View a markdown version of this page

Getting started with Amazon Web Services Support authorization - Amazon Web Services Support
PrerequisitesStep 1: Create an Amazon KMS signing keyStep 2: Set up IAM permissionsStep 3: Create your first support permitStep 4: Review support permit requests from Amazon Web Services SupportNext steps
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Getting started with Amazon Web Services Support authorization

This tutorial walks you through setting up Amazon Web Services Support authorization and creating your first support permit. You complete the following steps:

This tutorial takes approximately 10 minutes to complete.

  1. Create an Amazon KMS signing key

  2. Set up IAM permissions

  3. Create your first support permit

  4. Review support permit requests from Amazon Web Services Support

Prerequisites

Before you begin, verify that you have the following:

  • An active Amazon account

  • Permissions to create Amazon KMS keys in your account

  • Permissions to create IAM policies and attach them to users or roles

Step 1: Create an Amazon KMS signing key

Amazon Web Services Support authorization requires a Amazon KMS key with key spec ECC_NIST_P384 and key usage SIGN_VERIFY. The key must be in the same Region as your support permit.

Note

If you already have a Amazon KMS key with key spec ECC_NIST_P384 and key usage SIGN_VERIFY in the same Region, you can skip this step and use that key.

To create the key, run the following Amazon CLI command:

aws kms create-key \
    --key-usage SIGN_VERIFY \
    --key-spec ECC_NIST_P384 \
    --description "SupportAuthZ signing key" \
    --tags TagKey=supportauthz:managed,TagValue=true \
    --region us-east-1

Note the key ARN from the output. You use this value when you create support permits.

Include the required Amazon Web Services Support authorization policy statements in the create-key call. For the required statements, see Configuring Amazon KMS keys for Amazon Web Services Support authorization.

Example output
{
    "KeyMetadata": {
        "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
        "Arn": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
        "KeySpec": "ECC_NIST_P384",
        "KeyUsage": "SIGN_VERIFY"
    }
}

Step 2: Set up IAM permissions

Attach an IAM policy that grants permissions for Amazon Web Services Support authorization API operations. The following example policy grants access to all Amazon Web Services Support authorization actions.

The supportauthz:RegisterKey action lets you associate Amazon KMS keys with support permits. This permission-only action must be present in your IAM policy for Amazon Web Services Support authorization to function.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "supportauthz:CreateSupportPermit",
                "supportauthz:RegisterKey",
                "supportauthz:DeleteSupportPermit",
                "supportauthz:GetSupportPermit",
                "supportauthz:ListSupportPermits",
                "supportauthz:ListSupportPermitRequests",
                "supportauthz:RejectSupportPermitRequest",
                "supportauthz:GetAction",
                "supportauthz:ListActions"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "supportauthz.us-east-1.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant"
            ],
            "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "supportauthz.us-east-1.amazonaws.com",
                    "kms:RetiringServicePrincipal": "us-east-1.supportauthz.amazonaws.com",
                    "kms:GranteeServicePrincipal": "us-east-1.supportauthz.amazonaws.com"
                },
                "ForAllValues:StringEquals": {
                    "kms:GrantOperations": [
                        "DescribeKey",
                        "GetPublicKey",
                        "Sign"
                    ]
                }
            }
        }
    ]
}

To attach this policy to an IAM user or role, see Adding and removing IAM identity permissions in the Amazon Identity and Access Management User Guide.

Step 3: Create your first support permit

Create a support permit that authorizes Amazon Web Services Support to access information about your services for specific resources.

Console

  1. Sign in to the Amazon Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Granted access section, choose Preconfigure access.

  4. For Access type, choose one of the following:

    • All supported resources in this Region – Applies broad access to your entire account in the selected Region.

    • Choose resource ARN – Limits access to a specific resource that you identify by ARN.

  5. (Optional) For Details, enter a Name and Description for the support permit.

  6. For Access duration, choose one of the following:

    • No expiration – Access remains active until you revoke it.

    • Custom duration – Set a specific time window during which the support permit is valid.

  7. For Actions, choose the actions that Amazon Web Services Support is permitted to perform:

    • Select the All actions check box to permit all available actions on the covered resources. This removes the 10-action limit.

    • To choose specific actions, clear the All actions check box. Select a service from the Services list, and then select up to 10 individual actions from the actions table.

  8. For Signing key, choose an Amazon KMS key from the dropdown list. To create a new key, choose Create KMS signing key.

  9. Choose Submit.

Amazon CLI

Run the following command to create a time-bounded support permit for a specific resource:

aws supportauthz create-support-permit \
    --name "MyFirstPermit" \
    --signing-key-info '{"kmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
    --permit '{
        "actions": {"allActions": {}},
        "resources": {"resources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"]},
        "conditions": [
            {"allowAfter": "2026-06-01T00:00:00Z"},
            {"allowBefore": "2026-07-01T00:00:00Z"}
        ]
    }'

This support permit authorizes Amazon Web Services Support to perform all available actions on the specified Amazon Aurora cluster during June 2026.

Step 4: Review support permit requests from Amazon Web Services Support

When Amazon Web Services Support needs access to information about your services and no matching support permit exists, Amazon Web Services Support submits a support permit request. You can view pending requests and approve or reject them.

Console

  1. Sign in to the Amazon Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Pending access requests section, review the list of requests. Each request shows the associated support case, service, Support Permit Request ARN, status, and request access date.

  4. (Optional) To filter requests, use the Status and Service dropdown filters, or search by resource in the search field.

  5. To approve or reject a request, choose Manage support access.

Amazon CLI

To list pending requests, run the following command:

aws supportauthz list-support-permit-requests
Example output
{
    "supportPermitRequests": [
        {
            "arn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/req-1234abcd",
            "status": "PENDING",
            "supportCaseDisplayId": "case-12345678",
            "requestedActions": ["rds:ReadClusterData"],
            "requestedResources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"],
            "createdAt": "2026-06-01T12:00:00Z"
        }
    ]
}

To approve this request, create a support permit that covers the requested scope:

aws supportauthz create-support-permit \
    --name "ApproveCase12345678" \
    --signing-key-info '{"kmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
    --support-case-display-id "case-12345678" \
    --permit '{
        "actions": {"actions": ["rds:ReadClusterData"]},
        "resources": {"resources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"]},
        "conditions": [
            {"allowBefore": "2026-06-15T00:00:00Z"}
        ]
    }'

To reject a request, run the following command. This notifies Amazon Web Services Support that you don't want to accept the request. Rejecting a request doesn't prevent you from creating a support permit for the same actions and resources later.

aws supportauthz reject-support-permit-request \
    --request-arn "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/request-id"

Review each request and decide whether to approve or reject it:

  • To approve: Create a support permit that covers the requested scope. Include the supportCaseDisplayId parameter to automatically deactivate the support permit when the case closes.

  • To reject: Call RejectSupportPermitRequest to notify Amazon Web Services Support that you don't want to accept the request. Rejecting a request doesn't prevent you from creating a support permit for the same actions and resources later.

Next steps

After you complete this tutorial, see the following topics: