Resource-based policy examples for AWS Systems Manager Incident Manager
AWS Systems Manager Incident Manager supports resource-based permissions policies for Incident Manager response plans and contacts.
Incident Manager doesn't support resource-based policies that deny access to resources shared using AWS RAM.
To learn how to create a response plan or contact, see Response plans and Contacts.
Restricting Incident Manager response plan access by organization
The following example grants permissions to users in the organization with the
organization ID: o-abc123def45
to respond to incidents created using the
response plan myplan
.
The Condition
block uses the StringEquals
conditions and
the aws:PrincipalOrgID
condition key, which is an AWS Organizations specific
condition key. For more information about these condition keys, see Specifying conditions in a
policy.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "OrganizationAccess", "Effect": "Allow", "Principal": “*”, "Condition": { "StringEquals": {"aws:PrincipalOrgID":"o-abc123def45"} }, "Action": [ "ssm-incidents:GetResponsePlan", "ssm-incidents:StartIncident", "ssm-incidents:UpdateIncidentRecord", "ssm-incidents:GetIncidentRecord", "ssm-incidents:CreateTimelineEvent", "ssm-incidents:UpdateTimelineEvent", "ssm-incidents:GetTimelineEvent", "ssm-incidents:ListTimelineEvents", "ssm-incidents:UpdateRelatedItems", "ssm-incidents:ListRelatedItems" ], "Resource": [ "arn:aws:ssm-incidents:*:111122223333:response-plan/myplan", "arn:aws:ssm-incidents:*:111122223333:incident-record/myplan/*" ] } ] }
Providing Incident Manager contact access to a principal
The following example grants permission to the principal with the ARN
arn:aws:iam::999988887777:root
to create engagements to the contact
mycontact
.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "PrincipalAccess", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::999988887777:root" }, "Action": [ "ssm-contacts:GetContact", "ssm-contacts:StartEngagement", "ssm-contacts:DescribeEngagement", "ssm-contacts:ListPagesByContact" ], "Resource": [ "arn:aws:ssm-contacts:*:111122223333:contact/mycontact" "arn:aws:ssm-contacts:*:111122223333:engagement/mycontact/*" ] } ] }