Amazon Web Services Support authorization concepts
The following concepts help you understand how Amazon Web Services Support authorization works.
Support permits
A support permit is a resource that defines the scope and conditions under which Amazon Web Services Support can access information about your services that might contain your data during support case resolution. Without a support permit, Amazon Web Services Support can't access this information. Each support permit specifies which actions Amazon Web Services Support can take and the resources on which Amazon Web Services Support can take those actions, along with optional time-based conditions.
Support permits can't be modified after creation. To change the scope of an existing authorization, delete the support permit and create a new one.
Support permit scope
The support permit scope defines what Amazon Web Services Support is authorized to do. A support permit scope contains three elements:
- Actions
-
The specific operations that Amazon Web Services Support can perform. You can permit all actions or specify individual actions.
- Resources
-
The Amazon resources for which Amazon Web Services Support can access information about your services that might contain your data. You can permit all resources in the Region or specify individual resource ARNs.
- Conditions
-
Optional time-based constraints. You can set an
allowAftertime (the earliest time Amazon Web Services Support is able to use the support permit to authorize an action) and anallowBeforetime (the latest time Amazon Web Services Support is able to use the support permit to authorize an action) to create a time window. A support permit supports a maximum of 2 conditions.
Signing keys
The signing key is a customer-managed Amazon KMS asymmetric key that provides verification for support permits. The key must meet the following requirements:
Key spec:
ECC_NIST_P384Key usage:
SIGN_VERIFYLocation: Same Region as the support permit.
Your private key material never leaves Amazon KMS. Your KMS key is called to perform the signing operation and receives only the resulting signature.
Support permit requests
A support permit request is a notification from Amazon Web Services Support requesting access to information about your services that might contain your data for a specific resource to help resolve a support case. If you don't approve the request, Amazon Web Services Support can't access the requested information and might not be able to proceed with the investigation.
When Amazon Web Services Support submits a support permit request, you receive notifications through Amazon EventBridge events and Amazon CloudTrail log entries. You can then review the requested scope and approve or reject the request.
Permit states
A support permit transitions through the following states:
- ACTIVE
-
The support permit is active. Amazon Web Services Support can receive a signed authorization—a cryptographically signed token that permits a specific action, for actions within the support permit scope.
- INACTIVE
-
New signed authorizations aren't issued for INACTIVE support permits. A support permit transitions to INACTIVE automatically when the linked support case closes. Support permits can also transition to INACTIVE if the linked support case closes while an account is isolated or a Region is opted out. To re-authorize access after these transitions, create a new support permit.
- DELETING
-
Deletion initiated. New signed authorizations stop being issued. Due to eventual consistency, there might be a brief delay before the change takes effect. The support permit is then removed. To help prevent further signing operations, revoke the grant on the associated Amazon KMS key. For more information, see Revoking Amazon Web Services Support authorization access.
Permit request states
A support permit request transitions through the following states:
- PENDING
-
The request is awaiting your review.
- ACCEPTED
-
You created a support permit that satisfies the request.
- REJECTED
-
You rejected the request by calling
RejectSupportPermitRequest. - CANCELLED
-
Amazon Web Services Support cancelled the request.
Actions and resources
Actions are service-specific operations that Amazon Web Services Support can perform during support
investigations, such as reading diagnostic logs or viewing operational metrics. Each
action has a descriptive name, such as rds:ReadClusterData or
rds:ViewQueryLogsWithParameters. You can view available actions for
each service by using the ListActions and GetAction API
operations. For more information, see
Discovering support actions.
Resources are identified by their ARN. When you scope a support permit, you specify the resource ARNs for which Amazon Web Services Support can access service information, or you can permit access to service information for all resources in the Region.