IAM Identity Center directory
Prefix sso-directory, 57 actions · Domain Security, Identity & Compliance
13 AWS managed policies. 4 have reviewed guidance; the rest have authoritative permission data pending editorial review. 4 are service-linked role policies, shown with permission data only.
User access (4)
- AWSManagedSettingsReadOnlyAccessReader
- AWSSSODirectoryAdministratorAdmin
- AWSSSOMasterAccountAdministratorHigh privilegeAdmin
- AWSSSOMemberAccountAdministratorHigh privilegeAdmin
Operator and limited (4)
Service roles (1)
Service-linked roles (4)
Also grants IAM Identity Center directory actions (25)
- AdministratorAccess
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AIOpsConsoleAdminPolicy
- AIOpsOperatorAccess
- AIOpsReadOnlyAccess
- AmazonNimbleStudio-StudioAdmin
- AmazonNimbleStudio-StudioUser
- AWSCODAPermissionsBoundary
- AWSIoTSiteWiseMonitorPortalAccess
- AWSIoTSiteWiseMonitorServiceRolePolicy
- AWSManagedSettingsAdminAccess
- AWSMcpServiceActionsFullAccess
- AWSResourceExplorerServiceRolePolicy
- AWSServiceRoleForCodeWhispererPolicy
- AWSServiceRoleForUserSubscriptions
- AWSSSOReadOnly
- AWSSystemsManagerJustInTimeAccessServicePolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- MultiPartyApprovalFullAccess
- MultiPartyApprovalReadOnlyAccess
- PowerUserAccess
- ReadOnlyAccess
- SecurityAudit
- WellArchitectedAgentResourceScanning
addmembertogroup completevirtualmfadeviceregistration completewebauthndeviceregistration createalias createbearertoken createexternalidpconfigurationfordirectory creategroup createprovisioningtenant createuser deletebearertoken deleteexternalidpcertificate deleteexternalidpconfigurationfordirectory deletegroup deletemfadeviceforuser deleteprovisioningtenant deleteuser describedirectory describegroup describegroups describeprovisioningtenant describeuser describeuserbyuniqueattribute describeusers disableexternalidpconfigurationfordirectory disableuser enableexternalidpconfigurationfordirectory enableuser getawsspconfigurationfordirectory getgroupid getuserid getuserpoolinfo importexternalidpcertificate ismemberingroup ismemberingroups listbearertokens listexternalidpcertificates listexternalidpconfigurationsfordirectory listgroups listgroupsformember listgroupsforuser listmembersingroup listmfadevicesforuser listprovisioningtenants listusers removememberfromgroup searchgroups searchusers startvirtualmfadeviceregistration startwebauthndeviceregistration updateexternalidpconfigurationfordirectory updategroup updategroupdisplayname updatemfadeviceforuser updatepassword updateuser updateusername verifyemail
Actions (57)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| sso-directory:AddMemberToGroup | Write | 7 | 1 |
| sso-directory:CompleteVirtualMfaDeviceRegistration | Write | 7 | 1 |
| sso-directory:CompleteWebAuthnDeviceRegistration | Write | 7 | 1 |
| sso-directory:CreateAlias | Write | 7 | 1 |
| sso-directory:CreateBearerToken | Write | 7 | 1 |
| sso-directory:CreateExternalIdPConfigurationForDirectory | Write | 7 | 1 |
| sso-directory:CreateGroup | Write | 8 | 1 |
| sso-directory:CreateProvisioningTenant | Write | 7 | 1 |
| sso-directory:CreateUser | Write | 8 | 1 |
| sso-directory:DeleteBearerToken | Write | 7 | 1 |
| sso-directory:DeleteExternalIdPCertificate | Write | 7 | 1 |
| sso-directory:DeleteExternalIdPConfigurationForDirectory | Write | 7 | 1 |
| sso-directory:DeleteGroup | Write | 7 | 1 |
| sso-directory:DeleteMfaDeviceForUser | Write | 7 | 1 |
| sso-directory:DeleteProvisioningTenant | Write | 7 | 1 |
| sso-directory:DeleteUser | Write | 7 | 1 |
| sso-directory:DescribeDirectory | Read | 11 | 1 |
| sso-directory:DescribeGroup | Read | 13 | 2 |
| sso-directory:DescribeGroups | Read | 9 | 1 |
| sso-directory:DescribeProvisioningTenant | Read | 9 | 1 |
| sso-directory:DescribeUser | Read | 14 | 1 |
| sso-directory:DescribeUserByUniqueAttribute | Read | 9 | 1 |
| sso-directory:DescribeUsers | Read | 23 | 2 |
| sso-directory:DisableExternalIdPConfigurationForDirectory | Write | 7 | 1 |
| sso-directory:DisableUser | Write | 7 | 1 |
| sso-directory:EnableExternalIdPConfigurationForDirectory | Write | 7 | 1 |
| sso-directory:EnableUser | Write | 7 | 1 |
| sso-directory:GetAWSSPConfigurationForDirectory | Read | 8 | 1 |
| sso-directory:GetGroupId | Read | 8 | 1 |
| sso-directory:GetUserId | Read | 8 | 1 |
| sso-directory:GetUserPoolInfo | Read | 8 | 1 |
| sso-directory:ImportExternalIdPCertificate | Write | 7 | 1 |
| sso-directory:IsMemberInGroup | Read | 9 | 1 |
| sso-directory:IsMemberInGroups | Read | 7 | 1 |
| sso-directory:ListBearerTokens | Read | 9 | 1 |
| sso-directory:ListExternalIdPCertificates | Read | 9 | 1 |
| sso-directory:ListExternalIdPConfigurationsForDirectory | Read | 10 | 1 |
| sso-directory:ListGroups | Read | 9 | 1 |
| sso-directory:ListGroupsForMember | Read | 9 | 1 |
| sso-directory:ListGroupsForUser | Read | 9 | 1 |
| sso-directory:ListMembersInGroup | Read | 11 | 2 |
| sso-directory:ListMfaDevicesForUser | Read | 9 | 1 |
| sso-directory:ListProvisioningTenants | Read | 10 | 2 |
| sso-directory:ListUsers | Read | 9 | 1 |
| sso-directory:RemoveMemberFromGroup | Write | 7 | 1 |
| sso-directory:SearchGroups | Read | 14 | 2 |
| sso-directory:SearchUsers | Read | 18 | 1 |
| sso-directory:StartVirtualMfaDeviceRegistration | Write | 7 | 1 |
| sso-directory:StartWebAuthnDeviceRegistration | Write | 7 | 1 |
| sso-directory:UpdateExternalIdPConfigurationForDirectory | Write | 7 | 1 |
| sso-directory:UpdateGroup | Write | 7 | 1 |
| sso-directory:UpdateGroupDisplayName | Write | 7 | 1 |
| sso-directory:UpdateMfaDeviceForUser | Write | 7 | 1 |
| sso-directory:UpdatePassword | Write | 7 | 1 |
| sso-directory:UpdateUser | Write | 7 | 1 |
| sso-directory:UpdateUserName | Write | 7 | 1 |
| sso-directory:VerifyEmail | Write | 7 | 1 |