Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Identity Store

Amazon Identity Store (service prefix: identitystore) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Identity Store
Actions defined by Amazon Identity Store
Resource types defined by Amazon Identity Store
Condition keys for Amazon Identity Store

API operations defined by Amazon Identity Store

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateGroup	identitystore:CreateGroup	Write
CreateGroup	sso-directory:CreateGroup	Write
CreateGroupMembership	identitystore:CreateGroupMembership	Write
CreateGroupMembership	sso-directory:AddMemberToGroup	Write
CreateUser	identitystore:CreateUser	Write
CreateUser	sso-directory:CreateUser	Write
DeleteGroup	identitystore:DeleteGroup	Write
DeleteGroup	sso-directory:DeleteGroup	Write
DeleteGroupMembership	identitystore:DeleteGroupMembership	Write
DeleteGroupMembership	sso-directory:RemoveMemberFromGroup	Write
DeleteUser	identitystore:DeleteUser	Write
DeleteUser	sso-directory:DeleteUser	Write
DescribeGroup	identitystore:DescribeGroup	Read
	sso-directory:DescribeGroup	Read
	sso-directory:DescribeGroups	Read
DescribeGroupMembership	identitystore:DescribeGroupMembership	Read
	sso-directory:ListGroupsForMember	Read
	sso-directory:ListGroupsForUser	Read
DescribeUser	identitystore:DescribeUser	Read
	sso-directory:DescribeUser	Read
	sso-directory:DescribeUsers	Read
GetGroupId	identitystore:GetGroupId	Read
GetGroupId	sso-directory:GetGroupId	Read
GetGroupMembershipId	identitystore:GetGroupMembershipId	Read
	sso-directory:ListGroupsForMember	Read
	sso-directory:ListGroupsForUser	Read
GetUserId	identitystore:GetUserId	Read
GetUserId	sso-directory:GetUserId	Read
IsMemberInGroups	identitystore:IsMemberInGroups	Read
	sso-directory:IsMemberInGroup	Read
	sso-directory:IsMemberInGroups	Read
ListGroupMemberships	identitystore:ListGroupMemberships	List
ListGroupMemberships	sso-directory:ListMembersInGroup	Read
ListGroupMembershipsForMember	identitystore:ListGroupMembershipsForMember	List
	sso-directory:ListGroupsForMember	Read
	sso-directory:ListGroupsForUser	Read
ListGroups	identitystore:ListGroups	List
	sso-directory:ListGroups	Read
	sso-directory:SearchGroups	Read
ListUsers	identitystore:ListUsers	List
	sso-directory:ListUsers	Read
	sso-directory:SearchUsers	Read
UpdateGroup	identitystore:UpdateGroup	Write
	sso-directory:UpdateGroup	Write
	sso-directory:UpdateGroupDisplayName	Write
UpdateUser	identitystore:UpdateUser	Write
	sso-directory:UpdateUser	Write
	sso-directory:UpdateUserName	Write

Actions defined by Amazon Identity Store

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddRegion	Grants permission to add a region to an IdentityStore			Write
CreateGroup	Grants permission to create a group in the specified IdentityStore	Identitystore*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	Write
CreateGroupMembership	Grants permission to create a member to a group in the specified IdentityStore	Group*	identitystore:PrimaryRegion	Write
		Identitystore*	identitystore:PrimaryRegion
		User*	identitystore:PrimaryRegion
CreateIdentityStore	Grants permission to create a new IdentityStore in an Amazon Web Services account			Write
CreateUser	Grants permission to create a user in the specified IdentityStore	Identitystore*	identitystore:PrimaryRegion identitystore:ReservedUserId identitystore:UserExternalIdIssuers	Write
DeleteGroup	Grants permission to delete a group in the specified IdentityStore	Group*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	Write
DeleteGroup		Identitystore*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	Write
DeleteGroupMembership	Grants permission to remove a member that is part of a group in the specified IdentityStore	Group*	identitystore:PrimaryRegion	Write
		GroupMembership*	identitystore:PrimaryRegion
		Identitystore*	identitystore:PrimaryRegion
		User*	identitystore:PrimaryRegion
DeleteIdentityStore	Grants permission to delete an IdentityStore			Write
DeleteUser	Grants permission to delete a user in the specified IdentityStore	Identitystore*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	Write
DeleteUser		User*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	Write
DescribeGroup	Grants permission to retrieve information about a group in the specified IdentityStore	Group*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	Read
DescribeGroup		Identitystore*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	Read
DescribeGroupMembership	Grants permission to retrieve information about a member that is part of a group in the specified IdentityStore	Group*	identitystore:PrimaryRegion	Read
		GroupMembership*	identitystore:PrimaryRegion
		Identitystore*	identitystore:PrimaryRegion
		User*	identitystore:PrimaryRegion
DescribeRegion	Grants permission to retrieve configuration details for a specific IdentityStore region		identitystore:PrimaryRegion	Read
DescribeUser	Grants permission to retrieve information about user in the specified IdentityStore	Identitystore*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	Read
DescribeUser		User*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	Read
GetGroupId	Grants permission to retrieve ID information about group in the specified IdentityStore	Group*	identitystore:PrimaryRegion	Read
GetGroupId		Identitystore*	identitystore:PrimaryRegion	Read
GetGroupMembershipId	Grants permission to retrieve ID information of a member which is part of a group in the specified IdentityStore	Group*	identitystore:PrimaryRegion	Read
		GroupMembership*	identitystore:PrimaryRegion
		Identitystore*	identitystore:PrimaryRegion
		User*	identitystore:PrimaryRegion
GetUserId	Grants permission to retrieves ID information about user in the specified IdentityStore	Identitystore*	identitystore:PrimaryRegion	Read
GetUserId		User*	identitystore:PrimaryRegion	Read
IsMemberInGroups	Grants permission to check if a member is a part of groups in the specified IdentityStore	AllGroupMemberships*	identitystore:PrimaryRegion	Read
		Group*	identitystore:PrimaryRegion
		Identitystore*	identitystore:PrimaryRegion
		User*	identitystore:PrimaryRegion
ListGroupMemberships	Grants permission to retrieve all members that are part of a group in the specified IdentityStore	AllGroupMemberships*	identitystore:PrimaryRegion	List
		Group*	identitystore:PrimaryRegion
		Identitystore*	identitystore:PrimaryRegion
ListGroupMembershipsForMember	Grants permission to list groups of the target member in the specified IdentityStore	AllGroupMemberships*	identitystore:PrimaryRegion	List
		Identitystore*	identitystore:PrimaryRegion
		User*	identitystore:PrimaryRegion
ListGroups	Grants permission to search for groups within the specified IdentityStore	AllGroups*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	List
ListGroups		Identitystore*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	List
ListRegions	Grants permission to list all regions configured for an IdentityStore		identitystore:PrimaryRegion	List
ListUsers	Grants permission to search for users in the specified IdentityStore	AllUsers*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	List
ListUsers		Identitystore*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	List
RemoveRegion	Grants permission to remove a region from an IdentityStore			Write
ReserveUser	Grants permission to reserve a user by getting a userId	Identitystore*	identitystore:PrimaryRegion	Write
UpdateGroup	Grants permission to update information about a group in the specified IdentityStore	Group*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	Write
UpdateGroup		Identitystore*	identitystore:GroupExternalIdIssuers identitystore:PrimaryRegion	Write
UpdateIdentityStore	Grants permission to update the configuration of an IdentityStore			Write
UpdateUser	Grants permission to update user information in the specified IdentityStore	Identitystore*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	Write
UpdateUser		User*	identitystore:PrimaryRegion identitystore:UserExternalIdIssuers	Write

Resource types defined by Amazon Identity Store

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
AllGroupMemberships	arn:${Partition}:identitystore:::membership/*
AllGroups	arn:${Partition}:identitystore:::group/*
AllUsers	arn:${Partition}:identitystore:::user/*
Group	arn:${Partition}:identitystore:::group/${GroupId}
GroupMembership	arn:${Partition}:identitystore:::membership/${MembershipId}
Identitystore	arn:${Partition}:identitystore::${Account}:identitystore/${IdentityStoreId}
User	arn:${Partition}:identitystore:::user/${UserId}

Condition keys for Amazon Identity Store

Amazon Identity Store defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
identitystore:GroupExternalIdIssuers	Filters access by Issuer present in ExternalIds for Group resources	ArrayOfARN
identitystore:IdentityStoreArn	Filters access by Identity Store ARN	ARN
identitystore:PrimaryRegion	Filters access by Primary Region of Identity Store	String
identitystore:ReservedUserId	Filters access by a previously reserved User ID for CreateUser operation	String
identitystore:UserExternalIdIssuers	Filters access by Issuer present in ExternalIds for User resources	ArrayOfARN
identitystore:UserId	Filters access by Identity Store User ID	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Identity and Access Management Roles Anywhere (rolesanywhere)

Amazon Identity Store Auth (identitystore-auth)