This is the new *Amazon CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [Amazon CloudFormation User Guide](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::SupportAuthZ::SupportPermit
<a name="aws-resource-supportauthz-supportpermit"></a>

The `AWS::SupportAuthZ::SupportPermit` resource creates a support permit that authorizes Amazon Support to perform a specific set of actions on one or more of your resources for a bounded period of time. You define which actions are allowed, which resources they apply to, and optional time-window conditions that control when the permit is active.

Each permit is cryptographically signed with a customer managed Amazon KMS key so that the authorization is non-repudiable. You can optionally associate a permit with an Amazon Support case. For more information, see [Managing support permits](https://docs.amazonaws.cn/awssupport/latest/user/support-authorization-permits.html) in the *Amazon Support User Guide*.

**Note**  
You can't modify a support permit after you create it. Changing any property other than `Tags` requires replacement: Amazon CloudFormation deletes the existing permit and creates a new one.

## Syntax
<a name="aws-resource-supportauthz-supportpermit-syntax"></a>

To declare this entity in your Amazon CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-supportauthz-supportpermit-syntax.json"></a>

```
{
  "Type" : "AWS::SupportAuthZ::SupportPermit",
  "Properties" : {
      "[Description](#cfn-supportauthz-supportpermit-description)" : {{String}},
      "[Name](#cfn-supportauthz-supportpermit-name)" : {{String}},
      "[Permit](#cfn-supportauthz-supportpermit-permit)" : {{Permit}},
      "[SigningKeyInfo](#cfn-supportauthz-supportpermit-signingkeyinfo)" : {{SigningKeyInfo}},
      "[SupportCaseDisplayId](#cfn-supportauthz-supportpermit-supportcasedisplayid)" : {{String}},
      "[Tags](#cfn-supportauthz-supportpermit-tags)" : {{[ Tag, ... ]}}
    }
}
```

### YAML
<a name="aws-resource-supportauthz-supportpermit-syntax.yaml"></a>

```
Type: AWS::SupportAuthZ::SupportPermit
Properties:
  [Description](#cfn-supportauthz-supportpermit-description): {{String}}
  [Name](#cfn-supportauthz-supportpermit-name): {{String}}
  [Permit](#cfn-supportauthz-supportpermit-permit): {{
    Permit}}
  [SigningKeyInfo](#cfn-supportauthz-supportpermit-signingkeyinfo): {{
    SigningKeyInfo}}
  [SupportCaseDisplayId](#cfn-supportauthz-supportpermit-supportcasedisplayid): {{String}}
  [Tags](#cfn-supportauthz-supportpermit-tags): {{
    - Tag}}
```

## Properties
<a name="aws-resource-supportauthz-supportpermit-properties"></a>

`Description`  <a name="cfn-supportauthz-supportpermit-description"></a>
An optional description of the support permit.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `1024`  
*Update requires*: [Replacement](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`Name`  <a name="cfn-supportauthz-supportpermit-name"></a>
The name of the support permit. The name must be unique within your Amazon Web Services account in the current Region.  
You can't change the name after the permit is created. Specifying a different name replaces the permit.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^[a-zA-Z0-9]{1,256}$`  
*Minimum*: `1`  
*Maximum*: `256`  
*Update requires*: [Replacement](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`Permit`  <a name="cfn-supportauthz-supportpermit-permit"></a>
The grant definition for the permit: the actions that Amazon Support is authorized to perform, the resources they apply to, and optional time-window conditions.  
*Required*: Yes  
*Type*: [Permit](aws-properties-supportauthz-supportpermit-permit.md)  
*Update requires*: [Replacement](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`SigningKeyInfo`  <a name="cfn-supportauthz-supportpermit-signingkeyinfo"></a>
The customer managed Amazon KMS key used to cryptographically sign the permit.  
*Required*: Yes  
*Type*: [SigningKeyInfo](aws-properties-supportauthz-supportpermit-signingkeyinfo.md)  
*Update requires*: [Replacement](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`SupportCaseDisplayId`  <a name="cfn-supportauthz-supportpermit-supportcasedisplayid"></a>
The display identifier of the Amazon Support case to associate with the permit. When you specify this value, the permit is linked to the specified support case.  
*Required*: No  
*Type*: String  
*Pattern*: `^[a-zA-Z0-9:/-]{1,512}$`  
*Minimum*: `1`  
*Maximum*: `512`  
*Update requires*: [Replacement](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`Tags`  <a name="cfn-supportauthz-supportpermit-tags"></a>
An array of key-value pairs to apply to this resource.  
For more information, see [Tag](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html).  
*Required*: No  
*Type*: Array of [Tag](aws-properties-supportauthz-supportpermit-tag.md)  
*Maximum*: `50`  
*Update requires*: [No interruption](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Return values
<a name="aws-resource-supportauthz-supportpermit-return-values"></a>

### Ref
<a name="aws-resource-supportauthz-supportpermit-return-values-ref"></a>

When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the Amazon Resource Name (ARN) of the support permit, such as `arn:aws:supportauthz:us-east-1:123456789012:supportpermit/2494ccf5-d7b5-434a-adef-79e15e1e3191`.

For more information about using the `Ref` function, see [`Ref`](https://docs.amazonaws.cn/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html).

### Fn::GetAtt
<a name="aws-resource-supportauthz-supportpermit-return-values-fn--getatt"></a>

The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the `Fn::GetAtt` intrinsic function, see [`Fn::GetAtt`](https://docs.amazonaws.cn/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html).

#### 
<a name="aws-resource-supportauthz-supportpermit-return-values-fn--getatt-fn--getatt"></a>

`Arn`  <a name="Arn-fn::getatt"></a>
The Amazon Resource Name (ARN) of the support permit.

`CreatedAt`  <a name="CreatedAt-fn::getatt"></a>
The date and time when the support permit was created, in ISO 8601 format.

`PermitId`  <a name="PermitId-fn::getatt"></a>
The service-generated identifier of the support permit, which is the resource segment of the ARN.

`Status`  <a name="Status-fn::getatt"></a>
The current status of the support permit:  
+ `ACTIVE` – The permit is in effect and authorizes the granted actions, subject to any time-window conditions.
+ `INACTIVE` – The permit exists but does not currently authorize any actions.
+ `DELETING` – The permit is being deleted and no longer authorizes any actions.

## Examples
<a name="aws-resource-supportauthz-supportpermit--examples"></a>



**Topics**
+ [Grant time-bounded access to specific actions on specific resources](#aws-resource-supportauthz-supportpermit--examples--Grant_time-bounded_access_to_specific_actions_on_specific_resources)
+ [Grant all actions on all resources in the Region within a time window](#aws-resource-supportauthz-supportpermit--examples--Grant_all_actions_on_all_resources_in_the_Region_within_a_time_window)

### Grant time-bounded access to specific actions on specific resources
<a name="aws-resource-supportauthz-supportpermit--examples--Grant_time-bounded_access_to_specific_actions_on_specific_resources"></a>

The following example creates a support permit that allows two Amazon EC2 read actions on a single instance, active only before a specified time, and signed with a customer managed Amazon KMS key.

#### JSON
<a name="aws-resource-supportauthz-supportpermit--examples--Grant_time-bounded_access_to_specific_actions_on_specific_resources--json"></a>

```
{
  "Resources": {
    "ExampleSupportPermit": {
      "Type": "AWS::SupportAuthZ::SupportPermit",
      "Properties": {
        "Name": "ExampleTroubleshootingPermit",
        "Description": "Temporary EC2 read access for support case investigation",
        "SupportCaseDisplayId": "1234567890",
        "Permit": {
          "Actions": { "Actions": [ "ec2:DescribeInstances", "ec2:GetConsoleOutput" ] },
          "Resources": { "Resources": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-0abcd1234efgh5678" ] },
          "Conditions": [ { "AllowBefore": "2026-12-31T23:59:59Z" } ]
        },
        "SigningKeyInfo": {
          "KmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
        }
      }
    }
  }
}
```

#### YAML
<a name="aws-resource-supportauthz-supportpermit--examples--Grant_time-bounded_access_to_specific_actions_on_specific_resources--yaml"></a>

```
Resources:
  ExampleSupportPermit:
    Type: AWS::SupportAuthZ::SupportPermit
    Properties:
      Name: ExampleTroubleshootingPermit
      Description: Temporary EC2 read access for support case investigation
      SupportCaseDisplayId: "1234567890"
      Permit:
        Actions:
          Actions:
            - ec2:DescribeInstances
            - ec2:GetConsoleOutput
        Resources:
          Resources:
            - arn:aws:ec2:us-east-1:111122223333:instance/i-0abcd1234efgh5678
        Conditions:
          - AllowBefore: "2026-12-31T23:59:59Z"
      SigningKeyInfo:
        KmsKey: arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
```

### Grant all actions on all resources in the Region within a time window
<a name="aws-resource-supportauthz-supportpermit--examples--Grant_all_actions_on_all_resources_in_the_Region_within_a_time_window"></a>

The following example creates a support permit that grants all supported actions on every resource in the current Region during a specific time window, and is signed with a customer managed Amazon KMS key.

#### JSON
<a name="aws-resource-supportauthz-supportpermit--examples--Grant_all_actions_on_all_resources_in_the_Region_within_a_time_window--json"></a>

```
{
  "Resources": {
    "BroadSupportPermit": {
      "Type": "AWS::SupportAuthZ::SupportPermit",
      "Properties": {
        "Name": "FullRegionSupportPermit",
        "Description": "Broad time-bounded access for an escalation",
        "Permit": {
          "Actions": { "AllActions": {} },
          "Resources": { "AllResourcesInRegion": {} },
          "Conditions": [
            { "AllowAfter": "2026-09-01T00:00:00Z" },
            { "AllowBefore": "2026-09-08T00:00:00Z" }
          ]
        },
        "SigningKeyInfo": {
          "KmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
        }
      }
    }
  }
}
```

#### YAML
<a name="aws-resource-supportauthz-supportpermit--examples--Grant_all_actions_on_all_resources_in_the_Region_within_a_time_window--yaml"></a>

```
Resources:
  BroadSupportPermit:
    Type: AWS::SupportAuthZ::SupportPermit
    Properties:
      Name: FullRegionSupportPermit
      Description: Broad time-bounded access for an escalation
      Permit:
        Actions:
          AllActions: {}
        Resources:
          AllResourcesInRegion: {}
        Conditions:
          - AllowAfter: "2026-09-01T00:00:00Z"
          - AllowBefore: "2026-09-08T00:00:00Z"
      SigningKeyInfo:
        KmsKey: arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
```