View a markdown version of this page

AWS::SupportAuthZ::SupportPermit - Amazon CloudFormation
SyntaxPropertiesReturn valuesExamples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

This is the new Amazon CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the Amazon CloudFormation User Guide.

AWS::SupportAuthZ::SupportPermit

The AWS::SupportAuthZ::SupportPermit resource creates a support permit that authorizes Amazon Support to perform a specific set of actions on one or more of your resources for a bounded period of time. You define which actions are allowed, which resources they apply to, and optional time-window conditions that control when the permit is active.

Each permit is cryptographically signed with a customer managed Amazon KMS key so that the authorization is non-repudiable. You can optionally associate a permit with an Amazon Support case. For more information, see Managing support permits in the Amazon Support User Guide.

Note

You can't modify a support permit after you create it. Changing any property other than Tags requires replacement: Amazon CloudFormation deletes the existing permit and creates a new one.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::SupportAuthZ::SupportPermit",
  "Properties" : {
      "Description" : String,
      "Name" : String,
      "Permit" : Permit,
      "SigningKeyInfo" : SigningKeyInfo,
      "SupportCaseDisplayId" : String,
      "Tags" : [ Tag, ... ]
    }
}

YAML

Type: AWS::SupportAuthZ::SupportPermit
Properties:
  Description: String
  Name: String
  Permit: 
    Permit
  SigningKeyInfo: 
    SigningKeyInfo
  SupportCaseDisplayId: String
  Tags: 
    - Tag

Properties

Description

An optional description of the support permit.

Required: No

Type: String

Minimum: 1

Maximum: 1024

Update requires: Replacement

Name

The name of the support permit. The name must be unique within your Amazon Web Services account in the current Region.

You can't change the name after the permit is created. Specifying a different name replaces the permit.

Required: Yes

Type: String

Pattern: ^[a-zA-Z0-9]{1,256}$

Minimum: 1

Maximum: 256

Update requires: Replacement

Permit

The grant definition for the permit: the actions that Amazon Support is authorized to perform, the resources they apply to, and optional time-window conditions.

Required: Yes

Type: Permit

Update requires: Replacement

SigningKeyInfo

The customer managed Amazon KMS key used to cryptographically sign the permit.

Required: Yes

Type: SigningKeyInfo

Update requires: Replacement

SupportCaseDisplayId

The display identifier of the Amazon Support case to associate with the permit. When you specify this value, the permit is linked to the specified support case.

Required: No

Type: String

Pattern: ^[a-zA-Z0-9:/-]{1,512}$

Minimum: 1

Maximum: 512

Update requires: Replacement

Tags

An array of key-value pairs to apply to this resource.

For more information, see Tag.

Required: No

Type: Array of Tag

Maximum: 50

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the Amazon Resource Name (ARN) of the support permit, such as arn:aws:supportauthz:us-east-1:123456789012:supportpermit/2494ccf5-d7b5-434a-adef-79e15e1e3191.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

Arn

The Amazon Resource Name (ARN) of the support permit.

CreatedAt

The date and time when the support permit was created, in ISO 8601 format.

PermitId

The service-generated identifier of the support permit, which is the resource segment of the ARN.

Status

The current status of the support permit:

  • ACTIVE – The permit is in effect and authorizes the granted actions, subject to any time-window conditions.

  • INACTIVE – The permit exists but does not currently authorize any actions.

  • DELETING – The permit is being deleted and no longer authorizes any actions.

Examples

Grant time-bounded access to specific actions on specific resources

The following example creates a support permit that allows two Amazon EC2 read actions on a single instance, active only before a specified time, and signed with a customer managed Amazon KMS key.

JSON

{
  "Resources": {
    "ExampleSupportPermit": {
      "Type": "AWS::SupportAuthZ::SupportPermit",
      "Properties": {
        "Name": "ExampleTroubleshootingPermit",
        "Description": "Temporary EC2 read access for support case investigation",
        "SupportCaseDisplayId": "1234567890",
        "Permit": {
          "Actions": { "Actions": [ "ec2:DescribeInstances", "ec2:GetConsoleOutput" ] },
          "Resources": { "Resources": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-0abcd1234efgh5678" ] },
          "Conditions": [ { "AllowBefore": "2026-12-31T23:59:59Z" } ]
        },
        "SigningKeyInfo": {
          "KmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
        }
      }
    }
  }
}

YAML

Resources:
  ExampleSupportPermit:
    Type: AWS::SupportAuthZ::SupportPermit
    Properties:
      Name: ExampleTroubleshootingPermit
      Description: Temporary EC2 read access for support case investigation
      SupportCaseDisplayId: "1234567890"
      Permit:
        Actions:
          Actions:
            - ec2:DescribeInstances
            - ec2:GetConsoleOutput
        Resources:
          Resources:
            - arn:aws:ec2:us-east-1:111122223333:instance/i-0abcd1234efgh5678
        Conditions:
          - AllowBefore: "2026-12-31T23:59:59Z"
      SigningKeyInfo:
        KmsKey: arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

Grant all actions on all resources in the Region within a time window

The following example creates a support permit that grants all supported actions on every resource in the current Region during a specific time window, and is signed with a customer managed Amazon KMS key.

JSON

{
  "Resources": {
    "BroadSupportPermit": {
      "Type": "AWS::SupportAuthZ::SupportPermit",
      "Properties": {
        "Name": "FullRegionSupportPermit",
        "Description": "Broad time-bounded access for an escalation",
        "Permit": {
          "Actions": { "AllActions": {} },
          "Resources": { "AllResourcesInRegion": {} },
          "Conditions": [
            { "AllowAfter": "2026-09-01T00:00:00Z" },
            { "AllowBefore": "2026-09-08T00:00:00Z" }
          ]
        },
        "SigningKeyInfo": {
          "KmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
        }
      }
    }
  }
}

YAML

Resources:
  BroadSupportPermit:
    Type: AWS::SupportAuthZ::SupportPermit
    Properties:
      Name: FullRegionSupportPermit
      Description: Broad time-bounded access for an escalation
      Permit:
        Actions:
          AllActions: {}
        Resources:
          AllResourcesInRegion: {}
        Conditions:
          - AllowAfter: "2026-09-01T00:00:00Z"
          - AllowBefore: "2026-09-08T00:00:00Z"
      SigningKeyInfo:
        KmsKey: arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab