# Permissions
<a name="device-defender-detect-permissions"></a>

**Note**  
The Amazon IoT Device Defender detect feature will no longer be available to new customers starting August 31, 2026. If you would like to use the detect feature, sign up prior to August 31, 2026. To learn about alternatives to Amazon IoT Device Defender detect, see [Amazon IoT Device Defender detect feature availability change](https://docs.amazonaws.cn/iot-device-defender/latest/devguide/dd-detect-availability-change.html). There is no change to Amazon IoT Device Defender audit availability.

This section contains information about how to set up the IAM roles and policies required to manage Amazon IoT Device Defender Detect. For more information, see the [IAM User Guide](https://docs.amazonaws.cn/IAM/latest/UserGuide/).

## Give Amazon IoT Device Defender detect permission to publish alarms to an SNS topic
<a name="device-defender-detect-permissions-publish"></a>

If you use the `alertTargets` parameter in [CreateSecurityProfile](https://docs.amazonaws.cn/iot/latest/apireference/API_CreateSecurityProfile.html), you must specify an IAM role with two policies: a permissions policy and a trust policy. The permissions policy grants permission to Amazon IoT Device Defender to publish notifications to your SNS topic. The trust policy grants Amazon IoT Device Defender permission to assume the required role.

### Permission policy
<a name="detect-account-sns-permissions-policy"></a>

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": [
                "arn:aws-cn:sns:us-east-1:123456789012:{{your-topic-name}}"
            ]
        }
    ]
}
```

------

### Trust policy
<a name="detect-account-sns-trust-policy"></a>

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "iot.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

------

### Pass role policy
<a name="detect-account-passrole-policy"></a>

You also need an IAM permissions policy attached to the IAM user that allows the user to pass roles. See [Granting a User Permissions to Pass a Role to an Amazon Service](https://docs.amazonaws.cn/IAM/latest/UserGuide/id_roles_use_passrole.html).

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole"
            ],
            "Resource": "arn:aws-cn:iam::123456789012:role/Role_To_Pass"
        }
    ]
}
```

------