Actions, resources, and condition keys for Amazon IAM Identity Center directory

Amazon IAM Identity Center directory (service prefix: sso-directory) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

Actions defined by Amazon IAM Identity Center directory
Resource types defined by Amazon IAM Identity Center directory
Condition keys for Amazon IAM Identity Center directory

Actions defined by Amazon IAM Identity Center directory

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Access level
AddMemberToGroup	Grants permission to add a member to a group in the directory that Amazon IAM Identity Center provides by default	Write
CompleteVirtualMfaDeviceRegistration	Grants permission to complete the creation process of a virtual MFA device	Write
CompleteWebAuthnDeviceRegistration	Grants permission to complete the registration process of a WebAuthn device	Write
CreateAlias	Grants permission to create an alias for the directory that Amazon IAM Identity Center provides by default	Write
CreateBearerToken	Grants permission to create a bearer token for a given provisioning tenant	Write
CreateExternalIdPConfigurationForDirectory	Grants permission to create an External Identity Provider configuration for the directory	Write
CreateGroup	Grants permission to create a group in the directory that Amazon IAM Identity Center provides by default	Write
CreateProvisioningTenant	Grants permission to create a provisioning tenant for a given directory	Write
CreateUser	Grants permission to create a user in the directory that Amazon IAM Identity Center provides by default	Write
DeleteBearerToken	Grants permission to delete a bearer token	Write
DeleteExternalIdPCertificate	Grants permission to delete the given external IdP certificate	Write
DeleteExternalIdPConfigurationForDirectory	Grants permission to delete an External Identity Provider configuration associated with the directory	Write
DeleteGroup	Grants permission to delete a group from the directory that Amazon IAM Identity Center provides by default	Write
DeleteMfaDeviceForUser	Grants permission to delete a MFA device by device name for a given user	Write
DeleteProvisioningTenant	Grants permission to delete the provisioning tenant	Write
DeleteUser	Grants permission to delete a user from the directory that Amazon IAM Identity Center provides by default	Write
DescribeDirectory	Grants permission to retrieve information about the directory that Amazon IAM Identity Center provides by default	Read
DescribeGroup	Grants permission to query the group data, not including user and group members	Read
DescribeGroups	Grants permission to retrieve information about groups from the directory that Amazon IAM Identity Center provides by default	Read
DescribeProvisioningTenant	Grants permission to describes the provisioning tenant	Read
DescribeUser	Grants permission to retrieve information about a user from the directory that Amazon IAM Identity Center provides by default	Read
DescribeUserByUniqueAttribute	Grants permission to describe user with a valid unique attribute represented for the user	Read
DescribeUsers	Grants permission to retrieve information about user from the directory that Amazon IAM Identity Center provides by default	Read
DisableExternalIdPConfigurationForDirectory	Grants permission to disable authentication of end users with an External Identity Provider	Write
DisableUser	Grants permission to deactivate a user in the directory that Amazon IAM Identity Center provides by default	Write
EnableExternalIdPConfigurationForDirectory	Grants permission to enable authentication of end users with an External Identity Provider	Write
EnableUser	Grants permission to activate user in the directory that Amazon IAM Identity Center provides by default	Write
GetAWSSPConfigurationForDirectory	Grants permission to retrieve the Amazon IAM Identity Center Service Provider configurations for the directory	Read
GetGroupId	Grants permission to retrieve ID information about group from the directory that Amazon IAM Identity Center provides by default	Read
GetUserId	Grants permission to retrieve ID information about user from the directory that Amazon IAM Identity Center provides by default	Read
GetUserPoolInfo	(Deprecated) Grants permission to get UserPool Info	Read
ImportExternalIdPCertificate	Grants permission to import the IdP certificate used for verifying external IdP responses	Write
IsMemberInGroup	Grants permission to check if a member is a part of the group in the directory that Amazon IAM Identity Center provides by default	Read
IsMemberInGroups	Grants permission to check if a member is a part of multiple groups in the directory that Amazon IAM Identity Center provides by default	Read
ListBearerTokens	Grants permission to list bearer tokens for a given provisioning tenant	Read
ListExternalIdPCertificates	Grants permission to list the external IdP certificates of a given directory and IdP	Read
ListExternalIdPConfigurationsForDirectory	Grants permission to list all the External Identity Provider configurations created for the directory	Read
ListGroups	Grants permission to list groups from the directory that Amazon IAM Identity Center provides by default	Read
ListGroupsForMember	Grants permission to list groups of the target member	Read
ListGroupsForUser	Grants permission to list groups for a user from the directory that Amazon IAM Identity Center provides by default	Read
ListMembersInGroup	Grants permission to retrieve all members that are part of a group in the directory that Amazon IAM Identity Center provides by default	Read
ListMfaDevicesForUser	Grants permission to list all active MFA devices and their MFA device metadata for a user	Read
ListProvisioningTenants	Grants permission to list provisioning tenants for a given directory	Read
ListUsers	Grants permission to list users from the directory that Amazon IAM Identity Center provides by default	Read
RemoveMemberFromGroup	Grants permission to remove a member that is part of a group in the directory that Amazon IAM Identity Center provides by default	Write
SearchGroups	Grants permission to search for groups within the associated directory	Read
SearchUsers	Grants permission to search for users within the associated directory	Read
StartVirtualMfaDeviceRegistration	Grants permission to begin the creation process of virtual mfa device	Write
StartWebAuthnDeviceRegistration	Grants permission to begin the registration process of a WebAuthn device	Write
UpdateExternalIdPConfigurationForDirectory	Grants permission to update an External Identity Provider configuration associated with the directory	Write
UpdateGroup	Grants permission to update information about a group in the directory that Amazon IAM Identity Center provides by default	Write
UpdateGroupDisplayName	Grants permission to update group display name update group display name response	Write
UpdateMfaDeviceForUser	Grants permission to update MFA device information	Write
UpdatePassword	Grants permission to update a password by sending password reset link via email or generating one time password for a user in the directory that Amazon IAM Identity Center provides by default	Write
UpdateUser	Grants permission to update user information in the directory that Amazon IAM Identity Center provides by default	Write
UpdateUserName	Grants permission to update user name update user name response	Write
VerifyEmail	Grants permission to verify an email address of an User	Write

Resource types defined by Amazon IAM Identity Center directory

Amazon IAM Identity Center directory does not support specifying a resource ARN in the Resource element of an IAM policy statement.

Condition keys for Amazon IAM Identity Center directory

Amazon IAM Identity Center directory has no service-specific condition keys that can be used in the Condition element of policy statements.

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon IAM Identity Center (sso)

Amazon IAM Identity Center OIDC service (sso-oauth)