td>external-application</td><td></td></tr><tr><td>ListApplications</td><td>external-application</td><td></td></tr><tr><td>GetApplicationDetails</td><td>external-application</td><td></td></tr><tr><td>ListApplicationDependants</td><td>external-application</td><td></td></tr></tbody></table>

## Alerts

service: **alerts**

**Resource Syntax**

* alerts:alert:${Environment}/${AlertType}/${Alert}
* alerts:rule:${Environment}/Infrastructure/KafkaBrokerDown
* alerts:rule:${Environment}/DataProduced/red-app-going-slow

<table data-full-width="false"><thead><tr><th>Operation</th><th width="159">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateAlertRule</td><td>rule</td><td></td></tr><tr><td>DeleteAlertRule</td><td>rule</td><td></td></tr><tr><td>UpdateAlertRule</td><td>rule</td><td></td></tr><tr><td>ListAlertRules</td><td>rule</td><td></td></tr><tr><td>GetAlertRuleDetails</td><td>rule</td><td></td></tr><tr><td>ToggleAlertRule</td><td>rule</td><td></td></tr><tr><td>ListAlertEvents</td><td>alert-event</td><td></td></tr><tr><td>DeleteAlertEvents</td><td>alert-event</td><td></td></tr><tr><td>CreateChannel</td><td>alert-channel</td><td></td></tr><tr><td>ListChannels</td><td>alert-channel</td><td></td></tr><tr><td>GetChannelDetails</td><td>alert-channel</td><td></td></tr><tr><td>UpdateChannel</td><td>alert-channel</td><td></td></tr><tr><td>DeleteChannel</td><td>alert-channel</td><td></td></tr></tbody></table>

## Audits

service: **audit**

**Resource Syntax**

* audit:log:${Environment}
* audit:channel:${Environment}/${AuditChannelType}/${AuditChannel}

<table data-full-width="false"><thead><tr><th>Operation</th><th width="143">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>ListLogEvents</td><td>log</td><td></td></tr><tr><td>GetLogEventDetails</td><td>log</td><td></td></tr><tr><td>CreateChannel</td><td>channel</td><td></td></tr><tr><td>ListChannels</td><td>channel</td><td></td></tr><tr><td>GetChannelDetails</td><td>channel</td><td></td></tr><tr><td>UpdateChannel</td><td>channel</td><td></td></tr><tr><td>DeleteChannel</td><td>channel</td><td></td></tr><tr><td>ToggleChannel</td><td>channel</td><td></td></tr></tbody></table>

## Data Policies

service: **data-policies**

**Resource Syntax**

* data-policies:policy:${Environment}/${Policy}

<table data-full-width="false"><thead><tr><th>Operation</th><th width="152">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreatePolicy</td><td>policy</td><td></td></tr><tr><td>ListPolicies</td><td>policy</td><td></td></tr><tr><td>GetPolicyDetails</td><td>policy</td><td></td></tr><tr><td>UpdatePolicy</td><td>policy</td><td></td></tr><tr><td>DeletePolicy</td><td>policy</td><td></td></tr><tr><td>ListPolicyDependants</td><td>policy</td><td></td></tr></tbody></table>

## Environments

service: **environments**

**Resource Syntax**

* environments:environment:${Environment}

<table data-full-width="false"><thead><tr><th>Operation</th><th width="148">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateEnvironment</td><td>environment</td><td></td></tr><tr><td>DeleteEnvironment</td><td>environment</td><td></td></tr><tr><td>ListEnvironments</td><td>environment</td><td></td></tr><tr><td>UpdateEnvironment</td><td>environment</td><td></td></tr><tr><td>AccessEnvironment</td><td>environment</td><td></td></tr><tr><td>GetEnvironmentDetails</td><td>environment</td><td>Permission which allows users to gain overview of more information about the environment such as metrics, versions and more.</td></tr></tbody></table>

## Governance

service: **governance**

**Resource Syntax**

* governance:request:${Environment}/${ActionType}/\*
* governance:rule:${Environment}/${RuleCategory}/\*

<table data-full-width="false"><thead><tr><th>Operation</th><th width="149">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateRequest</td><td>request</td><td></td></tr><tr><td>ListRequests</td><td>request</td><td></td></tr><tr><td>GetRequestDetails</td><td>request</td><td></td></tr><tr><td>ApproveRequest</td><td>request</td><td></td></tr><tr><td>DenyRequest</td><td>request</td><td></td></tr><tr><td>GetRuleDetails</td><td>rule</td><td></td></tr><tr><td>UpdateRule</td><td>rule</td><td></td></tr></tbody></table>

## IAM

service: **iam**

**Resource Syntax**

* iam:role:${Role}
* iam:group:${Group}
* iam:user:${Username}
* iam:service-account:${ServiceAccount}

<table data-full-width="false"><thead><tr><th width="318">Operation</th><th width="161">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateRole</td><td>role</td><td></td></tr><tr><td>DeleteRole</td><td>role</td><td></td></tr><tr><td>UpdateRole</td><td>role</td><td></td></tr><tr><td>ListRoles</td><td>role</td><td></td></tr><tr><td>ListRoleDependants</td><td>role</td><td></td></tr><tr><td>GetRoleDetails</td><td>role</td><td></td></tr><tr><td>CreateGroup</td><td>group</td><td></td></tr><tr><td>DeleteGroup</td><td>group</td><td></td></tr><tr><td>UpdateGroup</td><td>group</td><td></td></tr><tr><td>ListGroups</td><td>group</td><td></td></tr><tr><td>ListGroupDependants</td><td>group</td><td></td></tr><tr><td>GetGroupDetails</td><td>group</td><td></td></tr><tr><td>CreateUser</td><td>user</td><td></td></tr><tr><td>DeleteUser</td><td>user</td><td></td></tr><tr><td>UpdateUser</td><td>user</td><td></td></tr><tr><td>ListUsers</td><td>user</td><td></td></tr><tr><td>ListUserDependants</td><td>user</td><td></td></tr><tr><td>GetUserDetails</td><td>user</td><td></td></tr><tr><td>CreateServiceAccount</td><td>service account</td><td></td></tr><tr><td>DeleteServiceAccount</td><td>service account</td><td></td></tr><tr><td>UpdateServiceAccount</td><td>service account</td><td></td></tr><tr><td>ListServiceAccounts</td><td>service account</td><td></td></tr><tr><td>ListServiceAccountDependants</td><td>service account</td><td></td></tr><tr><td>GetServiceAccountDetails</td><td>service account</td><td></td></tr></tbody></table>

## Kafka Connect

service: **kafka-connect**

**Resource Syntax**

* kafka-connect:connector:${Environment}/${KafkaConnectCluster}/${Connector}
* kafka-connect:cluster:${Environment}/${KafkaConnectCluster}

{% code title="Example role permission" %}

```yaml
name: global-connector-operator
policy:
  - action:
      - iam:List*
      - iam:Get*
    resource: iam:*
    effect: allow
  - action:
      - environments:Get*
      - environments:List*
      - environments:AccessEnvironment
    resource: environments:*
    effect: allow
  - action:
      - kafka-connect:List*
      - kafka-connect:GetClusterDetails
      - kafka-connect:GetConnectorDetails
      - kafka-connect:StartConnector
      - kafka-connect:StopConnector
    resource:
      - kafka-connect:cluster:*/*
      - kafka-connect:connector:*/*/*
    effect: allow
```

{% endcode %}

<table data-full-width="false"><thead><tr><th width="316">Operation</th><th width="146">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateConnector</td><td>connector</td><td></td></tr><tr><td>ListConnectors</td><td>connector</td><td></td></tr><tr><td>ListConnectors</td><td>connector</td><td></td></tr><tr><td>GetConnectorConfiguration</td><td>connector</td><td></td></tr><tr><td>UpdateConnectorConfiguration</td><td>connector</td><td></td></tr><tr><td>DeleteConnector</td><td>connector</td><td></td></tr><tr><td>StartConnector</td><td>connector</td><td></td></tr><tr><td>StopConnector</td><td>connector</td><td></td></tr><tr><td>ListConnectorDependants</td><td>connector</td><td></td></tr><tr><td>ListClusters</td><td>cluster</td><td></td></tr><tr><td>GetClusterDetails</td><td>cluster</td><td></td></tr><tr><td>DeployConnectors</td><td>cluster</td><td></td></tr></tbody></table>

## Kafka

service: **kafka**

**Resource Syntax**

* kafka:topic:${Environment}/${KafkaCluster}/${Topic}
* kafka:acl:${Environment}/${KafkaCluster}/${AclResourceType}/\* or kafka:acl:${Environment}/${KafkaCluster}/${AclResourceType}/${PrincipalType}/${Principal}
* kafka:quota:${Environment}/${KafkaCluster}/${QuotaType}/\* or
* kafka:quota:${Environment}/${KafkaCluster}/clients
* kafka:quota:${Environment}/${KafkaCluster}/users-default
* kafka:quota:${Environment}/${KafkaCluster}/client/${ClientID}
* kafka:quota:${Environment}/${KafkaCluster}/user/${Username}
* kafka:quota:${Environment}/${KafkaCluster}/user/${Username}/client/${ClientID}
* kafka:quota:${Environment}/${KafkaCluster}/user-client/${Username}/${ClientID}
* kafka:quota:${Environment}/${KafkaCluster}/user/${Username}/client/\*
* kafka:quota:${Environment}/${KafkaCluster}/user-all-clients/${Username}

{% code title="Example role permission" %}

```yaml
name: example
policy:
  - action:
      - kafka:ListTopics
      - kafka:GetTopicDetails 
    resource: 
      - kafka:topic:my_env/kafka/my_topic
```

{% endcode %}

<table data-full-width="false"><thead><tr><th width="269">Operation</th><th width="243">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateTopic</td><td>topic</td><td></td></tr><tr><td>DeleteTopic</td><td>topic</td><td></td></tr><tr><td>ListTopics</td><td>topic</td><td></td></tr><tr><td>GetTopicDetails</td><td>topic</td><td></td></tr><tr><td>UpdateTopicDetails</td><td>topic</td><td></td></tr><tr><td>ReadTopicData</td><td>topic</td><td></td></tr><tr><td>WriteTopicData</td><td>topic</td><td></td></tr><tr><td>DeleteTopicData</td><td>topic</td><td></td></tr><tr><td>ListTopicDependants</td><td>topic</td><td>List visibility of all entities that depend on this entity e.g. ListTopicDependants means that you'll be able to see (i.e. List) all consumer groups that read from that topic regardless of what your specific consumer group permissions.</td></tr><tr><td>CreateAcl</td><td>acl</td><td></td></tr><tr><td>GetAclDetails</td><td>acl</td><td></td></tr><tr><td>UpdateAcl</td><td>acl</td><td></td></tr><tr><td>DeleteAcl</td><td>acl</td><td></td></tr><tr><td>CreateQuota</td><td>quota</td><td></td></tr><tr><td>ListQuotas</td><td>quota</td><td></td></tr><tr><td>GetQuotaDetails</td><td>quota</td><td></td></tr><tr><td>UpdateQuota</td><td>quota</td><td></td></tr><tr><td>DeleteQuota</td><td>quota</td><td></td></tr><tr><td>DeleteConsumerGroup</td><td>consumer-group</td><td></td></tr><tr><td>UpdateConsumerGroup</td><td>consumer-group</td><td></td></tr><tr><td>ListConsumerGroups</td><td>consumer-group</td><td></td></tr><tr><td>GetConsumerGroupDetails</td><td>consumer-group</td><td></td></tr><tr><td>ListConsumerGroupDependants</td><td>consumer-group</td><td></td></tr></tbody></table>

## Kubernetes

service: **kubernetes**

**Resource Syntax**

* kubernetes:cluster:${Environment}/${KubernetesCluster}
* kubernetes:namespace:${Environment}/${KubernetesCluster}/${KubernetesNamespace}

<table data-full-width="false"><thead><tr><th>Operation</th><th width="172">Resource Type</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td>ListClusters</td><td>cluster</td><td></td><td></td></tr><tr><td>GetClusterDetails</td><td>cluster</td><td></td><td></td></tr><tr><td>ListNamespaces</td><td>namespace</td><td></td><td></td></tr><tr><td>DeployApps</td><td>namespace</td><td></td><td></td></tr></tbody></table>

## Registry

service: **registry**

**Resource Syntax**

* schemas:registry:${Environment}/${SchemaRegistry}

<table data-full-width="false"><thead><tr><th width="287">Operation</th><th width="151">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>GetRegistryConfiguration</td><td>registry</td><td></td></tr><tr><td>UpdateRegistryConfiguration</td><td>registry</td><td></td></tr></tbody></table>

## Schemas

service: **schemas**

**Resource Syntax**

* schemas:schema:${Environment}/${SchemaRegistry}/${Schema}

<table data-full-width="false"><thead><tr><th>Operation</th><th width="147">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateSchema</td><td>schema</td><td></td></tr><tr><td>DeleteSchema</td><td>schema</td><td></td></tr><tr><td>UpdateSchema</td><td>schema</td><td></td></tr><tr><td>GetSchemaDetails</td><td>schema</td><td></td></tr><tr><td>ListSchemas</td><td>schema</td><td></td></tr><tr><td>ListSchemaDependants</td><td>schema</td><td></td></tr></tbody></table>

## SQL Streaming

service: **sql-streaming**

**Resource Syntax**

* sql-streaming:sql-processor:${Environment}/${KubernetesCluster}/${KubernetesNamespace}/${SqlProcessor}
* For IN\_PROC processors sql-streaming:sql-processor:${Environment}/lenses-in-process/default/${SqlProcessor}

<table data-full-width="false"><thead><tr><th>Available Actions</th><th width="146">Resource Type</th><th>Description</th></tr></thead><tbody><tr><td>CreateProcessor</td><td>sql-processor</td><td></td></tr><tr><td>ListProcessors</td><td>sql-processor</td><td></td></tr><tr><td>GetProcessorDetails</td><td>sql-processor</td><td></td></tr><tr><td>GetProcessorSql</td><td>sql-processor</td><td></td></tr><tr><td>UpdateProcessorSql</td><td>sql-processor</td><td></td></tr><tr><td>DeleteProcessor</td><td>sql-processor</td><td></td></tr><tr><td>StartProcessor</td><td>sql-processor</td><td></td></tr><tr><td>StopProcessor</td><td>sql-processor</td><td></td></tr><tr><td>ScaleProcessor</td><td>sql-processor</td><td></td></tr><tr><td>GetProcessorLogs</td><td>sql-processor</td><td></td></tr><tr><td>ListProcessorDependants</td><td>sql-processor</td><td></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.lenses.io/latest/devx/6.0/user-guide/iam/iam-reference.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.