Skip to main content
IAM Policy Map

AWSSupportAccess

AdminAWS managedActiveReviewedShow on mapCompare

Summary

Allows users to access the AWS Support Center. AWS Support uses it to manage your support case lifecycle through the Support API, and enhanced functionality in the AWS Support Center Console is provided through the support-console API service.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN
arn:aws:iam::aws:policy/AWSSupportAccess
Default version
v4
Created
Last edited
Services
support, support-console

Control-plane actions (52)

By access level: 31 Read, 21 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
SupportAll 39 actions (see the Support page)22 Read, 17 Write; 0 restricted, 0 conditionalsupport:*
Support ConsoleAll 13 actions (see the Support Console page)9 Read, 4 Write; 0 restricted, 0 conditionalsupport-console:*

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants at least 80% of the write and permissions-management actions of: support (17 of 17).

Guidance

Practical scope

The policy is a single statement that allows support:* and support-console:* on Resource "*".

Use cases

  • The Support user job function in the IAM User Guide: a user who contacts AWS Support, creates support cases and views the status of existing cases.

Best practices

  • AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.

Security considerations

  • It allows every action in the support and support-console namespaces on all resources, not only creating cases.
  • AWS updated it to add permissions for the support-console API on July 18, 2025, and updates to an AWS managed policy affect every identity it is attached to. You cannot change the permissions in an AWS managed policy.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Support User Guide says you can attach this policy to your IAM entities, and the IAM User Guide lists it as the policy for the Support user job function.

Related policies

Same service

Same domain

Frequently asked questions

When should I attach AWSSupportAccess?
Attach it to a user who contacts AWS Support, creates support cases and views the status of existing cases.
What does AWSSupportAccess grant?
It allows support:* and support-console:* on all resources. AWS Support uses it to manage your support case lifecycle through the Support API, with enhanced Support Center Console functionality provided through the support-console API service.
What are the security risks of AWSSupportAccess?
It grants every action in the support and support-console namespaces on all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "support:*",
        "support-console:*"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v4, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSSupportAccess

Terraform

resource "aws_iam_role_policy_attachment" "awssupportaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSSupportAccess"),
);

Sources