Actions, resources, and condition keys for AWS IAM Identity Center

AWS IAM Identity Center (service prefix: sso) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by AWS IAM Identity Center
Resource types defined by AWS IAM Identity Center
Condition keys for AWS IAM Identity Center

Actions defined by AWS IAM Identity Center

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Access level column of the Actions table describes how the action is classified (List, Read, Permissions management, or Tagging). This classification can help you understand the level of access that an action grants when you use it in a policy. For more information about access levels, see Access levels in policy summaries.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

The Dependent actions column of the Actions table shows additional permissions that may be required to successfully call an action. These permissions may be needed in addition to the permission for the action itself. When an action specifies dependent actions, those dependencies may apply to additional resources defined for that action, not only the first resource listed in the table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AssociateDirectory	Grants permission to connect a directory to be used by AWS IAM Identity Center	Write			ds:AuthorizeApplication identitystore:CreateIdentityStore kms:Decrypt
AssociateProfile	Grants permission to create an association between a directory user or group and a profile	Write			kms:Decrypt
AttachCustomerManagedPolicyReferenceToPermissionSet	Grants permission to attach a customer managed policy reference to a permission set	Permissions management	Instance*		kms:Decrypt
AttachCustomerManagedPolicyReferenceToPermissionSet		Permissions management	PermissionSet*
AttachManagedPolicyToPermissionSet	Grants permission to attach an AWS managed policy to a permission set	Permissions management	Instance*		kms:Decrypt
AttachManagedPolicyToPermissionSet		Permissions management	PermissionSet*
CreateAccountAssignment	Grants permission to assign access to a Principal for a specified AWS account using a specified permission set	Write	Account*		kms:Decrypt
			Instance*
			PermissionSet*
CreateApplication	Grants permission to create an application	Write	ApplicationProvider*		kms:Decrypt
			Instance*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateApplicationAssignment	Grants permission to create an application assignment	Write	Application*		kms:Decrypt
CreateApplicationAssignment	Grants permission to create an application assignment	Write		sso:ApplicationAccount
CreateApplicationInstance	Grants permission to add an application instance to AWS IAM Identity Center	Write			kms:Decrypt
CreateApplicationInstanceCertificate	Grants permission to add a new certificate for an application instance	Write			kms:Decrypt
CreateInstance	Grants permission to create an identity center instance	Write	Instance*		iam:CreateServiceLinkedRole identitystore:CreateIdentityStore organizations:DescribeOrganization
CreateInstance	Grants permission to create an identity center instance	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateInstanceAccessControlAttributeConfiguration	Grants permission to enable the instance for ABAC and specify the attributes	Write	Instance*		iam:AttachRolePolicy iam:CreateRole iam:DeleteRole iam:DeleteRolePolicy iam:DetachRolePolicy iam:GetRole iam:ListAttachedRolePolicies iam:ListRolePolicies iam:PutRolePolicy iam:UpdateAssumeRolePolicy kms:Decrypt
CreateManagedApplicationInstance	Grants permission to add a managed application instance to AWS IAM Identity Center	Write			kms:Decrypt
CreatePermissionSet	Grants permission to create a permission set	Write	Instance*		kms:Decrypt
			PermissionSet*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateProfile	Grants permission to create a profile for an application instance	Write			kms:Decrypt
CreateTrust	Grants permission to create a federation trust in a target account	Write			kms:Decrypt
CreateTrustedTokenIssuer	Grants permission to create a trusted token issuer for an instance	Write	Instance*		kms:Decrypt
CreateTrustedTokenIssuer		Write		aws:RequestTag/${TagKey} aws:TagKeys
DeleteAccountAssignment	Grants permission to delete a Principal's access from a specified AWS account using a specified permission set	Write	Account*		kms:Decrypt
			Instance*
			PermissionSet*
DeleteApplication	Grants permission to delete an application	Write	Application*		kms:Decrypt
DeleteApplication	Grants permission to delete an application	Write		sso:ApplicationAccount
DeleteApplicationAccessScope	Grants permission to delete an access scope to an application	Write	Application*		kms:Decrypt
DeleteApplicationAccessScope		Write		sso:ApplicationAccount
DeleteApplicationAssignment	Grants permission to delete an application assignment	Write	Application*		kms:Decrypt
DeleteApplicationAssignment	Grants permission to delete an application assignment	Write		sso:ApplicationAccount
DeleteApplicationAuthenticationMethod	Grants permission to delete an authentication method to an application	Write	Application*		kms:Decrypt
DeleteApplicationAuthenticationMethod		Write		sso:ApplicationAccount
DeleteApplicationGrant	Grants permission to delete a grant from an application	Write	Application*		kms:Decrypt
DeleteApplicationGrant	Grants permission to delete a grant from an application	Write		sso:ApplicationAccount
DeleteApplicationInstance	Grants permission to delete the application instance	Write			kms:Decrypt
DeleteApplicationInstanceCertificate	Grants permission to delete an inactive or expired certificate from the application instance	Write			kms:Decrypt
DeleteInlinePolicyFromPermissionSet	Grants permission to delete the inline policy from a specified permission set	Write	Instance*		kms:Decrypt
DeleteInlinePolicyFromPermissionSet		Write	PermissionSet*
DeleteInstance	Grants permission to delete an identity center instance	Write	Instance*		identitystore:DeleteIdentityStore
DeleteInstanceAccessControlAttributeConfiguration	Grants permission to disable ABAC and remove the attributes list for the instance	Write	Instance*		kms:Decrypt
DeleteManagedApplicationInstance	Grants permission to delete the managed application instance	Write			kms:Decrypt
DeletePermissionSet	Grants permission to delete a permission set	Write	Instance*		kms:Decrypt
DeletePermissionSet	Grants permission to delete a permission set	Write	PermissionSet*
DeletePermissionsBoundaryFromPermissionSet	Grants permission to remove permissions boundary from a permission set	Permissions management	Instance*		kms:Decrypt
DeletePermissionsBoundaryFromPermissionSet		Permissions management	PermissionSet*
DeleteProfile	Grants permission to delete the profile for an application instance	Write			kms:Decrypt
DeleteTrustedTokenIssuer	Grants permission to delete a trusted token issuer for an instance	Write	TrustedTokenIssuer*		kms:Decrypt
DescribeAccountAssignmentCreationStatus	Grants permission to describe the status of the assignment creation request	Read	Instance*		kms:Decrypt
DescribeAccountAssignmentDeletionStatus	Grants permission to describe the status of an assignment deletion request	Read	Instance*		kms:Decrypt
DescribeApplication	Grants permission to obtain information about an application	Read	Application*		kms:Decrypt
DescribeApplication		Read		sso:ApplicationAccount
DescribeApplicationAssignment	Grants permission to retrieve an application assignment	Read	Application*		kms:Decrypt
DescribeApplicationAssignment	Grants permission to retrieve an application assignment	Read		sso:ApplicationAccount
DescribeApplicationProvider	Grants permission to describe an application provider	Read	ApplicationProvider*
DescribeInstance	Grants permission to obtain information about an identity center instance	Read	Instance*
DescribeInstanceAccessControlAttributeConfiguration	Grants permission to get the list of attributes used by the instance for ABAC	Read	Instance*		kms:Decrypt
DescribePermissionSet	Grants permission to describe a permission set	Read	Instance*		kms:Decrypt
DescribePermissionSet	Grants permission to describe a permission set	Read	PermissionSet*
DescribePermissionSetProvisioningStatus	Grants permission to describe the status for the given Permission Set Provisioning request	Read	Instance*		kms:Decrypt
DescribeRegisteredRegions	Grants permission to obtain the regions where your organization has enabled AWS IAM Identity Center	Read
DescribeTrustedTokenIssuer	Grants permission to describe a trusted token issuer for an instance	Read	TrustedTokenIssuer*		kms:Decrypt
DetachCustomerManagedPolicyReferenceFromPermissionSet	Grants permission to detach a customer managed policy reference from a permission set	Permissions management	Instance*		kms:Decrypt
DetachCustomerManagedPolicyReferenceFromPermissionSet		Permissions management	PermissionSet*
DetachManagedPolicyFromPermissionSet	Grants permission to detach the attached AWS managed policy from the specified permission set	Permissions management	Instance*		kms:Decrypt
DetachManagedPolicyFromPermissionSet		Permissions management	PermissionSet*
DisassociateDirectory	Grants permission to disassociate a directory to be used by AWS IAM Identity Center	Write			ds:UnauthorizeApplication identitystore:DeleteIdentityStore kms:Decrypt
DisassociateProfile	Grants permission to disassociate a directory user or group from a profile	Write			kms:Decrypt
GetApplicationAccessScope	Grants permission to get an access scope to an application	Read	Application*		kms:Decrypt
GetApplicationAccessScope	Grants permission to get an access scope to an application	Read		sso:ApplicationAccount
GetApplicationAssignmentConfiguration	Grants permission to read assignment configurations for an application	Read	Application*		kms:Decrypt
GetApplicationAssignmentConfiguration		Read		sso:ApplicationAccount
GetApplicationAuthenticationMethod	Grants permission to get an authentication method to an application	Read	Application*		kms:Decrypt
GetApplicationAuthenticationMethod		Read		sso:ApplicationAccount
GetApplicationGrant	Grants permission to obtain details about a grant belonging to an application	Read	Application*		kms:Decrypt
GetApplicationGrant		Read		sso:ApplicationAccount
GetApplicationInstance	Grants permission to retrieve details for an application instance	Read			kms:Decrypt
GetApplicationSessionConfiguration	Grants permission to get session configuration for an application	Read	Application*		kms:Decrypt
GetApplicationSessionConfiguration		Read		sso:ApplicationAccount
GetApplicationTemplate	Grants permission to retrieve application template details	Read
GetInlinePolicyForPermissionSet	Grants permission to obtain the inline policy assigned to the permission set	Read	Instance*		kms:Decrypt
GetInlinePolicyForPermissionSet		Read	PermissionSet*
GetManagedApplicationInstance	Grants permission to retrieve details for an application instance	Read			kms:Decrypt
GetMfaDeviceManagementForDirectory	Grants permission to retrieve Mfa Device Management settings for the directory	Read			kms:Decrypt
GetPermissionSet	Grants permission to retrieve details of a permission set	Read			kms:Decrypt
GetPermissionsBoundaryForPermissionSet	Grants permission to get permissions boundary for a permission set	Read	Instance*		kms:Decrypt
GetPermissionsBoundaryForPermissionSet		Read	PermissionSet*
GetProfile	Grants permission to retrieve a profile for an application instance	Read			kms:Decrypt
GetSSOStatus	Grants permission to check if AWS IAM Identity Center is enabled	Read
GetSharedSsoConfiguration	Grants permission to retrieve shared configuration for the current SSO instance	Read			kms:Decrypt
GetSsoConfiguration	Grants permission to retrieve configuration for the current SSO instance	Read			kms:Decrypt
GetTrust	Grants permission to retrieve the federation trust in a target account	Read			kms:Decrypt
ImportApplicationInstanceServiceProviderMetadata	Grants permission to update the application instance by uploading an application SAML metadata file provided by the service provider	Write			kms:Decrypt
ListAccountAssignmentCreationStatus	Grants permission to list the status of the AWS account assignment creation requests for a specified SSO instance	List	Instance*		kms:Decrypt
ListAccountAssignmentDeletionStatus	Grants permission to list the status of the AWS account assignment deletion requests for a specified SSO instance	List	Instance*		kms:Decrypt
ListAccountAssignments	Grants permission to list the assignee of the specified AWS account with the specified permission set	List	Account*		kms:Decrypt
			Instance*
			PermissionSet*
ListAccountAssignmentsForPrincipal	Grants permission to list accounts assigned to user or group	List	Instance*		kms:Decrypt
ListAccountsForProvisionedPermissionSet	Grants permission to list all the AWS accounts where the specified permission set is provisioned	List	Instance*		kms:Decrypt
ListAccountsForProvisionedPermissionSet		List	PermissionSet*
ListApplicationAccessScopes	Grants permission to list access scopes to an application	List	Application*		kms:Decrypt
ListApplicationAccessScopes	Grants permission to list access scopes to an application	List		sso:ApplicationAccount
ListApplicationAssignments	Grants permission to list application assignments	List	Application*		kms:Decrypt
ListApplicationAssignments	Grants permission to list application assignments	List		sso:ApplicationAccount
ListApplicationAssignmentsForPrincipal	Grants permission to list applications assigned to user or group	List	Instance*		kms:Decrypt
ListApplicationAssignmentsForPrincipal		List		sso:ApplicationAccount
ListApplicationAuthenticationMethods	Grants permission to list authentication methods to an application	List	Application*		kms:Decrypt
ListApplicationAuthenticationMethods		List		sso:ApplicationAccount
ListApplicationGrants	Grants permission to list grants from an application	List	Application*		kms:Decrypt
ListApplicationGrants	Grants permission to list grants from an application	List		sso:ApplicationAccount
ListApplicationInstanceCertificates	Grants permission to retrieve all of the certificates for a given application instance	Read			kms:Decrypt
ListApplicationInstances	Grants permission to retrieve all application instances	List			kms:Decrypt sso:GetApplicationInstance
ListApplicationProviders	Grants permission to list application providers	List	ApplicationProvider*
ListApplicationTemplates	Grants permission to retrieve all supported application templates	List			sso:GetApplicationTemplate
ListApplications	Grants permission to retrieve all applications associated with the instance of IAM Identity Center	List			kms:Decrypt
ListCustomerManagedPolicyReferencesInPermissionSet	Grants permission to list the customer managed policy references that are attached to a permission set	List	Instance*		kms:Decrypt
ListCustomerManagedPolicyReferencesInPermissionSet		List	PermissionSet*
ListDirectoryAssociations	Grants permission to retrieve details about the directory connected to AWS IAM Identity Center	Read			kms:Decrypt
ListInstances	Grants permission to list the SSO Instances that the caller has access to	List
ListManagedPoliciesInPermissionSet	Grants permission to list the AWS managed policies that are attached to a specified permission set	List	Instance*		kms:Decrypt
ListManagedPoliciesInPermissionSet		List	PermissionSet*
ListPermissionSetProvisioningStatus	Grants permission to list the status of the Permission Set Provisioning requests for a specified SSO instance	List	Instance*		kms:Decrypt
ListPermissionSets	Grants permission to retrieve all permission sets	List	Instance*		kms:Decrypt
ListPermissionSetsProvisionedToAccount	Grants permission to list all the permission sets that are provisioned to a specified AWS account	List	Account*		kms:Decrypt
ListPermissionSetsProvisionedToAccount		List	Instance*
ListProfileAssociations	Grants permission to retrieve the directory user or group associated with the profile	Read			kms:Decrypt
ListProfiles	Grants permission to retrieve all profiles for an application instance	List			kms:Decrypt sso:GetProfile
ListTagsForResource	Grants permission to list the tags that are attached to a specified resource	Read	Application		kms:Decrypt
			Instance
			PermissionSet
			TrustedTokenIssuer
ListTrustedTokenIssuers	Grants permission to list trusted token issuers for an instance	List	Instance*		kms:Decrypt
ProvisionPermissionSet	Grants permission to provision a specified permission set to the specified target	Write	Account*		kms:Decrypt
			Instance*
			PermissionSet*
PutApplicationAccessScope	Grants permission to create/update an access scope to an application	Write	Application*		kms:Decrypt
PutApplicationAccessScope		Write		sso:ApplicationAccount
PutApplicationAssignmentConfiguration	Grants permission to add assignment configurations to an application	Write	Application*		kms:Decrypt
PutApplicationAssignmentConfiguration		Write		sso:ApplicationAccount
PutApplicationAuthenticationMethod	Grants permission to create/update an authentication method to an application	Write	Application*		kms:Decrypt
PutApplicationAuthenticationMethod		Write		sso:ApplicationAccount
PutApplicationGrant	Grants permission to create/update a grant to an application	Write	Application*		kms:Decrypt
PutApplicationGrant		Write		sso:ApplicationAccount
PutApplicationSessionConfiguration	Grants permission to put session configuration for an application	Write	Application*		kms:Decrypt
PutApplicationSessionConfiguration		Write		sso:ApplicationAccount
PutInlinePolicyToPermissionSet	Grants permission to attach an IAM inline policy to a permission set	Write	Instance*		kms:Decrypt
PutInlinePolicyToPermissionSet		Write	PermissionSet*
PutMfaDeviceManagementForDirectory	Grants permission to put Mfa Device Management settings for the directory	Write			kms:Decrypt
PutPermissionsBoundaryToPermissionSet	Grants permission to add permissions boundary to a permission set	Permissions management	Instance*		kms:Decrypt
PutPermissionsBoundaryToPermissionSet		Permissions management	PermissionSet*
PutPermissionsPolicy	Grants permission to add a policy to a permission set	Permissions management			kms:Decrypt
SearchGroups	Grants permission to search for groups within the associated directory	Read			ds:DescribeDirectories kms:Decrypt
SearchUsers	Grants permission to search for users within the associated directory	Read			ds:DescribeDirectories kms:Decrypt
StartSSO	Grants permission to initialize AWS IAM Identity Center	Write			kms:Decrypt kms:DescribeKey kms:Encrypt kms:GenerateDataKeyWithoutPlaintext organizations:DescribeOrganization organizations:EnableAWSServiceAccess
TagResource	Grants permission to associate a set of tags with a specified resource	Tagging	Application		kms:Decrypt
			Instance
			PermissionSet
			TrustedTokenIssuer
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to disassociate a set of tags from a specified resource	Tagging	Application		kms:Decrypt
			Instance
			PermissionSet
			TrustedTokenIssuer
				aws:TagKeys
UpdateApplication	Grants permission to update an application	Write	Application*		kms:Decrypt
UpdateApplication	Grants permission to update an application	Write		sso:ApplicationAccount
UpdateApplicationInstanceActiveCertificate	Grants permission to set a certificate as the active one for this application instance	Write			kms:Decrypt
UpdateApplicationInstanceDisplayData	Grants permission to update display data of an application instance	Write			kms:Decrypt
UpdateApplicationInstanceResponseConfiguration	Grants permission to update federation response configuration for the application instance	Write			kms:Decrypt
UpdateApplicationInstanceResponseSchemaConfiguration	Grants permission to update federation response schema configuration for the application instance	Write			kms:Decrypt
UpdateApplicationInstanceSecurityConfiguration	Grants permission to update security details for the application instance	Write			kms:Decrypt
UpdateApplicationInstanceServiceProviderConfiguration	Grants permission to update service provider related configuration for the application instance	Write			kms:Decrypt
UpdateApplicationInstanceStatus	Grants permission to update the status of an application instance	Write			kms:Decrypt
UpdateInstance	Grants permission to update an identity center instance	Write	Instance*		identitystore:UpdateIdentityStore kms:Decrypt kms:DescribeKey kms:Encrypt kms:GenerateDataKeyWithoutPlaintext
UpdateInstanceAccessControlAttributeConfiguration	Grants permission to update the attributes to use with the instance for ABAC	Write	Instance*		kms:Decrypt
UpdateManagedApplicationInstanceStatus	Grants permission to update the status of a managed application instance	Write			kms:Decrypt
UpdatePermissionSet	Grants permission to update the permission set	Permissions management	Instance*		kms:Decrypt
UpdatePermissionSet	Grants permission to update the permission set	Permissions management	PermissionSet*
UpdateProfile	Grants permission to update the profile for an application instance	Write			kms:Decrypt
UpdateSSOConfiguration	Grants permission to update the configuration for the current SSO instance	Write			kms:Decrypt
UpdateTrust	Grants permission to update the federation trust in a target account	Write			kms:Decrypt
UpdateTrustedTokenIssuer	Grants permission to update a trusted token issuer for an instance	Write	TrustedTokenIssuer*		kms:Decrypt

Resource types defined by AWS IAM Identity Center

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
PermissionSet	`arn:${Partition}:sso:::permissionSet/${InstanceId}/${PermissionSetId}`	aws:ResourceTag/${TagKey}
Account	`arn:${Partition}:sso:::account/${AccountId}`
Instance	`arn:${Partition}:sso:::instance/${InstanceId}`	aws:ResourceTag/${TagKey}
Application	`arn:${Partition}:sso::${AccountId}:application/${InstanceId}/${ApplicationId}`	aws:ResourceTag/${TagKey} sso:ApplicationAccount
TrustedTokenIssuer	`arn:${Partition}:sso::${AccountId}:trustedTokenIssuer/${InstanceId}/${TrustedTokenIssuerId}`	aws:ResourceTag/${TagKey}
ApplicationProvider	`arn:${Partition}:sso::aws:applicationProvider/${ApplicationProviderId}`

Condition keys for AWS IAM Identity Center

AWS IAM Identity Center defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see AWS global condition context keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
sso:ApplicationAccount	Filters access by the account which creates the application. This condition key is not supported for customer managed SAML applications	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS IAM Access Analyzer

AWS IAM Identity Center directory