View a markdown version of this page

Using service-linked roles for Amazon Web Services Support Plans - Amazon Web Services Support
Service-linked role permissions for Amazon Web Services Support PlansCreating a service-linked role for Amazon Web Services Support PlansEditing a service-linked role for Amazon Web Services Support PlansDeleting a service-linked role for Amazon Web Services Support Plans
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Using service-linked roles for Amazon Web Services Support Plans

Amazon Web Services Support Plans uses an Amazon Identity and Access Management (IAM) service-linked role to read and update Amazon resources used to manage your account's support plan on your behalf.

The AWSServiceRoleForSupportPlans service-linked role is a unique IAM role that is linked directly to Support Plans. This service-linked role is predefined, and it includes the permissions that Support Plans requires to call other Amazon services on your behalf.

The AWSServiceRoleForSupportPlans service-linked role trusts the supportplans.amazonaws.com service to assume the role.

Service-linked role permissions for Amazon Web Services Support Plans

This role uses the AWSSupportPlansServiceRolePolicy Amazon managed policy. This managed policy is attached to the role and allows the role permission to complete actions on your behalf.

The role's permissions policy allows Support Plans to perform the following actions on your behalf:

  • organizations:ListAccounts

  • supportplans:AcceptSupportAgreement

  • supportplans:CancelSupportAgreement

  • supportplans:CreateSupportAgreement

  • supportplans:GetSupportAgreement

  • supportplans:ListSupportAgreementRevisions

  • supportplans:ListSupportAgreements

  • supportplans:RejectSupportAgreement

  • supportplans:StartSupportPlanUpdate

  • supportplans:UpdateSupportAgreement

For more information about the allowed actions, see the AWSSupportPlansServiceRolePolicy policy in the IAM console.

Creating a service-linked role for Amazon Web Services Support Plans

You don't need to manually create the AWSServiceRoleForSupportPlans role. When you create a support plan through the Support Plan Management page in the Amazon Web Services Management Console, Support Plans automatically creates this role for you.

Note

If you need to create this role manually, you can use the IAM console, Amazon CLI, or the IAM API. For more information, see Creating a service-linked role in the IAM User Guide.

Editing a service-linked role for Amazon Web Services Support Plans

You can use IAM to edit the description for the AWSServiceRoleForSupportPlans service-linked role. You can't edit the trust policy or permissions policy, and you can't attach additional policies to this role. For more information, see Editing a service-linked role in the IAM User Guide.

Deleting a service-linked role for Amazon Web Services Support Plans

Support Plans doesn't delete the AWSServiceRoleForSupportPlans service-linked role on your behalf. If you want to delete this role, you must first cancel your active support plan. To do this, contact Amazon Web Services Support. After Amazon Web Services Support confirms the cancellation, you can use the IAM console, Amazon CLI, or the IAM API to delete the role. For more information, see Deleting a service-linked role in the IAM User Guide.