Identity Store
Prefix identitystore, 29 actions · Domain Security, Identity & Compliance
19 AWS managed policies. 6 have reviewed guidance; the rest have authoritative permission data pending editorial review. 5 are service-linked role policies, shown with permission data only.
User access (6)
- AWSManagedSettingsAdminAccessAdmin
- AWSManagedSettingsReadOnlyAccessReader
- AWSSSODirectoryAdministratorAdmin
- AWSSSOMasterAccountAdministratorHigh privilegeAdmin
- AWSSSOMemberAccountAdministratorHigh privilegeAdmin
- FinOpsAgentIdentityReaderPolicyReader
Operator and limited (7)
Service roles (1)
Service-linked roles (5)
Also grants Identity Store actions (33)
- AdministratorAccess
- AIDevOpsAgentAccessPolicy
- AIOpsAssistantPolicy
- AIOpsConsoleAdminPolicy
- AIOpsOperatorAccess
- AIOpsReadOnlyAccess
- AmazonNimbleStudio-StudioAdmin
- AmazonNimbleStudio-StudioUser
- AmazonQuickSuiteAccessPolicy
- AmazonRedshiftServiceLinkedRolePolicy
- AssuranceOperatorPolicy
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSDeadlineCloud-UserAccessFarms
- AWSDeadlineCloud-UserAccessQueues
- AWSMcpServiceActionsFullAccess
- AWSResourceExplorerServiceRolePolicy
- AWSSupplyChainFederationAdminAccess
- AWSSupportServiceRolePolicy
- AWSSystemsManagerJustInTimeAccessTokenPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudWatchOmniSpaceAccessPolicy
- PowerUserAccess
- ReadOnlyAccess
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- WellArchitectedAgentResourceScanning
addregion creategroup creategroupmembership createidentitystore createuser deletegroup deletegroupmembership deleteidentitystore deleteuser describegroup describegroupmembership describeidentitystore describeregion describeuser getgroupid getgroupmembershipid getuserid ismemberingroups listgroupmemberships listgroupmembershipsformember listgroups listidentitystores listregions listusers removeregion reserveuser updategroup updateidentitystore updateuser
Actions (29)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| identitystore:AddRegion | Write | 6 | 1 |
| identitystore:CreateGroup | Write | 9 | 1 |
| identitystore:CreateGroupMembership | Write | 8 | 1 |
| identitystore:CreateIdentityStore | Write | 6 | 1 |
| identitystore:CreateUser | Write | 8 | 2 |
| identitystore:DeleteGroup | Write | 8 | 1 |
| identitystore:DeleteGroupMembership | Write | 7 | 1 |
| identitystore:DeleteIdentityStore | Write | 6 | 1 |
| identitystore:DeleteUser | Write | 8 | 3 |
| identitystore:DescribeGroup | Read | 23 | 12 |
| identitystore:DescribeGroupMembership | Read | 15 | 1 |
| identitystore:DescribeIdentityStore | Read | 7 | 1 |
| identitystore:DescribeRegion | Read | 7 | 1 |
| identitystore:DescribeUser | Read | 25 | 14 |
| identitystore:GetGroupId | Read | 13 | 1 |
| identitystore:GetGroupMembershipId | Read | 9 | 1 |
| identitystore:GetUserId | Read | 13 | 2 |
| identitystore:IsMemberInGroups | Read | 10 | 2 |
| identitystore:ListGroupMemberships | List | 20 | 2 |
| identitystore:ListGroupMembershipsForMember | List | 23 | 6 |
| identitystore:ListGroups | List | 20 | 5 |
| identitystore:ListIdentityStores | List | 7 | 1 |
| identitystore:ListRegions | List | 7 | 1 |
| identitystore:ListUsers | List | 20 | 5 |
| identitystore:RemoveRegion | Write | 6 | 1 |
| identitystore:ReserveUser | Write | 8 | 2 |
| identitystore:UpdateGroup | Write | 8 | 1 |
| identitystore:UpdateIdentityStore | Write | 7 | 1 |
| identitystore:UpdateUser | Write | 8 | 2 |