Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Identity and access management for Amazon License Manager

Amazon Identity and Access Management (IAM) is an Amazon service that helps an administrator securely control access to Amazon resources. IAM administrators control who can be authenticated (signed in) and authorized (have permissions) to use Amazon resources. With IAM you can create users and groups under your Amazon account. You control the permissions that users have to perform tasks using Amazon resources. You can use IAM for no additional charge.

By default, users don't have permissions for License Manager resources and operations. To allow users to manage License Manager resources, you must create an IAM policy that explicitly grants them permissions.

When you attach a policy to a user or group of users, it allows or denies the users permission to perform the specified tasks on the specified resources. For more information, see Policies and Permissions in the IAM User Guide guide.

Create users, groups, and roles

You can create users and groups for your Amazon Web Services account and then assign them the permissions they require. As a best practice, users should acquire the permissions by assuming IAM roles. For more information on how to set up users and groups for your Amazon Web Services account, see Getting started with Amazon License Manager.

An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user in that it is an Amazon identity with permissions policies that determine what the identity can and cannot do in Amazon. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.

IAM policy structure

An IAM policy is a JSON document that consists of one or more statements. Each statement is structured as follows.

{
  "Statement":[{
    "Effect":"effect",
    "Action":"action",
    "Resource":"arn",
    "Condition":{
      "condition":{
        "key":"value"
        }
      }
    }
  ]
}

Various elements make up a statement:

Create IAM policies for License Manager

In an IAM policy statement, you can specify any API operation from any service that supports IAM. License Manager, uses the following prefixes with the name of the API operation:

For example:

For more information on the available License Manager APIs, see the following API references:

To specify multiple operations in a single statement, separate them with commas as follows:

"Action": ["license-manager:action1", "license-manager:action2"]

You can also specify multiple operations using wildcards. For example, you can specify all License Manager API operations whose name begins with the word List as follows:

"Action": "license-manager:List*"

To specify all License Manager API operations, use the * wildcard as follows:

"Action": "license-manager:*"

Example policy for an ISV using License Manager

ISVs that distribute licenses through License Manager require the following permissions:

{ 
    "Version": "2012-10-17",     
    "Statement": [ 
        { 
        "Sid": "VisualEditor0", 
        "Effect": "Allow",
        "Action": [
            "license-manager:CreateLicense", 
            "license-manager:ListLicenses", 
            "license-manager:CreateLicenseVersion", 
            "license-manager:ListLicenseVersions", 
            "license-manager:GetLicense", 
            "license-manager:DeleteLicense", 
            "license-manager:CheckoutLicense", 
            "license-manager:CheckInLicense", 
            "kms:GetPublicKey"
        ], 
        "Resource": "*"
        } 
    ] 
}

Grant permissions to users, groups, and roles

Once you have created the IAM policies you require, you must grant these permissions to your users, groups, and roles.

To provide access, add permissions to your users, groups, or roles: