Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by IdentityCenter, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by IdentityCenter, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for IdentityCenter.

**Table 1** Actions supported by IdentityCenter
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
IdentityCenter:user:create	Grants permission to create a user.	Write	-	-	-
IdentityCenter:user:list	Grants permission to query the user list.	Read	-	-	-
IdentityCenter:user:describe	Grants permission to query user details.	Read	-	-	-
IdentityCenter:user:describeUsers	Grants permission to batch obtain user details.	Read	-	-	-
IdentityCenter:user:update	Grants permission to update a user.	Write	-	-	-
IdentityCenter:user:delete	Grants permission to delete a user.	Write	-	-	-
IdentityCenter:user:getUserId	Grants permission to obtain the user ID.	Read	-	-	-
IdentityCenter:user:enableUser	Grants permission to enable a user.	Write	-	-	-
IdentityCenter:user:disableUser	Grants permission to disable a user.	Write	-	-	-
IdentityCenter:group:create	Grants permission to create a group.	Write	-	-	-
IdentityCenter:group:list	Grants permission to query the group list.	Read	-	-	-
IdentityCenter:group:describe	Grants permission to query group details.	Read	-	-	-
IdentityCenter:group:describeGroups	Grants permission to batch obtain group details.	Read	-	-	-
IdentityCenter:group:update	Grants permission to update a group.	Write	-	-	-
IdentityCenter:group:delete	Grants permission to delete a group.	Write	-	-	-
IdentityCenter:group:getGroupId	Grants permission to obtain the group ID.	Read	-	-	-
IdentityCenter:groupMembership:create	Grants permission to add a member to a group.	Write	-	-	-
IdentityCenter:groupMemberships:list	Grants permission to query all members in a group.	Read	-	-	-
IdentityCenter:groupMembership:listForMember	Grants permission to query all groups that a user is added to.	Read	-	-	-
IdentityCenter:groupMembership:describe	Grants permission to query the group membership.	Read	-	-	-
IdentityCenter:groupMembership:delete	Grants permission to disassociate users and groups.	Write	-	-	-
IdentityCenter:groupMembership:getGroupMembershipId	Grants permission to query the membership ID.	Read	-	-	-
IdentityCenter:groupMembership:isMembershipInGroup	Grants permission to query whether a user is in a group.	Read	-	-	-
IdentityCenter:externalIdp:create	Grants permission to create an external identity provider.	Write	-	-	-
IdentityCenter:externalIdp:list	Grants permission to obtain the identity source configuration of the external identity provider.	Read	-	-	-
IdentityCenter:externalIdp:enable	Grants permission to enable an external identity provider.	Write	-	-	-
IdentityCenter:externalIdp:disable	Grants permission to disable an external identity provider.	Write	-	-	-
IdentityCenter:externalIdp:getSpConfiguration	Grants permission to obtain the configuration of the IAM Identity Center service provider.	Read	-	-	-
IdentityCenter:externalIdp:update	Grants permission to update the configuration of the external identity provider.	Write	-	-	-
IdentityCenter:externalIdp:delete	Grants permission to delete the configuration of the external identity provider.	Write	-	-	-
IdentityCenter:externalIdp:importCertificate	Grants permission to import a certificate.	Write	-	-	-
IdentityCenter:externalIdp:deleteCertificate	Grants permission to delete a certificate.	Write	-	-	-
IdentityCenter:externalIdp:listCertificates	Grants permission to obtain the certificate list.	Read	-	-	-
IdentityCenter:externalIdp:createProvisioningTenant	Grants permission to create a tenant.	Write	-	-	-
IdentityCenter:externalIdp:listProvisioningTenant	Grants permission to query the tenant list.	Read	-	-	-
IdentityCenter:externalIdp:deleteProvisioningTenant	Grants permission to delete a tenant.	Write	-	-	-
IdentityCenter:externalIdp:createBearerToken	Grants permission to create a bearer token.	Write	-	-	-
IdentityCenter:externalIdp:listBearerTokens	Grants permission to query the bearer token list.	Read	-	-	-
IdentityCenter:externalIdp:deleteBearerToken	Grants permission to delete a bearer token.	Write	-	-	-
IdentityCenter:user:updatePassword	Grants permission to update a password by sending a password reset link via email or generating a one-time password for a user.	Write	-	-	-
IdentityCenter:user:deleteUserMfaDevice	Grants permission to delete an MFA device for a specified user.	Write	-	-	-
IdentityCenter:user:updateMfaDevice	Grants permission to update MFA device information.	Write	-	-	-
IdentityCenter:user:listMfaDevice	Grants permission to query the MFA device list.	Read	-	-	-
IdentityCenter:user:registerVirtualMfaDevice	Grants permission to begin the creation process of a virtual MFA device.	Write	-	-	-
IdentityCenter:user:verifyEmail	Grants permission to verify an email address of a user.	Write	-	-	-
IdentityCenter:user:batchDeleteSession	Grants permission to delete user sessions in batches.	Write	-	-	-
IdentityCenter:user:listSessions	Grants permission to query the user session list.	List	-	-	-
IdentityCenter:serviceProvider:activeCertificate	Grants permission to activate identity provider certificates.	Write	-	-	-
IdentityCenter:serviceProvider:deleteCertificate	Grants permission to delete identity provider certificates.	Write	-	-	-
IdentityCenter:serviceProvider:createCertificate	Grants permission to create identity provider certificates.	Write	-	-	-
IdentityCenter:serviceProvider:listCertificates	Grants permission to obtain identity provider certificates.	List	-	-	-
IdentityCenter:permissionSet:create	Grants permission to create a permission set.	Write	instance *	-	-
			permissionSet *	-
			-	g:RequestTag/<tag-key> g:TagKeys
IdentityCenter:permissionSet:attachManagedPolicy	Grants permission to attach system-defined policies to a permission set.	Permission_management	instance *	-	-
IdentityCenter:permissionSet:attachManagedPolicy		Permission_management	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:detachManagedPolicy	Grants permission to detach system-defined policies from a specified permission set.	Permission_management	instance *	-	-
IdentityCenter:permissionSet:detachManagedPolicy		Permission_management	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:update	Grants permission to update the permission set of a specified instance.	Permission_management	instance *	-	-
IdentityCenter:permissionSet:update		Permission_management	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:delete	Grants permission to delete the permission set of a specified instance.	Write	instance *	-	-
IdentityCenter:permissionSet:delete		Write	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:list	Grants permission to list the permission sets of a specified instance.	List	instance *	-	-
IdentityCenter:permissionSet:listAccountsForProvisioned	Grants permission to list all the accounts that the specified permission set is associated with.	List	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:listAccountsForProvisioned		List	instance *	-	-
IdentityCenter:permissionSet:listProvisioningStatus	Grants permission to list the status of the permission set attachment request for a specified instance.	List	instance *	-	-
IdentityCenter:permissionSet:listManagedPolicies	Grants permission to list the system-defined policies attached to a specified permission set.	List	instance *	-	-
IdentityCenter:permissionSet:listManagedPolicies		List	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:listProvisionedToAccount	Grants permission to list all permission sets associated with a specified account.	List	account *	-	-
IdentityCenter:permissionSet:listProvisionedToAccount		List	instance *	-	-
IdentityCenter:permissionSet:describeProvisioningStatus	Grants permission to obtain the details of the permission set attachment status.	Read	instance *	-	-
IdentityCenter:permissionSet:describe	Grants permission to obtain the permission set details of a specified instance.	Read	instance *	-	-
IdentityCenter:permissionSet:describe		Read	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:provision	Grants permission to attach a specified permission set to a specified principal.	Write	account *	-	-
			instance *	-
			permissionSet *	g:ResourceTag/<tag-key>
IdentityCenter:instance:getIdentityCenterStatus	Grants permission to query the IAM Identity Center service status.	Read	-	-	-
IdentityCenter:instance:registerRegion	Grants permission to register a region.	Write	-	-	-
IdentityCenter:instance:describeRegisteredRegions	Grants permission to query regions enabled in IAM Identity Center.	Read	-	-	-
IdentityCenter:instance:startIdentityCenter	Grants permission to enable IAM Identity Center.	Write	-	-	-
IdentityCenter:instance:deleteIdentityCenter	Grants permission to disable IAM Identity Center.	Write	-	-	-
IdentityCenter:instance:list	Grants permission to query the IAM Identity Center instance list.	List	-	-	-
IdentityCenter:instance:describeInstanceAccessControlAttributeConfiguration	Grants permission to query access control attributes of a specific instance.	Read	instance *	-	-
IdentityCenter:instance:updateInstanceAccessControlAttributeConfiguration	Grants permission to update access control attributes of a specific instance.	Write	instance *	-	-
IdentityCenter:instance:deleteInstanceAccessControlAttributeConfiguration	Grants permission to delete access control attributes of a specific instance.	Write	instance *	-	-
IdentityCenter:instance:createInstanceAccessControlAttributeConfiguration	Grants permission to enable access control attributes for a specific instance.	Write	instance *	-	-
IdentityCenter:tags:list	Grants permission to list the tags attached to a specific resource.	List	instance *	-	-
IdentityCenter:tags:list		List	permissionSet	g:ResourceTag/<tag-key>	-
IdentityCenter:resources:listTags	Grants permission to list the tags of a specific resource type.	List	instance *	-	-
IdentityCenter:resources:tag	Grants permission to add tags to a specific resource.	Tagging	instance *	-	-
			permissionSet	g:ResourceTag/<tag-key>
			-	g:RequestTag/<tag-key> g:TagKeys
IdentityCenter:resources:untag	Grants permission to delete tags from a specific resource.	Tagging	instance *	-	-
			permissionSet	g:ResourceTag/<tag-key>
			-	g:RequestTag/<tag-key> g:TagKeys
IdentityCenter:resources:listByTag	Grants permission to list the resources of a specific resource type and tag.	List	instance *	-	-
IdentityCenter:resources:listByTag		List	-	g:TagKeys	-
IdentityCenter:resources:countByTag	Grants permission to query the quantity of resources of a specific resource type and tag.	Read	instance *	-	-
IdentityCenter:resources:countByTag		Read	-	g:TagKeys	-
IdentityCenter:accountAssignment:create	Grants permission to assign access to principals for a specified account using a specified permission set.	Write	instance *	-	-
			account *	-
			permissionSet *	g:ResourceTag/<tag-key>
IdentityCenter:accountAssignment:delete	Grants permission to delete a principal's access from a specified account using a specified permission set.	Write	instance *	-	-
			account *	-
			permissionSet *	g:ResourceTag/<tag-key>
IdentityCenter:accountAssignment:list	Grants permission to list the assignee of the specified account with the specified permission set.	List	instance *	-	-
			account *	-
			permissionSet *	g:ResourceTag/<tag-key>
IdentityCenter:accountAssignment:describeDeletionStatus	Grants permission to obtain the details about the status of the assignment deletion request.	Read	instance *	-	-
IdentityCenter:accountAssignment:describeCreationStatus	Grants permission to obtain the details about the status of the assignment creation request.	Read	instance *	-	-
IdentityCenter:accountAssignment:listCreationStatus	Grants permission to list the status of the account assignment creation request for a specified IAM Identity Center instance.	List	instance *	-	-
IdentityCenter:accountAssignment:listDeletionStatus	Grants permission to list the status of the account assignment deletion request for a specified IAM Identity Center instance.	List	instance *	-	-
IdentityCenter:accountAssignment:listProfileAssociation	Grants permission to query all users or groups associated with an account or permission set.	Read	-	-	-
IdentityCenter:accountAssignment:disassociationProfile	Grants permission to disassociate all authorizations from a user or group.	Write	-	-	-
IdentityCenter:instance:listIdentityStoreAssociations	Grants permission to query details about the identity source configured in IAM Identity Center.	Read	-	-	-
IdentityCenter:ssoConfiguration:update	Grants permission to update the configuration for the current IAM Identity Center instance.	Write	-	-	-
IdentityCenter:ssoConfiguration:describe	Grants permission to obtain the configuration for the current IAM Identity Center instance.	Read	-	-	-
IdentityCenter:mfaDevices:describeManagementSettings	Grants permission to obtain MFA settings.	Read	-	-	-
IdentityCenter:mfaDevices:updateManagementSettings	Grants permission to update MFA settings.	Write	-	-	-
IdentityCenter:instance:createAlias	Grants permission to create an alias for a specified identity source.	Write	-	-	-
IdentityCenter:permissionSet:attachCustomRole	Grants permission to attach a custom role to a permission set.	Permission_management	instance *	-	-
IdentityCenter:permissionSet:attachCustomRole		Permission_management	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:attachCustomPolicy	Grants permission to attach a custom policy to a permission set.	Permission_management	instance *	-	-
IdentityCenter:permissionSet:attachCustomPolicy		Permission_management	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:getCustomRole	Grants permission to obtain a custom role of a permission set.	Read	instance *	-	-
IdentityCenter:permissionSet:getCustomRole		Read	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:getCustomPolicy	Grants permission to obtain a custom policy of a permission set.	Read	instance *	-	-
IdentityCenter:permissionSet:getCustomPolicy		Read	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:detachCustomRole	Grants permission to delete a custom role of a permission set.	Permission_management	instance *	-	-
IdentityCenter:permissionSet:detachCustomRole		Permission_management	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:permissionSet:detachCustomPolicy	Grants permission to delete a custom policy of a permission set.	Permission_management	instance *	-	-
IdentityCenter:permissionSet:detachCustomPolicy		Permission_management	permissionSet *	g:ResourceTag/<tag-key>	-
IdentityCenter:application:createApplicationInstance	Grants permission to add an application instance to IAM Identity Center.	Write	-	-	-
IdentityCenter:application:createApplicationInstanceCertificate	Grants permission to add a new certificate for an application instance.	Write	-	-	-
IdentityCenter:application:deleteApplicationInstance	Grants permission to delete the application instance.	Write	-	-	-
IdentityCenter:application:deleteApplicationInstanceCertificate	Grants permission to delete an inactive or expired certificate from the application instance.	Write	-	-	-
IdentityCenter:application:deleteProfile	Grants permission to delete the association between an application instance and a user or user group.	Write	-	-	-
IdentityCenter:application:describeApplication	Grants permission to obtain information about an application.	Read	application *	-	-
IdentityCenter:application:getApplicationAssignmentConfiguration	Grants permission to read assignment configurations for an application.	Read	application *	-	-
IdentityCenter:application:getApplicationInstance	Grants permission to retrieve details for an application instance.	Read	-	-	-
IdentityCenter:application:importApplicationInstanceServiceProviderMetadata	Grants permission to update the application instance by uploading an application SAML metadata file provided by the service provider.	Write	-	-	-
IdentityCenter:application:listApplicationInstanceCertificates	Grants permission to retrieve all of the certificates for a given application instance.	List	-	-	-
IdentityCenter:application:listApplicationInstances	Grants permission to retrieve all application instances.	List	-	-	-
IdentityCenter:application:listApplicationTemplates	Grants permission to retrieve all supported application templates.	List	-	-	-
IdentityCenter:application:listApplications	Grants permission to retrieve all applications associated with the instance of IAM Identity Center.	List	-	-	-
IdentityCenter:application:listProfiles	Grants permission to check whether an application instance is associated with a user or user group.	List	-	-	-
IdentityCenter:application:updateApplicationInstanceActiveCertificate	Grants permission to set a certificate as the active one for this application instance.	Write	-	-	-
IdentityCenter:application:updateApplicationInstanceDisplayData	Grants permission to update the display details of an application instance.	Write	-	-	-
IdentityCenter:application:updateApplicationInstanceResponseConfiguration	Grants permission to update federation response configuration for the application instance.	Write	-	-	-
IdentityCenter:application:updateApplicationInstanceResponseSchemaConfiguration	Grants permission to update federation response schema configuration for the application instance.	Write	-	-	-
IdentityCenter:application:updateApplicationInstanceSecurityConfiguration	Grants permission to update the security configurations of an application instance.	Write	-	-	-
IdentityCenter:application:updateApplicationInstanceServiceProviderConfiguration	Grants permission to update service provider related configuration for the application instance.	Write	-	-	-
IdentityCenter:application:updateApplicationInstanceStatus	Grants permission to update the status of an application instance.	Write	-	-	-
IdentityCenter:applicationProvider:describeApplicationProvider	Grants permission to describe an application provider.	Read	applicationProvider *	-	-
IdentityCenter:applicationProvider:listApplicationProviders	Grants permission to list application providers.	List	applicationProvider	-	-
IdentityCenter:applicationAssignment:create	Grants permission to create an application assignment.	Write	application *	-	-
IdentityCenter:applicationAssignment:delete	Grants permission to delete an application assignment.	Write	application *	-	-
IdentityCenter:applicationAssignment:list	Grants permission to list application assignments.	List	application *	-	-
IdentityCenter:applicationAssignmentsForPrincipal:list	Grants permission to list applications assigned to user or group.	List	instance *	-	-

Each API of IdentityCenter usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by IdentityCenter APIs
API	Action	Dependencies
POST /v1/identity-stores/{identity_store_id}/users	IdentityCenter:user:create	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/users	IdentityCenter:user:list	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/users/{user_id}	IdentityCenter:user:describe	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/batch-query	IdentityCenter:user:describeUsers	organizations:delegatedAdministrators:list
PUT /v1/identity-stores/{identity_store_id}/users/{user_id}	IdentityCenter:user:update	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/users/{user_id}	IdentityCenter:user:delete	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/retrieve-user-id	IdentityCenter:user:getUserId	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/{user_id}/enable	IdentityCenter:user:enableUser	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/{user_id}/disable	IdentityCenter:user:disableUser	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/groups	IdentityCenter:group:create	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/groups	IdentityCenter:group:list	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/groups/{group_id}	IdentityCenter:group:describe	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/groups/batch-query	IdentityCenter:group:describeGroups	organizations:delegatedAdministrators:list
PUT /v1/identity-stores/{identity_store_id}/groups/{group_id}	IdentityCenter:group:update	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/groups/{group_id}	IdentityCenter:group:delete	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/groups/retrieve-group-id	IdentityCenter:group:getGroupId	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/group-memberships	IdentityCenter:groupMembership:create	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/group-memberships	IdentityCenter:groupMemberships:list	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/group-memberships-for-member	IdentityCenter:groupMembership:listForMember	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/group-memberships/{membership_id}	IdentityCenter:groupMembership:describe	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/group-memberships/{membership_id}	IdentityCenter:groupMembership:delete	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/group-memberships/retrieve-group-membership-id	IdentityCenter:groupMembership:getGroupMembershipId	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/is-member-in-groups	IdentityCenter:groupMembership:isMembershipInGroup	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/external-idp	IdentityCenter:externalIdp:create	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/external-idp	IdentityCenter:externalIdp:list	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/enable	IdentityCenter:externalIdp:enable	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/disable	IdentityCenter:externalIdp:disable	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/sp-config	IdentityCenter:externalIdp:getSpConfiguration	organizations:delegatedAdministrators:list
PUT /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}	IdentityCenter:externalIdp:update	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}	IdentityCenter:externalIdp:delete	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/certificate	IdentityCenter:externalIdp:importCertificate	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/certificate/{certificate_id}	IdentityCenter:externalIdp:deleteCertificate	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/certificate	IdentityCenter:externalIdp:listCertificates	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/provision-tenant	IdentityCenter:externalIdp:createProvisioningTenant	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/provision-tenant	IdentityCenter:externalIdp:listProvisioningTenant	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}	IdentityCenter:externalIdp:deleteProvisioningTenant	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}/bearer-token	IdentityCenter:externalIdp:createBearerToken	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}/bearer-token	IdentityCenter:externalIdp:listBearerTokens	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}/bearer-token/{token_id}	IdentityCenter:externalIdp:deleteBearerToken	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/{user_id}/reset-password	IdentityCenter:user:updatePassword	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/users/{user_id}/mfa-devices/{device_id}	IdentityCenter:user:deleteUserMfaDevice	organizations:delegatedAdministrators:list
PUT /v1/identity-stores/{identity_store_id}/users/{user_id}/mfa-devices/{device_id}	IdentityCenter:user:updateMfaDevice	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/retrieve-mfa-devices	IdentityCenter:user:listMfaDevice	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/{user_id}/mfa-devices/register-mfa-device	IdentityCenter:user:registerVirtualMfaDevice	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/{user_id}/verify-email	IdentityCenter:user:verifyEmail	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/users/{user_id}/sessions/batch-delete	IdentityCenter:user:batchDeleteSession	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/users/{user_id}/sessions	IdentityCenter:user:listSessions	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/saml-certificates	IdentityCenter:serviceProvider:createCertificate	organizations:delegatedAdministrators:list
DELETE /v1/identity-stores/{identity_store_id}/saml-certificates/{certificate_id}	IdentityCenter:serviceProvider:deleteCertificate	organizations:delegatedAdministrators:list
GET /v1/identity-stores/{identity_store_id}/saml-certificates	IdentityCenter:serviceProvider:listCertificates	organizations:delegatedAdministrators:list
POST /v1/identity-stores/{identity_store_id}/saml-certificates/{certificate_id}/active	IdentityCenter:serviceProvider:activeCertificate	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/permission-sets	IdentityCenter:permissionSet:create	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/permission-sets/{permission_set_id}/attach-managed-policy	IdentityCenter:permissionSet:attachManagedPolicy	iam:policies:getV5 organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/permission-sets/{permission_set_id}/detach-managed-policy	IdentityCenter:permissionSet:detachManagedPolicy	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/permission-sets/{permission_set_id}	IdentityCenter:permissionSet:update	organizations:delegatedAdministrators:list
DELETE /v1/instances/{instance_id}/permission-sets/{permission_set_id}	IdentityCenter:permissionSet:delete	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets	IdentityCenter:permissionSet:list	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/{permission_set_id}/accounts	IdentityCenter:permissionSet:listAccountsForProvisioned	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/provisioning-statuses	IdentityCenter:permissionSet:listProvisioningStatus	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/{permission_set_id}/managed-policies	IdentityCenter:permissionSet:listManagedPolicies	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/provisioned-to-accounts	IdentityCenter:permissionSet:listProvisionedToAccount	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/provisioning-status/{request_id}	IdentityCenter:permissionSet:describeProvisioningStatus	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/{permission_set_id}	IdentityCenter:permissionSet:describe	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/permission-sets/{permission_set_id}/provision	IdentityCenter:permissionSet:provision	organizations:delegatedAdministrators:list
GET /v1/identity-center-service/status	IdentityCenter:instance:getIdentityCenterStatus	organizations:delegatedAdministrators:list
POST /v1/register-regions	IdentityCenter:instance:registerRegion	-
GET /v1/registered-regions	IdentityCenter:instance:describeRegisteredRegions	organizations:delegatedAdministrators:list
POST /v1/service/start	IdentityCenter:instance:startIdentityCenter	iam:agencies:createServiceLinkedAgency organizations:trustedServices:enable
POST /v1/service/delete	IdentityCenter:instance:deleteIdentityCenter	iam:agencies:deleteServiceLinkedAgency
GET /v1/instances	IdentityCenter:instance:list	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/access-control-attribute-configuration	IdentityCenter:instance:describeInstanceAccessControlAttributeConfiguration	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/access-control-attribute-configuration	IdentityCenter:instance:updateInstanceAccessControlAttributeConfiguration	organizations:delegatedAdministrators:list
DELETE /v1/instances/{instance_id}/access-control-attribute-configuration	IdentityCenter:instance:deleteInstanceAccessControlAttributeConfiguration	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/access-control-attribute-configuration	IdentityCenter:instance:createInstanceAccessControlAttributeConfiguration	organizations:delegatedAdministrators:list
GET /v1/instances/{resource_type}/{resource_id}/tags	IdentityCenter:tags:list	organizations:delegatedAdministrators:list
POST /v1/instances/{resource_type}/{resource_id}/tags/create	IdentityCenter:resources:tag	organizations:delegatedAdministrators:list
POST /v1/instances/{resource_type}/{resource_id}/tags/delete	IdentityCenter:resources:untag	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/account-assignments/create	IdentityCenter:accountAssignment:create	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/account-assignments/delete	IdentityCenter:accountAssignment:delete	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/account-assignments	IdentityCenter:accountAssignment:list	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/account-assignments/deletion-status/{request_id}	IdentityCenter:accountAssignment:describeDeletionStatus	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/account-assignments/creation-status/{request_id}	IdentityCenter:accountAssignment:describeCreationStatus	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/account-assignments/creation-statuses	IdentityCenter:accountAssignment:listCreationStatus	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/account-assignments/deletion-statuses	IdentityCenter:accountAssignment:listDeletionStatus	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/disassociate-profile	IdentityCenter:accountAssignment:disassociationProfile	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/identity-store-associations	IdentityCenter:instance:listIdentityStoreAssociations	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/sso-configuration	IdentityCenter:ssoConfiguration:update	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/sso-configuration	IdentityCenter:ssoConfiguration:describe	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/mfa-devices/management-settings	IdentityCenter:mfaDevices:describeManagementSettings	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/mfa-devices/management-settings	IdentityCenter:mfaDevices:updateManagementSettings	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/alias	IdentityCenter:instance:createAlias	organizations:delegatedAdministrators:list
DELETE /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-policy	IdentityCenter:permissionSet:detachCustomPolicy	organizations:delegatedAdministrators:list
DELETE /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-role	IdentityCenter:permissionSet:detachCustomRole	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-policy	IdentityCenter:permissionSet:getCustomPolicy	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-role	IdentityCenter:permissionSet:getCustomRole	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-policy	IdentityCenter:permissionSet:attachCustomPolicy	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-role	IdentityCenter:permissionSet:attachCustomRole	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/application-instances	IdentityCenter:application:createApplicationInstance	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates	IdentityCenter:application:createApplicationInstanceCertificate	organizations:delegatedAdministrators:list
DELETE /v1/instances/{instance_id}/application-instances/{application_instance_id}	IdentityCenter:application:deleteApplicationInstance	organizations:delegatedAdministrators:list
DELETE /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates/{certificate_id}	IdentityCenter:application:deleteApplicationInstanceCertificate	organizations:delegatedAdministrators:list
DELETE /v1/instances/{instance_id}/application-instances/{application_instance_id}/profiles/{profile_id}	IdentityCenter:application:deleteProfile	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/applications/{application_instance_id}	IdentityCenter:application:describeApplication	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/applications/{application_instance_id}/assignments-configuration	IdentityCenter:application:getApplicationAssignmentConfiguration	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/application-instances/{application_instance_id}	IdentityCenter:application:getApplicationInstance	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/application-instances/{application_instance_id}/metadata	IdentityCenter:application:importApplicationInstanceServiceProviderMetadata	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates	IdentityCenter:application:listApplicationInstanceCertificates	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/application-instances	IdentityCenter:application:listApplicationInstances	organizations:delegatedAdministrators:list IdentityCenter:application:getApplicationInstance
GET /v1/application-templates	IdentityCenter:application:listApplicationTemplates	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/applications	IdentityCenter:application:listApplications	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/application-instances/{application_instance_id}/profiles	IdentityCenter:application:listProfiles	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates/{certificate_id}	IdentityCenter:application:updateApplicationInstanceActiveCertificate	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/application-instances/{application_instance_id}/display-data	IdentityCenter:application:updateApplicationInstanceDisplayData	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/application-instances/{application_instance_id}/response-configuration	IdentityCenter:application:updateApplicationInstanceResponseConfiguration	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/application-instances/{application_instance_id}/response-schema-configuration	IdentityCenter:application:updateApplicationInstanceResponseSchemaConfiguration	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/application-instances/{application_instance_id}/security-configuration	IdentityCenter:application:updateApplicationInstanceSecurityConfiguration	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/application-instances/{application_instance_id}/service-provider-configuration	IdentityCenter:application:updateApplicationInstanceServiceProviderConfiguration	organizations:delegatedAdministrators:list
PUT /v1/instances/{instance_id}/application-instances/{application_instance_id}/status	IdentityCenter:application:updateApplicationInstanceStatus	organizations:delegatedAdministrators:list
GET /v1/application-providers/{application_provider_id}	IdentityCenter:applicationProvider:describeApplicationProvider	organizations:delegatedAdministrators:list
GET /v1/application-providers	IdentityCenter:applicationProvider:listApplicationProviders	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/applications/{application_instance_id}/assignments/create	IdentityCenter:applicationAssignment:create	organizations:delegatedAdministrators:list
POST /v1/instances/{instance_id}/applications/{application_instance_id}/assignments/delete	IdentityCenter:applicationAssignment:delete	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/applications/{application_instance_id}/assignments	IdentityCenter:applicationAssignment:list	organizations:delegatedAdministrators:list
GET /v1/instances/{instance_id}/application-assignments-for-principals	IdentityCenter:applicationAssignmentsForPrincipal:list	organizations:delegatedAdministrators:list

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for IdentityCenter.

**Table 3** Resource types supported by IdentityCenter
Resource Type	URN
application	IdentityCenter::<management-account-id>:application:<instance-id>/<application-instance-id>
account	IdentityCenter::<management-account-id>:account:<account-id>
instance	IdentityCenter::<management-account-id>:instance:<instance-id>
permissionSet	IdentityCenter::<management-account-id>:permissionSet:<instance-id>/<permission-set-id>
applicationProvider	IdentityCenter:::applicationProvider:<application-provider-name>

Conditions

IdentityCenter does not support service-specific condition keys in identity policies.It can only use global condition keys applicable to all services. For details, see Global Condition Keys.

Parent topic: Permissions and Supported Actions

Previous topic: Introduction

Next topic: Appendixes