Manage access to AWS Support Center
You must have permissions to access Support Center and to create a support case.
You can use one of the following options to access Support Center:
-
Use the email address and password associated with your AWS account. This identity is called the AWS account root user.
-
Use AWS Identity and Access Management (IAM).
If you have a Business, Enterprise On-Ramp, or Enterprise Support plan, you can also use the Support API to access Support and Trusted Advisor operations programmatically. For more information, see the AWS Support API Reference.
Note
If you can't sign in to Support Center, you can use the Contact Us
AWS account
You can sign in to the AWS Management Console and access the Support Center by using your AWS account email address and password. This identity is called the AWS account root user. However, we strongly recommend that you don't use the root user for your everyday tasks, even the administrative ones. Instead, we recommend that you use IAM, which lets you control who can perform certain tasks in your account.
AWS support actions
You can perform the following Support actions in the console. You can also specify these Support actions in an IAM policy to allow or deny specific actions.
Note
If you deny any of the below actions in your IAM policies, it could result in unintended behaviour in Support Center when creating or interacting with a support case.
| Action | Description |
|---|---|
|
|
Grants permission to add one or more attachments to an attachment set. An attachment set is a temporary container for attachments that you add to a case or case communication. The set is available for 1 hour after it's created. The expiryTime returned in the response is when the set expires. |
|
|
Grants permission to add additional customer communication to an Support case, including a set of email addresses to copy on the communication. |
|
|
Grants permission to create a case. |
|
|
Grants permission to retrieve an attachment on a case. |
|
|
Grants permission to allow secondary services to read Support case attributes. *This is used internally by Support Center to get attributes tagged on your case. |
|
|
Grants permission to return a list of Support cases that matches a case ID or case IDs. |
|
|
Grants permission to get a single communication and attachments for a single AWS Support case. |
|
|
Grants permission to return communications and attachments for one or more Support cases. |
|
|
Grants permission to return a list of CreateCaseOption types along with the corresponding supported hours and language availability. |
|
|
Grants permission to return issue types for Support cases. This is used internally by Support Center to get available issue types for your account. |
|
|
Grants permission to return the current list of AWS services and a list of service categories for each service. You then use service names and categories to create a case. Each AWS service has its own set of categories. |
|
|
Grants permission to return the list of severity levels that you can assign to a Support case. |
|
|
Grants permission to return a list of supported languages for a specified categoryCode, issueType and serviceCode. |
|
|
Grants permission to return the support level for an AWS account identifier. This is used internally by Support Center to identify your support level. |
|
|
Grants permission to return the refresh status of the AWS Trusted Advisor checks that have the specified check IDs. |
|
|
Grants permission to return the results of the AWS Trusted Advisor check that has the specified check ID. |
|
|
Grants permission to return information about all available AWS Trusted Advisor checks, including the name, ID, category, description, and metadata. |
|
|
Grants permission to return the results for the AWS Trusted Advisor check summaries for the check IDs that you specified. |
|
|
Grants permission to retrieve details about a specific interaction by its unique identifier. This is used internally by Support Center to retrieve personalized recommendations. |
|
|
Grants permission to initiate a call on Support Center. This is used internally by Support Center to start a call on your behalf. |
|
|
Grants permission to initiate a chat on Support Center. This is used internally by Support Center to start a chat on your behalf. |
|
|
Grants permission to allow secondary services to attach attributes to Support cases. This is used internally by Support Center to add operational tags to your Support cases. |
|
|
Grants permission to rate a Support case communication. |
|
|
Grants permission to refresh the AWS Trusted Advisor check that you specify using the check ID. |
|
|
Grants permission to resolve a Support case. |
|
|
Grants permission to return a list of Support cases that matches the given inputs. This is used internally by Support Center to find searched cases. |
|
|
Grants permission to initiate a new interaction to receive personalized troubleshooting assistance for account and technical issues. This is used internally by Support Center to initiate the troubleshooting process. |
IAM
By default, IAM users can't access the Support Center. You can use IAM to create individual users or groups. Then, you attach IAM policies to these entities, so that they have permission to perform actions and access resources, such as to open Support Center cases and use the Support API.
After you create IAM users, you can give those users individual passwords and an account-specific sign-in page. They can then sign in to your AWS account and work in the Support Center. IAM users who have AWS Support access can see all cases that are created for the account.
For more information, see Sign in to the AWS Management Console as an IAM user in the IAM User Guide.
The easiest way to grant permissions is to attach the AWS managed policy AWSSupportAccessResource element is
always set to *. You can't allow or deny access to specific support cases.
Example : Allow access to all Support actions
The AWS managed policy AWSSupportAccess
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["support:*"],
"Resource": "*"
}
]
}For more information about how to attach the AWSSupportAccess policy
to your entities, see Adding IAM identity permissions (console) in the
IAM User Guide.
Example : Allow access to all actions except the ResolveCase action
You can also create customer managed policies in IAM to specify what actions to allow or deny. The following policy statement allows an IAM user to perform all actions in Support except resolve a case.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "support:*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "support:ResolveCase",
"Resource": "*"
}]
}For more information about how to create a customer managed IAM policy, see Creating IAM policies (console) in the IAM User Guide.
If the user or group already has a policy, you can add the AWS Support-specific policy statement to that policy.
Important
-
If you can't view cases in the Support Center, make sure that you have the required permissions. You might need to contact your IAM administrator. For more information, see Identity and access management for AWS Support.
Access to AWS Trusted Advisor
In the AWS Management Console, a separate trustedadvisor IAM namespace controls
access to Trusted Advisor. In the Support API, the support IAM namespace controls
access to Trusted Advisor. For more information, see Manage access to AWS Trusted Advisor.
