Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Signin

AWS Signin (service prefix: signin) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Signin

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateOAuth2Token	signin:CreateOAuth2Token	Read
CreateOAuth2TokenWithIAM	signin:CreateOAuth2Token	Read
DeleteConsoleAuthorizationConfiguration	signin:DeleteConsoleAuthorizationConfiguration	Write
DeleteResourcePermissionStatement	signin:DeleteResourcePermissionStatement	Write
GetConsoleAuthorizationConfiguration	signin:GetConsoleAuthorizationConfiguration	Read
GetResourcePolicy	signin:GetResourcePolicy	Read
IntrospectOAuth2TokenWithIAM	signin:IntrospectOAuth2Token	Read
ListResourcePermissionStatements	signin:ListResourcePermissionStatements	List
PutConsoleAuthorizationConfiguration	signin:PutConsoleAuthorizationConfiguration	Write
PutResourcePermissionStatement	signin:PutResourcePermissionStatement	Write
RevokeOAuth2TokenWithIAM	signin:RevokeOAuth2Token	Write

Actions defined by AWS Signin

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
Authenticate	Grants permission to authenticate to the AWS Management Console	console*	signin:PrincipalArn	Read
AuthorizeOAuth2Access	Grants permission to authenticate through a browser and obtain an OAuth 2.0 authorization code for credential exchange	console*		Read
		oauth2-public-client-localhost*	signin:OAuthClientId signin:OAuthRedirectUri
		oauth2-public-client-remote*	signin:OAuthClientId signin:OAuthRedirectUri
		oauth2-resource-service-principal*	signin:OAuthClientId signin:OAuthRedirectUri
CreateOAuth2PublicClient	Grants permission to dynamically register an OAuth 2.0 public client for use with AWS Sign-In	oauth2-public-client-registration*	signin:OAuthRedirectUri	Write
CreateOAuth2Token	Grants permission to exchange an authorization code for OAuth 2.0 access token and refresh token that can be used to access AWS services from developer tools and applications	console*		Read
		oauth2-public-client-localhost*	signin:OAuthClientAuthentication