Dataset Management
Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.
Note
Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to SailPoint Agentic Fabric for more information.
For more information, refer to Managing Datasets and Resources for datasets, resources, owner correlation, and aggregation.
Datasets
A dataset is a named group of one or more related resources that the source aggregates together.
When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.
Note
Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.
Dataset Aggregation
Configure aggregation on the Dataset Aggregations tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to Configuring Dataset Aggregations.
Resources
A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.
In the UI, each resource appears under Dataset Management > Resources with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.
For more information, refer to Managing Resources.
Owner Correlation
Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to Configuring Owner Correlation.
Supported Datasets
Go to Dataset Management > Datasets on your AWS SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.
Note
Configure aggregation for each dataset separately. For more information, refer to Dataset Aggregation.
The connector collects AWS IAM roles and policies in the AWS IAM dataset. It collects AWS Bedrock, AWS Bedrock AgentCore, Amazon Connect Customer, and Amazon Quick, and AWS Agent Registry resources in separate datasets for agentic identity security. It collects durable IAM user credentials and AWS Secrets Manager secrets in separate datasets for credential governance.
| Dataset name | Dataset ID | Associated resources | Required license | Default schedule |
|---|---|---|---|---|
| AWS IAM | aws:iam |
AWS IAM Role, AWS Role Has Policy | Machine Identity Security | Every 12 hours |
| AWS Bedrock | aws:bedrock |
AWS Bedrock Agent Alias Version, AWS Bedrock Action Group, AWS Bedrock Knowledge Base, AWS Agent Uses Capability, AWS Agent Uses Agent, AWS Bedrock Agent Uses Role | Agentic Identity Security | Every 12 hours |
| AWS Bedrock AgentCore | aws:bedrockagentcore |
AWS Bedrock AgentCore Runtime Endpoint, AWS Bedrock AgentCore Gateway, AWS Bedrock AgentCore Gateway Target, AWS Bedrock AgentCore Credential Provider, AWS Bedrock AgentCore Inbound Access Config, AWS Bedrock AgentCore Workload Identity, and related resource links | Agentic Identity Security | Every 12 hours |
| Amazon Connect Customer | aws:connectcustomer |
Amazon Connect Customer Instance, Amazon Connect Customer Domain, Amazon Connect Customer AI Agent, Amazon Connect Customer Knowledge Base, Amazon Connect Customer Prompt, Amazon Connect Customer Guardrail, Amazon Connect Customer Tool, and Amazon Connect Customer Security Profile | Agentic Identity Security | Every 12 hours |
| Amazon Quick | aws:quick |
Amazon Quick Agent, Amazon Quick Action Connector, and related resource links | Agentic Identity Security | Every 12 hours |
| AWS Agent Registry | aws:agent-registry |
AWS Agent Registry Record and related resource links | Agentic Identity Security | Every 12 hours |
| AWS IAM Credentials | aws:iam-credentials |
IAM Access Key, CodeCommit HTTPS Credential, CodeCommit SSH Public Key, IAM Signing Certificate | SailPoint Agentic Fabric | Every 12 hours |
| AWS Secrets Manager | aws:secretsmanager |
AWS Secrets Manager Secret | SailPoint Agentic Fabric | Every 12 hours |
Supported Resources
A resource represents a type of object the connector collects from AWS, such as IAM roles, Bedrock agents, Secrets Manager, Amazon Connect Customer agents, Amazon Quick agents, AWS Agent Registry agents, AWS Agent Registry MCP servers, action groups, or credentials. Each resource defines the attributes collected for that object type, such as name, ID, or status, and how each object appears in SailPoint.
For more information, refer to Managing Resources.
Note
When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.
Under Dataset Management > Resources, the AWS source lists each object type the connector aggregates. Select a resource to review its schema on the Schema tab.
AWS IAM
The AWS IAM dataset contains the following resources and resource links:
| Resource name | Resource type | Resource ID |
|---|---|---|
| AWS IAM Role | Account | aws:iam-role |
| AWS Role Has Policy | Access | aws:role-has-policy |
For schema attribute details, refer to AWS IAM Attributes.
AWS Bedrock
The AWS Bedrock dataset contains the following resources and resource links:
| Resource name | Resource type | Resource ID |
|---|---|---|
| AWS Bedrock Agent Alias Version | Agent | aws:bedrock-agent-alias-version |
| AWS Bedrock Action Group | Capability | aws:bedrock-action-group |
| AWS Bedrock Knowledge Base | Capability | aws:bedrock-knowledge-base |
| AWS Agent Uses Capability | Access | aws:bedrock-agent-uses-capability |
| AWS Agent Uses Agent | Access | aws:bedrock-agent-uses-agent |
| AWS Bedrock Agent Uses Role | Access | aws:bedrock-agent-uses-role |
For schema attribute details, refer to AWS Bedrock Attributes.
AWS Bedrock AgentCore
The AWS Bedrock AgentCore dataset contains the following resources and resource links:
| Resource name | Resource type | Resource ID |
|---|---|---|
| AWS Bedrock AgentCore Runtime Endpoint | Agent | aws:agentcore-runtime-endpoint |
| AWS Bedrock AgentCore Gateway | Application | aws:agentcore-gateway |
| AWS Bedrock AgentCore Gateway Target | Capability | aws:agentcore-target |
| AWS Bedrock AgentCore Credential Provider | Credential | aws:agentcore-credential-provider |
| AWS Bedrock AgentCore Inbound Access Config | Credential | aws:agentcore-inbound-access-config |
| AWS Bedrock AgentCore Workload Identity | Account | aws:agentcore-workload-identity |
| AWS AgentCore Agent Uses Role | Access | aws:agentcore-agent-uses-role |
| AWS AgentCore Agent Has Workload Identity | Extends | aws:agentcore-agent-has-workload-identity |
| AWS AgentCore Application Has Workload Identity | Extends | aws:agentcore-application-has-workload-identity |
| AWS AgentCore Agent Has Inbound Access | Access | aws:agentcore-agent-has-inbound-access |
| AWS AgentCore Capability Uses Credential | Access | aws:agentcore-capability-uses-credential |
| AWS AgentCore Application Has Capability | Access | aws:agentcore-application-has-capability |
For schema attribute details, refer to AWS Bedrock AgentCore Attributes.
AWS IAM Credentials
The AWS IAM Credentials dataset contains the following resources:
| Resource name | Resource type | Resource ID |
|---|---|---|
| IAM Access Key | Credential | aws:iam-user-access-key |
| CodeCommit HTTPS Credential | Credential | aws:iam-codecommit-https-credential |
| CodeCommit SSH Public Key | Credential | aws:iam-codecommit-ssh-key |
| IAM Signing Certificate | Credential | aws:iam-signing-certificate |
For schema attribute details, refer to AWS IAM Credential Attributes.
AWS Secrets Manager
The AWS Secrets Manager dataset contains the following resource:
| Resource name | Resource type | Resource ID |
|---|---|---|
| AWS Secrets Manager Secret | Credential | aws:secretsmanager-secret |
For schema attribute details, refer to AWS Secrets Manager Attributes.
Amazon Connect Customer
The Amazon Connect Customer dataset contains the following resources and resource links:
| Resource name | Resource type | Resource ID |
|---|---|---|
| Amazon Connect Customer Instance | Application | aws:connectcustomer-instance |
| Amazon Connect Customer Domain | Application | aws:connectcustomer-assistant |
| Amazon Connect Customer AI Agent | Agent | aws:connectcustomer-ai-agent |
| Amazon Connect Customer Knowledge Base | Capability | aws:connectcustomer-knowledge-base |
| Amazon Connect Customer Prompt | Capability | aws:connectcustomer-prompt |
| Amazon Connect Customer Guardrail | Capability | aws:connectcustomer-guardrail |
| Amazon Connect Customer Tool | Capability | aws:connectcustomer-tool |
| Amazon Connect Customer Security Profile | Capability | aws:connectcustomer-security-profile |
| Amazon Connect Customer Domain Belongs To Instance | Access | aws:connectcustomer-assistant-belongs-to-instance |
| Amazon Connect Customer AI Agent Belongs To Domain | Access | aws:connectcustomer-agent-belongs-to-assistant |
| Amazon Connect Customer AI Agent Uses Knowledge Base | Access | aws:connectcustomer-agent-uses-knowledge-base |
| Amazon Connect Customer AI Agent Uses Prompt | Access | aws:connectcustomer-agent-uses-prompt |
| Amazon Connect Customer AI Agent Uses Guardrail | Access | aws:connectcustomer-agent-uses-guardrail |
| Amazon Connect Customer AI Agent Uses Tool | Access | aws:connectcustomer-agent-uses-tool |
| Amazon Connect Customer AI Agent Has Security Profile | Access | aws:connectcustomer-agent-has-security-profile |
| Amazon Connect Customer AI Agent Uses Role | Access | aws:connectcustomer-agent-uses-role |
For schema attribute details, refer to Amazon Connect Customer Attributes.
Amazon Quick
The Amazon Quick dataset contains the following resources and resource links:
| Resource name | Resource type | Resource ID |
|---|---|---|
| Amazon Quick Agent | Agent | aws:quick-agent |
| Amazon Quick Action Connector | Capability | aws:quick-action-connector |
| Amazon Quick Agent Uses Action Connector | Access | aws:quick-agent-uses-action-connector |
| Amazon Quick Agent Granted To | Access | aws:quick-agent-granted-to |
| Amazon Quick Action Connector Granted To | Access | aws:quick-action-connector-granted-to |
For schema attribute details, refer to Amazon Quick Attributes.
AWS Agent Registry
The AWS Agent Registry dataset contains the following resources and resource links:
| Resource name | Resource type | Resource ID |
|---|---|---|
| AWS Agent Registry Agent | Agent | aws:agent-registry-record-agent |
| AWS Agent Registry MCP | Application | aws:agent-registry-record-mcp |
| AWS Agent Registry Record Describes Resource | Access | aws:agent-registry-record-describes-resource |
| AWS Agent Registry Record Syncs Using Credential | Access | aws:agent-registry-record-syncs-using-credential |
For schema attribute details, refer to AWS Agent Registry Attributes.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.