Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS IAM Identity Center

AWS IAM Identity Center (service prefix: sso) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS IAM Identity Center
Actions defined by AWS IAM Identity Center
Resource types defined by AWS IAM Identity Center
Condition keys for AWS IAM Identity Center

API operations defined by AWS IAM Identity Center

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Access level
AddRegion	sso-admin	sso:AddRegion	Write
AttachCustomerManagedPolicyReferenceToPermissionSet	sso-admin	sso:AttachCustomerManagedPolicyReferenceToPermissionSet	Permissions management, Write
AttachManagedPolicyToPermissionSet	sso-admin	sso:AttachManagedPolicyToPermissionSet	Permissions management, Write
AttachManagedPolicyToPermissionSet	sso-admin	sso:PutPermissionsPolicy	Permissions management, Write
CreateAccountAssignment	sso-admin	sso:AssociateProfile	Write
		sso:CreateAccountAssignment	Write
		sso:CreateApplicationInstance	Write
		sso:CreateProfile	Write
		sso:CreateTrust	Write
		sso:GetApplicationInstance	Read
		sso:GetProfile	Read
		sso:GetTrust	Read
		sso:UpdateProfile	Write
		sso:UpdateTrust	Write
CreateApplication	sso-admin	sso:CreateApplication	Write
		sso:CreateApplicationInstance	Write
		sso:CreateManagedApplicationInstance	Write
		sso:PutApplicationAssignmentConfiguration	Write
		sso:TagResource	Tagging, Write
CreateApplicationAssignment	sso-admin	sso:AssociateProfile	Write
CreateApplicationAssignment	sso-admin	sso:CreateApplicationAssignment	Write
CreateInstance	sso-admin	sso:CreateInstance	Write
CreateInstance	sso-admin	sso:TagResource	Tagging, Write
CreateInstanceAccessControlAttributeConfiguration	sso-admin	sso:CreateInstanceAccessControlAttributeConfiguration	Write
CreatePermissionSet	sso-admin	sso:CreatePermissionSet	Write
CreatePermissionSet	sso-admin	sso:TagResource	Tagging, Write
CreateTrustedTokenIssuer	sso-admin	sso:CreateTrustedTokenIssuer	Write
CreateTrustedTokenIssuer	sso-admin	sso:TagResource	Tagging, Write
DeleteAccountAssignment	sso-admin	sso:DeleteAccountAssignment	Write
DeleteAccountAssignment	sso-admin	sso:DeleteProfile	Write
DeleteApplication	sso-admin	sso:DeleteApplication	Write
		sso:DeleteApplicationInstance	Write
		sso:DeleteManagedApplicationInstance	Write
DeleteApplicationAccessScope	sso-admin	sso:DeleteApplicationAccessScope	Write
DeleteApplicationAssignment	sso-admin	sso:DeleteApplicationAssignment	Write
DeleteApplicationAssignment	sso-admin	sso:DisassociateProfile	Write
DeleteApplicationAuthenticationMethod	sso-admin	sso:DeleteApplicationAuthenticationMethod	Write
DeleteApplicationGrant	sso-admin	sso:DeleteApplicationGrant	Write
DeleteInlinePolicyFromPermissionSet	sso-admin	sso:DeleteInlinePolicyFromPermissionSet	Write
DeleteInstance	sso-admin	sso:DeleteInstance	Write
DeleteInstance	sso-admin	sso:StartSSO	Write
DeleteInstanceAccessControlAttributeConfiguration	sso-admin	sso:DeleteInstanceAccessControlAttributeConfiguration	Write
DeletePermissionSet	sso-admin	sso:DeletePermissionSet	Write
DeletePermissionsBoundaryFromPermissionSet	sso-admin	sso:DeletePermissionsBoundaryFromPermissionSet	Permissions management, Write
DeleteTrustedTokenIssuer	sso-admin	sso:DeleteTrustedTokenIssuer	Write
DescribeAccountAssignmentCreationStatus	sso-admin	sso:DescribeAccountAssignmentCreationStatus	Read
DescribeAccountAssignmentDeletionStatus	sso-admin	sso:DescribeAccountAssignmentDeletionStatus	Read
DescribeApplication	sso-admin	sso:DescribeApplication	Read
		sso:GetApplicationInstance	Read
		sso:GetManagedApplicationInstance	Read
DescribeApplicationAssignment	sso-admin	sso:DescribeApplicationAssignment	Read
DescribeApplicationProvider	sso-admin	sso:DescribeApplicationProvider	Read
DescribeApplicationProvider	sso-admin	sso:GetApplicationTemplate	Read
DescribeInstance	sso-admin	sso:DescribeInstance	Read
		sso:GetSharedSsoConfiguration	Read
		sso:ListDirectoryAssociations	Read
DescribeInstanceAccessControlAttributeConfiguration	sso-admin	sso:DescribeInstanceAccessControlAttributeConfiguration	Read
DescribePermissionSet	sso-admin	sso:DescribePermissionSet	Read
DescribePermissionSet	sso-admin	sso:GetPermissionSet	Read
DescribePermissionSetProvisioningStatus	sso-admin	sso:DescribePermissionSetProvisioningStatus	Read
DescribeRegion	sso-admin	sso:DescribeRegion	Read
DescribeTrustedTokenIssuer	sso-admin	sso:DescribeTrustedTokenIssuer	Read
DetachCustomerManagedPolicyReferenceFromPermissionSet	sso-admin	sso:DetachCustomerManagedPolicyReferenceFromPermissionSet	Permissions management, Write
DetachManagedPolicyFromPermissionSet	sso-admin	sso:DetachManagedPolicyFromPermissionSet	Permissions management, Write
GetApplicationAccessScope	sso-admin	sso:GetApplicationAccessScope	Read
GetApplicationAssignmentConfiguration	sso-admin	sso:GetApplicationAssignmentConfiguration	Read
GetApplicationAuthenticationMethod	sso-admin	sso:GetApplicationAuthenticationMethod	Read
GetApplicationGrant	sso-admin	sso:GetApplicationGrant	Read
GetApplicationSessionConfiguration	sso-admin	sso:GetApplicationSessionConfiguration	Read
GetInlinePolicyForPermissionSet	sso-admin	sso:GetInlinePolicyForPermissionSet	Read
GetPermissionsBoundaryForPermissionSet	sso-admin	sso:GetPermissionsBoundaryForPermissionSet	Read
ListAccountAssignmentCreationStatus	sso-admin	sso:ListAccountAssignmentCreationStatus	List
ListAccountAssignmentDeletionStatus	sso-admin	sso:ListAccountAssignmentDeletionStatus	List
ListAccountAssignments	sso-admin	sso:ListAccountAssignments	List
ListAccountAssignments	sso-admin	sso:ListProfileAssociations	Read
ListAccountAssignmentsForPrincipal	sso-admin	sso:ListAccountAssignmentsForPrincipal	List
ListAccountsForProvisionedPermissionSet	sso-admin	sso:GetApplicationInstance	Read
		sso:ListAccountsForProvisionedPermissionSet	List
		sso:ListApplicationInstances	List
ListApplicationAccessScopes	sso-admin	sso:ListApplicationAccessScopes	List
ListApplicationAssignments	sso-admin	sso:ListApplicationAssignments	List
ListApplicationAssignments	sso-admin	sso:ListProfileAssociations	Read
ListApplicationAssignmentsForPrincipal	sso-admin	sso:ListApplicationAssignmentsForPrincipal	List
ListApplicationAuthenticationMethods	sso-admin	sso:ListApplicationAuthenticationMethods	List
ListApplicationGrants	sso-admin	sso:ListApplicationGrants	List
ListApplicationProviders	sso-admin	sso:GetApplicationTemplate	Read
		sso:ListApplicationProviders	List
		sso:ListApplicationTemplates	List
ListApplications	sso-admin	sso:GetApplicationInstance	Read
		sso:ListApplicationInstances	List
		sso:ListApplicationProviders	List
		sso:ListApplications	List
ListCustomerManagedPolicyReferencesInPermissionSet	sso-admin	sso:ListCustomerManagedPolicyReferencesInPermissionSet	List
ListInstances	sso-admin	sso:ListInstances	List
ListManagedPoliciesInPermissionSet	sso-admin	sso:ListManagedPoliciesInPermissionSet	List
ListPermissionSetProvisioningStatus	sso-admin	sso:ListPermissionSetProvisioningStatus	List
ListPermissionSets	sso-admin	sso:ListPermissionSets	List
ListPermissionSetsProvisionedToAccount	sso-admin	sso:GetProfile	Read
		sso:ListPermissionSetsProvisionedToAccount	List
		sso:ListProfiles	List
ListRegions	sso-admin	sso:ListRegions	List
ListTagsForResource	sso-admin	sso:ListTagsForResource	Read
ListTrustedTokenIssuers	sso-admin	sso:ListTrustedTokenIssuers	List
ProvisionPermissionSet	sso-admin	sso:ProvisionPermissionSet	Write
PutApplicationAccessScope	sso-admin	sso:PutApplicationAccessScope	Write
PutApplicationAssignmentConfiguration	sso-admin	sso:PutApplicationAssignmentConfiguration	Write
PutApplicationAuthenticationMethod	sso-admin	sso:CreateManagedApplicationInstance	Write
PutApplicationAuthenticationMethod	sso-admin	sso:PutApplicationAuthenticationMethod	Write
PutApplicationGrant	sso-admin	sso:CreateManagedApplicationInstance	Write
PutApplicationGrant	sso-admin	sso:PutApplicationGrant	Write
PutApplicationSessionConfiguration	sso-admin	sso:PutApplicationSessionConfiguration	Write
PutInlinePolicyToPermissionSet	sso-admin	sso:PutInlinePolicyToPermissionSet	Write
PutInlinePolicyToPermissionSet	sso-admin	sso:PutPermissionsPolicy	Permissions management, Write
PutPermissionsBoundaryToPermissionSet	sso-admin	sso:PutPermissionsBoundaryToPermissionSet	Permissions management, Write
RemoveRegion	sso-admin	sso:RemoveRegion	Write
TagResource	sso-admin	sso:TagResource	Tagging, Write
UntagResource	sso-admin	sso:UntagResource	Tagging, Write
UpdateApplication	sso-admin	sso:PutApplicationAssignmentConfiguration	Write
		sso:UpdateApplication	Write
		sso:UpdateApplicationInstanceDisplayData	Write
		sso:UpdateApplicationInstanceStatus	Write
		sso:UpdateManagedApplicationInstanceStatus	Write
UpdateInstance	sso-admin	sso:UpdateInstance	Write
UpdateInstanceAccessControlAttributeConfiguration	sso-admin	sso:UpdateInstanceAccessControlAttributeConfiguration	Write
UpdatePermissionSet	sso-admin	sso:UpdatePermissionSet	Permissions management, Write
UpdateTrustedTokenIssuer	sso-admin	sso:UpdateTrustedTokenIssuer	Write

Actions defined by AWS IAM Identity Center

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddRegion	Grants permission to add a region to an IAM Identity Center instance	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
AssociateDirectory	Grants permission to connect a directory to be used by AWS IAM Identity Center			Write
AssociateProfile	Grants permission to create an association between a directory user or group and a profile			Write
AttachCustomerManagedPolicyReferenceToPermissionSet	Grants permission to attach a customer managed policy reference to a permission set	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Permissions management, Write
AttachCustomerManagedPolicyReferenceToPermissionSet		PermissionSet*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Permissions management, Write
AttachManagedPolicyToPermissionSet	Grants permission to attach an AWS managed policy to a permission set	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Permissions management, Write
AttachManagedPolicyToPermissionSet		PermissionSet*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Permissions management, Write
CreateAccountAssignment	Grants permission to assign access to a Principal for a specified AWS account using a specified permission set	Account*		Write
		Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion
		PermissionSet*	aws:ResourceTag/${TagKey} sso:PrimaryRegion
CreateApplication	Grants permission to create an application	Application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys sso:ApplicationAccount sso:PrimaryRegion	Write
		ApplicationProvider*	aws:RequestTag/${TagKey} aws:TagKeys
		Instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys sso:PrimaryRegion
CreateApplicationAssignment	Grants permission to create an application assignment	Application*	aws:ResourceTag/${TagKey} sso:ApplicationAccount sso:PrimaryRegion	Write
CreateApplicationInstance	Grants permission to add an application instance to AWS IAM Identity Center			Write
CreateApplicationInstanceCertificate	Grants permission to add a new certificate for an application instance			Write
CreateInstance	Grants permission to create an identity center instance	Instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys sso:PrimaryRegion	Write
CreateInstanceAccessControlAttributeConfiguration	Grants permission to enable the instance for ABAC and specify the attributes	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
CreateManagedApplicationInstance	Grants permission to add a managed application instance to AWS IAM Identity Center			Write
CreatePermissionSet	Grants permission to create a permission set	Instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys sso:PrimaryRegion	Write
CreatePermissionSet	Grants permission to create a permission set	PermissionSet*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys sso:PrimaryRegion	Write
CreateProfile	Grants permission to create a profile for an application instance			Write
CreateTrust	Grants permission to create a federation trust in a target account			Write
CreateTrustedTokenIssuer	Grants permission to create a trusted token issuer for an instance	Instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys sso:PrimaryRegion	Write
CreateTrustedTokenIssuer		TrustedTokenIssuer*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys sso:PrimaryRegion	Write
DeleteAccountAssignment	Grants permission to delete a Principal's access from a specified AWS account using a specified permission set	Account*		Write
		Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion
		PermissionSet*	aws:ResourceTag/${TagKey} sso:PrimaryRegion
DeleteApplication	Grants permission to delete an application	Application*	aws:ResourceTag/${TagKey} sso:ApplicationAccount sso:PrimaryRegion	Write
DeleteApplicationAccessScope	Grants permission to delete an access scope to an application	Application*	aws:ResourceTag/${TagKey} sso:ApplicationAccount sso:PrimaryRegion	Write
DeleteApplicationAssignment	Grants permission to delete an application assignment	Application*	aws:ResourceTag/${TagKey} sso:ApplicationAccount sso:PrimaryRegion	Write
DeleteApplicationAuthenticationMethod	Grants permission to delete an authentication method to an application	Application*	aws:ResourceTag/${TagKey} sso:ApplicationAccount sso:PrimaryRegion	Write
DeleteApplicationGrant	Grants permission to delete a grant from an application	Application*	aws:ResourceTag/${TagKey} sso:ApplicationAccount sso:PrimaryRegion	Write
DeleteApplicationInstance	Grants permission to delete the application instance			Write
DeleteApplicationInstanceCertificate	Grants permission to delete an inactive or expired certificate from the application instance			Write
DeleteInlinePolicyFromPermissionSet	Grants permission to delete the inline policy from a specified permission set	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
DeleteInlinePolicyFromPermissionSet		PermissionSet*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
DeleteInstance	Grants permission to delete an identity center instance	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
DeleteInstanceAccessControlAttributeConfiguration	Grants permission to disable ABAC and remove the attributes list for the instance	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
DeleteManagedApplicationInstance	Grants permission to delete the managed application instance			Write
DeletePermissionSet	Grants permission to delete a permission set	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
DeletePermissionSet	Grants permission to delete a permission set	PermissionSet*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
DeletePermissionsBoundaryFromPermissionSet	Grants permission to remove permissions boundary from a permission set	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Permissions management, Write
DeletePermissionsBoundaryFromPermissionSet		PermissionSet*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Permissions management, Write
DeleteProfile	Grants permission to delete the profile for an application instance			Write
DeleteTrustedTokenIssuer	Grants permission to delete a trusted token issuer for an instance	TrustedTokenIssuer*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Write
DescribeAccountAssignmentCreationStatus	Grants permission to describe the status of the assignment creation request	Instance*	aws:ResourceTag/${TagKey} sso:PrimaryRegion	Read
DescribeAccountAssignmentDeletionStatus	Grants permission to describe the status of an assignment deletion request	Instance*