# SailPoint AWS SaaS Connector Documentation > AWS SaaS Connector Documentation # Documentation # Configuring AWS ## Configuring AWS Manually If you cannot access CloudFormation, you can manually add AWS accounts within your organization. SailPoint gathers information from your AWS Organization in two steps: - First, it uses a role in the management account to get a list of all your AWS Accounts. - Then, it uses a role with the same name and external ID in each member account to collect the resources. ### Collecting AWS Resources Manually You must create an identity and access management role on your Amazon Web Services source account. This is where you will attach the policy defining what data SailPoint AWS SaaS can read. If you’re using manual IAM roles with an AWS organization, you must repeat this process to create a role in each subaccount. 1. Sign in to the Amazon Web Services Management console, and search for **IAM**. 2. Select **Roles**, then select **Create role**. 3. Select the **Custom trust policy** option. > **Screenshot** > > [![Collecting AWS Resources Manually]()]() 4. Paste the following code in the **Custom trust policy** window, replacing `` with the **External ID** provided by SailPoint in [Connection Settings](): ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::874540850173:role/ciem_universal" ] }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` 5. Confirm the trust policy contains the correct role ARN: - Commercial accounts: `arn:aws:iam::874540850173:role/ciem_universal` - GovCloud accounts: `arn:aws-us-gov:iam::229634586956:role/ciem_universal` 6. Select **Require external ID** and enter the same **External ID** provided by SailPoint. 7. Select **Next** to be taken to **Add Permissions**. 8. Select **Create policy** and then select the **JSON** tab. 9. Replace the JSON text with the required permissions for: - [Non Multiple-group Object Source Policies]() - [Multiple Group Object Source Policies]() - [Machine Identity Governance Policies]() 10. Select **Next: Tags**. Tags are optional. 11. Select **Next: Review**. Enter an appropriate name and description for the role. 12. Select **Create policy**. The new policy will be displayed in the list of IAM policies. 13. Select the new policy checkbox and select **Next**. 14. Enter a role name and details. Review the information and select **Create Role**. You will be redirected to the roles page. 15. Search for and select the new role to find its role name. You will need this role name to connect your AWS source accounts with the SailPoint AWS SaaS Source. 16. If you are creating manual IAM roles to work in an AWS organization, repeat the IAM role creation process for each subaccount. > [!CAUTION] > > - If you do not include a new role in every subaccount you may have gaps in your data. > - All roles must use the same external ID provided by SailPoint in the connection settings of the AWS SaaS source. > [!IMPORTANT] > > You must verify your configuration before connecting your source. Refer to [Verifying Your AWS Configuration](<#verifying-your-aws-configuration>) for the verification steps. ## Configuring AWS Automatically SailPoint provides CloudFormation templates to automate the creation of IAM roles and policies, a CloudTrail trail, and an S3 Bucket. Depending on your configuration preference and existing infrastructure, different templates are available. ### Collecting Data from All AWS Accounts SailPoint gathers information from your AWS Organization in two steps: - First, it uses a role in the management account to get a list of all your AWS Accounts. - Then, it uses a role with the same name and external ID in each member account to collect the resources. > **Note** > > To ensure CIEM data processing works correctly, the role names used for both StackSets and Stacks must be consistent. ### Automated Setup with CloudFormation SailPoint offers CloudFormation templates to simplify the setup. These templates create the necessary roles with the minimum required permissions: - A primary role is created in the management account to list all other accounts. - Identical roles are created in each member account for SailPoint to assume. To successfully configure everything using CloudFormation, you must follow all the steps for both StackSets (for multiple accounts) and Stacks (for single accounts). For more information, refer to [CloudFormation Deployment Methods](<#cloudformation-deployment-methods>). ### CloudFormation Deployment Methods #### Collecting Resources from All AWS Accounts Using StackSet The following process creates a role and policies with minimum privileges in the management account. Create an in-line policy on the role for reading resource data from your AWS cloud. To enable inventory collection in all accounts: 1. Follow the AWS directions to [create a StackSet]() with service-managed permissions. 1. Upload the appropriate cloud formation template: > **AWS accounts only** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags", > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy", > > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > **AWS accounts with Activity Insights** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags", > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudtrail:LookupEvents", > > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > **AWS accounts with Agent Discovery** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags", > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy", > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey", > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:GetAgentRuntimeEndpoint", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListWorkloadIdentities", > "bedrock-agentcore:GetWorkloadIdentity", > "bedrock-agentcore:ListOauth2CredentialProviders", > "bedrock-agentcore:GetApiKeyCredentialProvider", > "bedrock-agentcore:ListApiKeyCredentialProviders", > "bedrock-agentcore:GetOauth2CredentialProvider", > > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > **AWS accounts with CIEM and Activity Insights** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "*", > "Action": [ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:GetGateway", > "bedrock-agentcore:GetGatewayTarget", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListGateways", > "bedrock-agentcore:ListGatewayTargets", > "bedrock:GetAgent", > "bedrock:GetAgentAlias", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentActionGroups", > "bedrock:ListAgentAliases", > "bedrock:ListAgentKnowledgeBases", > "bedrock:ListAgents", > "bedrock:ListAgentVersions", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > > ```json > { > "AWSTemplateFormatVersion" : "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources" : { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": > { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": [ > "arn:aws-us-gov:iam::229634586956:role/ciem_universal" > ] > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ { > "PolicyName" : "SailPointAWSPolicy", > "PolicyDocument" : { > "Version":"2012-10-17", > "Statement":[ > { > "Effect":"Allow", > "Resource":"*", > "Action":[ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:GetGateway", > "bedrock-agentcore:GetGatewayTarget", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListGateways", > "bedrock-agentcore:ListGatewayTargets", > "bedrock:GetAgent", > "bedrock:GetAgentAlias", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentActionGroups", > "bedrock:ListAgentAliases", > "bedrock:ListAgentKnowledgeBases", > "bedrock:ListAgents", > "bedrock:ListAgentVersions", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > > > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > ``` > **AWS accounts with CIEM, Activity Insights, and Agent Discovery** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "*", > "Action": [ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "iam:ListUsers", > "iam:ListAccessKeys", > "iam:GetAccessKeyLastUsed", > "iam:ListServiceSpecificCredentials", > "iam:ListSSHPublicKeys", > "iam:ListSigningCertificates", > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey", > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:GetAgentRuntimeEndpoint", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListWorkloadIdentities", > "bedrock-agentcore:GetWorkloadIdentity", > "bedrock-agentcore:ListOauth2CredentialProviders", > "bedrock-agentcore:GetApiKeyCredentialProvider", > "bedrock-agentcore:ListApiKeyCredentialProviders", > "bedrock-agentcore:GetOauth2CredentialProvider", > "connect:ListInstances", > "connect:DescribeInstance", > "connect:ListIntegrationAssociations", > "connect:ListEntitySecurityProfiles", > "connect:DescribeSecurityProfile", > "wisdom:GetAssistant", > "wisdom:ListAIAgents", > "wisdom:ListAIAgentVersions", > "wisdom:GetAIAgent", > "wisdom:GetAssistantAssociation", > "wisdom:GetKnowledgeBase", > "wisdom:GetAIPrompt", > "wisdom:GetAIGuardrail", > "quicksight:ListAgents", > "quicksight:DescribeAgent", > "quicksight:DescribeAgentPermissions", > "quicksight:ListActionConnectors", > "quicksight:DescribeActionConnector", > "quicksight:DescribeActionConnectorPermissions", > "agent-registry:ListRegistries", > "agent-registry:ListRegistryRecords", > "agent-registry:GetRegistryRecord", > "agent-registry:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > > > **Important** > > > > - Amazon Bedrock AgentCore agents are not supported in AWS GovCloud. For more information about the support of this regional service, refer to [AWS Regions]() in the AWS documentation. > > - Amazon Connect Customer agent discovery actions aren't included in this AWS GovCloud template. The following list of Amazon Connect instance APIs is still valid for partition. > > > > - `connect:ListInstances` > > - `connect:ListIntegrationAssociations` > > - `"connect:DescribeInstance"` > > - `"connect:ListEntitySecurityProfiles"` > > - `"connect:DescribeSecurityProfile"` > > > > Confirm regional availability for Amazon Q in Connect and the `wisdom:*` APIs before adding the following actions: > > > > - `"wisdom:GetAssistant"` > > - `"wisdom:ListAIAgents"` > > - `"wisdom:ListAIAgentVersions"` > > - `"wisdom:GetAIAgent"` > > - `"wisdom:GetAssistantAssociation"` > > - `"wisdom:GetKnowledgeBase"` > > - `"wisdom:GetAIPrompt"` > > - `"wisdom:GetAIGuardrail"` > > - Amazon Quick agent discovery actions aren't included in this AWS GovCloud template. Confirm regional availability for Amazon Quick and the `quicksight:*` APIs before adding the actions listed in [Machine Identity Governance Policies](). > > - AWS Agent Registry discovery actions aren't included in this AWS GovCloud template. Confirm regional availability for AWS Agent Registry and the `agent-registry:*` APIs before adding the actions listed in [Machine Identity Governance Policies](). > > ```json > { > "AWSTemplateFormatVersion" : "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources" : { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": > { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": [ > "arn:aws-us-gov:iam::229634586956:role/ciem_universal" > ] > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ { > "PolicyName" : "SailPointAWSPolicy", > "PolicyDocument" : { > "Version":"2012-10-17", > "Statement":[ > { > "Effect":"Allow", > "Resource":"*", > "Action":[ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "iam:ListUsers", > "iam:ListAccessKeys", > "iam:GetAccessKeyLastUsed", > "iam:ListServiceSpecificCredentials", > "iam:ListSSHPublicKeys", > "iam:ListSigningCertificates", > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey", > "agent-registry:ListRegistries", > "agent-registry:ListRegistryRecords", > "agent-registry:GetRegistryRecord", > "agent-registry:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > ``` 2. Under **Deployment regions**, select a single region. Because IAM resources are account-level objects, they do not need to be created per region. This setup creates the roles and policies required to collect activity data from all AWS member accounts. #### Collecting Resources from All AWS Accounts Using Stack The following process creates a role and policies with minimum privileges in the management account. Create an in-line policy on the role for reading resource data from your AWS cloud. To enable inventory collection in all accounts: 1. Follow the AWS directions to [create a stack]() in the root management account where logs are captured. 2. Upload the appropriate cloud formation template: > **AWS accounts only** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags", > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy", > > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > **AWS accounts with Activity Insights** > > > **Note** > > > > Ensure the role name matches the StackSet name previously specified. > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags", > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudtrail:LookupEvents", > > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > **AWS accounts with Agent Discovery** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags", > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy", > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey", > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:GetAgentRuntimeEndpoint", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListWorkloadIdentities", > "bedrock-agentcore:GetWorkloadIdentity", > "bedrock-agentcore:ListOauth2CredentialProviders", > "bedrock-agentcore:GetApiKeyCredentialProvider", > "bedrock-agentcore:ListApiKeyCredentialProviders", > "bedrock-agentcore:GetOauth2CredentialProvider", > > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > **AWS accounts with CIEM and Activity Insights** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "*", > "Action": [ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > > ```json > { > "AWSTemplateFormatVersion" : "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources" : { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": > { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": [ > "arn:aws-us-gov:iam::229634586956:role/ciem_universal" > ] > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ { > "PolicyName" : "SailPointAWSPolicy", > "PolicyDocument" : { > "Version":"2012-10-17", > "Statement":[ > { > "Effect":"Allow", > "Resource":"*", > "Action":[ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > ``` > **AWS accounts with CIEM, Activity Insights, and Agent Discovery** > > ```json > { > "AWSTemplateFormatVersion": "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources": { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": "arn:aws:iam::874540850173:role/ciem_universal" > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ > { > "PolicyName": "SailPointAWSPolicy", > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Resource": "*", > "Action": [ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "iam:ListUsers", > "iam:ListAccessKeys", > "iam:GetAccessKeyLastUsed", > "iam:ListServiceSpecificCredentials", > "iam:ListSSHPublicKeys", > "iam:ListSigningCertificates", > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey", > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:GetAgentRuntimeEndpoint", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListWorkloadIdentities", > "bedrock-agentcore:GetWorkloadIdentity", > "bedrock-agentcore:ListOauth2CredentialProviders", > "bedrock-agentcore:GetApiKeyCredentialProvider", > "bedrock-agentcore:ListApiKeyCredentialProviders", > "bedrock-agentcore:GetOauth2CredentialProvider", > "connect:ListInstances", > "connect:ListIntegrationAssociations", > "wisdom:GetAssistant", > "wisdom:ListAIAgents", > "wisdom:ListAIAgentVersions", > "wisdom:GetAIAgent", > "quicksight:ListAgents", > "quicksight:DescribeAgent", > "quicksight:DescribeAgentPermissions", > "quicksight:ListActionConnectors", > "quicksight:DescribeActionConnector", > "quicksight:DescribeActionConnectorPermissions", > "agent-registry:ListRegistries", > "agent-registry:ListRegistryRecords", > "agent-registry:GetRegistryRecord", > "agent-registry:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > } > ``` > > > **Note** > > > > Amazon Bedrock AgentCore agents are not supported in AWS GovCloud. For more information about the support of this regional service, refer to [AWS Regions]() in the AWS documentation. > > > **Important** > > > > - Amazon Bedrock AgentCore agents are not supported in AWS GovCloud. For more information about the support of this regional service, refer to [AWS Regions]() in the AWS documentation. > > - Amazon Connect Customer agent discovery actions aren't included in this AWS GovCloud template. The following list of Amazon Connect instance APIs is still valid for partition. > > > > - `connect:ListInstances` > > - `connect:ListIntegrationAssociations` > > - `"connect:DescribeInstance"` > > - `"connect:ListEntitySecurityProfiles"` > > - `"connect:DescribeSecurityProfile"` > > > > Confirm regional availability for Amazon Q in Connect and the `wisdom:*` APIs before adding the following actions: > > > > - `"wisdom:GetAssistant"` > > - `"wisdom:ListAIAgents"` > > - `"wisdom:ListAIAgentVersions"` > > - `"wisdom:GetAIAgent"` > > - `"wisdom:GetAssistantAssociation"` > > - `"wisdom:GetKnowledgeBase"` > > - `"wisdom:GetAIPrompt"` > > - `"wisdom:GetAIGuardrail"` > > - Amazon Quick agent discovery actions aren't included in this AWS GovCloud template. Confirm regional availability for Amazon Quick and the `quicksight:*` APIs before adding the actions listed in [Machine Identity Governance Policies](). > > - AWS Agent Registry discovery actions aren't included in this AWS GovCloud template. Confirm regional availability for AWS Agent Registry and the `agent-registry:*` APIs before adding the actions listed in [Machine Identity Governance Policies](). > > ```json > { > "AWSTemplateFormatVersion" : "2010-09-09", > "Parameters": { > "RoleName": { > "Default": "SailPointAWSRole", > "Description": "Role with this name will be created.", > "Type": "String" > }, > "ExternalId": { > "Description": "Unique external ID needed for assuming role.", > "Type": "String" > }, > "RolePolicyName": { > "Default": "SailPointAWSPolicy", > "Description": "Policy to allow SailPoint Role to read objects under the specified Cloud Trail Bucket.", > "Type": "String" > }, > "BucketName": { > "Description": "Name of existing Bucket with CloudTrail logs.", > "Type": "String" > } > }, > "Resources" : { > "SailPointAWSPolicy": { > "Type": "AWS::IAM::ManagedPolicy", > "DeletionPolicy": "Retain", > "Properties": { > "Description": "Policy for created for AWS Organizations", > "Path": "/", > "Roles": [ > { > "Ref": "SailPointAWSRole" > } > ], > "PolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Action": [ > "s3:GetBucketLocation", > "s3:ListBucket" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > } > }, > { > "Action": [ > "s3:GetObject" > ], > "Effect": "Allow", > "Resource": { > "Fn::Join": [ > "/", > [ > { > "Fn::Join": [ > ":", > [ > "arn:aws:s3::", > { > "Ref": "BucketName" > } > ] > ] > }, > "*" > ] > ] > } > } > ] > } > } > }, > "SailPointAWSRole": { > "Type": "AWS::IAM::Role", > "DeletionPolicy": "Retain", > "Properties": { > "RoleName": > { > "Ref": "RoleName" > }, > "AssumeRolePolicyDocument": { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { > "AWS": [ > "arn:aws-us-gov:iam::229634586956:role/ciem_universal" > ] > }, > "Action": "sts:AssumeRole", > "Condition": { > "StringEquals": { > "sts:ExternalId": { > "Ref": "ExternalId" > } > } > } > } > ] > }, > "Policies": [ { > "PolicyName" : "SailPointAWSPolicy", > "PolicyDocument" : { > "Version":"2012-10-17", > "Statement":[ > { > "Effect":"Allow", > "Resource":"*", > "Action":[ > "organizations:Describe*", > "organizations:List*", > "iam:Get*", > "iam:List*", > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteLoginProfile", > "cloudtrail:DescribeTrails", > "cloudtrail:GetEventSelectors", > "cloudtrail:GetTrailStatus", > "cloudtrail:ListTags", > "cloudtrail:LookupEvents", > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudwatch:Describe*", > "cloudwatch:ListTagsForResource", > "dynamodb:DescribeGlobalTable", > "dynamodb:DescribeTable", > "dynamodb:DescribeTimeToLive", > "dynamodb:ListGlobalTables", > "dynamodb:ListStreams", > "dynamodb:ListTables", > "dynamodb:ListTagsOfResource", > "ec2:Describe*", > "ec2:DescribeTransitGatewayAttachments", > "ec2:DescribeTransitGatewayMulticastDomains", > "ec2:DescribeTransitGatewayPeeringAttachments", > "ec2:DescribeTransitGatewayRouteTables", > "ec2:DescribeTransitGatewayVpcAttachments", > "ec2:DescribeTransitGateways", > "ec2:GetManagedPrefixListAssociations", > "ec2:GetManagedPrefixListEntries", > "ec2:GetTransitGatewayAttachmentPropagations", > "ec2:GetTransitGatewayMulticastDomainAssociations", > "ec2:GetTransitGatewayPrefixListReferences", > "ec2:GetTransitGatewayRouteTableAssociations", > "ec2:GetTransitGatewayRouteTablePropagations", > "elasticloadbalancing:Describe*", > "kms:Describe*", > "kms:Get*", > "kms:List*", > "lambda:GetFunctionConfiguration", > "lambda:GetFunctionEventInvokeConfig", > "lambda:GetLayerVersionPolicy", > "lambda:GetPolicy", > "lambda:List*", > "rds:Describe*", > "rds:ListTagsForResource", > "s3:GetAccessPoint", > "s3:GetAccessPointPolicy", > "s3:GetAccessPointPolicyStatus", > "s3:GetAccountPublicAccessBlock", > "s3:GetAnalyticsConfiguration", > "s3:GetBucket*", > "s3:GetEncryptionConfiguration", > "s3:GetInventoryConfiguration", > "s3:GetObjectAcl", > "s3:GetObjectVersionAcl", > "s3:GetReplicationConfiguration", > "s3:ListAccessPoints", > "s3:ListAllMyBuckets", > "sns:GetTopicAttributes", > "sns:ListSubscriptions", > "sns:ListSubscriptionsByTopic", > "sns:ListTagsForResource", > "sns:ListTopics", > "sqs:GetQueueAttributes", > "sqs:ListDeadLetterSourceQueues", > "sqs:ListQueueTags", > "sqs:ListQueues", > "tag:GetResources", > "tag:GetTagKeys", > "iam:GenerateCredentialReport", > "iam:GenerateServiceLastAccessedDetails", > "iam:SimulateCustomPolicy", > "iam:SimulatePrincipalPolicy", > "iam:ListUsers", > "iam:ListAccessKeys", > "iam:GetAccessKeyLastUsed", > "iam:ListServiceSpecificCredentials", > "iam:ListSSHPublicKeys", > "iam:ListSigningCertificates", > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey", > "agent-registry:ListRegistries", > "agent-registry:ListRegistryRecords", > "agent-registry:GetRegistryRecord", > "agent-registry:ListTagsForResource", > "iam:DeleteGroup", > "iam:DeleteGroupPolicy" > > ] > } > ] > } > } > ], > "Path": "/" > } > } > }, > "Outputs": { > "SailPointAWSRoleARN": { > "Description": "SailPoint AWS Role ARN", > "Value": { > "Fn::GetAtt": [ > "SailPointAWSRole", > "Arn" > ] > } > }, > "SailPointAWSRoleExternalId": { > "Description": "SailPoint AWS Role External ID", > "Value": { > "Ref": "ExternalId" > } > } > } > ``` ### Enabling Data Collection After the AWS roles are configured, you must take the final steps in your SailPoint tenant: - First, enable inventory collection for all accounts. - After that, you can choose to include activity data. ## Verifying Your AWS Configuration When you have finished connecting your AWS accounts, you must verify that the configuration was successful. To verify your configuration: 1. In the AWS Console **IAM** service, select **Roles**. 2. Search for the IAM role created by CloudFormation. Select the role and save its name and ARN. For example, `arn:aws:iam::xxxxxxxxxxxx:role/SailPointAWSRole` 3. Select the **Trust Relationships** tab and confirm the principal displays: `874540850173` for Commercial accounts `229634586956` for GovCloud accounts 4. Select **Policies** and search for the IAM role created by CloudFormation. For example, `SailPointAWSRole` 5. Select **Permissions** and verify the bucket name in the JSON. 6. Ensure the policy allows `s3:GetBucketLocation` and `s3:ListBucket` actions on the CloudTrail bucket, and the `s3:GetObject` action on the S3 bucket contents. ### Viewing a Summary of the Details 1. Go to **CloudFormation \> Stacks**, and select the stack. 2. Select the **Parameters** tab to view the key values for your configuration. > [!NOTE] > > **Screenshot** > > [![Viewing a Summary of the Details]()]() # Connecting SailPoint and AWS SaaS To connect SailPoint with AWS, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 9. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 10. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings Securely connect SailPoint and to the Amazon Web Services SaaS source. The Amazon Web Services SaaS connector supports the IAM Role Authentication Method. Permissions for the role must be configured in the management AWS account and a trust relationship must be established. > [!IMPORTANT] > > To manage organizational entities like service control policies, organization units, or AWS accounts, you must provide the Management Account ID and role permissions must be configured in the management AWS account. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Enter the IAM **Role Name** that has authorization to call all the AWS accounts to be aggregated. This role must have the permissions specified in [Prerequisites]() and [IAM Role Authentication Method](). 2. Enter the **Region** name for the AWS data center. The default region is `us-east-1`. 3. The **External ID** is auto populated. You must copy the external ID provided by SailPoint, then paste it when configuring AWS. 4. Enter the **Management Account ID** for the organization. This is required to manage all AWS accounts as well as organization entities like service control policies, organization units. 5. Select **Save**. ## Aggregation Settings 1. Enter the number of records per page in **Page Size**. > **Screenshot** > > [![Aggregation Settings]()]() - Default: 10 - Minimum: 1 - Maximum: 1000 ### Switch Role You can change the role session name to a user friendly name that appears in the CloudTrail logs. You can specify the role and the duration of the session for that role to be used. For more information about how AWS handles this feature, refer to [Switching to a role (console)]() in the AWS documentation. > [!NOTE] > > This configuration has been moved from the API to the user interface. > [!NOTE] > > **Screenshot** > > [![Switch Role]()]() 1. Enter the role name to be used in **Role Session Name**. 2. Specify the length of the session in **Role Session Duration in Seconds**. - Default: 3600 (1 hour) - Maximum: 43200 (12 hours) - Minimum: 3600 (1 hour) 3. Select **Save**. ## Machine Identity Governance Settings > [!NOTE] > > Your organization must have SailPoint Agentic Fabric to discover agents. AWS IAM Credentials and AWS Secrets Manager credential discovery require SAF Datasets. Contact your Customer Success team for more information. For more information, refer to [SailPoint Agentic Fabric](). Enable and configure aggregation settings for machine identities in AWS Bedrock, AWS Bedrock AgentCore, AWS IAM, AWS Secrets Manager, Amazon Connect Customer, and Amazon Quick, and AWS Agent Registry. ### Prerequisites Before you can configure agent governance in the connector, you must set the agent governance policies to configure how the connector handles these accounts. For more information, refer to [Machine Identity Governance Policies](). > [!NOTE] > > **Screenshot** > > [![Machine Identity Governance Settings]()]() 1. Select **Enable Amazon Bedrock Agents** to include AWS Bedrock AI agents in governance. 2. Enter the **Regions** code (e.g. us-east-1) to look for AWS Bedrock AI agents. Press **Enter** to add the region name into a growing list. For more information about the support of this regional service, refer to [AWS Regions]() in the AWS documentation. 3. Select **Enable Amazon Bedrock AgentCore Agents** to include AWS Bedrock AgentCore AI agents in governance. 4. Enter the **Regions** code (e.g. us-east-1) to look for AWS Bedrock AgentCore AI agents. Press **Enter** to add the region name into a growing list. For more information about the support of this regional service, refer to [AWS Regions]() in the AWS documentation. 5. Select **Enable AWS Secrets Manager** to include AWS Secrets Manager in governance. 6. Enter the **Regions** code (e.g. us-east-1) to look for AWS Secrets Manager secrets. Press **Enter** to add the region name into a growing list. For more information about the support of this regional service, refer to [AWS Regions]() in the AWS documentation. 7. Select the **Enable Amazon Connect Customer Agents** toggle to discover Amazon Connect Customer AI agents. 8. Enter a region code in **Regions** (for example, `us-east-1`). Refer to [Amazon Connect endpoints and quotas]() for regional availability. The connector discovers Amazon Connect Customer AI agents only in regions where Amazon Q in Connect is enabled for the instance. > **Note** > > The linked document is not maintained by SailPoint and is subject to change without notice. 9. Select the **Enable Amazon Quick** toggle to discover Amazon Quick agents and action connectors. 10. Enter a region code in **Regions** (for example, `us-east-1`). The connector discovers Amazon Quick resources in the following regions: - `us-east-1` - `us-west-2` - `ap-southeast-2` - `ap-northeast-1` - `eu-central-1` - `eu-west-1` - `eu-west-2` Refer to [Amazon QuickSight endpoints and quotas]() for regional availability. > **Note** > > The linked document is not maintained by SailPoint and is subject to change without notice. 11. Select the **Enable AWS Agent Registry** toggle to discover Agent Registry catalog records. > **Note** > > The AWS Agent Registry dataset (`aws:agent-registry`) is aggregated by the AWS SaaS connector through resource listing. It is not routed to Cloud Infrastructure Entitlement Management (CIEM). 12. Enter a region code in **Regions** (for example, `us-east-1`). The connector discovers AWS Agent Registry records in the following regions: - `us-east-1` - `us-west-2` - `eu-west-1` - `ap-northeast-1` - `ap-southeast-2` Refer to [Supported AWS Regions]() for regional availability. > **Note** > > The linked document is not maintained by SailPoint and is subject to change without notice. ### Configuring IAM Credential Discovery Enable and configure aggregation of durable IAM user credentials as non-human identities (NHIs). > [!NOTE] > > IAM credential discovery supports aggregation only. Enabling, disabling, and deleting credential resources are not supported. > [!NOTE] > > **Screenshot** > > [![Configuring IAM Credential Discovery]()]() 1. Select the **Enable AWS IAM Credentials** toggle to discover IAM user credentials. 2. Select the credential types to aggregate: - **Include Access Keys** - **Include CodeCommit HTTPS Credentials** - **Include CodeCommit SSH Keys** - **Include Signing Certificates** During source onboarding, all four credential types are selected by default. IAM access keys are enabled during source creation. 3. Select **Save**. 4. Run aggregation for the **AWS IAM Credentials** dataset. ## Additional Settings Configure the settings for retry attempts when a timeout error occurs. For detailed information about AWS recommendations, refer to [Retries and backoff in the Amazon Builder's Library](). > [!NOTE] > > The linked document is not maintained by SailPoint and is subject to change without notice. > [!NOTE] > > **Screenshot** > > [![Additional Settings]()]() 1. In **Maximum Retry Limit**, specify the number of retries to attempt before the connection terminates with an error log message. 2. In **Base Delay in Milliseconds**, specify the amount of time to wait before retrying the connection. The base delay exponentially increases after every retry attempt. For example, if the default base delay is 10 seconds, subsequent retry attempts will be 20 seconds, then 40 seconds, and so on. Default: 500 3. In **Throttled Base Delay in Milliseconds**, specify the amount of time to wait if the initial retry fails. This time duration increases after every retry attempt. The value automatically increases exponentially with each failed attempt. Default: 1000 4. In **Maximum Backoff Time in Milliseconds**, specify the amount of time to wait between attempts. After the delay reaches this maximum limit, the time between retries will stop increasing. Default: 20000 ### Provisioning Configuration > [!NOTE] > > **Screenshot** > > [![Provisioning Configuration]()]() 1. In **Change Password Policy ARN**, provide the Amazon Resource Name (ARN) used to create AWS accounts or to handle password changes. 2. Select **Save**. ## Activity Data Insights SailPoint pulls in activity data in the form of events like user logins, password changes, and content updates within the application. You can view an identity’s activity data within an application to discover trends for that user. Activity Insights supports activity of IAM Users from the respective AWS Accounts. This allows you to gather account information and activity data from Amazon Web Services > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). The AWS SaaS connector requires `AWSCloudTrail_ReadOnlyAccess` permissions to pull activity data for AWS sources. For more information, refer to [AWSCloudTrail\_ReadOnlyAccess]() in *Required Permissions*. > [!NOTE] > > Activity Data Insights (ADI) is only supported for Commercial accounts that are not supported by GovCloud accounts. To configure Activity Insights, complete the following: > [!NOTE] > > **Screenshot** > > [![Activity Data Insights]()]() 1. To opt-in to the ADI feature and receive activity data, enable the **Enable Activity Insights** option. To opt-out, leave the option disabled. 2. Select **Save**. > [!NOTE] > > **IAM role trust policy requirement for Activity Insights** > > Activity Insights collects data using SailPoint's `ciem_universal role`, which passes session tags when assuming your AWS source role. To allow this, the trust policy of the role you created for the AWS SaaS source must permit `sts:TagSession` in addition to `sts:AssumeRole`. > > Update your AWS source role's trust policy like given below: > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Principal": { "AWS": ["arn:aws:iam::874540850173:role/ciem_universal"] }, > "Action": ["sts:AssumeRole", "sts:TagSession"], > "Condition": { "StringEquals": { "sts:ExternalId": "" } } > } > ] > } > ``` ## Cloud Infrastructure Entitlement Management (CIEM) Settings > [!IMPORTANT] > > You must have a CIEM license to enable cloud governance features. Contact your SailPoint Customer Success Manager to request access. For more information, refer to the [SailPoint CIEM Overview](). > [!NOTE] > > For additional information on CIEM settings, refer to [Configuring Amazon Web Services](). 1. Select **Enable Cloud Infrastructure Entitlement Management (CIEM)** to view access to cloud resources and infrastructure granted through entitlements. > **Screenshot** > > [![Cloud Infrastructure Entitlement Management (CIEM) Settings]()]() 2. Enter the **CloudTrail ARN** for an organization or individual member account. You can add up to 150 CloudTrail ARNs, separated by commas. 3. Enter the AWS **CloudTrail Bucket Account ID** where the CloudTrail bucket is hosted. 4. Select **Save**. ## AWS Account Settings 1. In the **AWS Accounts** field, use the drop-down list to select the accounts you want to include in aggregation. > **Screenshot** > > [![AWS Account Settings]()]() 2. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # AWS Agent Registry Attributes Schema attributes for resources in the **AWS Agent Registry** dataset (`aws:agent-registry`). The registry record is the catalog identity collected in this dataset. The registry container is an access boundary in AWS and isn't collected as a resource. ## Resource Nodes | Resource name | Resource type | Resource ID | Identity attribute | Display attribute | | --- | --- | --- | --- | --- | | AWS Agent Registry Agent | `std:agent` | `aws:agent-registry-record-agent` | `recordArn` | `displayName` | | AWS Agent Registry MCP | `std:application` | `aws:agent-registry-record-mcp` | `recordArn` | `displayName` | AWS `recordType` `AGENT` maps to resource ID `aws:agent-registry-record-agent`, resource type `std:agent`, and subtype `AGENT`. AWS `recordType` `MCP` maps to resource ID `aws:agent-registry-record-mcp` and resource type `std:application`. MCP records don't include the `type` attribute. `SKILL` and `CUSTOM` record types aren't collected. > [!NOTE] > > The connector collects registry records only. It doesn't collect registry catalogs as resource nodes. It collects records in every lifecycle status, including `DRAFT`, `PENDING_APPROVAL`, and `APPROVED`. The approved-only discoverable view isn't used for inventory. `discoverable` is `true` only when `status` is `APPROVED`, and that value doesn't filter inventory. ## AWS Agent Registry Agent and MCP Both record types share the attributes below. The resource ID and resource type differ. The `type` attribute is set only on AGENT records. **Resource ID**: `aws:agent-registry-record-agent` or `aws:agent-registry-record-mcp` **Resource type**: `std:agent` or `std:application` **Identity attribute**: `recordArn` **Display attribute**: `displayName` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The registry record ARN. | | `recordArn` | string | The native registry record ARN. | | `recordId` | string | The short registry record identifier. | | `registryArn` | string | The ARN of the containing registry. The connector stores this as an attribute on the record and doesn't collect the registry as a resource. | | `name` | string | The customer-specified name unique within the registry. | | `displayName` | string | The human-readable label. When AWS omits it, the connector uses name. | | `description` | string | Free-text description. | | `spDescription` | string | Record description, mirrored for SailPoint description promotion. | | `recordType` | string | AWS semantic type when collected: AGENT or MCP. SKILL and CUSTOM aren't collected. | | `recordVersion` | string | The customer version string. | | `status` | string | The registry record lifecycle status. The connector collects records in every lifecycle status. | | `discoverable` | boolean | true only when status is APPROVED. This attribute doesn't filter inventory. | | `descriptorKey` | string | Populated primary descriptor: a2aAgentCard, mcpServer, agentSkillsDefinition, or custom. | | `descriptorData` | string | The primary descriptor payload. The connector stores metadata only and never executes this payload. | | `descriptorDataSchemaVersion` | string | The schema version declared by the primary descriptor. | | `tools` | string | The MCP tool inventory payload for MCP records. | | `a2aSkills` | string | The JSON array from A2A agent card skills for AGENT records. | | `syncSourceUrl` | string | The registered descriptor synchronization URL. | | `syncCredentialProviderArn` | string | The IAM or OAuth credential provider ARN used for synchronization. | | `syncCredentialProviderType` | string | The non-secret credential provider type. | | `tags` | string | The resource tags on the record. | | `createdAt` | string | The creation time in ISO-8601 format. | | `updatedAt` | string | The last modification time in ISO-8601 format. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID that owns the resource. | | `spBusinessApplication` | string | The SailPoint business application. Always AWS Agent Registry. | | `type` | string | Set only on AGENT records. The value is AGENT. MCP records don't include type. | ## Resource Links Resource links are `std:access` links resolved by AWS aggregation. Native resource ARNs referenced by registry records, such as Bedrock agents, AgentCore resources, or IAM roles, and sync credential provider ARNs are external targets. The connector emits links only. It doesn't duplicate those native Bedrock, AgentCore, or IAM resources in this dataset. The syncs-using-credential link includes a `syncCredentialProviderArn` attribute. | Resource name | Resource type | Resource ID | Identity form | | --- | --- | --- | --- | | AWS Agent Registry Record Describes Resource | `std:access` | `aws:agent-registry-record-describes-resource` | `aws:agent-registry-record-describes-resource#{Record ARN}#{Native Resource ARN}` | | AWS Agent Registry Record Syncs Using Credential | `std:access` | `aws:agent-registry-record-syncs-using-credential` | `aws:agent-registry-record-syncs-using-credential#{Record ARN}#{Credential Provider ARN}` | # AWS Bedrock Attributes Schema attributes for resources in the **AWS Bedrock** dataset. ## AWS Bedrock Agent Alias Version **Resource ID**: `aws:bedrock-agent-alias-version` **Resource type**: `std:agent` **Identity attribute**: `agentAliasArn` **Display attribute**: `agentAliasName` **Features**: `ACTIVATE, DEACTIVATE` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The agent alias ARN. | | `disabled` | boolean | Whether the agent alias is disabled. | | `agentAliasArn` | string | The ARN of the agent alias. | | `agentAliasId` | string | The ID of the agent alias. | | `agentAliasName` | string | The name of the agent alias. | | `agentAliasStatus` | string | The current status of the agent alias. | | `aliasInvocationState` | string | The current invocation state of the agent alias. | | `aliasClientToken` | string | Client token for the alias. | | `aliasCreatedAt` | string | Creation time of the alias. | | `aliasUpdatedAt` | string | Last update time of the alias. | | `agentVersion` | string | The routed agent version (or DRAFT for draft aliases). | | `provisionedThroughput` | string | Provisioned throughput allocated to this alias configuration. | | `agentArn` | string | ARN of the underlying base agent. | | `agentCollaboration` | string | Agent collaboration configuration status. | | `agentId` | string | ID of the underlying agent. | | `agentName` | string | Name of the underlying agent. | | `agentResourceRoleArn` | string | The IAM role ARN assumed by the agent. | | `versionStatus` | string | Status of the agent version (set when a pinned version is resolved). | | `agentStatus` | string | Status of the underlying agent (set when falling back to DRAFT agent). | | `agentClientToken` | string | Client token of the underlying agent. | | `agentCreatedAt` | string | Creation time of the agent/version. | | `customerEncryptionKeyArn` | string | KMS key used by the agent. | | `agentDescription` | string | Description of the underlying agent/version. | | `foundationModel` | string | The foundation model utilized by the agent. | | `orchestrationType` | string | The type of orchestration the agent uses. | | `preparedAt` | string | Time the agent version was prepared. | | `agentUpdatedAt` | string | Last update time of the agent/version. | | `tags` | string | The tags applied to the agent alias version. | | `spStatus` | string | SailPoint-normalized agent status. | | `spDescription` | string | Description sourced from the alias, version, or agent (first non-null). | | `awsRegion` | string | AWS region where the alias version resides. | | `awsAccountId` | string | AWS account ID where the alias version resides. | | `spBusinessApplication` | string | SailPoint business application of the agent. Always AWS Bedrock. | ## AWS Bedrock Action Group **Resource ID**: `aws:bedrock-action-group` **Resource type**: `std:capability` **Identity attribute**: `actionGroupArn` **Display attribute**: `actionGroupName` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The action group ARN. | | `actionGroupArn` | string | The ARN of the action group. | | `actionGroupId` | string | The unique ID of the action group. | | `actionGroupName` | string | Name of the action group. | | `actionGroupState` | string | Current state of the action group. | | `agentId` | string | ID of the agent this group belongs to. | | `agentVersion` | string | Version of the agent this group belongs to. | | `actionGroupExecutor` | string | Execution destination value (for example, Lambda ARN). | | `clientToken` | string | The client token used to create the group. | | `createdAt` | string | Creation time of the action group. | | `description` | string | Description of the action group. | | `parentActionSignature` | string | Parent action signature configuration. | | `updatedAt` | string | Last update time of the action group. | | `tags` | string | The tags applied to the action group. | | `spStatus` | string | SailPoint-normalized agent status. | | `spDescription` | string | Action group description (mirrors description field). | | `awsRegion` | string | AWS region where the action group resides. | | `awsAccountId` | string | AWS account ID where the action group resides. | | `spBusinessApplication` | string | SailPoint business application of the action group. Always AWS Bedrock. | | `type` | string | Capability type (always TOOL for action groups). | ## AWS Bedrock Knowledge Base **Resource ID**: `aws:bedrock-knowledge-base` **Resource type**: `std:capability` **Identity attribute**: `knowledgeBaseArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The knowledge base ARN. | | `knowledgeBaseArn` | string | The knowledge base ARN. | | `knowledgeBaseId` | string | The ID of the knowledge base. | | `name` | string | The knowledge base name. | | `knowledgeBaseStatus` | string | Status of the knowledge base. | | `roleArn` | string | The IAM role ARN associated with the knowledge base. | | `description` | string | Knowledge base description. | | `createdAt` | string | Creation time. | | `updatedAt` | string | Last update time. | | `knowledgeBaseConfigurationType` | string | The type of knowledge base configuration. | | `embeddingModelArn` | string | ARN of the embedding model used. | | `tags` | string | The tags applied to the knowledge base. | | `spStatus` | string | SailPoint-normalized knowledge base status. | | `spDescription` | string | Knowledge base description (mirrors description field). | | `awsRegion` | string | AWS region where the knowledge base resides. | | `awsAccountId` | string | AWS account ID where the knowledge base resides. | | `spBusinessApplication` | string | SailPoint business application of the knowledge base. Always AWS Bedrock. | | `type` | string | Capability type (always MCP for knowledge bases). | | `storageConfigurationType` | string | Storage backend type for the knowledge base. | | `s3VectorsIndexArn` | string | ARN of the S3 Vectors index (when storage type is S3\_VECTORS). | | `s3VectorsIndexName` | string | Name of the S3 Vectors index. | | `s3VectorsVectorBucketArn` | string | ARN of the S3 vector bucket. | ## AWS Agent Uses Capability **Resource ID**: `aws:bedrock-agent-uses-capability` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:bedrock-agent-uses-capability\#{Agent Alias ARN}\#{Capability ARN}. | ## AWS Agent Uses Agent **Resource ID**: `aws:bedrock-agent-uses-agent` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:bedrock-agent-uses-agent\#{Supervisor Agent Alias ARN}\#{Collaborator Agent Alias ARN}. | | `relayConversationHistory` | string | Relay conversation history setting. | ## AWS Bedrock Agent Uses Role **Resource ID**: `aws:bedrock-agent-uses-role` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:bedrock-agent-uses-role\#{Agent Alias ARN}\#{Role ARN}. | # AWS Bedrock AgentCore Attributes Schema attributes for resources in the **AWS Bedrock AgentCore** dataset. ## AWS Bedrock AgentCore Runtime Endpoint **Resource ID**: `aws:agentcore-runtime-endpoint` **Resource type**: `std:agent` **Identity attribute**: `agentRuntimeEndpointArn` **Display attribute**: `endpointName` **Features**: `ACTIVATE, DEACTIVATE` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The agent runtime endpoint ARN. | | `disabled` | boolean | Whether the agent runtime endpoint is disabled. | | `agentRuntimeEndpointArn` | string | Endpoint ARN. | | `agentRuntimeArn` | string | Base agent runtime ARN. | | `endpointId` | string | Endpoint ID. | | `endpointName` | string | Endpoint name. | | `endpointDescription` | string | Description. | | `endpointStatus` | string | Endpoint status. | | `liveVersion` | string | The version of the runtime currently live. | | `targetVersion` | string | The version targeted for deployment. | | `endpointCreatedAt` | string | Creation time. | | `endpointLastUpdatedAt` | string | Last update time. | | `agentRuntimeVersion` | string | Agent runtime version. | | `agentRuntimeId` | string | Agent runtime ID. | | `agentRuntimeName` | string | Agent runtime name. | | `runtimeDescription` | string | Runtime description. | | `runtimeStatus` | string | Runtime agent status. | | `runtimeLastUpdatedAt` | string | Runtime last update time. | | `tags` | string | The tags applied to the AWS Bedrock AgentCore Runtime Endpoint. | | `spStatus` | string | SailPoint-normalized runtime endpoint status. | | `spDescription` | string | Description sourced from the endpoint or runtime version (first non-null). | | `awsRegion` | string | AWS region where the runtime endpoint resides. | | `awsAccountId` | string | AWS account ID where the runtime endpoint resides. | | `spBusinessApplication` | string | SailPoint business application of the runtime endpoint. Always AWS Bedrock AgentCore. | ## AWS Bedrock AgentCore Gateway **Resource ID**: `aws:agentcore-gateway` **Resource type**: `std:application` **Identity attribute**: `gatewayArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The gateway ARN. | | `gatewayArn` | string | The gateway ARN. | | `gatewayId` | string | The gateway ID. | | `name` | string | The gateway name. | | `description` | string | The gateway description. | | `gatewayUrl` | string | The resolvable URL for the gateway. | | `roleArn` | string | The IAM role ARN used by the gateway. | | `authorizerType` | string | The authorizer configuration type. | | `authorizerDiscoveryUrl` | string | The extracted discovery URL for the authorizer. | | `policyEngineArn` | string | The policy engine ARN applied to the gateway. | | `protocolType` | string | The API protocol type. | | `exceptionLevel` | string | The exception tracking/error level. | | `kmsKeyArn` | string | The KMS key ARN used for encryption. | | `gatewayStatus` | string | Gateway status. | | `createdAt` | string | Creation time. | | `updatedAt` | string | Last update time. | | `workloadIdentityArn` | string | The associated workload identity ARN. | | `tags` | string | The tags applied to the gateway. | | `spStatus` | string | SailPoint-normalized gateway status. | | `spDescription` | string | Gateway description (mirrors description field). | | `awsRegion` | string | AWS region where the gateway resides. | | `awsAccountId` | string | AWS account ID where the gateway resides. | | `spBusinessApplication` | string | SailPoint business application of the gateway. Always AWS Bedrock AgentCore. | ## AWS Bedrock AgentCore Gateway Target **Resource ID**: `aws:agentcore-target` **Resource type**: `std:capability` **Identity attribute**: `targetArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The gateway target ARN. | | `targetArn` | string | The target ARN. | | `name` | string | Target name. | | `description` | string | Target description. | | `gatewayArn` | string | The ARN of the gateway this target belongs to. | | `targetId` | string | Target ID. | | `targetStatus` | string | Target status. | | `createdAt` | string | Creation time. | | `updatedAt` | string | Last update time. | | `lastSynchronizedAt` | string | Time the target was last synchronized. | | `type` | string | Type. | | `mcpTargetType` | string | Derived MCP target type. | | `spStatus` | string | SailPoint-normalized target status. | | `spDescription` | string | Target description (mirrors description field). | | `awsRegion` | string | AWS region where the gateway target resides. | | `awsAccountId` | string | AWS account ID where the gateway target resides. | | `spBusinessApplication` | string | SailPoint business application of the target. Always AWS Bedrock AgentCore. | ## AWS Bedrock AgentCore Credential Provider **Resource ID**: `aws:agentcore-credential-provider` **Resource type**: `std:credential` **Identity attribute**: `credentialProviderArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The credential provider ARN. | | `credentialProviderArn` | string | Credential provider ARN. | | `name` | string | Name of the provider. | | `apiKeySecretArn` | string | The ARN to the API key Secrets Manager secret. | | `callbackUrl` | string | OAuth callback URL. | | `credentialProviderVendor` | string | Provider vendor identity. | | `clientSecretArn` | string | Secret ARN containing the OAuth client secret. | | `createdTime` | string | Creation time. | | `lastUpdatedTime` | string | Last update time. | | `tags` | string | The tags applied to the credential provider. | | `awsRegion` | string | AWS region where the credential provider resides. | | `awsAccountId` | string | AWS account ID where the credential provider resides. | | `spBusinessApplication` | string | SailPoint business application of the credential provider. Always AWS Bedrock AgentCore. | ## AWS Bedrock AgentCore Inbound Access Config **Resource ID**: `aws:agentcore-inbound-access-config` **Resource type**: `std:credential` **Identity attribute**: `agentRuntimeArn` **Display attribute**: `agentRuntimeName` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The inbound access config identity. | | `agentRuntimeArn` | string | ARN of the agent runtime. | | `agentRuntimeName` | string | Name of the agent runtime. | | `authorizerDiscoveryUrl` | string | The extracted discovery URL for the authorizer. | | `allowedAudience` | array | Allowed audience. | | `allowedClients` | array | Allowed clients. | | `allowedScopes` | array | Allowed scopes. | | `tags` | string | The tags applied to the inbound access config. | | `awsRegion` | string | AWS region where the inbound access config resides. | | `awsAccountId` | string | AWS account ID where the inbound access config resides. | | `spBusinessApplication` | string | SailPoint business application of the inbound access config. Always AWS Bedrock AgentCore. | ## AWS Bedrock AgentCore Workload Identity **Resource ID**: `aws:agentcore-workload-identity` **Resource type**: `std:account` **Identity attribute**: `workloadIdentityArn` **Display attribute**: `name` **Classification**: `machine` | Attribute | Type | Description | | --- | --- | --- | | `classification` | string | The classification of the account (for example, machine). | | `identity` | string | The workload identity ARN. | | `workloadIdentityArn` | string | The workload identity ARN. | | `name` | string | Name of the workload identity. | | `createdTime` | string | Creation time. | | `lastUpdatedTime` | string | Last update time. | | `tags` | string | The tags applied to the workload identity. | | `awsRegion` | string | AWS region where the workload identity resides. | | `awsAccountId` | string | AWS account ID where the workload identity resides. | | `spBusinessApplication` | string | SailPoint business application of the workload identity. Always AWS Bedrock AgentCore. | ## AWS AgentCore Agent Uses Role **Resource ID**: `aws:agentcore-agent-uses-role` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:agentcore-agent-uses-role\#{Agent Alias ARN}\#{Role ARN}. | ## AWS AgentCore Agent Has Workload Identity **Resource ID**: `aws:agentcore-agent-has-workload-identity` **Resource type**: `std:extends` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:agentcore-agent-has-workload-identity\#{Agent Runtime Endpoint ARN}\#{Workload Identity ARN}. | ## AWS AgentCore Application Has Workload Identity **Resource ID**: `aws:agentcore-application-has-workload-identity` **Resource type**: `std:extends` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:agentcore-application-has-workload-identity\#{Gateway ARN}\#{Workload Identity ARN}. | | `awsRegion` | string | AWS region associated with the link. | ## AWS AgentCore Agent Has Inbound Access **Resource ID**: `aws:agentcore-agent-has-inbound-access` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:agentcore-agent-has-inbound-access\#{Agent Runtime Endpoint ARN}\#{Agent Runtime ARN}/InboundAccess. | | `awsRegion` | string | AWS region associated with the link. | ## AWS AgentCore Capability Uses Credential **Resource ID**: `aws:agentcore-capability-uses-credential` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:agentcore-capability-uses-credential\#{Gateway Target ARN}\#{Credential Provider ARN}. | ## AWS AgentCore Application Has Capability **Resource ID**: `aws:agentcore-application-has-capability` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:agentcore-application-has-capability\#{Gateway ARN}\#{Gateway Target ARN}. | # Amazon Connect Customer Attributes Schema attributes for resources in the **Amazon Connect Customer** dataset. ## Resource Nodes | Resource name | Resource type | Resource ID | Identity attribute | Display attribute | | --- | --- | --- | --- | --- | | Amazon Connect Customer Instance | `std:application` | `aws:connectcustomer-instance` | `instanceArn` | `instanceAlias` | | Amazon Connect Customer Domain | `std:application` | `aws:connectcustomer-assistant` | `assistantArn` | `name` | | Amazon Connect Customer AI Agent | `std:agent` | `aws:connectcustomer-ai-agent` | `aiAgentArn` | `agentName` | | Amazon Connect Customer Knowledge Base | `std:capability` | `aws:connectcustomer-knowledge-base` | `knowledgeBaseArn` | `name` | | Amazon Connect Customer Prompt | `std:capability` | `aws:connectcustomer-prompt` | `promptArn` | `name` | | Amazon Connect Customer Guardrail | `std:capability` | `aws:connectcustomer-guardrail` | `guardrailArn` | `name` | | Amazon Connect Customer Tool | `std:capability` | `aws:connectcustomer-tool` | `toolId` | `toolName` | | Amazon Connect Customer Security Profile | `std:capability` | `aws:connectcustomer-security-profile` | `securityProfileArn` | `name` | For AI agent and capability nodes, `type` is the SailPoint subtype `AGENT`, `MCP`, or `TOOL`. The `category` attribute contains the AWS AI agent kind, such as `ORCHESTRATION`, `ANSWER_RECOMMENDATION`, or `MANUAL_SEARCH`. Instance and domain resources don't use the subtype attribute. ## Amazon Connect Customer Instance **Resource ID**: `aws:connectcustomer-instance` **Resource type**: `std:application` **Identity attribute**: `instanceArn` **Display attribute**: `instanceAlias` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The Connect instance ARN. | | `instanceArn` | string | The Amazon Connect instance ARN. | | `instanceId` | string | The Connect instance ID. | | `instanceAlias` | string | The display name of the Connect instance. | | `instanceStatus` | string | The status of the Connect instance. | | `identityManagementType` | string | The Connect identity management or identity provider type. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | ## Amazon Connect Customer Domain The Amazon Connect console uses **domain** for the object that the API calls an **assistant**. **Resource ID**: `aws:connectcustomer-assistant` **Resource type**: `std:application` **Identity attribute**: `assistantArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The Amazon Connect Customer domain ARN. | | `assistantArn` | string | The domain / assistant ARN. | | `assistantId` | string | The domain / assistant ID. | | `name` | string | The domain / assistant display name. | | `status` | string | The domain status. | | `capabilityType` | string | The domain capability type, such as V2. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | ## Amazon Connect Customer AI Agent The connector aggregates one node for each published AI agent version. It doesn't aggregate draft or `$LATEST` versions. The identity is the version-qualified ARN. **Resource ID**: `aws:connectcustomer-ai-agent` **Resource type**: `std:agent` **Identity attribute**: `aiAgentArn` **Display attribute**: `agentName` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The AI agent ARN. Published versions use a version-qualified ARN. SYSTEM agents that AWS doesn't expose as numbered versions use an unqualified ARN. | | `aiAgentArn` | string | The AI agent ARN. Published versions use a version-qualified ARN. SYSTEM agents without numbered versions use an unqualified ARN without the `:$LATEST` suffix. | | `aiAgentId` | string | The base AI agent ID. | | `agentName` | string | The AI agent name and version. CUSTOMER agents use `{name}:{version}`, such as `SupportOrchestrator:2`. SYSTEM agents use `{name}:LATEST`. | | `agentDescription` | string | The AI agent description. | | `status` | string | The lifecycle status, such as ACTIVE. This attribute isn't a soft-disable setting. | | `type` | string | The SailPoint subtype. Always AGENT. | | `category` | string | The AI agent kind, such as ORCHESTRATION, ANSWER\_RECOMMENDATION, or MANUAL\_SEARCH. | | `origin` | string | The agent origin: SYSTEM or CUSTOMER. | | `locale` | string | The agent locale. | | `versionNumber` | string | The published version number. This value is empty for SYSTEM agents that AWS doesn't expose as numbered versions. | | `lastModified` | string | The last modification time in ISO-8601 format. | | `tags` | string | The comma-separated agent tags, such as `env:prod,team:support`. | | `roleArn` | string | The Connect instance service role ARN from `DescribeInstance.ServiceRole`. This value can link to `aws:iam-role`. | | `inboundCredentials` | string | The non-secret inbound credential metadata. | | `suggestedMessages` | string | The suggested messages. | | `spStatus` | string | The SailPoint-normalized agent status. | | `spDescription` | string | The SailPoint description, which matches `agentDescription`. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | ## Amazon Connect Customer Knowledge Base **Resource ID**: `aws:connectcustomer-knowledge-base` **Resource type**: `std:capability` **Identity attribute**: `knowledgeBaseArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The Amazon Connect Customer knowledge base ARN. | | `knowledgeBaseArn` | string | The Amazon Connect Customer knowledge base ARN. | | `knowledgeBaseId` | string | The Amazon Connect Customer knowledge base ID. | | `name` | string | The Amazon Connect Customer knowledge base display name. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | | `type` | string | The SailPoint subtype. Always MCP. | ## Amazon Connect Customer Prompt **Resource ID**: `aws:connectcustomer-prompt` **Resource type**: `std:capability` **Identity attribute**: `promptArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The Amazon Connect Customer prompt ARN. | | `promptArn` | string | The Amazon Connect Customer prompt ARN. | | `promptId` | string | The Amazon Connect Customer prompt ID. | | `name` | string | The Amazon Connect Customer prompt display name. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | | `type` | string | The SailPoint subtype. Always MCP. | ## Amazon Connect Customer Guardrail **Resource ID**: `aws:connectcustomer-guardrail` **Resource type**: `std:capability` **Identity attribute**: `guardrailArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The Amazon Connect Customer guardrail ARN. | | `guardrailArn` | string | The Amazon Connect Customer guardrail ARN. | | `guardrailId` | string | The Amazon Connect Customer guardrail ID. | | `name` | string | The Amazon Connect Customer guardrail display name. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | | `type` | string | The SailPoint subtype. Always MCP. | ## Amazon Connect Customer Tool **Resource ID**: `aws:connectcustomer-tool` **Resource type**: `std:capability` **Identity attribute**: `toolId` **Display attribute**: `toolName` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The Amazon Connect Customer tool ID. | | `toolId` | string | The unique AWS tool ID. | | `toolName` | string | The Amazon Connect Customer tool display name. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | | `type` | string | The SailPoint subtype. Always TOOL. | ## Amazon Connect Customer Security Profile **Resource ID**: `aws:connectcustomer-security-profile` **Resource type**: `std:capability` **Identity attribute**: `securityProfileArn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The Amazon Connect Customer security profile ARN. | | `securityProfileArn` | string | The Amazon Connect Customer security profile ARN. | | `securityProfileId` | string | The Amazon Connect Customer security profile ID. | | `name` | string | The Amazon Connect Customer security profile display name. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID where the resource resides. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Connect Customer. | | `type` | string | The SailPoint subtype. Always TOOL. | ## Resource Links | Resource name | Resource type | Resource ID | Identity form | | --- | --- | --- | --- | | Amazon Connect Customer Domain Belongs To Instance | `std:access` | `aws:connectcustomer-assistant-belongs-to-instance` | `aws:connectcustomer-assistant-belongs-to-instance#{Assistant ARN}#{Instance ARN}` | | Amazon Connect Customer AI Agent Belongs To Domain | `std:access` | `aws:connectcustomer-agent-belongs-to-assistant` | `aws:connectcustomer-agent-belongs-to-assistant#{AI Agent ARN}#{Assistant ARN}` | | Amazon Connect Customer AI Agent Uses Knowledge Base | `std:access` | `aws:connectcustomer-agent-uses-knowledge-base` | `aws:connectcustomer-agent-uses-knowledge-base#{AI Agent ARN}#{Knowledge Base ARN}` | | Amazon Connect Customer AI Agent Uses Prompt | `std:access` | `aws:connectcustomer-agent-uses-prompt` | `aws:connectcustomer-agent-uses-prompt#{AI Agent ARN}#{Prompt ARN}` | | Amazon Connect Customer AI Agent Uses Guardrail | `std:access` | `aws:connectcustomer-agent-uses-guardrail` | `aws:connectcustomer-agent-uses-guardrail#{AI Agent ARN}#{Guardrail ARN}` | | Amazon Connect Customer AI Agent Uses Tool | `std:access` | `aws:connectcustomer-agent-uses-tool` | `aws:connectcustomer-agent-uses-tool#{AI Agent ARN}#{Tool ARN}` | | Amazon Connect Customer AI Agent Has Security Profile | `std:access` | `aws:connectcustomer-agent-has-security-profile` | `aws:connectcustomer-agent-has-security-profile#{AI Agent ARN}#{Security Profile ARN}` | | Amazon Connect Customer AI Agent Uses Role | `std:access` | `aws:connectcustomer-agent-uses-role` | `aws:connectcustomer-agent-uses-role#{AI Agent ARN}#{Role ARN}` | # AWS IAM Attributes Schema attributes for resources in the **AWS IAM** dataset. ## AWS IAM Role **Resource ID**: `aws:iam-role` **Resource type**: `std:account` **Identity attribute**: `arn` **Display attribute**: `roleName` **Classification**: `machine` | Attribute | Type | Description | | --- | --- | --- | | `classification` | string | The classification of the account (for example, machine). | | `identity` | string | The role ARN. | | `arn` | string | The ARN of the role. | | `roleName` | string | The name of the role. | | `roleId` | string | The ID of the role. | | `path` | string | The path of the role. | | `createDate` | string | The creation date of the role. | | `tags` | string | The tags applied to the role. | | `roleLastUsedDate` | string | The last used date of the role. | | `roleLastUsedRegion` | string | The region the role was last used in. | | `assumeRolePolicyDocument` | string | URL-decoded policy document. | | `awsRegion` | string | AWS region where the role resides. | | `awsAccountId` | string | AWS account ID where the role resides. | ## AWS Role Has Policy **Resource ID**: `aws:role-has-policy` **Resource type**: `std:access` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Unique identifier of the form aws:role-has-policy\#{Role ARN}\#{Policy ARN or Inline ID}. | | `from` | object | | | `to` | object | | | `linkResolvedBy` | string | ciem-aggregation | # AWS IAM Credential Attributes Schema attributes for resources in the **AWS IAM Credentials** dataset. ## IAM Access Key **Resource ID**: `aws:iam-user-access-key` **Resource type**: `std:credential` **Identity attribute**: `credentialId` **Display attribute**: `accessKeyId` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The aggregation identity, which matches `credentialId`. | | `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{AccessKeyId}`. | | `credentialType` | string | The credential type. Always `AWS_IAM_ACCESS_KEY`. | | `accessKeyId` | string | The native access key ID. The connector does not collect the secret access key. | | `ownerName` | string | The owning IAM user name. | | `ownerArn` | string | The owning IAM user ARN. | | `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. | | `status` | string | The AWS status, `Active` or `Inactive`. | | `disabled` | boolean | Whether the status is `Inactive`. | | `createDate` | string | The creation time in ISO-8601 format. | | `lastUsedDate` | string | The last-used date reported by AWS. Omitted when AWS has no record. | | `lastUsedService` | string | The last-used AWS service name. The AWS `N/A` value is omitted. | | `lastUsedRegion` | string | The last-used AWS Region. The AWS `N/A` value is omitted. | | `displayName` | string | The credential display label. | | `resourceUrl` | string | The IAM console security credentials link. | | `awsAccountId` | string | AWS account ID where the credential resides. | | `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. | | `awsRegion` | string | AWS region where the credential resides. Always `global`. | | `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. | ## CodeCommit HTTPS Credential **Resource ID**: `aws:iam-codecommit-https-credential` **Resource type**: `std:credential` **Identity attribute**: `credentialId` **Display attribute**: `serviceUserName` > [!NOTE] > > AWS does not provide last-use or rotation field for CodeCommit HTTPS credentials. The password is not returned by the list API. | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The aggregation identity, which matches `credentialId`. | | `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{ServiceSpecificCredentialId}`. | | `credentialType` | string | The credential type. Always `AWS_CODECOMMIT_HTTPS_CREDENTIAL`. | | `serviceSpecificCredentialId` | string | The native service-specific credential ID. | | `serviceName` | string | The AWS service name. Always `codecommit.amazonaws.com`. | | `serviceUserName` | string | The generated Git user name. | | `ownerName` | string | The owning IAM user name. | | `ownerArn` | string | The owning IAM user ARN. | | `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. | | `status` | string | The AWS status, `Active` or `Inactive`. | | `disabled` | boolean | Whether the status is `Inactive`. | | `createDate` | string | The creation time in ISO-8601 format. | | `displayName` | string | The credential display label. | | `resourceUrl` | string | The IAM console security credentials link. | | `awsAccountId` | string | AWS account ID where the credential resides. | | `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. | | `awsRegion` | string | AWS region where the credential resides. Always `global`. | | `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. | ## CodeCommit SSH Public Key **Resource ID**: `aws:iam-codecommit-ssh-key` **Resource type**: `std:credential` **Identity attribute**: `credentialId` **Display attribute**: `sshPublicKeyId` > [!NOTE] > > The connector does not collect the public key body or fingerprint during aggregation. | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The aggregation identity, which matches `credentialId`. | | `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{SSHPublicKeyId}`. | | `credentialType` | string | The credential type. Always `AWS_CODECOMMIT_SSH_KEY`. | | `sshPublicKeyId` | string | The native SSH public key ID. | | `ownerName` | string | The owning IAM user name. | | `ownerArn` | string | The owning IAM user ARN. | | `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. | | `status` | string | The AWS status, `Active` or `Inactive`. | | `disabled` | boolean | Whether the status is `Inactive`. | | `uploadDate` | string | The upload time in ISO-8601 format. | | `displayName` | string | The credential display label. | | `resourceUrl` | string | The IAM console security credentials link. | | `awsAccountId` | string | AWS account ID where the credential resides. | | `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. | | `awsRegion` | string | AWS region where the credential resides. Always `global`. | | `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. | ## IAM Signing Certificate **Resource ID**: `aws:iam-signing-certificate` **Resource type**: `std:credential` **Identity attribute**: `credentialId` **Display attribute**: `certificateId` > [!NOTE] > > The certificate PEM body returned by the list is discarded immediately without being stored. | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The aggregation identity, which matches `credentialId`. | | `credentialId` | string | The credential ID in the format `{awsAccountId}:{credentialType}:{UserName}:{CertificateId}`. | | `credentialType` | string | The credential type. Always `AWS_IAM_SIGNING_CERTIFICATE`. | | `certificateId` | string | The native signing certificate ID. | | `ownerName` | string | The owning IAM user name. | | `ownerArn` | string | The owning IAM user ARN. | | `ownerPrincipalType` | string | The owner principal type. Always `IAM_USER`. | | `status` | string | The AWS status, `Active` or `Inactive`. | | `disabled` | boolean | Whether the status is `Inactive`. | | `uploadDate` | string | The upload time in ISO-8601 format. | | `displayName` | string | The credential display label. | | `resourceUrl` | string | The IAM console security credentials link. | | `awsAccountId` | string | AWS account ID where the credential resides. | | `awsPartition` | string | The AWS partition, such as `aws` or `aws-us-gov`. | | `awsRegion` | string | AWS region where the credential resides. Always `global`. | | `spBusinessApplication` | string | SailPoint business application for the credential. Always `AWS IAM`. | # Amazon Quick Attributes Schema attributes for resources in the **Amazon Quick** dataset. ## Resource Nodes | Resource name | Resource type | Resource ID | Identity attribute | Display attribute | | --- | --- | --- | --- | --- | | Amazon Quick Agent | `std:agent` | `aws:quick-agent` | `arn` | `name` | | Amazon Quick Action Connector | `std:capability` | `aws:quick-action-connector` | `arn` | `name` | On agent and capability nodes, `type` is the SailPoint subtype `AGENT` or `TOOL`. The `category` attribute on an action connector contains the AWS connector category. > [!NOTE] > > The connector collects agents and action connectors only. It doesn't collect spaces, flows, knowledge bases, or data sources. ## Amazon Quick Agent **Resource ID**: `aws:quick-agent` **Resource type**: `std:agent` **Identity attribute**: `arn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The agent ARN. | | `arn` | string | The agent ARN. | | `agentId` | string | The short identifier of the agent. | | `name` | string | The display name of the agent. | | `spDescription` | string | The agent description. | | `agentStatus` | string | The operational health of the agent: `ACTIVE`, `UPDATING`, `FAILED`, or `CREATING`. | | `agentLifecycle` | string | The publication state of the agent: `PREVIEW` or `PUBLISHED`. | | `creator` | string | The creator identifier returned by AWS. The connector doesn't create a resource link for the creator. | | `createdAt` | string | The creation time in ISO-8601 format. | | `updatedAt` | string | The last update time in ISO-8601 format. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID that owns the resource. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Quick. | | `type` | string | The SailPoint subtype. Always `AGENT`. | ## Amazon Quick Action Connector **Resource ID**: `aws:quick-action-connector` **Resource type**: `std:capability` **Identity attribute**: `arn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | The action connector ARN. | | `arn` | string | The action connector ARN. | | `actionConnectorId` | string | The short identifier of the action connector. | | `name` | string | The display name of the action connector. | | `description` | string | The action connector description. | | `category` | string | The connector category from the AWS `type` field. | | `status` | string | The provisioning status of the action connector. | | `enabledActions` | array | The outbound actions enabled on the action connector. | | `vpcConnectionArn` | string | The VPC connection ARN, when present. The connector doesn't create a resource link for the VPC connection. | | `createdAt` | string | The creation time in ISO-8601 format. | | `updatedAt` | string | The last update time in ISO-8601 format. | | `awsRegion` | string | The AWS region where the resource resides. | | `awsAccountId` | string | The AWS account ID that owns the resource. | | `spBusinessApplication` | string | The SailPoint business application. Always Amazon Quick. | | `type` | string | The SailPoint subtype. Always `TOOL`. | ## Resource Links Grant links include an `actions` attribute that lists the permissions granted to the principal. The identity of a grant link includes a hash of those actions. The principal on a grant link is a user, group, namespace, or IAM role ARN, which the connector doesn't collect as an Amazon Quick resource. | Resource name | Resource type | Resource ID | Identity form | | --- | --- | --- | --- | | Amazon Quick Agent Uses Action Connector | `std:access` | `aws:quick-agent-uses-action-connector` | `aws:quick-agent-uses-action-connector#{Agent ARN}#{Action Connector ARN}` | | Amazon Quick Agent Granted To | `std:access` | `aws:quick-agent-granted-to` | `aws:quick-agent-granted-to#{Agent ARN}#{Principal ARN}#{Actions Hash}` | | Amazon Quick Action Connector Granted To | `std:access` | `aws:quick-action-connector-granted-to` | `aws:quick-action-connector-granted-to#{Action Connector ARN}#{Principal ARN}#{Actions Hash}` | # AWS Secrets Manager Attributes Schema attributes for resources in the **AWS Secrets Manager** dataset. ## AWS Secrets Manager Secret **Resource ID**: `aws:secretsmanager-secret` **Resource type**: `std:credential` **Identity attribute**: `arn` **Display attribute**: `name` | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Amazon Resource Name of the secret. | | `arn` | string | Amazon Resource Name of the secret. | | `name` | string | Friendly name of the secret. | | `description` | string | Description of the secret. | | `awsAccountId` | string | AWS account ID where the secret resides. | | `awsRegion` | string | AWS region where the secret resides. | | `createdDate` | string | Date the secret was created. | | `deletedDate` | string | Date deletion of the secret was requested. | | `kmsKeyId` | string | The KMS key used to encrypt the secret value. | | `lastAccessedDate` | string | Date the secret value was last retrieved. | | `lastChangedDate` | string | Date the secret was last modified. | | `lastRotatedDate` | string | Date the secret was last rotated. | | `nextRotationDate` | string | Date the secret is next scheduled to rotate. | | `owningService` | string | AWS service that created and manages the secret, if any. | | `primaryRegion` | string | Primary region of a replicated secret. | | `rotationEnabled` | boolean | Whether automatic rotation is enabled for the secret. | | `rotationLambdaARN` | string | ARN of the Lambda function that rotates the secret. | | `rotationAutomaticallyAfterDays` | string | Number of days between automatic rotations of the secret. | | `rotationDuration` | string | Length of the rotation window for the secret. | | `rotationScheduleExpression` | string | Schedule expression that defines when the secret rotates. | | `externalSecretRotationRoleArn` | string | ARN of the role used for externally managed rotation. | | `externalSecretRotationMetadata` | string | Metadata describing externally managed rotation of the secret. | | `type` | string | Type of the secret. | | `versionIdsToStages` | string | Version identifiers of the secret mapped to their staging labels. | | `tags` | string | The tags applied to the secret. | | `replicationStatus` | string | Replication state of the secret in each replica region. | | `resourcePolicy` | string | JSON resource policy returned by GetResourcePolicy. | | `spBusinessApplication` | string | SailPoint business application of the secret. Always AWS Secrets Manager. | # Dataset Management Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history. > [!NOTE] > > Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric]() for more information. For more information, refer to [Managing Datasets and Resources]() for datasets, resources, owner correlation, and aggregation. ## Datasets A *dataset* is a named group of one or more related resources that the source aggregates together. When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources. > [!NOTE] > > Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them. ### Dataset Aggregation Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](). ## Resources A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model. In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation. For more information, refer to [Managing Resources](). ### Owner Correlation Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](). ## Supported Datasets Go to **Dataset Management \> Datasets** on your AWS SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation. > [!NOTE] > > Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](). The connector collects AWS IAM roles and policies in the **AWS IAM** dataset. It collects AWS Bedrock, AWS Bedrock AgentCore, Amazon Connect Customer, and Amazon Quick, and AWS Agent Registry resources in separate datasets for agentic identity security. It collects durable IAM user credentials and AWS Secrets Manager secrets in separate datasets for credential governance. | Dataset name | Dataset ID | Associated resources | Required license | Default schedule | | --- | --- | --- | --- | --- | | **AWS IAM** | `aws:iam` | AWS IAM Role, AWS Role Has Policy | Machine Identity Security | Every 12 hours | | **AWS Bedrock** | `aws:bedrock` | AWS Bedrock Agent Alias Version, AWS Bedrock Action Group, AWS Bedrock Knowledge Base, AWS Agent Uses Capability, AWS Agent Uses Agent, AWS Bedrock Agent Uses Role | Agentic Identity Security | Every 12 hours | | **AWS Bedrock AgentCore** | `aws:bedrockagentcore` | AWS Bedrock AgentCore Runtime Endpoint, AWS Bedrock AgentCore Gateway, AWS Bedrock AgentCore Gateway Target, AWS Bedrock AgentCore Credential Provider, AWS Bedrock AgentCore Inbound Access Config, AWS Bedrock AgentCore Workload Identity, and related resource links | Agentic Identity Security | Every 12 hours | | **Amazon Connect Customer** | `aws:connectcustomer` | Amazon Connect Customer Instance, Amazon Connect Customer Domain, Amazon Connect Customer AI Agent, Amazon Connect Customer Knowledge Base, Amazon Connect Customer Prompt, Amazon Connect Customer Guardrail, Amazon Connect Customer Tool, and Amazon Connect Customer Security Profile | Agentic Identity Security | Every 12 hours | | **Amazon Quick** | `aws:quick` | Amazon Quick Agent, Amazon Quick Action Connector, and related resource links | Agentic Identity Security | Every 12 hours | | **AWS Agent Registry** | `aws:agent-registry` | AWS Agent Registry Record and related resource links | Agentic Identity Security | Every 12 hours | | **AWS IAM Credentials** | `aws:iam-credentials` | IAM Access Key, CodeCommit HTTPS Credential, CodeCommit SSH Public Key, IAM Signing Certificate | SailPoint Agentic Fabric | Every 12 hours | | **AWS Secrets Manager** | `aws:secretsmanager` | AWS Secrets Manager Secret | SailPoint Agentic Fabric | Every 12 hours | ## Supported Resources A resource represents a type of object the connector collects from AWS, such as IAM roles, Bedrock agents, Secrets Manager, Amazon Connect Customer agents, Amazon Quick agents, AWS Agent Registry agents, AWS Agent Registry MCP servers, action groups, or credentials. Each resource defines the attributes collected for that object type, such as name, ID, or status, and how each object appears in SailPoint. For more information, refer to [Managing Resources](). > [!NOTE] > > When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources. Under **Dataset Management** \> **Resources**, the AWS source lists each object type the connector aggregates. Select a resource to review its schema on the **Schema** tab. ### AWS IAM The AWS IAM dataset contains the following resources and resource links: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **AWS IAM Role** | Account | `aws:iam-role` | | **AWS Role Has Policy** | Access | `aws:role-has-policy` | For schema attribute details, refer to [AWS IAM Attributes](). ### AWS Bedrock The AWS Bedrock dataset contains the following resources and resource links: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **AWS Bedrock Agent Alias Version** | Agent | `aws:bedrock-agent-alias-version` | | **AWS Bedrock Action Group** | Capability | `aws:bedrock-action-group` | | **AWS Bedrock Knowledge Base** | Capability | `aws:bedrock-knowledge-base` | | **AWS Agent Uses Capability** | Access | `aws:bedrock-agent-uses-capability` | | **AWS Agent Uses Agent** | Access | `aws:bedrock-agent-uses-agent` | | **AWS Bedrock Agent Uses Role** | Access | `aws:bedrock-agent-uses-role` | For schema attribute details, refer to [AWS Bedrock Attributes](). ### AWS Bedrock AgentCore The AWS Bedrock AgentCore dataset contains the following resources and resource links: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **AWS Bedrock AgentCore Runtime Endpoint** | Agent | `aws:agentcore-runtime-endpoint` | | **AWS Bedrock AgentCore Gateway** | Application | `aws:agentcore-gateway` | | **AWS Bedrock AgentCore Gateway Target** | Capability | `aws:agentcore-target` | | **AWS Bedrock AgentCore Credential Provider** | Credential | `aws:agentcore-credential-provider` | | **AWS Bedrock AgentCore Inbound Access Config** | Credential | `aws:agentcore-inbound-access-config` | | **AWS Bedrock AgentCore Workload Identity** | Account | `aws:agentcore-workload-identity` | | **AWS AgentCore Agent Uses Role** | Access | `aws:agentcore-agent-uses-role` | | **AWS AgentCore Agent Has Workload Identity** | Extends | `aws:agentcore-agent-has-workload-identity` | | **AWS AgentCore Application Has Workload Identity** | Extends | `aws:agentcore-application-has-workload-identity` | | **AWS AgentCore Agent Has Inbound Access** | Access | `aws:agentcore-agent-has-inbound-access` | | **AWS AgentCore Capability Uses Credential** | Access | `aws:agentcore-capability-uses-credential` | | **AWS AgentCore Application Has Capability** | Access | `aws:agentcore-application-has-capability` | For schema attribute details, refer to [AWS Bedrock AgentCore Attributes](). ### AWS IAM Credentials The AWS IAM Credentials dataset contains the following resources: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **IAM Access Key** | Credential | `aws:iam-user-access-key` | | **CodeCommit HTTPS Credential** | Credential | `aws:iam-codecommit-https-credential` | | **CodeCommit SSH Public Key** | Credential | `aws:iam-codecommit-ssh-key` | | **IAM Signing Certificate** | Credential | `aws:iam-signing-certificate` | For schema attribute details, refer to [AWS IAM Credential Attributes](). ### AWS Secrets Manager The AWS Secrets Manager dataset contains the following resource: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **AWS Secrets Manager Secret** | Credential | `aws:secretsmanager-secret` | For schema attribute details, refer to [AWS Secrets Manager Attributes](). ### Amazon Connect Customer The Amazon Connect Customer dataset contains the following resources and resource links: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **Amazon Connect Customer Instance** | Application | `aws:connectcustomer-instance` | | **Amazon Connect Customer Domain** | Application | `aws:connectcustomer-assistant` | | **Amazon Connect Customer AI Agent** | Agent | `aws:connectcustomer-ai-agent` | | **Amazon Connect Customer Knowledge Base** | Capability | `aws:connectcustomer-knowledge-base` | | **Amazon Connect Customer Prompt** | Capability | `aws:connectcustomer-prompt` | | **Amazon Connect Customer Guardrail** | Capability | `aws:connectcustomer-guardrail` | | **Amazon Connect Customer Tool** | Capability | `aws:connectcustomer-tool` | | **Amazon Connect Customer Security Profile** | Capability | `aws:connectcustomer-security-profile` | | **Amazon Connect Customer Domain Belongs To Instance** | Access | `aws:connectcustomer-assistant-belongs-to-instance` | | **Amazon Connect Customer AI Agent Belongs To Domain** | Access | `aws:connectcustomer-agent-belongs-to-assistant` | | **Amazon Connect Customer AI Agent Uses Knowledge Base** | Access | `aws:connectcustomer-agent-uses-knowledge-base` | | **Amazon Connect Customer AI Agent Uses Prompt** | Access | `aws:connectcustomer-agent-uses-prompt` | | **Amazon Connect Customer AI Agent Uses Guardrail** | Access | `aws:connectcustomer-agent-uses-guardrail` | | **Amazon Connect Customer AI Agent Uses Tool** | Access | `aws:connectcustomer-agent-uses-tool` | | **Amazon Connect Customer AI Agent Has Security Profile** | Access | `aws:connectcustomer-agent-has-security-profile` | | **Amazon Connect Customer AI Agent Uses Role** | Access | `aws:connectcustomer-agent-uses-role` | For schema attribute details, refer to [Amazon Connect Customer Attributes](). ### Amazon Quick The Amazon Quick dataset contains the following resources and resource links: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **Amazon Quick Agent** | Agent | `aws:quick-agent` | | **Amazon Quick Action Connector** | Capability | `aws:quick-action-connector` | | **Amazon Quick Agent Uses Action Connector** | Access | `aws:quick-agent-uses-action-connector` | | **Amazon Quick Agent Granted To** | Access | `aws:quick-agent-granted-to` | | **Amazon Quick Action Connector Granted To** | Access | `aws:quick-action-connector-granted-to` | For schema attribute details, refer to [Amazon Quick Attributes](). ### AWS Agent Registry The AWS Agent Registry dataset contains the following resources and resource links: | Resource name | Resource type | Resource ID | | --- | --- | --- | | **AWS Agent Registry Agent** | Agent | `aws:agent-registry-record-agent` | | **AWS Agent Registry MCP** | Application | `aws:agent-registry-record-mcp` | | **AWS Agent Registry Record Describes Resource** | Access | `aws:agent-registry-record-describes-resource` | | **AWS Agent Registry Record Syncs Using Credential** | Access | `aws:agent-registry-record-syncs-using-credential` | For schema attribute details, refer to [AWS Agent Registry Attributes](). # Frequently Asked Questions ## How do I require workloads to use temporary credentials with IAM roles to access AWS? Follow the [Security Best Practices](). ## What are "Non Multiple-group Object Source Policies" and "Multiple Group Object Source Policies"? See an example of the [Multiple Group Object Source Policies]() here. # Integrating SailPoint with Amazon Web Services (AWS) SaaS The SailPoint Amazon Web Services (AWS) SaaS connector enables organizations to extend existing identity lifecycle and compliance management capabilities within SailPoint to mission-critical AWS IaaS environments to provide a central point of visibility, administration, and governance across the entire enterprise. This includes policy discovery and access history across all organization accounts, provisioning AWS entities and objects, access review and certification, and federated access support. This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of an AWS SaaS source. > [!IMPORTANT] > > If you want to enable additional cloud governance features (for example, visualization of effective access) for your AWS Cloud Infrastructure, you must have a CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information. > > For more information on the additional features supported with cloud governance, refer to the table in the [Supported Features](<#supported-features>) section. ## Onboard AWS with SailPoint Agentic Fabric (SAF) SailPoint Agentic Fabric (SAF) provides an automated, guided onboarding experience to connect your AWS environment to SailPoint. SAF automatically creates, deploys, and configures the AWS SaaS source in SailPoint, reducing the manual setup steps. After onboarding, the source is ready for aggregation and governance. For detailed onboarding instructions, prerequisites, and supported deployment models, refer to [Configuring the AWS SaaS Connector](). > [!IMPORTANT] > > To enable advanced governance capabilities for AWS resources and AI agents, an active SailPoint Agentic Fabric Advanced Governance license is required. Contact your SailPoint Customer Success Manager to request access and for more information. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. The AWS SaaS supports the following features: - Load AWS Accounts - \*Provision AWS Accounts - \*Access Certifications (certification of entitlements connected to AWS accounts) - \*Password management For more information on features, refer to [Source Features](). ### Account Management - Manage IAM Users under the AWS Account as Accounts - Aggregate, Refresh Accounts - Create, Update, Delete, Enable, Disable > **Note** > > For more information on enabling and disabling, see [IAM User Status](<#iam-user-status>). - Change Password - Add/Remove Entitlements (Groups, AWS Managed Policies, Customer Managed Policies, Inline Policies) ### Non-Human Identity Discovery The connector discovers the following non-human identities through Dataset Management. #### Agent Discovery - Amazon Bedrock Agents - Amazon Bedrock AgentCore Agents - Amazon Connect Customer Agents - Amazon Quick Agents - AWS Agent Registry #### Credential Discovery - AWS IAM Credentials - AWS Secrets Manager Secrets Refer to Dataset Management for more information. Refer to [Discovering Potential Non-Human Accounts]() for more information. ### IAM Entities - **IAM Groups**: Aggregate, Refresh - **AWS Managed Policy Management**: Aggregate, Refresh - **Customer Managed Policies**: Aggregate, Refresh - **Inline Policies**: Aggregate, Refresh - **Role Management**: Aggregate, Refresh ### Tags Management This connector supports the aggregation and refresh of tags attribute for the following entities: - IAM Role - Customer Managed Policy - Service Control Policy - Organization Unit - AWS Account ### Organization Entities This connector supports the following on Organization Entities (managed as group object only): - AWS Accounts Management: Aggregate, Refresh - Organization Unit Management: Aggregate, Refresh - Service Control Policy Management: Aggregate, Refresh ### Permissions Management This connector supports the JSON Policy for Permission Policy and Trust Policy as a direct permission. The Permission Policy for the following AWS entities are represented as Permissions: - AWS Managed Policies - Customer Managed Policies - Inline Policies - Service Control Policies The Trust Policy for the following AWS entity is represented as direct permission: - Roles > [!NOTE] > > \*Role aggregation takes care of aggregating the trust polices (entities that can assume a role) as direct permission. ### Supported Features Comparison with Cloud Governance > [!IMPORTANT] > > If you want to enable additional cloud governance features (for example, visualization of effective access) for your AWS Cloud Infrastructure, you must have a CIEM license. AWS Managed Policies, Customer Managed Policies, and Inline Policies are also available with Machine Identity Security or Agentic Identity Security. Contact your SailPoint Customer Success Manager to request access and for more information. | Supported Features | AWS Connector (Standard Features) | AWS Connector (With Cloud Governance) | AWS Connector (With Machine Identity Security or Agentic Identity Security) | | --- | --- | --- | --- | | **Account Management**

Manage IAM Users under the AWS Account as Accounts
Aggregate, Refresh Accounts
Create, Update, Delete
Change Password
Enable and Disable

Aggregate IAM Users and its connected Entitlements (Groups, AWS Managed Policies, Customer Managed Policies, and Inline Policies)
Add/Remove Entitlements (Groups, AWS Managed Policies, Customer Managed Policies, and Inline Policies) | Yes

**Note:** Only IAM groups have user-friendly names, while all other Entitlements are displayed using ARN. | Yes

**Note:** Every Entitlement is displayed using user-friendly names. | Yes | | **Group Management**\*

Manage IAM Groups
Aggregate, Refresh Group | Yes | Yes | Yes | | **AWS Managed Policies**

Manage as group object
Aggregate, Refresh | No | Yes | Yes | | **Customer Managed Policies**

Manage as group object
Aggregate, Refresh, Create, Update, Delete

**Note:** Updating the **Customer Managed Policy** creates a new policy version. | No | Yes | Yes | | **Inline Policies Management**

Manage as group object
Create, Update, Delete
Aggregate, Refresh | No | Yes | Yes | | **Organization Unit**

Manage as group object
Aggregate, Refresh | No | Yes | No | | **Service Control Policy**

Manage as group object
Aggregate, Refresh | No | Yes | No | | **AWS Accounts**

Manage as group object
Aggregate, Refresh | No | Yes | No | | **Tags Management**

Aggregate and refresh of tags attribute for the following entities:

IAM Role
Customer Managed Policy
Service Control Policy
Organization Unit
AWS Account | No | Yes | No | | IAM Role Management

Manage as group object
Aggregate, Refresh
Provisioning \*
Update, Add, and Remove AWS Managed Policy or Customer Managed Policy from Role | No | Yes | No | ### IAM User Status The following are the SailPoint operations with the corresponding IAM User Status: #### Enable - Set Console Password (This would also activate the Signing Certificate if it is associated with an IAM User.) - Activates Last Created Access Keys - Activates Last Created AWS CodeCommit HTTPS Credentials - Activates Last Created AWS CodeCommit SSH Keys - Activates Signing Certificates #### Disable - Deletes Console Password - Inactivates Both Access Keys - Inactivates Both AWS CodeCommit HTTPS Credentials - Inactivates All AWS CodeCommit SSH Keys - Inactivates Signing Certificates > [!NOTE] > > When you enable an AWS IAM (Identity Access Management) user for the AWS source it activates the Signing Certificate (if the certificate is associated with that user) along with setting the console password. When you disable the user, the source will deactivate the Signing Certificate. ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). #### Examples > [!NOTE] > > **Privilege Level: High** > > [![Privilege Level: High]()]() > [!NOTE] > > **Privilege Level: Medium** > > [![Privilege Level: Medium]()]() > [!NOTE] > > **Privilege Level: Low** > > [![Privilege Level: Low]()]() ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Prerequisites - Create an IAM role and assign required permission to it so that it uses all the cross-account roles. - Create a Customer/ Inline managed policy in each AWS account that you want to manage. Use the exact JSON policy provided by SailPoint. For more information, refer to [Multiple Group Object Source Policies](), [Non Multiple-group Object Source Policies](), and [Machine Identity Governance Policies](). - [Create Cross Account Roles]() in each AWS account that you want to manage and attach the appropriate policies to the role. Create an IAM role and assign required permission to it so that it uses all the cross-account roles. - The AWS System Administrator can refine the Permission Policies as needed. - For agent discovery, use the policies in [Machine Identity Governance Policies]() for Amazon Bedrock Agents, Amazon Bedrock AgentCore Agents, Amazon Connect Customer Agents, and Amazon Quick Agents, and AWS Agent Registry. - For IAM credential discovery, use the policy in [Machine Identity Governance Policies]() for AWS IAM Credentials. Before onboarding AWS with SailPoint Agentic Fabric (SAF), ensure you meet the following prerequisites: - All features must be enabled for your AWS Organization. - Your management account administrator must enable trusted access for CloudFormation StackSets. # Machine Account Attributes Machine account creation uses the same source attributes as standard account creation. For the complete list of supported attributes and their descriptions, refer to [Default Account Attributes]() For more information, refer to [Machine Identity Security Overview](). # Using Multiple Group Entitlements The AWS source supports multiple group objects. The details of the features are: | Feature | IAM Users | | --- | --- | | Aggregate | âś” | | Create, Update, Enable, Disable, Delete | âś” | | Group Entitlements (Read, Request, Revoke) | Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies

**Note:** InlinePolicies can be read and revoked. | ## Group Entitlements SailPoint provides the ability to aggregate additional details from the managed system through Group Entitlements. These objects have a separate schema defining list of attributes. The aggregation task fetches these as additional details when aggregation is run for that Group Entitlement type. > [!NOTE] > > The following group objects are available with Cloud Infrastructure Entitlement Management (CIEM), Machine Identity Security, or Agentic Identity Security: > > - AWS Managed Policies > - Customer Managed Policies > - Inline Policies > > The following group objects are available only with CIEM: > > - Service Control Policy > - Roles > - Organization Unit > - AWS Accounts | | Aggregation | Permissions | Read Heirarchy Group | | --- | --- | --- | --- | | Groups | ✔ | NA | NA | | AWSManagedPolicies | ✔ | ✔ | NA | | CustomerManagedPolicies | ✔ | ✔ | NA | | InlinePolicies | ✔ | ✔ | NA | | Roles | ✔ | ✔ | NA | | SCP | ✔ | ✔ | NA | | AWSAccount | ✔ | NA | NA | | OrganizationUnit | ✔ | NA | ✔ | - NA = Not Applicable. - The objects such as, Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies, and Roles are the IAM entities. - The objects, such as Service Control Policies (SCP), AWSAccount and OrganizationUnit (OU) are the Organization entities. - The AWS source supports JSON Policy for Permission Policy, and Trust Policy is represented as Permissions. - The Permission Policy for the following AWS entities are represented as Permissions: - AWS Managed Policies - Customer Managed Policies - Inline Policies - Service Control Policies - The Trust Policy for the following AWS entity is represented as Permissions: - Roles ## Using Multiple Group Entitlements with a Pre-Existing Source To start using Multiple Group Entitlements with your current (pre-existing) AWS source(s), perform the following steps: 1. Use [createSchema]() API to create new group schema for your source. > **Example of API body content for adding Project Roles to an existing source** > > ```text > AWS Managed Policies: > { > "name": "AWSManagedPolicy", > "nativeObjectType": "AWSManagedPolicy", > "identityAttribute": "ARN", > "displayAttribute": "PolicyName", > "hierarchyAttribute": null, > "includePermissions": false, > "features": [ > "NO_GROUP_PERMISSIONS_PROVISIONING" > ], > "configuration": {}, > "attributes": [ > { > "name": "PolicyName", > "type": "STRING", > "schema": null, > "description": "The friendly name of the AWS managed policy ", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "PolicyId", > "type": "STRING", > "schema": null, > "description": "The unique ID of the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Description", > "type": "STRING", > "schema": null, > "description": "A friendly description of the AWS managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > > { > "name": "ARN", > "type": "STRING", > "schema": null, > "description": "Amazon Resource Name of the AWS managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Path", > "type": "STRING", > "schema": null, > "description": "The path to the AWS managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "CreateDate", > "type": "STRING", > "schema": null, > "description": "The creation date of the AWS managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "UpdateDate", > "type": "STRING", > "schema": null, > "description": "The last update date of the AWS managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "DefaultVersionId ", > "type": "STRING", > "schema": null, > "description": "The currently enabled version ID of the AWS managed policy ", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "PolicyJSON", > "type": "STRING", > "schema": null, > "description": "The JSON document for the AWS managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > } > ] > } > > ##################################################### > > Customer Managed Policies: > > { > "name": "CustomerManagedPolicy", > "nativeObjectType": "CustomerManagedPolicy", > "identityAttribute": "ARN", > "displayAttribute": "PolicyName", > "hierarchyAttribute": null, > "includePermissions": false, > "features": [ > "PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING" > ], > "configuration": {}, > "attributes": [ > { > "name": "PolicyName", > "type": "STRING", > "schema": null, > "description": "The friendly name of the customer managed policy ", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "PolicyId", > "type": "STRING", > "schema": null, > "description": "The unique ID of the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Description", > "type": "STRING", > "schema": null, > "description": "A friendly description of the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "CreateDate", > "type": "STRING", > "schema": null, > "description": "The creation date of the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "UpdateDate", > "type": "STRING", > "schema": null, > "description": "The last update date of the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "ARN", > "type": "STRING", > "schema": null, > "description": "Amazon Resource Name of the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Path", > "type": "STRING", > "schema": null, > "description": "The path to the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "DefaultVersionId ", > "type": "STRING", > "schema": null, > "description": "The currently enabled version ID of the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "PolicyJSON", > "type": "STRING", > "schema": null, > "description": "The JSON document for the customer managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "PolicyGroups", > "type": "STRING", > "schema": null, > "description": "Groups attached to the customer managed policy", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "PolicyRoles", > "type": "STRING", > "schema": null, > "description": "Roles attached to the customer managed policy", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > } > ] > } > > #################################################### > > Inline Policies: > > { > "name": "InlinePolicy", > "nativeObjectType": "InlinePolicy", > "identityAttribute": "Id", > "displayAttribute": "Name", > "hierarchyAttribute": null, > "includePermissions": false, > "features": [ > "NO_GROUP_PERMISSIONS_PROVISIONING" > ], > "configuration": {}, > "attributes": [ > { > "name": "Name", > "type": "STRING", > "schema": null, > "description": "The friendly name of the policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Id", > "type": "STRING", > "schema": null, > "description": "The unique ID of the policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "PolicyJSON", > "type": "STRING", > "schema": null, > "description": "The JSON document for the policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > } > ] > } > > > ################################################### > > > > > Roles: > > { > "name": "Role", > "nativeObjectType": "Role", > "identityAttribute": "ARN", > "displayAttribute": "RoleName", > "hierarchyAttribute": null, > "includePermissions": false, > "features": [ > "PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING" > ], > "configuration": {}, > "attributes": [ > { > "name": "RoleName", > "type": "STRING", > "schema": null, > "description": "The friendly name of the role", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "RoleId", > "type": "STRING", > "schema": null, > "description": "The unique ID of the role", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Path", > "type": "STRING", > "schema": null, > "description": "Path to the Role", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "ARN", > "type": "STRING", > "schema": null, > "description": "Amazon Resource Name of the role", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Description", > "type": "STRING", > "schema": null, > "description": "Role Description", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "CreateDate", > "type": "STRING", > "schema": null, > "description": "Creation date of the role", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "AWSManagedPolicies", > "type": "STRING", > "schema": null, > "description": "AWS Managed Policies directly assigned to the role", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "CustomerManagedPolicies", > "type": "STRING", > "schema": null, > "description": "Customer Managed Policies directly assigned to the role", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "InlinePolicies", > "type": "STRING", > "schema": null, > "description": "Inline Policies directly assigned to the role", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "TrustPolicyJSON", > "type": "STRING", > "schema": null, > "description": "Trust Relationship Policy JSON", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "MaxSessionDuration", > "type": "STRING", > "schema": null, > "description": "Maximum CLI/API session duration", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > } > ] > } > > > > ################################################### > Service Control Policies: > > { > "name": "SCP", > "nativeObjectType": "SCP", > "identityAttribute": "ARN", > "displayAttribute": "RoleName", > "hierarchyAttribute": null, > "includePermissions": false, > "features": [ > "NO_GROUP_PERMISSIONS_PROVISIONING" > ], > "configuration": {}, > "attributes": [ > { > "name": "SCPName", > "type": "STRING", > "schema": null, > "description": "The friendly name of the Service Control Policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "SCPId", > "type": "STRING", > "schema": null, > "description": "The unique ID of the Service Control Policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "ARN", > "type": "STRING", > "schema": null, > "description": "A friendly description of the Service Control Policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Description", > "type": "STRING", > "schema": null, > "description": "A friendly description of the Service Control Policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "AWSManaged", > "type": "STRING", > "schema": null, > "description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "PolicyJSON", > "type": "STRING", > "schema": null, > "description": "The JSON document for the Service Control Policy", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > } > ] > } > > > ################################################### > AWS Accounts: > { > "name": "AWSAccount", > "nativeObjectType": "AWSAccount", > "identityAttribute": "ARN", > "displayAttribute": "AWSAccountName", > "hierarchyAttribute": null, > "includePermissions": false, > "features": [], > "configuration": {}, > "attributes": [ > { > "name": "AWSAccountName", > "type": "STRING", > "schema": null, > "description": "The friendly name of the AWS account.", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "AWSAccountId", > "type": "STRING", > "schema": null, > "description": "The unique ID of the AWS account.", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "ARN", > "type": "STRING", > "schema": null, > "description": "Amazon Resource Name of the AWS account.", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Email", > "type": "STRING", > "schema": null, > "description": "The email address associated with the AWS account.", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "Status", > "type": "STRING", > "schema": null, > "description": "The status of the AWS account in the organization.", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "CreateDate", > "type": "STRING", > "schema": null, > "description": "Creation date of the role", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "JoinedMethod", > "type": "STRING", > "schema": null, > "description": "The method by which the AWS account joined the organization.", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "CustomerManagedPolicies", > "type": "STRING", > "schema": null, > "description": "Customer Managed Policies directly assigned to the role", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "JoinedTimestamp", > "type": "STRING", > "schema": null, > "description": "The date the AWS account became a part of the organization.", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "OrganizationUnit", > "type": "STRING", > "schema": null, > "description": "Organization unit holding the AWS Account", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > } > ] > } > > ################################################### > Organization Units: > { > "name": "OrganizationUnit", > "nativeObjectType": "OrganizationUnit", > "identityAttribute": "ARN", > "displayAttribute": "OUName", > "hierarchyAttribute": Parent, > "includePermissions": false, > "features": [], > "configuration": {}, > "attributes": [ > { > "name": "OUName", > "type": "STRING", > "schema": null, > "description": "The friendly name of the Organization Unit", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "OUId", > "type": "STRING", > "schema": null, > "description": "The unique ID of the Organization Unit", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "ARN", > "type": "STRING", > "schema": null, > "description": "Amazon Resource Name of the Organization Unit", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "ServiceControlPolicies", > "type": "STRING", > "schema": null, > "description": "Service Control Policies attached to the Organization Unit", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > }, > { > "name": "Parent", > "type": "STRING", > "schema": null, > "description": "Parent Organization Unit", > "isMulti": false, > "isEntitlement": false, > "isGroup": false > }, > { > "name": "AWSAccounts", > "type": "STRING", > "schema": null, > "description": "AWS Accounts attached to the Organization Unit", > "isMulti": true, > "isEntitlement": true, > "isGroup": false > } > ] > } > ``` 2. Update Account Schema with the following steps: 1. Get account schema using [getSchema]() API. 2. Copy the schema to a file. 3. Search for the attribute corresponding to the group schema that was added in step 1. 4. Add/update the below two properties for the attribute found in the previous step (2.c.) `"isGroup": true,` `"schema": {"type": "CONNECTOR_SCHEMA","id": "","name": ""}` 5. Add the schema (modified in step 2.d.) to the payload to update the account schema in the source. Use [replaceSchema]() API for this task. > **Note** > > Remove `NO_PERMISSIONS_PROVISIONING` from the feature string so there won’t be any work item while removing associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through certification. # Provisioning The AWS SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in AWS directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes | Account Attribute | Generator | Description | | --- | --- | --- | | UserName | Identity Attribute | The user name as taken from the SailPoint user name. | | password | Create Password | This generator creates an initial password for the new AWS account that matches the password policy assigned to the associated AWS source in SailPoint. | | AccountId | Disabled | The Account ID or ARN of the AWS Account under which the IAM user is to be created.

**Note:** By default, this attribute is 'Disabled', you can set it as per your requirement.

For example, you can set it to 'Static' and provide the AWS Account ID or ARN in which you want to create an IAM user. | | AccessKey | Static | The Access key associated with a user. | | PasswordResetRequired | Static | Indication for user to create a new password.

**Note:** Users automatically get the IAMUserChangePassword policy to allow them to change their own password. | # Required Permissions This following permissions are required to perform connector operations: ## Non Multiple-Group Object Source Policies > [!IMPORTANT] > > For single-account setups, you must enable **AWS Organizations**. This automatically designates the account as the **Management Account**, which is required for the AWS SaaS connector. Single accounts without the Organizations service are not supported. > [!NOTE] > > **SPAggregationPolicy** > > This aggregation policy must be assigned to the role of AWS accounts you want to manage. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPOrganizationPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "organizations:ListAccounts" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPProvisioningPolicy** > > Must be assigned to the Role of AWS Account which needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **AWSCloudTrail\_ReadOnlyAccess** > > Activity Insights Policies are required to pull activity data in the form of events like user logins, password changes, and content updates within the application. Policies must be assigned to the role of the AWS Account that needs to be managed. If you have a license of activity insights, you must add this permission to see the activity data of the connector. > > > **Important** > > > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Action": [ > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudtrail:LookupEvents" > ], > "Resource": "*" > } > ] > } > ``` ## Multiple Group Object Source Policies ### Policy Examples for Role > [!NOTE] > > **SPOrganizationPolicy** > > Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPAggregationPolicy** > > Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPProvisioningPolicy** > > Required for Multiple-group Object Source and must be assigned to the Role of the AWS Account that needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:DeleteGroup", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteGroupPolicy", > "iam:DeleteLoginProfile" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **AWSCloudTrail\_ReadOnlyAccess** > > Activity Insights Policies are required to pull activity data in the form of events like user logins, password changes, and content updates within the application. Policies must be assigned to the role of the AWS Account that needs to be managed. If you have a license of activity insights, you must add this permission to see the activity data of the connector. > > > **Important** > > > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Action": [ > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudtrail:LookupEvents" > ], > "Resource": "*" > } > ] > } > ``` ## Machine Identity Governance Policies > [!NOTE] > > **BedrockAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "BedrockAgentDiscovery", > "Effect": "Allow", > "Action": [ > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **BedrockAgentCoreAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "BedrockAgentCoreAgentDiscovery", > "Effect": "Allow", > "Action": [ > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:GetAgentRuntimeEndpoint", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListWorkloadIdentities", > "bedrock-agentcore:GetWorkloadIdentity", > "bedrock-agentcore:ListOauth2CredentialProviders", > "bedrock-agentcore:GetApiKeyCredentialProvider", > "bedrock-agentcore:ListApiKeyCredentialProviders", > "bedrock-agentcore:GetOauth2CredentialProvider" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **ConnectCustomerAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "ConnectCustomerAgentDiscovery", > "Effect": "Allow", > "Action": [ > "connect:ListInstances", > "connect:DescribeInstance", > "connect:ListIntegrationAssociations", > "connect:ListEntitySecurityProfiles", > "connect:DescribeSecurityProfile", > "wisdom:GetAssistant", > "wisdom:ListAIAgents", > "wisdom:ListAIAgentVersions", > "wisdom:GetAIAgent", > "wisdom:GetAssistantAssociation", > "wisdom:GetKnowledgeBase", > "wisdom:GetAIPrompt", > "wisdom:GetAIGuardrail" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **QuickAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "QuickAgentDiscovery", > "Effect": "Allow", > "Action": [ > "quicksight:ListAgents", > "quicksight:DescribeAgent", > "quicksight:DescribeAgentPermissions", > "quicksight:ListActionConnectors", > "quicksight:DescribeActionConnector", > "quicksight:DescribeActionConnectorPermissions" > ], > "Resource": "*" > } > ] > } > ``` > > > **Note** > > > > This policy applies to the AWS Commercial (`aws`) partition only. > [!NOTE] > > **AgentRegistryDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "AgentRegistryDiscovery", > "Effect": "Allow", > "Action": [ > "agent-registry:ListRegistries", > "agent-registry:ListRegistryRecords", > "agent-registry:GetRegistryRecord", > "agent-registry:ListTagsForResource" > ], > "Resource": "*" > } > ] > } > ``` > > > **Note** > > > > - This policy uses the `agent-registry` control-plane namespace (AgentRegistryControl API). > > - Deprecated preview `bedrock-agentcore` Registry APIs aren't supported. Those APIs shut down on September 17, 2026. > > - `ListRegistries` enumerates records in each catalog. Registry catalogs aren't collected as resources. > > - `GetRegistry` isn't required. > > - The policy is read-only. No create, update, or delete permissions are required. > > - The connector collects records in every lifecycle status, including `DRAFT`, `PENDING_APPROVAL`, and `APPROVED`. The approved-only discoverable view isn't used for inventory. > [!NOTE] > > **IAMCredentialsDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "IAMCredentialsDiscovery", > "Effect": "Allow", > "Action": [ > "iam:ListUsers", > "iam:ListAccessKeys", > "iam:GetAccessKeyLastUsed", > "iam:ListServiceSpecificCredentials", > "iam:ListSSHPublicKeys", > "iam:ListSigningCertificates" > ], > "Resource": "*" > } > ] > } > ``` # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The AWS SaaS connector uses the following default correlation and object configurations. For AWS IAM, Bedrock, AgentCore, Amazon Connect Customer, and Amazon Quick, and AWS Agent Registry resource schemas collected through Dataset Management, refer to [Supported Resources](). The following table lists the schema objects supported by the connector and the license required for each object. Cloud Infrastructure Entitlement Management (CIEM), Machine Identity Security, and Agentic Identity Security are separate licenses. A **Yes** means that license includes the object. | Schema object | CIEM | Machine Identity Security or Agentic Identity Security | No additional license | | --- | --- | --- | --- | | **Account**

This object represents IAM user accounts. | Yes | Yes | Yes | | **Group**

This is the primary group object, and the object type is `Group`. | Yes | Yes | Yes | | **AWS Managed Policy**

The object type is `AWSManagedPolicy`. These policies are created and managed by AWS. | Yes | Yes | No | | **Customer Managed Policy**

The object type is `Customer Managed Policy`. These policies are created in the AWS account. | Yes | Yes | No | | **Inline Policy**

The object type is `InlinePolicy`. The policy is embedded in one user, group, or role. | Yes | Yes | No | | **IAM Role**

The object type is `Role`. This role is managed as a group object. | Yes | No | No | | **Service Control Policy**

The object type is `SCP`. | Yes | No | No | | **Organization Unit**

The object type is `OrganizationUnit`. | Yes | No | No | | **AWS Account**

The object type is `AWSAccount`. This account is managed as a group object. | Yes | No | No | > [!NOTE] > > IAM roles collected through Dataset Management are separate from the Role group object. For those resource schemas, refer to [Supported Resources](). For the operations supported for each object, refer to [Supported Features](). ## Correlation Configuration There is no default correlation mapping, so prior to the aggregation you can map the account attribute with the identity attribute as per your requirement. | Account Attribute | Operation | Identity Attribute | | --- | --- | --- | | UserName | Equals | Name | | UserName | Equals | UserName | ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | ARN | Account | | ARN | Group | | Id | InlinePolicy | | ARN | AWSManagedPolicy | | ARN | CustomerManagedPolicy | | ARN | Role | | ARN | SCP | | ARN | AWSAccount | | ARN | OrganizationUnit | ### Default Account Attributes The AWS SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Type | Description | | --- | --- | --- | | UserName | String | Friendly name of the user. | | UserId | String | Unique ID of the user. | | Path | String | Path to the user. | | ARN | String | Amazon Resource Name of the user.

This is an Account ID which must not be changed. | | CreateDate | String | Creation date of the user. | | ConsoleAccess | String | Password status of the user. | | Groups | Group | Groups the user is a part of. | | AWSManagedPolicies | AWSManagedPolicy | AWS Managed Policies directly assigned to the user. | | CustomerManagedPolicies | CustomerManagedPolicy | Customer Managed Policies directly assigned to the user. | | InlinePolicies | InlinePolicy | Inline Policies directly assigned to the user. | | Access Keys | String | Access keys associated with the user. | | AWS CodeCommit HTTPS Credentials | String | AWS CodeCommit HTTPS Git credentials associated with the user. | | AWS CodeCommit SSH Keys | String | AWS CodeCommit SSH public keys associated with the user. | | Signing Certificates | String | Signing Certificates associated with the user. | | Multi-Factor Authentication Device | String | Multi-Factor Authentication device associated with the user. | | PasswordLastUsed | String | Password last used date of the user. | | AccessKeyLastUsed | String | Access key last used details of the user. | | Tags | String | Tag list in the format TagKey\~TagValue pair | ### Tags Attribute A new Tags Attribute is available for aggregation to identify and organize AWS resources. Tags are displayed as Key/Value pairs for the aggregated entities. This multivalued, string attribute stores the Key/Value pair as a single string in K=V,K2=V2 format with tags separated by commas. For example: ```text [Key~Value, Costcenter~Austin, Department~QA, Location~Offshore ] ``` The form-data appears as follows: - Key: `Costcenter, Department, Location` - Value: `Austin, QA, Offshore` By default the tilda(\~) delimiter is between the key value pair. However, the separator can be configured as `tagKeyValueSeparator`. ```text ``` ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The AWS SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. #### Object Type: Group | Attribute Name | Type | Description | | --- | --- | --- | | GroupName | String | Friendly name of the group. | | GroupId | String | Unique ID of the group. | | Path | String | Path to the group. | | ARN | String | Amazon Resource Name of the group.

This is an Account ID which must not be changed. | | Create | String | Creation date of the group. | | AWSManagedPolicies | AWSManagedPolicy | AWS Managed Policies directly assigned to the group. | | CustomerManagedPolicies | CustomerManagedPolicy | Customer Managed Policies directly assigned to the group. | | InlinePolicies | InlinePolicy | Inline Policies directly assigned to the group. | #### Object Type: AWSManagedPolicy | Attribute Name | Type | Description | | --- | --- | --- | | PolicyName | String | The friendly name of the AWS managed policy. | | PolicyId | String | The unique ID of the AWS managed policy. | | Description | String | A friendly description of the AWS managed policy. | | ARN | String | Amazon Resource Name of the AWS managed policy.

This is an Account ID which must not be changed. | | Path | String | The path to the AWS managed policy. | | CreateDate | String | The creation date of the AWS managed policy. | | UpdateDate | String | The last update date of the AWS managed policy. | | DefaultVersionId | String | The currently enabled version ID of the AWS managed policy. | | PolicyJSON | String | The JSON document for the AWS managed policy. | #### Object Type: Customer Managed Policy | Attribute Name | Type | Description | | --- | --- | --- | | PolicyName | String | The friendly name of the customer managed policy. | | PolicyId | String | The unique ID of the customer managed policy. | | Description | String | A friendly description of the customer managed policy. | | CreateDate | String | The creation date of the customer managed policy. | | UpdateDate | String | The last update date of the customer managed policy. | | ARN | String | Amazon Resource Name of the customer managed policy.

This is an Account ID which must not be changed. | | Path | String | The path to the customer managed policy. | | DefaultVersionId | String | The currently enabled version ID of the customer managed policy. | | PolicyJSON | String | The JSON document for the customer managed policy. | | PolicyGroups | String | Groups attached to the customer managed policy. | | PolicyRoles | String | Roles attached to the customer managed policy. | | Tags | String | Tag list in the format TatKey\~TagValue pair | #### Object Type: InlinePolicy | Attribute Name | Type | Description | | --- | --- | --- | | Name | String | The friendly name of the policy. | | Id | String | The unique ID of the policy.

This is an Account ID which must not be changed. | | PolicyJSON | String | The JSON document for the policy. | #### Object Type: Role | Attribute Name | Type | Description | | --- | --- | --- | | RoleName | String | The friendly name of the role. | | RoleId | String | The unique ID of the role. | | Path | String | Path to the Role. | | ARN | String | Amazon Resource Name of the role.

This is an Account ID which must not be changed. | | Description | String | Role Description. | | CreateDate | String | Creation date of the role. | | AWSManagedPolicies | AWSManagedPolicy | AWS Managed Policies directly assigned to the role. | | CustomerManagedPolicies | CustomerManagedPolicy | Customer Managed Policies directly assigned to the role. | | InlinePolicies | InlinePolicy | Inline Policies directly assigned to the role. | | TrustPolicyJSON | String | Trust Relationship Policy JSON. | | MaxSessionDuration | String | Maximum CLI/API session duration. | | Tags | String | Tag list in the format TagKey\~TagValue pair | #### Object Type: SCP | Attribute Name | Type | Description | | --- | --- | --- | | SCPName | String | The friendly name of the Service Control Policy. | | SCPId | String | The unique ID of the Service Control Policy. | | ARN | String | Amazon Resource Name of the Service Control Policy.

This is an Account ID which must not be changed. | | Description | String | A friendly description of the Service Control Policy. | | AWSManaged | String | A boolean value that indicates whether the Service Control Policy is an AWS managed policy. | | PolicyJSON | String | The JSON document for the Service Control Policy. | | Tags | String | Tag list in the format TagKey\~TagValue pair | #### Object Type: AWSAccount | Attribute Name | Type | Description | | --- | --- | --- | | AWSAccountName | String | The friendly name of the AWS account. | | AWSAccountId | String | The unique ID of the AWS account. | | ARN | String | Amazon Resource Name of the AWS account.

This is an Account ID which must not be changed. | | Email | String | The email address associated with the AWS account. | | Status | String | The status of the AWS account in the organization. | | JoinedMethod | String | The method by which the AWS account joined the organization. | | JoinedTimestamp | String | The date the AWS account became a part of the organization. | | OrganizationUnit | OrganizationUnit | Organization unit holding the AWS Account. | | Tags | String | Tag list in the format TagKey\~TagValue pair | #### Object Type: OrganizationUnit | Attribute Name | Type | Description | | --- | --- | --- | | OUName | String | The friendly name of the Organization Unit. | | OUId | String | The unique ID of the Organization Unit. | | ARN | String | Amazon Resource Name of the Organization Unit.

This is an Account ID which must not be changed. | | ServiceControlPolicies | SCP | Service Control Policies attached to the Organization Unit. | | Parent | OrganizationUnit | Parent Organization Unit. | | AWSAccounts | AWSAccount | AWS Accounts attached to the Organization Unit. | | Tags | String | Tag list in the format TagKey\~TagValue pair | ## Default Machine Identity Attributes Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts. For more information, refer to [Machine Identity Security Overview](). The following table describes the Agent Bedrock and Agentcore Bedrock schema attributes. > [!NOTE] > > The description and name attributes will be displayed at the top level but not at the connector level. ### Object Type: bedrock | Attribute Name | Type | Description | | --- | --- | --- | | aliasId | string | The unique identifier of the alias of the agent. | | name | string | The name with combination of agent name & agent alias name. | | agentArn | string | The Amazon Resource Name (ARN) of the bedrock agent. | | foundationModel | string | The foundation model that the version invokes. | | region | string | The region of the agent alias. | | role | string | The Amazon Resource Name (ARN) of the IAM role with permissions to invoke API operations on the agent. | | customerEncryptionKeyArn | string | The Amazon Resource Name (ARN) of the AWS KMS key that encrypts the agent. | | description | string | The description of the bedrock agent alias. | | version | string | Contains details about the version of the agent associated to alias. | | agentName | string | The name of the agent that the version belongs to. | | aliasName | string | The name of the alias of the agent. | | agentAliasStatus | string | The status of the alias. | | agentCollaboration | string | The agent’s collaboration settings. | | createdAt | string | The timestamp when the agent runtime endpoint was created. | | updatedAt | string | The timestamp when the agent runtime endpoint was last updated. | | resources | array | \- | | connectedAgents | array | \- | ### Object Type: bedrockagentcore | Attribute Name | Type | Description | | --- | --- | --- | | name | string | The name with combination of agent runtime & agent runtime endpoint names. | | agentRuntimeId | string | The unique identifier of agent runtime Id. | | description | string | The description of the agent runtime endpoint. | | agentRuntimeEndpointArn | string | The Amazon Resource Name (ARN) of the agent runtime endpoint. | | agentRuntimeEndpointStatus | string | The current status of the agent runtime endpoint. | | region | string | The region of the agent runtime endpoint. | | endpointName | string | The name of the agent runtime endpoint. | | endpointId | string | The unique identifier of agent runtime endpoint. | | associatedVersion | string | The live version of the agent runtime endpoint. This is the version that is currently serving requests. | | agentRuntimeArn | string | The Amazon Resource Name (ARN) of the agent runtime associated with the endpoint. | | agentRuntimeName | string | The name of the agent runtime. | | role | string | The IAM role ARN that provides permissions for the agent runtime. | | workloadIdentityArn | string | The Amazon Resource Name (ARN) of the workload identity. | | workloadIdentityName | string | The name of the workload identity. | | createdAt | string | The timestamp when the agent runtime endpoint was created. | | updatedAt | string | The timestamp when the agent runtime endpoint was last updated. | | resources | array | \- | | inboundAccess | array | \- | # Source Configuration Guide IAM Role is the authentication method to configure the AWS SaaS connector in SailPoint. > [!NOTE] > > It’s a good idea to establish a naming convention for the policies and roles that you create during this process. For example, "SPAggregationPolicy", "SPAssumeRolePolicy", and "SPCrossAccountRole". > [!IMPORTANT] > > This guide assumes you are connecting to an AWS environment that uses AWS Organizations with multiple AWS accounts under it. This is the most common deployment method. If you are connecting to a single AWS account without access to an AWS organization (for testing, POCs, etc.), you must manually remove the AWS organization schema objects as those are included by default with the AWS connector. Instructions on how to remove the schema objects are included at the [end](<#how-to-remove-the-schema-objects-for-use-with-a-single-aws-account>) of this guide. - [IAM Role Authentication](<#iam-role-authentication>) - [Overview](<#overview>) - [Policies](<#policies>) - [Cross-account Roles](<#cross-account-roles>) - [IAM Service Role](<#iam-service-role>) - [How to Remove the Schema Objects for use with a single AWS Account](<#how-to-remove-the-schema-objects-for-use-with-a-single-aws-account>) To manage all AWS accounts, turn the **Manage All Accounts** toggle on. The service user must be in the management AWS account to get all the AWS Account IDs. ## IAM Role Authentication ## Overview You will be creating two different role types and 4 different policies. 1. IAM Service Role 1. Attached Policy: 1. Assume Role Policy - this grants permission to assume the cross-account roles. 2. IAM Cross-account role(s) - one for each AWS account you want to manage 1. Attached Policies: These grant the permissions needed for IDN to perform its normal operations. 1. Aggregation Policy 2. Organization Policy 3. Provisioning Policy > [!IMPORTANT] > > Our documentation outlines two sets of policies you can choose from depending on whether or not you need multi-group object support. If you only want to manage one entitlement in AWS, such as a group, then use the "Policies Required for Non Multiple-group Object Source". If you want to manage more than one entitlement type in AWS, such as groups, AWS Managed Policies, Customer Managed Policies, Inline Policies, Service Control Policies (SCPs), AWS Organization OUs, AWS Accounts, etc. then use the "Policies Required for Multiple-group Object Source". Multi-group object support is a more recent enhancement and provides more capability/visibility. In most cases, you should use the multi-group object policies. > [!NOTE] > > Perform these steps in the order outlined below as they are dependent on one another. ### Policies Create 3 policies in each AWS account you want to manage: 1. Aggregation Policy 2. Organization Policy 3. Provisioning Policy These will be attached to your cross-account roles. 1. Create a new policy. 2. Select the JSON tab 3. Paste in the JSON provided in the connector documentation. For most deployments, you will be using the multiple group object policies found in this guide. ### Cross-Account Roles Create a cross-account role in each AWS account you want to manage and attach the 3 policies you created above. When creating this role, select the second option in the role creation wizard for **Another AWS account**. Enter the Account ID for the management account in your AWS Organization (even for the one you create in the management account). You must use the same name for every cross-account role. > [!NOTE] > > **Screenshot** > > [![Cross-account Roles]()]() > [!NOTE] > > You must modify the Trust Relationship for the cross-account role at the management account level to include a trust for all other member AWS account IDs that you want to manage. > [!NOTE] > > **Screenshot** > > [![Cross-account Roles]()]() Example JSON: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam:::root", "arn:aws:iam:::root", "arn:aws:iam:::root" ] }, "Action": "sts:AssumeRole", "Condition": {} } ] } ``` > [!NOTE] > > The cross-account roles you create on each member AWS account only need to trust the management account ID. ### IAM Service Role The role also needs to have a policy attached to it that allows it to assume the cross-account role(s) you will create. 1. Create a new policy. 2. Select the JSON tab. 3. Paste in the following JSON: ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": [ "arn:aws:iam:::role/", "arn:aws:iam:::role/", "arn:aws:iam:::role/" ] } ] } ``` > [!NOTE] > > The Resource section will contain references to all of the cross-account roles you create. You can copy the Role ARN from the top of the role summary screen. > [!NOTE] > > **Screenshot** > > [![IAM Service Role]()]() > [!NOTE] > > Example Role ARN: "arn:aws:iam::012345678901:role/SPCrossAccountRole" The result should look similar to this: > [!NOTE] > > **Screenshot** > > [![IAM Service Role]()]() ## How to Remove the Schema Objects for Use with a Single AWS Account The default AWS connector assumes you will be connecting to an AWS Organization structure, therefore, it includes default group schema objects related to AWS Organization objects. If you attempt to connect to a single AWS account, you will likely encounter error messages during a test connection regarding AWS Organizations. Today, the workaround is to manually remove the group schema objects related to AWS Organization objects. This requires API work as there is currently no UI for group schema. You must remove the following group schema objects using Postman: - OrganizationUnit - SCP - AWSAccount To modify the schema, use Postman to do the following: 1. List all the sources in your IDN tenant to find the AWS source ID: 1. GET https://{tenant}.api.identitynow.com/v3/sources 2. [https://developer.sailpoint.com/docs/api/list-sources-v-1/]() 2. List the AWS source schema using the ID you obtained from step 1: 1. GET https://{tenant}.api.identitynow.com/v3/sources/{sourceId}/schemas 2. [https://developer.sailpoint.com/docs/api/get-source-schemas-v-1/]() 3. Note the schemaId for each of the section you will remove (OrganizationUnit, SCP, AWSAccount) 3. Delete each of the schema sections for OrganizationUnit, SCP and AWSAccount using the appropriate schemaId for each: 1. DELETE https://{tenant}.api.identitynow.com/v3/sources/{sourceId}/schemas/{schemaId} 2. [https://developer.sailpoint.com/docs/api/delete-source-schema-v-1/]() As a reference, here is the default schema. You will see a section for OrganizationUnit, SCP and AWSAccount near the very bottom of the schema: > [!NOTE] > > Each section has a unique schemaId. You will need those IDs to delete each section. ```json [ { "nativeObjectType": "account", "identityAttribute": "ARN", "displayAttribute": "UserName", "hierarchyAttribute": null, "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "UserName", "type": "STRING", "schema": null, "description": "The friendly name of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "UserId", "type": "STRING", "schema": null, "description": "The unique ID of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "Path to the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "User Creation date", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ConsoleAccess", "type": "STRING", "schema": null, "description": "Password Status", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Groups", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260c", "name": "group" }, "description": "Groups the user is a part of", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "AWSManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260d", "name": "AWSManagedPolicy" }, "description": "AWS Managed Policies directly assigned to this user", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "CustomerManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260e", "name": "CustomerManagedPolicy" }, "description": "Customer Managed Policies directly assigned to this user", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "InlinePolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260f", "name": "InlinePolicy" }, "description": "Inline Policies directly assigned to this user", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "Access Keys", "type": "STRING", "schema": null, "description": "Access keys associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "AWS CodeCommit HTTPS Credentials", "type": "STRING", "schema": null, "description": "AWS CodeCommit HTTPS Git credentials associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "AWS CodeCommit SSH Keys", "type": "STRING", "schema": null, "description": "AWS CodeCommit SSH public keys associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "Signing Certificates", "type": "STRING", "schema": null, "description": "Signing Certificates associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "PasswordLastUsed", "type": "STRING", "schema": null, "description": "Password last used date of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AccessKeyLastUsed", "type": "STRING", "schema": null, "description": "Access key last used details of the user ", "isMulti": true, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260b", "name": "account", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "group", "identityAttribute": "ARN", "displayAttribute": "GroupName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "GroupName", "type": "STRING", "schema": null, "description": "The friendly name of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "GroupId", "type": "STRING", "schema": null, "description": "The unique ID of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "Path to the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "Creation date of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSManagedPolicies", "type": "STRING", "schema": null, "description": "AWS Managed Policies directly assigned to the group", "isMulti": true, "isEntitlement": true, "isGroup": false }, { "name": "CustomerManagedPolicies", "type": "STRING", "schema": null, "description": "Customer Managed Policies directly assigned to the group", "isMulti": true, "isEntitlement": true, "isGroup": false }, { "name": "InlinePolicies", "type": "STRING", "schema": null, "description": "Inline Policies directly assigned to the group", "isMulti": true, "isEntitlement": true, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260c", "name": "group", "created": "2021-08-12T19:11:37.577Z", "modified": "2021-08-12T19:11:37.673Z" }, { "nativeObjectType": "AWSManagedPolicy", "identityAttribute": "ARN", "displayAttribute": "PolicyName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "PolicyName", "type": "STRING", "schema": null, "description": "The friendly name of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyId", "type": "STRING", "schema": null, "description": "The unique ID of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "A friendly description of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "The path to the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "The creation date of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "UpdateDate", "type": "STRING", "schema": null, "description": "The last update date of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "DefaultVersionId", "type": "STRING", "schema": null, "description": "The currently enabled version ID of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260d", "name": "AWSManagedPolicy", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "CustomerManagedPolicy", "identityAttribute": "ARN", "displayAttribute": "PolicyName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "PROVISIONING", "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "PolicyName", "type": "STRING", "schema": null, "description": "The friendly name of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyId", "type": "STRING", "schema": null, "description": "The unique ID of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "A friendly description of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "The creation date of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "UpdateDate", "type": "STRING", "schema": null, "description": "The last update date of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "The path to the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "DefaultVersionId", "type": "STRING", "schema": null, "description": "The currently enabled version ID of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyGroups", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260c", "name": "group" }, "description": "Groups attached to the customer managed policy", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "PolicyRoles", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692610", "name": "Role" }, "description": "Roles attached to the customer managed policy", "isMulti": true, "isEntitlement": true, "isGroup": true } ], "id": "2c9180887b36bc33017b3bc6ec69260e", "name": "CustomerManagedPolicy", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "InlinePolicy", "identityAttribute": "Id", "displayAttribute": "Name", "hierarchyAttribute": null, "includePermissions": false, "features": [ "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "Name", "type": "STRING", "schema": null, "description": "The friendly name of the policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Id", "type": "STRING", "schema": null, "description": "The unique ID of the policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the policy", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260f", "name": "InlinePolicy", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "Role", "identityAttribute": "ARN", "displayAttribute": "RoleName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "PROVISIONING", "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "RoleName", "type": "STRING", "schema": null, "description": "The friendly name of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "RoleId", "type": "STRING", "schema": null, "description": "The unique ID of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "Path to the Role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "Role Description", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "Creation date of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260d", "name": "AWSManagedPolicy" }, "description": "AWS Managed Policies directly assigned to the role", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "CustomerManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260e", "name": "CustomerManagedPolicy" }, "description": "Customer Managed Policies directly assigned to the role", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "InlinePolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260f", "name": "InlinePolicy" }, "description": "Inline Policies directly assigned to the role", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "TrustPolicyJSON", "type": "STRING", "schema": null, "description": "Trust Relationship Policy JSON", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "MaxSessionDuration", "type": "STRING", "schema": null, "description": "Maximum CLI/API session duration", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec692610", "name": "Role", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "SCP", "identityAttribute": "ARN", "displayAttribute": "SCPName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "SCPName", "type": "STRING", "schema": null, "description": "The friendly name of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "SCPId", "type": "STRING", "schema": null, "description": "The unique ID of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "A friendly description of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSManaged", "type": "STRING", "schema": null, "description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec692611", "name": "SCP", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "AWSAccount", "identityAttribute": "ARN", "displayAttribute": "AWSAccountName", "hierarchyAttribute": null, "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "AWSAccountName", "type": "STRING", "schema": null, "description": "The friendly name of the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSAccountId", "type": "STRING", "schema": null, "description": "The unique ID of the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Email", "type": "STRING", "schema": null, "description": "The email address associated with the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Status", "type": "STRING", "schema": null, "description": "The status of the AWS account in the organization.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "JoinedMethod", "type": "STRING", "schema": null, "description": "The method by which the AWS account joined the organization.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "JoinedTimestamp", "type": "STRING", "schema": null, "description": "The date the AWS account became a part of the organization.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "OrganizationUnit", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692613", "name": "OrganizationUnit" }, "description": "Organization unit holding the AWS Account", "isMulti": false, "isEntitlement": false, "isGroup": true } ], "id": "2c9180887b36bc33017b3bc6ec692612", "name": "AWSAccount", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "OrganizationUnit", "identityAttribute": "ARN", "displayAttribute": "OUName", "hierarchyAttribute": "Parent", "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "OUName", "type": "STRING", "schema": null, "description": "The friendly name of the Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "OUId", "type": "STRING", "schema": null, "description": "The unique ID of the Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ServiceControlPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692611", "name": "SCP" }, "description": "Service Control Policies attached to the Organization Unit", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "Parent", "type": "STRING", "schema": null, "description": "Parent Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": true }, { "name": "AWSAccounts", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692612", "name": "AWSAccount" }, "description": "AWS Accounts attached to the Organization Unit", "isMulti": true, "isEntitlement": true, "isGroup": true } ], "id": "2c9180887b36bc33017b3bc6ec692613", "name": "OrganizationUnit", "created": "2021-08-12T19:11:37.577Z", "modified": null } ] ``` Here is the section that must be removed: ```json { "nativeObjectType": "SCP", "identityAttribute": "ARN", "displayAttribute": "SCPName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "SCPName", "type": "STRING", "schema": null, "description": "The friendly name of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "SCPId", "type": "STRING", "schema": null, "description": "The unique ID of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "A friendly description of the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSManaged", "type": "STRING", "schema": null, "description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the Service Control Policy", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec692611", "name": "SCP", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "AWSAccount", "identityAttribute": "ARN", "displayAttribute": "AWSAccountName", "hierarchyAttribute": null, "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "AWSAccountName", "type": "STRING", "schema": null, "description": "The friendly name of the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSAccountId", "type": "STRING", "schema": null, "description": "The unique ID of the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Email", "type": "STRING", "schema": null, "description": "The email address associated with the AWS account.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Status", "type": "STRING", "schema": null, "description": "The status of the AWS account in the organization.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "JoinedMethod", "type": "STRING", "schema": null, "description": "The method by which the AWS account joined the organization.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "JoinedTimestamp", "type": "STRING", "schema": null, "description": "The date the AWS account became a part of the organization.", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "OrganizationUnit", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692613", "name": "OrganizationUnit" }, "description": "Organization unit holding the AWS Account", "isMulti": false, "isEntitlement": false, "isGroup": true } ], "id": "2c9180887b36bc33017b3bc6ec692612", "name": "AWSAccount", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "OrganizationUnit", "identityAttribute": "ARN", "displayAttribute": "OUName", "hierarchyAttribute": "Parent", "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "OUName", "type": "STRING", "schema": null, "description": "The friendly name of the Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "OUId", "type": "STRING", "schema": null, "description": "The unique ID of the Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ServiceControlPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692611", "name": "SCP" }, "description": "Service Control Policies attached to the Organization Unit", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "Parent", "type": "STRING", "schema": null, "description": "Parent Organization Unit", "isMulti": false, "isEntitlement": false, "isGroup": true }, { "name": "AWSAccounts", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692612", "name": "AWSAccount" }, "description": "AWS Accounts attached to the Organization Unit", "isMulti": true, "isEntitlement": true, "isGroup": true } ], "id": "2c9180887b36bc33017b3bc6ec692613", "name": "OrganizationUnit", "created": "2021-08-12T19:11:37.577Z", "modified": null } ``` Here is what it should look like after you modify it: ```json [ { "nativeObjectType": "account", "identityAttribute": "ARN", "displayAttribute": "UserName", "hierarchyAttribute": null, "includePermissions": false, "features": [], "configuration": {}, "attributes": [ { "name": "UserName", "type": "STRING", "schema": null, "description": "The friendly name of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "UserId", "type": "STRING", "schema": null, "description": "The unique ID of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "Path to the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "User Creation date", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ConsoleAccess", "type": "STRING", "schema": null, "description": "Password Status", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Groups", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260c", "name": "group" }, "description": "Groups the user is a part of", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "AWSManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260d", "name": "AWSManagedPolicy" }, "description": "AWS Managed Policies directly assigned to this user", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "CustomerManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260e", "name": "CustomerManagedPolicy" }, "description": "Customer Managed Policies directly assigned to this user", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "InlinePolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260f", "name": "InlinePolicy" }, "description": "Inline Policies directly assigned to this user", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "Access Keys", "type": "STRING", "schema": null, "description": "Access keys associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "AWS CodeCommit HTTPS Credentials", "type": "STRING", "schema": null, "description": "AWS CodeCommit HTTPS Git credentials associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "AWS CodeCommit SSH Keys", "type": "STRING", "schema": null, "description": "AWS CodeCommit SSH public keys associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "Signing Certificates", "type": "STRING", "schema": null, "description": "Signing Certificates associated with the user", "isMulti": true, "isEntitlement": false, "isGroup": false }, { "name": "PasswordLastUsed", "type": "STRING", "schema": null, "description": "Password last used date of the user", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AccessKeyLastUsed", "type": "STRING", "schema": null, "description": "Access key last used details of the user ", "isMulti": true, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260b", "name": "account", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "group", "identityAttribute": "ARN", "displayAttribute": "GroupName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "GroupName", "type": "STRING", "schema": null, "description": "The friendly name of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "GroupId", "type": "STRING", "schema": null, "description": "The unique ID of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "Path to the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "Creation date of the group", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSManagedPolicies", "type": "STRING", "schema": null, "description": "AWS Managed Policies directly assigned to the group", "isMulti": true, "isEntitlement": true, "isGroup": false }, { "name": "CustomerManagedPolicies", "type": "STRING", "schema": null, "description": "Customer Managed Policies directly assigned to the group", "isMulti": true, "isEntitlement": true, "isGroup": false }, { "name": "InlinePolicies", "type": "STRING", "schema": null, "description": "Inline Policies directly assigned to the group", "isMulti": true, "isEntitlement": true, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260c", "name": "group", "created": "2021-08-12T19:11:37.577Z", "modified": "2021-08-12T19:11:37.673Z" }, { "nativeObjectType": "AWSManagedPolicy", "identityAttribute": "ARN", "displayAttribute": "PolicyName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "PolicyName", "type": "STRING", "schema": null, "description": "The friendly name of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyId", "type": "STRING", "schema": null, "description": "The unique ID of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "A friendly description of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "The path to the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "The creation date of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "UpdateDate", "type": "STRING", "schema": null, "description": "The last update date of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "DefaultVersionId", "type": "STRING", "schema": null, "description": "The currently enabled version ID of the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the AWS managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260d", "name": "AWSManagedPolicy", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "CustomerManagedPolicy", "identityAttribute": "ARN", "displayAttribute": "PolicyName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "PROVISIONING", "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "PolicyName", "type": "STRING", "schema": null, "description": "The friendly name of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyId", "type": "STRING", "schema": null, "description": "The unique ID of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "A friendly description of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "The creation date of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "UpdateDate", "type": "STRING", "schema": null, "description": "The last update date of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "The path to the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "DefaultVersionId", "type": "STRING", "schema": null, "description": "The currently enabled version ID of the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the customer managed policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyGroups", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260c", "name": "group" }, "description": "Groups attached to the customer managed policy", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "PolicyRoles", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec692610", "name": "Role" }, "description": "Roles attached to the customer managed policy", "isMulti": true, "isEntitlement": true, "isGroup": true } ], "id": "2c9180887b36bc33017b3bc6ec69260e", "name": "CustomerManagedPolicy", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "InlinePolicy", "identityAttribute": "Id", "displayAttribute": "Name", "hierarchyAttribute": null, "includePermissions": false, "features": [ "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "Name", "type": "STRING", "schema": null, "description": "The friendly name of the policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Id", "type": "STRING", "schema": null, "description": "The unique ID of the policy", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "PolicyJSON", "type": "STRING", "schema": null, "description": "The JSON document for the policy", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec69260f", "name": "InlinePolicy", "created": "2021-08-12T19:11:37.577Z", "modified": null }, { "nativeObjectType": "Role", "identityAttribute": "ARN", "displayAttribute": "RoleName", "hierarchyAttribute": null, "includePermissions": false, "features": [ "PROVISIONING", "NO_GROUP_PERMISSIONS_PROVISIONING" ], "configuration": {}, "attributes": [ { "name": "RoleName", "type": "STRING", "schema": null, "description": "The friendly name of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "RoleId", "type": "STRING", "schema": null, "description": "The unique ID of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Path", "type": "STRING", "schema": null, "description": "Path to the Role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "ARN", "type": "STRING", "schema": null, "description": "Amazon Resource Name of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "Description", "type": "STRING", "schema": null, "description": "Role Description", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "CreateDate", "type": "STRING", "schema": null, "description": "Creation date of the role", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "AWSManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260d", "name": "AWSManagedPolicy" }, "description": "AWS Managed Policies directly assigned to the role", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "CustomerManagedPolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260e", "name": "CustomerManagedPolicy" }, "description": "Customer Managed Policies directly assigned to the role", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "InlinePolicies", "type": "STRING", "schema": { "type": "CONNECTOR_SCHEMA", "id": "2c9180887b36bc33017b3bc6ec69260f", "name": "InlinePolicy" }, "description": "Inline Policies directly assigned to the role", "isMulti": true, "isEntitlement": true, "isGroup": true }, { "name": "TrustPolicyJSON", "type": "STRING", "schema": null, "description": "Trust Relationship Policy JSON", "isMulti": false, "isEntitlement": false, "isGroup": false }, { "name": "MaxSessionDuration", "type": "STRING", "schema": null, "description": "Maximum CLI/API session duration", "isMulti": false, "isEntitlement": false, "isGroup": false } ], "id": "2c9180887b36bc33017b3bc6ec692610", "name": "Role", "created": "2021-08-12T19:11:37.577Z", "modified": null } ] ``` # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Test Connection Errors ```text [ ConnectorException ] [ Error details ] aws_default_errorAWS Client creation failed : ull} (requestld: a5213b0b292a457ca37ad344b3721b2f) (requestld: a5213b0b292a457ca37ad344b3721b2f ``` **Resolution 1:** Ensure the role is created in the management account ID, as it is mandatory. The test connection is performed on the created role in the management account, therefore, it will fail if the role is created only in a child AWS account. **Resolution 2:** In the configuration page, ensure only the **Role Name** is entered, and not the **Role ARN**. ```text [InsufficientPermissionException] [Possible suggestions] Service account must be present in the management account with the required permissions. [Error details] Test Connection Failed: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: 65fc15e5-7e90-11e8-9d6a-6fc388fd2d28) ``` If Service user is in Member AWS account, Test Connection fails. **Resolution**: Ensure that the service user is created in the management account with required permission to manage organization entities. If you do not want to manage the Organization entities, remove them from schema. When configuring a new Amazon Web Services source, the Test Connection fails with the following error message: ```text sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Your account is not a member of an organization. (Service: AWSOrganizations; Status Code: 400; Error Code: AWSOrganizationsNotInUseException; Request ID: c8d77e54-ec98-11e8-b722-bb0efb7fc919) ``` If Service user is in Member AWS account, Test Connection fails. **Resolution**: Ensure that the AWS Account is a member of the AWS Organization which must be managed. When configuring a new Amazon Web Services source, the Test Connection fails with the following error message: ```text [ Error details ] aws_default_errorError occurred while testing AWS Organizations connectivity ``` **Resolution**: Create Cross Account Roles in each AWS account that you want to manage and attach the appropriate policies to the role. For more information, refer to [Source Configuration Guide](). For the upgraded sources, if multiple group objects are configured, work item(s) got created while revoking associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through **certification**. **Resolution:** Remove `NO_PERMISSIONS_PROVISIONING` from the feature string in Source XML. ## Role Not Created Error ```text [ InvalidConfigurationException ] [ Possible suggestions ] Ensure that the required role is created in the specified AWS accounts and the user has required permissions. [ Error details ] Test connection failed for accounts [list of AWS account IDs] Failure Reason=Access denied (Service: AWSSecurityTokenService) ``` If **Manage All Accounts** is selected, and the provided role is not present in any of the AWS accounts, then the test connection fails . ```text Exception during aggregation. Reason:openconnector.InvalidRequestException: Aggregation is failed for following AWS Account Ids: [comma separated list of accounts] ``` Aggregation fails **Resolution:** Ensure the role is created in all the AWS Accounts with the same name and having sufficient permissions. ## Create Account Error ```text sailpoint.connector.ConnectorException: Access denied (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: f56b8ec5-1e7e-11e9-bab1-d124100fa000) ``` Error while creating an account. **Resolution**: Ensure that the Account ID or ARN of the AWS Account is correctly mentioned in the Account ID of the account attribute. For example: ```text arn:aws:organizations::441113549707:account/o-lqs5akk5dy/170915734915 ``` ## Identity Attribute Error ```text sailpoint.connector.ConnectorException: Un-supported identity attribute for account ``` **Resolution**: The Account ID must be mapped with the ARN in the attribute schema. ## Throttling Error Aggregation fails with the following error: ```text openconnector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Rate exceeded (Service: AmazonIdentityManagement; Status Code: 400; Error Code: Throttling; Request ID: )] ``` **Resolution**: Configure the throttling and set a higher value as per the requirement and allowed API limit. ## Aggregation Error ```text Exception during aggregation of Object Type InlinePolicy on Application AWSDemo1 [source]. Reason: java.lang.RuntimeException: An error occurred while aggregating Application 'ApplicationName' [source] ``` While performing Entitlement Aggregation when multiple group objects are supported. **Resolution:** Set the `aggregate_timeout` attribute with a value in milliseconds (300, 1000) using the REST API. ```text POST /cc/api/source/update/ ``` `` : The URL for the customer's SailPoint tenant ` [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## Miscellaneous Errors Tags are not aggregated for Role after upgrade. **Resolution**: Ensure `updateRole` provisioning policy is configured for the application with the Tags attribute ReadOnly='True' ```text ``` ## A timeout error occurs when attempting to connect **Resolution**: Utilize the API calls to increase the timeout value to 60 seconds: PATCH https://{tenant}.api.identitynow.com/v3/sources/{id} Content-Type: application/json-patch+json Body: ```json [ { "op": "add", "path": "/connectorAttributes/healthCheckTimeout", "value": 60 } ] ``` ## InsufficientPermissionException **Error**: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: a90d35bd-9832-4211-9e7a-1f966063b642; Proxy: null) **Resolution**: The service account must be present in the management account with the required permissions. Permissions should be: ```json { "Statement": [ { "Action": [ "iam:ListUsers", "iam:ListUserTags", "iam:ListUserPolicies", "iam:ListSigningCertificates", "iam:ListServiceSpecificCredentials", "iam:ListSSHPublicKeys", "iam:ListRoles", "iam:ListRoleTags", "iam:ListRolePolicies", "iam:ListPolicyTags", "iam:ListPolicies", "iam:ListMFADevices", "iam:ListGroupsForUser", "iam:ListGroups", "iam:ListGroupPolicies", "iam:ListEntitiesForPolicy", "iam:ListAttachedUserPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedGroupPolicies", "iam:ListAccountAliases", "iam:ListAccessKeys", "iam:GetUserPolicy", "iam:GetUser", "iam:GetRolePolicy", "iam:GetRole", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:GetLoginProfile", "iam:GetGroupPolicy", "iam:GetGroup", "iam:GetAccessKeyLastUsed" ], "Effect": "Allow", "Resource": "*", "Sid": "SPAggregationPolicy" }, { "Action": [ "organizations:ListTargetsForPolicy", "organizations:ListTagsForResource", "organizations:ListRoots", "organizations:ListPoliciesForTarget", "organizations:ListPolicies", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:ListAccountsForParent", "organizations:ListAccounts", "organizations:DescribePolicy", "organizations:DescribeOrganizationalUnit", "organizations:DescribeOrganization", "organizations:DescribeAccount" ], "Effect": "Allow", "Resource": "*", "Sid": "SPOrganizationPolicy" } ], "Version": "2012-10-17" } ``` ## Partial Deployment If the onboarding workflow shows **Partial**, one or more member accounts failed StackSet deployment. **Resolution**: Follow the below steps: - In the AWS Console, go to **CloudFormation \> StackSets** and select the SailPoint StackSet. - Open **Operations** and review the failed operation and error details. - Open **Stack instances** and filter by **FAILED** to identify affected member accounts and regions. - Resolve the reported issue and retry the failed deployment. For more information, refer to [SAF AWS Onboarding: Partial StackSet Deployment](). > [!NOTE] > > A Partial status indicates that the deployment succeeded for some accounts but requires your attention for others. ## Scan Count 0 for IAM Role Dataset Aggregation ```text https response error StatusCode: 403, RequestID: api error AccessDenied: User: arn:aws:sts:::assumed-role// is not authorized to perform: iam:GetAccountAuthorizationDetails on resource: * because no identity-based policy allows the iam:GetAccountAuthorizationDetails action ``` **Resolution**: Add the `iam:GetAccountAuthorizationDetails` permission to the existing policy attached to the role.