Actions, resources, and condition keys for AWS IAM Identity Center directory

AWS IAM Identity Center directory (service prefix: sso-directory) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by AWS IAM Identity Center directory

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Access level column of the Actions table describes how the action is classified (List, Read, Permissions management, or Tagging). This classification can help you understand the level of access that an action grants when you use it in a policy. For more information about access levels, see Access levels in policy summaries.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

The Dependent actions column of the Actions table shows additional permissions that may be required to successfully call an action. These permissions may be needed in addition to the permission for the action itself. When an action specifies dependent actions, those dependencies may apply to additional resources defined for that action, not only the first resource listed in the table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AddMemberToGroup	Grants permission to add a member to a group in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
CompleteVirtualMfaDeviceRegistration	Grants permission to complete the creation process of a virtual MFA device	Write
CompleteWebAuthnDeviceRegistration	Grants permission to complete the registration process of a WebAuthn device	Write
CreateAlias	Grants permission to create an alias for the directory that AWS IAM Identity Center provides by default	Write
CreateBearerToken	Grants permission to create a bearer token for a given provisioning tenant	Write			kms:Decrypt
CreateExternalIdPConfigurationForDirectory	Grants permission to create an External Identity Provider configuration for the directory	Write
CreateGroup	Grants permission to create a group in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
CreateProvisioningTenant	Grants permission to create a provisioning tenant for a given directory	Write			kms:Decrypt
CreateUser	Grants permission to create a user in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
DeleteBearerToken	Grants permission to delete a bearer token	Write			kms:Decrypt
DeleteExternalIdPCertificate	Grants permission to delete the given external IdP certificate	Write
DeleteExternalIdPConfigurationForDirectory	Grants permission to delete an External Identity Provider configuration associated with the directory	Write
DeleteGroup	Grants permission to delete a group from the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
DeleteMfaDeviceForUser	Grants permission to delete a MFA device by device name for a given user	Write
DeleteProvisioningTenant	Grants permission to delete the provisioning tenant	Write			kms:Decrypt
DeleteUser	Grants permission to delete a user from the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
DescribeDirectory	Grants permission to retrieve information about the directory that AWS IAM Identity Center provides by default	Read
DescribeGroup	Grants permission to query the group data, not including user and group members	Read			kms:Decrypt
DescribeGroups	Grants permission to retrieve information about groups from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
DescribeProvisioningTenant	Grants permission to describes the provisioning tenant	Read			kms:Decrypt
DescribeUser	Grants permission to retrieve information about a user from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
DescribeUserByUniqueAttribute	Grants permission to describe user with a valid unique attribute represented for the user	Read			kms:Decrypt
DescribeUsers	Grants permission to retrieve information about user from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
DisableExternalIdPConfigurationForDirectory	Grants permission to disable authentication of end users with an External Identity Provider	Write
DisableUser	Grants permission to deactivate a user in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
EnableExternalIdPConfigurationForDirectory	Grants permission to enable authentication of end users with an External Identity Provider	Write
EnableUser	Grants permission to activate user in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
GetAWSSPConfigurationForDirectory	Grants permission to retrieve the AWS IAM Identity Center Service Provider configurations for the directory	Read
GetGroupId	Grants permission to retrieve ID information about group from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
GetUserId	Grants permission to retrieve ID information about user from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
GetUserPoolInfo	(Deprecated) Grants permission to get UserPool Info	Read
ImportExternalIdPCertificate	Grants permission to import the IdP certificate used for verifying external IdP responses	Write
IsMemberInGroup	Grants permission to check if a member is a part of the group in the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
IsMemberInGroups	Grants permission to check if a member is a part of multiple groups in the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
ListBearerTokens	Grants permission to list bearer tokens for a given provisioning tenant	Read			kms:Decrypt
ListExternalIdPCertificates	Grants permission to list the external IdP certificates of a given directory and IdP	Read
ListExternalIdPConfigurationsForDirectory	Grants permission to list all the External Identity Provider configurations created for the directory	Read
ListGroups	Grants permission to list groups from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
ListGroupsForMember	Grants permission to list groups of the target member	Read			kms:Decrypt
ListGroupsForUser	Grants permission to list groups for a user from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
ListMembersInGroup	Grants permission to retrieve all members that are part of a group in the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
ListMfaDevicesForUser	Grants permission to list all active MFA devices and their MFA device metadata for a user	Read
ListProvisioningTenants	Grants permission to list provisioning tenants for a given directory	Read			kms:Decrypt
ListUsers	Grants permission to list users from the directory that AWS IAM Identity Center provides by default	Read			kms:Decrypt
RemoveMemberFromGroup	Grants permission to remove a member that is part of a group in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
SearchGroups	Grants permission to search for groups within the associated directory	Read			kms:Decrypt
SearchUsers	Grants permission to search for users within the associated directory	Read			kms:Decrypt
StartVirtualMfaDeviceRegistration	Grants permission to begin the creation process of virtual mfa device	Write
StartWebAuthnDeviceRegistration	Grants permission to begin the registration process of a WebAuthn device	Write
UpdateExternalIdPConfigurationForDirectory	Grants permission to update an External Identity Provider configuration associated with the directory	Write
UpdateGroup	Grants permission to update information about a group in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
UpdateGroupDisplayName	Grants permission to update group display name update group display name response	Write			kms:Decrypt
UpdateMfaDeviceForUser	Grants permission to update MFA device information	Write
UpdatePassword	Grants permission to update a password by sending password reset link via email or generating one time password for a user in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
UpdateUser	Grants permission to update user information in the directory that AWS IAM Identity Center provides by default	Write			kms:Decrypt
UpdateUserName	Grants permission to update user name update user name response	Write			kms:Decrypt
VerifyEmail	Grants permission to verify an email address of an User	Write

Resource types defined by AWS IAM Identity Center directory

AWS IAM Identity Center directory does not support specifying a resource ARN in the Resource element of an IAM policy statement. To allow access to AWS IAM Identity Center directory, specify "Resource": "*" in your policy.

Condition keys for AWS IAM Identity Center directory

IAM Identity Center directory has no service-specific context keys that can be used in the Condition element of policy statements. For the list of the global context keys that are available to all services, see AWS global condition context keys.