Actions, resources, and condition keys for AWS IAM Identity Center (successor to AWS Single Sign-On)

AWS IAM Identity Center (successor to AWS Single Sign-On) (service prefix: sso) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by AWS IAM Identity Center (successor to AWS Single Sign-On)
Resource types defined by AWS IAM Identity Center (successor to AWS Single Sign-On)
Condition keys for AWS IAM Identity Center (successor to AWS Single Sign-On)

Actions defined by AWS IAM Identity Center (successor to AWS Single Sign-On)

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AssociateDirectory	Grants permission to connect a directory to be used by AWS IAM Identity Center	Write			ds:AuthorizeApplication
AssociateProfile	Grants permission to create an association between a directory user or group and a profile	Write
AttachCustomerManagedPolicyReferenceToPermissionSet	Grants permission to attach a customer managed policy reference to a permission set	Permissions management	Instance*
AttachCustomerManagedPolicyReferenceToPermissionSet		Permissions management	PermissionSet*
AttachManagedPolicyToPermissionSet	Grants permission to attach an AWS managed policy to a permission set	Permissions management	Instance*
AttachManagedPolicyToPermissionSet		Permissions management	PermissionSet*
CreateAccountAssignment	Grants permission to assign access to a Principal for a specified AWS account using a specified permission set	Write	Account*
			Instance*
			PermissionSet*
CreateApplication	Grants permission to create an application	Write	ApplicationProvider*
			Instance*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateApplicationAssignment	Grants permission to create an application assignment	Write	Application*
CreateApplicationAssignment	Grants permission to create an application assignment	Write		sso:ApplicationAccount
CreateApplicationInstance	Grants permission to add an application instance to AWS IAM Identity Center	Write
CreateApplicationInstanceCertificate	Grants permission to add a new certificate for an application instance	Write
CreateInstance	Grants permission to create an identity center instance	Write	Instance*		iam:CreateServiceLinkedRole organizations:DescribeOrganization
CreateInstance	Grants permission to create an identity center instance	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateInstanceAccessControlAttributeConfiguration	Grants permission to enable the instance for ABAC and specify the attributes	Write	Instance*		iam:AttachRolePolicy iam:CreateRole iam:DeleteRole iam:DeleteRolePolicy iam:DetachRolePolicy iam:GetRole iam:ListAttachedRolePolicies iam:ListRolePolicies iam:PutRolePolicy iam:UpdateAssumeRolePolicy
CreateManagedApplicationInstance	Grants permission to add a managed application instance to AWS IAM Identity Center	Write
CreatePermissionSet	Grants permission to create a permission set	Write	Instance*
			PermissionSet*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateProfile	Grants permission to create a profile for an application instance	Write
CreateTrust	Grants permission to create a federation trust in a target account	Write
CreateTrustedTokenIssuer	Grants permission to create a trusted token issuer for an instance	Write	Instance*
CreateTrustedTokenIssuer		Write		aws:RequestTag/${TagKey} aws:TagKeys
DeleteAccountAssignment	Grants permission to delete a Principal's access from a specified AWS account using a specified permission set	Write	Account*
			Instance*
			PermissionSet*
DeleteApplication	Grants permission to delete an application	Write	Application*
DeleteApplication	Grants permission to delete an application	Write		sso:ApplicationAccount
DeleteApplicationAccessScope	Grants permission to delete an access scope to an application	Write	Application*
DeleteApplicationAccessScope		Write		sso:ApplicationAccount
DeleteApplicationAssignment	Grants permission to delete an application assignment	Write	Application*
DeleteApplicationAssignment	Grants permission to delete an application assignment	Write		sso:ApplicationAccount
DeleteApplicationAuthenticationMethod	Grants permission to delete an authentication method to an application	Write	Application*
DeleteApplicationAuthenticationMethod		Write		sso:ApplicationAccount
DeleteApplicationGrant	Grants permission to delete a grant from an application	Write	Application*
DeleteApplicationGrant	Grants permission to delete a grant from an application	Write		sso:ApplicationAccount
DeleteApplicationInstance	Grants permission to delete the application instance	Write
DeleteApplicationInstanceCertificate	Grants permission to delete an inactive or expired certificate from the application instance	Write
DeleteInlinePolicyFromPermissionSet	Grants permission to delete the inline policy from a specified permission set	Write	Instance*
DeleteInlinePolicyFromPermissionSet		Write	PermissionSet*
DeleteInstance	Grants permission to delete an identity center instance	Write	Instance*
DeleteInstanceAccessControlAttributeConfiguration	Grants permission to disable ABAC and remove the attributes list for the instance	Write	Instance*
DeleteManagedApplicationInstance	Grants permission to delete the managed application instance	Write
DeletePermissionSet	Grants permission to delete a permission set	Write	Instance*
DeletePermissionSet	Grants permission to delete a permission set	Write	PermissionSet*
DeletePermissionsBoundaryFromPermissionSet	Grants permission to remove permissions boundary from a permission set	Permissions management	Instance*
DeletePermissionsBoundaryFromPermissionSet		Permissions management	PermissionSet*
DeletePermissionsPolicy	Grants permission to delete the permission policy associated with a permission set	Permissions management
DeleteProfile	Grants permission to delete the profile for an application instance	Write
DeleteTrustedTokenIssuer	Grants permission to delete a trusted token issuer for an instance	Write	TrustedTokenIssuer*
DescribeAccountAssignmentCreationStatus	Grants permission to describe the status of the assignment creation request	Read	Instance*
DescribeAccountAssignmentDeletionStatus	Grants permission to describe the status of an assignment deletion request	Read	Instance*
DescribeApplication	Grants permission to obtain information about an application	Read	Application*
DescribeApplication		Read		sso:ApplicationAccount
DescribeApplicationAssignment	Grants permission to retrieve an application assignment	Read	Application*
DescribeApplicationAssignment	Grants permission to retrieve an application assignment	Read		sso:ApplicationAccount
DescribeApplicationProvider	Grants permission to describe an application provider	Read	ApplicationProvider*
DescribeDirectories	Grants permission to obtain information about the directories for this account	Read
DescribeInstance	Grants permission to obtain information about an identity center instance	Read	Instance*
DescribeInstanceAccessControlAttributeConfiguration	Grants permission to get the list of attributes used by the instance for ABAC	Read	Instance*
DescribePermissionSet	Grants permission to describe a permission set	Read	Instance*
DescribePermissionSet	Grants permission to describe a permission set	Read	PermissionSet*
DescribePermissionSetProvisioningStatus	Grants permission to describe the status for the given Permission Set Provisioning request	Read	Instance*
DescribePermissionsPolicies	Grants permission to retrieve all the permissions policies associated with a permission set	Read
DescribeRegisteredRegions	Grants permission to obtain the regions where your organization has enabled AWS IAM Identity Center	Read
DescribeTrustedTokenIssuer	Grants permission to describe a trusted token issuer for an instance	Read	TrustedTokenIssuer*
DescribeTrusts	Grants permission to obtain information about the trust relationships for this account	Read
DetachCustomerManagedPolicyReferenceFromPermissionSet	Grants permission to detach a customer managed policy reference from a permission set	Permissions management	Instance*
DetachCustomerManagedPolicyReferenceFromPermissionSet		Permissions management	PermissionSet*
DetachManagedPolicyFromPermissionSet	Grants permission to detach the attached AWS managed policy from the specified permission set	Permissions management	Instance*
DetachManagedPolicyFromPermissionSet		Permissions management	PermissionSet*
DisassociateDirectory	Grants permission to disassociate a directory to be used by AWS IAM Identity Center	Write			ds:UnauthorizeApplication
DisassociateProfile	Grants permission to disassociate a directory user or group from a profile	Write
GetApplicationAccessScope	Grants permission to get an access scope to an application	Read	Application*
GetApplicationAccessScope	Grants permission to get an access scope to an application	Read		sso:ApplicationAccount
GetApplicationAssignmentConfiguration	Grants permission to read assignment configurations for an application	Read	Application*
GetApplicationAssignmentConfiguration		Read		sso:ApplicationAccount
GetApplicationAuthenticationMethod	Grants permission to get an authentication method to an application	Read	Application*
GetApplicationAuthenticationMethod		Read		sso:ApplicationAccount
GetApplicationGrant	Grants permission to obtain details about a grant belonging to an application	Read	Application*
GetApplicationGrant		Read		sso:ApplicationAccount
GetApplicationInstance	Grants permission to retrieve details for an application instance	Read
GetApplicationTemplate	Grants permission to retrieve application template details	Read
GetInlinePolicyForPermissionSet	Grants permission to obtain the inline policy assigned to the permission set	Read	Instance*
GetInlinePolicyForPermissionSet		Read	PermissionSet*
GetManagedApplicationInstance	Grants permission to retrieve details for an application instance	Read
GetMfaDeviceManagementForDirectory	Grants permission to retrieve Mfa Device Management settings for the directory	Read
GetPermissionSet	Grants permission to retrieve details of a permission set	Read
GetPermissionsBoundaryForPermissionSet	Grants permission to get permissions boundary for a permission set	Read	Instance*
GetPermissionsBoundaryForPermissionSet		Read	PermissionSet*
GetPermissionsPolicy	Grants permission to retrieve all permission policies associated with a permission set	Read			sso:DescribePermissionsPolicies
GetProfile	Grants permission to retrieve a profile for an application instance	Read
GetSSOStatus	Grants permission to check if AWS IAM Identity Center is enabled	Read
GetSharedSsoConfiguration	Grants permission to retrieve shared configuration for the current SSO instance	Read
GetSsoConfiguration	Grants permission to retrieve configuration for the current SSO instance	Read
GetTrust	Grants permission to retrieve the federation trust in a target account	Read
ImportApplicationInstanceServiceProviderMetadata	Grants permission to update the application instance by uploading an application SAML metadata file provided by the service provider	Write
ListAccountAssignmentCreationStatus	Grants permission to list the status of the AWS account assignment creation requests for a specified SSO instance	List	Instance*
ListAccountAssignmentDeletionStatus	Grants permission to list the status of the AWS account assignment deletion requests for a specified SSO instance	List	Instance*
ListAccountAssignments	Grants permission to list the assignee of the specified AWS account with the specified permission set	List	Account*
			Instance*
			PermissionSet*
ListAccountAssignmentsForPrincipal	Grants permission to list accounts assigned to user or group	List	Instance*
ListAccountsForProvisionedPermissionSet	Grants permission to list all the AWS accounts where the specified permission set is provisioned	List	Instance*
ListAccountsForProvisionedPermissionSet		List	PermissionSet*
ListApplicationAccessScopes	Grants permission to list access scopes to an application	List	Application*
ListApplicationAccessScopes	Grants permission to list access scopes to an application	List		sso:ApplicationAccount
ListApplicationAssignments	Grants permission to list application assignments	List	Application*
ListApplicationAssignments	Grants permission to list application assignments	List		sso:ApplicationAccount
ListApplicationAssignmentsForPrincipal	Grants permission to list applications assigned to user or group	List	Instance*
ListApplicationAssignmentsForPrincipal		List		sso:ApplicationAccount
ListApplicationAuthenticationMethods	Grants permission to list authentication methods to an application	List	Application*
ListApplicationAuthenticationMethods		List		sso:ApplicationAccount
ListApplicationGrants	Grants permission to list grants from an application	List	Application*
ListApplicationGrants	Grants permission to list grants from an application	List		sso:ApplicationAccount
ListApplicationInstanceCertificates	Grants permission to retrieve all of the certificates for a given application instance	Read
ListApplicationInstances	Grants permission to retrieve all application instances	List			sso:GetApplicationInstance
ListApplicationProviders	Grants permission to list application providers	List	ApplicationProvider*
ListApplicationTemplates	Grants permission to retrieve all supported application templates	List			sso:GetApplicationTemplate
ListApplications	Grants permission to retrieve all applications associated with the instance of IAM Identity Center	List
ListCustomerManagedPolicyReferencesInPermissionSet	Grants permission to list the customer managed policy references that are attached to a permission set	List	Instance*
ListCustomerManagedPolicyReferencesInPermissionSet		List	PermissionSet*
ListDirectoryAssociations	Grants permission to retrieve details about the directory connected to AWS IAM Identity Center	Read
ListInstances	Grants permission to list the SSO Instances that the caller has access to	List
ListManagedPoliciesInPermissionSet	Grants permission to list the AWS managed policies that are attached to a specified permission set	List	Instance*
ListManagedPoliciesInPermissionSet		List	PermissionSet*
ListPermissionSetProvisioningStatus	Grants permission to list the status of the Permission Set Provisioning requests for a specified SSO instance	List	Instance*
ListPermissionSets	Grants permission to retrieve all permission sets	List	Instance*
ListPermissionSetsProvisionedToAccount	Grants permission to list all the permission sets that are provisioned to a specified AWS account	List	Account*
ListPermissionSetsProvisionedToAccount		List	Instance*
ListProfileAssociations	Grants permission to retrieve the directory user or group associated with the profile	Read
ListProfiles	Grants permission to retrieve all profiles for an application instance	List			sso:GetProfile
ListTagsForResource	Grants permission to list the tags that are attached to a specified resource	Read	Application
			Instance
			PermissionSet
			TrustedTokenIssuer
ListTrustedTokenIssuers	Grants permission to list trusted token issuers for an instance	List	Instance*
ProvisionPermissionSet	Grants permission to provision a specified permission set to the specified target	Write	Account*
			Instance*
			PermissionSet*
PutApplicationAccessScope	Grants permission to create/update an access scope to an application	Write	Application*
PutApplicationAccessScope		Write		sso:ApplicationAccount
PutApplicationAssignmentConfiguration	Grants permission to add assignment configurations to an application	Write	Application*
PutApplicationAssignmentConfiguration		Write		sso:ApplicationAccount
PutApplicationAuthenticationMethod	Grants permission to create/update an authentication method to an application	Write	Application*
PutApplicationAuthenticationMethod		Write		sso:ApplicationAccount
PutApplicationGrant	Grants permission to create/update a grant to an application	Write	Application*
PutApplicationGrant		Write		sso:ApplicationAccount
PutInlinePolicyToPermissionSet	Grants permission to attach an IAM inline policy to a permission set	Write	Instance*
PutInlinePolicyToPermissionSet		Write	PermissionSet*
PutMfaDeviceManagementForDirectory	Grants permission to put Mfa Device Management settings for the directory	Write
PutPermissionsBoundaryToPermissionSet	Grants permission to add permissions boundary to a permission set	Permissions management	Instance*
PutPermissionsBoundaryToPermissionSet		Permissions management	PermissionSet*
PutPermissionsPolicy	Grants permission to add a policy to a permission set	Permissions management
SearchGroups	Grants permission to search for groups within the associated directory	Read			ds:DescribeDirectories
SearchUsers	Grants permission to search for users within the associated directory	Read			ds:DescribeDirectories
StartSSO	Grants permission to initialize AWS IAM Identity Center	Write			organizations:DescribeOrganization organizations:EnableAWSServiceAccess
TagResource	Grants permission to associate a set of tags with a specified resource	Tagging	Application
			Instance
			PermissionSet
			TrustedTokenIssuer
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to disassociate a set of tags from a specified resource	Tagging	Application
			Instance
			PermissionSet
			TrustedTokenIssuer
				aws:TagKeys
UpdateApplication	Grants permission to update an application	Write	Application*
UpdateApplication	Grants permission to update an application	Write		sso:ApplicationAccount
UpdateApplicationInstanceActiveCertificate	Grants permission to set a certificate as the active one for this application instance	Write
UpdateApplicationInstanceDisplayData	Grants permission to update display data of an application instance	Write
UpdateApplicationInstanceResponseConfiguration	Grants permission to update federation response configuration for the application instance	Write
UpdateApplicationInstanceResponseSchemaConfiguration	Grants permission to update federation response schema configuration for the application instance	Write
UpdateApplicationInstanceSecurityConfiguration	Grants permission to update security details for the application instance	Write
UpdateApplicationInstanceServiceProviderConfiguration	Grants permission to update service provider related configuration for the application instance	Write
UpdateApplicationInstanceStatus	Grants permission to update the status of an application instance	Write
UpdateDirectoryAssociation	Grants permission to update the user attribute mappings for your connected directory	Write
UpdateInstance	Grants permission to update an identity center instance	Write	Instance*
UpdateInstanceAccessControlAttributeConfiguration	Grants permission to update the attributes to use with the instance for ABAC	Write	Instance*
UpdateManagedApplicationInstanceStatus	Grants permission to update the status of a managed application instance	Write
UpdatePermissionSet	Grants permission to update the permission set	Permissions management	Instance*
UpdatePermissionSet	Grants permission to update the permission set	Permissions management	PermissionSet*
UpdateProfile	Grants permission to update the profile for an application instance	Write
UpdateSSOConfiguration	Grants permission to update the configuration for the current SSO instance	Write
UpdateTrust	Grants permission to update the federation trust in a target account	Write
UpdateTrustedTokenIssuer	Grants permission to update a trusted token issuer for an instance	Write	TrustedTokenIssuer*

Resource types defined by AWS IAM Identity Center (successor to AWS Single Sign-On)

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
PermissionSet	`arn:${Partition}:sso:::permissionSet/${InstanceId}/${PermissionSetId}`	aws:ResourceTag/${TagKey}
Account	`arn:${Partition}:sso:::account/${AccountId}`
Instance	`arn:${Partition}:sso:::instance/${InstanceId}`	aws:ResourceTag/${TagKey}
Application	`arn:${Partition}:sso::${AccountId}:application/${InstanceId}/${ApplicationId}`	aws:ResourceTag/${TagKey} sso:ApplicationAccount
TrustedTokenIssuer	`arn:${Partition}:sso::${AccountId}:trustedTokenIssuer/${InstanceId}/${TrustedTokenIssuerId}`	aws:ResourceTag/${TagKey}
ApplicationProvider	`arn:${Partition}:sso::aws:applicationProvider/${ApplicationProviderId}`

Condition keys for AWS IAM Identity Center (successor to AWS Single Sign-On)

AWS IAM Identity Center (successor to AWS Single Sign-On) defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
sso:ApplicationAccount	Filters access by the account which creates the application	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS IAM Access Analyzer

AWS IAM Identity Center (successor to AWS Single Sign-On) directory