IAM Identity Center
Prefix sso, 126 actions · Domain Security, Identity & Compliance
21 AWS managed policies. 7 have reviewed guidance; the rest have authoritative permission data pending editorial review. 7 are service-linked role policies, shown with permission data only.
User access (4)
- AIOpsConsoleAdminPolicyAdmin
- AWSSSOMasterAccountAdministratorHigh privilegeAdmin
- AWSSSOMemberAccountAdministratorHigh privilegeAdmin
- MultiPartyApprovalFullAccessAdmin
Operator and limited (8)
- AmazonBioDiscoveryFullAccessOperator
- AmazonBioDiscoveryInAppFullAccessOperator
- AWSGrafanaWorkspacePermissionManagementOperator
- AWSGrafanaWorkspacePermissionManagementV2Operator
- AWSManagedAccountUserEntitlementAccessOperator
- AWSSSOReadOnlyOperator
- AWSSystemsManagerJustInTimeAccessTokenSessionPolicyOperator
- MultiPartyApprovalReadOnlyAccessOperator
Service roles (2)
Service-linked roles (7)
- AmazonHoneycodeServiceRolePolicyReader
- AWSServiceRoleForAWSTransformOperator
- AWSServiceRoleForCodeWhispererPolicyOperator
- AWSServiceRoleForMonitronPolicyOperator
- AWSServiceRoleForUserSubscriptionsOperator
- AWSSystemsManagerJustInTimeAccessServicePolicyOperator
- AWSSystemsManagerNotificationsServicePolicyReader
Also grants IAM Identity Center actions (42)
- AdministratorAccess
- AIDevOpsAgentAccessPolicy
- AIOpsAssistantPolicy
- AIOpsOperatorAccess
- AIOpsReadOnlyAccess
- AmazonDataZoneFullAccess
- AmazonDataZonePreviewConsoleFullAccess
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonOpenSearchServiceRolePolicy
- AmazonQuickSuiteAccessPolicy
- AmazonRedshiftServiceLinkedRolePolicy
- AmazonSageMakerHyperPodObservabilityAdminAccess
- AmazonSageMakerNotebooksServiceRolePolicy
- AppStudioServiceRolePolicy
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSAccountSettingsManagementRole
- AWSBudgetsSpendLimitMemberRolePolicy
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSManagedSettingsAdminAccess
- AWSManagedSettingsReadOnlyAccess
- AWSMcpServiceActionsFullAccess
- AWSResourceExplorerServiceRolePolicy
- AWSSSODirectoryAdministrator
- AWSSupportServiceRolePolicy
- AWSSystemsManagerChangeManagementServicePolicy
- AWSSystemsManagerJustInTimeAccessTokenPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- SageMakerStudioAdminIAMConsolePolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioFullAccess
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- WellArchitectedAgentResourceScanning
addregion associatedirectory associateprofile attachcustomermanagedpolicyreferencetopermissionset attachmanagedpolicytopermissionset createaccountassignment createapplication createapplicationassignment createapplicationinstance createapplicationinstancecertificate createinstance createinstanceaccesscontrolattributeconfiguration createmanagedapplicationinstance createpermissionset createprofile createtrust createtrustedtokenissuer deleteaccountassignment deleteapplication deleteapplicationaccessscope deleteapplicationassignment deleteapplicationauthenticationmethod deleteapplicationgrant deleteapplicationinstance deleteapplicationinstancecertificate deleteinlinepolicyfrompermissionset deleteinstance deleteinstanceaccesscontrolattributeconfiguration deletemanagedapplicationinstance deletepermissionset deletepermissionsboundaryfrompermissionset deleteprofile deletetrustedtokenissuer describeaccountassignmentcreationstatus describeaccountassignmentdeletionstatus describeapplication describeapplicationassignment describeapplicationprovider describeinstance describeinstanceaccesscontrolattributeconfiguration describepermissionset describepermissionsetprovisioningstatus describeregion describeregisteredregions describetrustedtokenissuer detachcustomermanagedpolicyreferencefrompermissionset detachmanagedpolicyfrompermissionset disassociatedirectory disassociateprofile getapplicationaccessscope getapplicationassignmentconfiguration getapplicationauthenticationmethod getapplicationgrant getapplicationinstance getapplicationsessionconfiguration getapplicationtemplate getinlinepolicyforpermissionset getmanagedapplicationinstance getmfadevicemanagementfordirectory getpermissionset getpermissionsboundaryforpermissionset getprofile getssostatus getsharedssoconfiguration getssoconfiguration gettrust importapplicationinstanceserviceprovidermetadata listaccountassignmentcreationstatus listaccountassignmentdeletionstatus listaccountassignments listaccountassignmentsforprincipal listaccountsforprovisionedpermissionset listapplicationaccessscopes listapplicationassignments listapplicationassignmentsforprincipal listapplicationauthenticationmethods listapplicationgrants listapplicationinstancecertificates listapplicationinstances listapplicationproviders listapplicationtemplates listapplications listcustomermanagedpolicyreferencesinpermissionset listdirectoryassociations listinstances listmanagedpoliciesinpermissionset listpermissionsetprovisioningstatus listpermissionsets listpermissionsetsprovisionedtoaccount listprofileassociations listprofiles listregions listtagsforresource listtrustedtokenissuers provisionpermissionset putapplicationaccessscope putapplicationassignmentconfiguration putapplicationauthenticationmethod putapplicationgrant putapplicationsessionconfiguration putinlinepolicytopermissionset putmfadevicemanagementfordirectory putpermissionsboundarytopermissionset putpermissionspolicy removeregion searchgroups searchusers startsso tagresource untagresource updateapplication updateapplicationinstanceactivecertificate updateapplicationinstancedisplaydata updateapplicationinstanceresponseconfiguration updateapplicationinstanceresponseschemaconfiguration updateapplicationinstancesecurityconfiguration updateapplicationinstanceserviceproviderconfiguration updateapplicationinstancestatus updateinstance updateinstanceaccesscontrolattributeconfiguration updatemanagedapplicationinstancestatus updatepermissionset updateprofile updatessoconfiguration updatetrust updatetrustedtokenissuer
Actions (126)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| sso:AddRegion | Write | 5 | 1 |
| sso:AssociateDirectory | Write | 5 | 1 |
| sso:AssociateProfile | Write | 11 | 1 |
| sso:AttachCustomerManagedPolicyReferenceToPermissionSet | Permissions management | 5 | 1 |
| sso:AttachManagedPolicyToPermissionSet | Permissions management | 5 | 1 |
| sso:CreateAccountAssignment | Write | 5 | 1 |
| sso:CreateApplication | Write | 6 | 7 |
| sso:CreateApplicationAssignment | Write | 9 | 5 |
| sso:CreateApplicationInstance | Write | 6 | 1 |
| sso:CreateApplicationInstanceCertificate | Write | 5 | 1 |
| sso:CreateInstance | Write | 5 | 1 |
| sso:CreateInstanceAccessControlAttributeConfiguration | Write | 5 | 1 |
| sso:CreateManagedApplicationInstance | Write | 7 | 1 |
| sso:CreatePermissionSet | Write | 5 | 1 |
| sso:CreateProfile | Write | 6 | 1 |
| sso:CreateTrust | Write | 6 | 1 |
| sso:CreateTrustedTokenIssuer | Write | 5 | 1 |
| sso:DeleteAccountAssignment | Write | 5 | 1 |
| sso:DeleteApplication | Write | 6 | 8 |
| sso:DeleteApplicationAccessScope | Write | 6 | 2 |
| sso:DeleteApplicationAssignment | Write | 7 | 5 |
| sso:DeleteApplicationAuthenticationMethod | Write | 5 | 2 |
| sso:DeleteApplicationGrant | Write | 5 | 2 |
| sso:DeleteApplicationInstance | Write | 5 | 1 |
| sso:DeleteApplicationInstanceCertificate | Write | 5 | 1 |
| sso:DeleteInlinePolicyFromPermissionSet | Write | 5 | 1 |
| sso:DeleteInstance | Write | 5 | 1 |
| sso:DeleteInstanceAccessControlAttributeConfiguration | Write | 5 | 1 |
| sso:DeleteManagedApplicationInstance | Write | 6 | 1 |
| sso:DeletePermissionSet | Write | 5 | 1 |
| sso:DeletePermissionsBoundaryFromPermissionSet | Permissions management | 5 | 1 |
| sso:DeleteProfile | Write | 5 | 1 |
| sso:DeleteTrustedTokenIssuer | Write | 5 | 1 |
| sso:DescribeAccountAssignmentCreationStatus | Read | 11 | 1 |
| sso:DescribeAccountAssignmentDeletionStatus | Read | 10 | 1 |
| sso:DescribeApplication | Read | 20 | 11 |
| sso:DescribeApplicationAssignment | Read | 10 | 3 |
| sso:DescribeApplicationProvider | Read | 10 | 1 |
| sso:DescribeInstance | Read | 23 | 10 |
| sso:DescribeInstanceAccessControlAttributeConfiguration | Read | 13 | 2 |
| sso:DescribePermissionSet | Read | 14 | 2 |
| sso:DescribePermissionSetProvisioningStatus | Read | 10 | 1 |
| sso:DescribeRegion | Read | 9 | 1 |
| sso:DescribeRegisteredRegions | Read | 22 | 2 |
| sso:DescribeTrustedTokenIssuer | Read | 10 | 1 |
| sso:DetachCustomerManagedPolicyReferenceFromPermissionSet | Permissions management | 5 | 1 |
| sso:DetachManagedPolicyFromPermissionSet | Permissions management | 5 | 1 |
| sso:DisassociateDirectory | Write | 5 | 1 |
| sso:DisassociateProfile | Write | 8 | 1 |
| sso:GetApplicationAccessScope | Read | 10 | 1 |
| sso:GetApplicationAssignmentConfiguration | Read | 13 | 1 |
| sso:GetApplicationAuthenticationMethod | Read | 10 | 2 |
| sso:GetApplicationGrant | Read | 11 | 2 |
| sso:GetApplicationInstance | Read | 10 | 1 |
| sso:GetApplicationSessionConfiguration | Read | 10 | 1 |
| sso:GetApplicationTemplate | Read | 9 | 1 |
| sso:GetInlinePolicyForPermissionSet | Read | 15 | 2 |
| sso:GetManagedApplicationInstance | Read | 18 | 4 |
| sso:GetMfaDeviceManagementForDirectory | Read | 8 | 1 |
| sso:GetPermissionSet | Read | 8 | 1 |
| sso:GetPermissionsBoundaryForPermissionSet | Read | 15 | 2 |
| sso:GetProfile | Read | 15 | 1 |
| sso:GetSSOStatus | Read | 10 | 1 |
| sso:GetSharedSsoConfiguration | Read | 16 | 1 |
| sso:GetSsoConfiguration | Read | 8 | 1 |
| sso:GetTrust | Read | 9 | 1 |
| sso:ImportApplicationInstanceServiceProviderMetadata | Write | 5 | 1 |
| sso:ListAccountAssignmentCreationStatus | List | 10 | 1 |
| sso:ListAccountAssignmentDeletionStatus | List | 10 | 1 |
| sso:ListAccountAssignments | List | 12 | 2 |
| sso:ListAccountAssignmentsForPrincipal | List | 10 | 1 |
| sso:ListAccountsForProvisionedPermissionSet | List | 10 | 1 |
| sso:ListApplicationAccessScopes | List | 11 | 2 |
| sso:ListApplicationAssignments | List | 17 | 4 |
| sso:ListApplicationAssignmentsForPrincipal | List | 11 | 1 |
| sso:ListApplicationAuthenticationMethods | List | 10 | 1 |
| sso:ListApplicationGrants | List | 11 | 2 |
| sso:ListApplicationInstanceCertificates | Read | 9 | 1 |
| sso:ListApplicationInstances | List | 10 | 1 |
| sso:ListApplicationProviders | List | 10 | 1 |
| sso:ListApplicationTemplates | List | 10 | 1 |
| sso:ListApplications | List | 19 | 3 |
| sso:ListCustomerManagedPolicyReferencesInPermissionSet | List | 15 | 2 |
| sso:ListDirectoryAssociations | Read | 21 | 3 |
| sso:ListInstances | List | 25 | 7 |
| sso:ListManagedPoliciesInPermissionSet | List | 15 | 2 |
| sso:ListPermissionSetProvisioningStatus | List | 10 | 1 |
| sso:ListPermissionSets | List | 14 | 3 |
| sso:ListPermissionSetsProvisionedToAccount | List | 10 | 1 |
| sso:ListProfileAssociations | Read | 16 | 1 |
| sso:ListProfiles | List | 15 | 1 |
| sso:ListRegions | List | 9 | 1 |
| sso:ListTagsForResource | Read | 14 | 2 |
| sso:ListTrustedTokenIssuers | List | 10 | 1 |
| sso:ProvisionPermissionSet | Write | 5 | 1 |
| sso:PutApplicationAccessScope | Write | 6 | 8 |
| sso:PutApplicationAssignmentConfiguration | Write | 6 | 6 |
| sso:PutApplicationAuthenticationMethod | Write | 6 | 7 |
| sso:PutApplicationGrant | Write | 6 | 7 |
| sso:PutApplicationSessionConfiguration | Write | 5 | 2 |
| sso:PutInlinePolicyToPermissionSet | Write | 5 | 1 |
| sso:PutMfaDeviceManagementForDirectory | Write | 5 | 1 |
| sso:PutPermissionsBoundaryToPermissionSet | Permissions management | 5 | 1 |
| sso:PutPermissionsPolicy | Permissions management | 5 | 1 |
| sso:RemoveRegion | Write | 5 | 1 |
| sso:SearchGroups | Read | 7 | 1 |
| sso:SearchUsers | Read | 6 | 1 |
| sso:StartSSO | Write | 5 | 1 |
| sso:TagResource | Tagging | 5 | 2 |
| sso:UntagResource | Tagging | 5 | 1 |
| sso:UpdateApplication | Write | 6 | 3 |
| sso:UpdateApplicationInstanceActiveCertificate | Write | 5 | 1 |
| sso:UpdateApplicationInstanceDisplayData | Write | 5 | 1 |
| sso:UpdateApplicationInstanceResponseConfiguration | Write | 5 | 1 |
| sso:UpdateApplicationInstanceResponseSchemaConfiguration | Write | 5 | 1 |
| sso:UpdateApplicationInstanceSecurityConfiguration | Write | 5 | 1 |
| sso:UpdateApplicationInstanceServiceProviderConfiguration | Write | 5 | 1 |
| sso:UpdateApplicationInstanceStatus | Write | 5 | 1 |
| sso:UpdateInstance | Write | 6 | 1 |
| sso:UpdateInstanceAccessControlAttributeConfiguration | Write | 5 | 1 |
| sso:UpdateManagedApplicationInstanceStatus | Write | 5 | 1 |
| sso:UpdatePermissionSet | Permissions management | 5 | 1 |
| sso:UpdateProfile | Write | 6 | 1 |
| sso:UpdateSSOConfiguration | Write | 5 | 1 |
| sso:UpdateTrust | Write | 6 | 1 |
| sso:UpdateTrustedTokenIssuer | Write | 5 | 1 |