# Using service-linked roles for Amazon Web Services Support Plans
<a name="using-service-linked-roles-sup-plans"></a>

Amazon Web Services Support Plans uses an Amazon Identity and Access Management (IAM) [service-linked role](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role) to read and update Amazon resources used to manage your account's support plan on your behalf.

The `AWSServiceRoleForSupportPlans` service-linked role is a unique IAM role that is linked directly to Support Plans. This service-linked role is predefined, and it includes the permissions that Support Plans requires to call other Amazon services on your behalf.

The `AWSServiceRoleForSupportPlans` service-linked role trusts the `supportplans.amazonaws.com` service to assume the role.

## Service-linked role permissions for Amazon Web Services Support Plans
<a name="service-linked-role-permissions-sup-plans"></a>

This role uses the `AWSSupportPlansServiceRolePolicy` Amazon managed policy. This managed policy is attached to the role and allows the role permission to complete actions on your behalf.

The role's permissions policy allows Support Plans to perform the following actions on your behalf:
+ `organizations:ListAccounts`
+ `supportplans:AcceptSupportAgreement`
+ `supportplans:CancelSupportAgreement`
+ `supportplans:CreateSupportAgreement`
+ `supportplans:GetSupportAgreement`
+ `supportplans:ListSupportAgreementRevisions`
+ `supportplans:ListSupportAgreements`
+ `supportplans:RejectSupportAgreement`
+ `supportplans:StartSupportPlanUpdate`
+ `supportplans:UpdateSupportAgreement`

For more information about the allowed actions, see the [AWSSupportPlansServiceRolePolicy](https://console.amazonaws.cn/iam/home#/policies/arn:aws:iam::aws:policy/aws-service-role/AWSSupportPlansServiceRolePolicy$jsonEditor) policy in the IAM console.

## Creating a service-linked role for Amazon Web Services Support Plans
<a name="create-service-linked-role-sup-plans"></a>

You don't need to manually create the `AWSServiceRoleForSupportPlans` role. When you create a support plan through the Support Plan Management page in the Amazon Web Services Management Console, Support Plans automatically creates this role for you.

**Note**  
If you need to create this role manually, you can use the IAM console, Amazon CLI, or the IAM API. For more information, see [Creating a service-linked role](https://docs.amazonaws.cn/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role) in the *IAM User Guide*.

## Editing a service-linked role for Amazon Web Services Support Plans
<a name="edit-service-linked-role-sup-plans"></a>

You can use IAM to edit the description for the `AWSServiceRoleForSupportPlans` service-linked role. You can't edit the trust policy or permissions policy, and you can't attach additional policies to this role. For more information, see [Editing a service-linked role](https://docs.amazonaws.cn/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the *IAM User Guide*.

## Deleting a service-linked role for Amazon Web Services Support Plans
<a name="delete-service-linked-role-sup-plans"></a>

Support Plans doesn't delete the `AWSServiceRoleForSupportPlans` service-linked role on your behalf. If you want to delete this role, you must first cancel your active support plan. To do this, contact Amazon Web Services Support. After Amazon Web Services Support confirms the cancellation, you can use the IAM console, Amazon CLI, or the IAM API to delete the role. For more information, see [Deleting a service-linked role](https://docs.amazonaws.cn/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the *IAM User Guide*.