Using Multiple Group Entitlements

The AWS source supports multiple group objects. The details of the features are:

Feature	IAM Users
Aggregate	✔
Create, Update, Enable, Disable, Delete	✔
Group Entitlements (Read, Request, Revoke)	Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies Note: InlinePolicies can be read and revoked.

Group Entitlements

SailPoint provides the ability to aggregate additional details from the managed system through Group Entitlements. These objects have a separate schema defining list of attributes. The aggregation task fetches these as additional details when aggregation is run for that Group Entitlement type.

Note

The following group objects are available with Cloud Infrastructure Entitlement Management (CIEM), Machine Identity Security, or Agentic Identity Security:

AWS Managed Policies
Customer Managed Policies
Inline Policies

The following group objects are available only with CIEM:

Service Control Policy
Roles
Organization Unit
AWS Accounts

	Aggregation	Permissions	Read Heirarchy Group
Groups	✔	NA	NA
AWSManagedPolicies	✔	✔	NA
CustomerManagedPolicies	✔	✔	NA
InlinePolicies	✔	✔	NA
Roles	✔	✔	NA
SCP	✔	✔	NA
AWSAccount	✔	NA	NA
OrganizationUnit	✔	NA	✔

NA = Not Applicable.
The objects such as, Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies, and Roles are the IAM entities.
The objects, such as Service Control Policies (SCP), AWSAccount and OrganizationUnit (OU) are the Organization entities.
The AWS source supports JSON Policy for Permission Policy, and Trust Policy is represented as Permissions.
The Permission Policy for the following AWS entities are represented as Permissions:
- AWS Managed Policies
- Customer Managed Policies
- Inline Policies
- Service Control Policies
The Trust Policy for the following AWS entity is represented as Permissions:
- Roles

Using Multiple Group Entitlements with a Pre-Existing Source

To start using Multiple Group Entitlements with your current (pre-existing) AWS source(s), perform the following steps:

Use createSchema API to create new group schema for your source.

Example of API body content for adding Project Roles to an existing source

 AWS Managed Policies:
{
"name": "AWSManagedPolicy",
"nativeObjectType": "AWSManagedPolicy",
"identityAttribute": "ARN",
"displayAttribute": "PolicyName",
"hierarchyAttribute": null,
"includePermissions": false,
"features": [
"NO_GROUP_PERMISSIONS_PROVISIONING"
],
"configuration": {},
"attributes": [
{
"name": "PolicyName",
"type": "STRING",
"schema": null,
"description": "The friendly name of the AWS managed policy ",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "PolicyId",
"type": "STRING",
"schema": null,
"description": "The unique ID of the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Description",
"type": "STRING",
"schema": null,
"description": "A friendly description of the AWS managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},

{
"name": "ARN",
"type": "STRING",
"schema": null,
"description": "Amazon Resource Name of the AWS managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Path",
"type": "STRING",
"schema": null,
"description": "The path to the AWS managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "CreateDate",
"type": "STRING",
"schema": null,
"description": "The creation date of the AWS managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "UpdateDate",
"type": "STRING",
"schema": null,
"description": "The last update date of the AWS managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "DefaultVersionId ",
"type": "STRING",
"schema": null,
"description": "The currently enabled version ID of the AWS managed policy ",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "PolicyJSON",
"type": "STRING",
"schema": null,
"description": "The JSON document for the AWS managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
}
]
}

##################################################### 

Customer Managed Policies:

{
"name": "CustomerManagedPolicy",
"nativeObjectType": "CustomerManagedPolicy",
"identityAttribute": "ARN",
"displayAttribute": "PolicyName",
"hierarchyAttribute": null,
"includePermissions": false,
"features": [
"PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING"
],
"configuration": {},
"attributes": [
{
"name": "PolicyName",
"type": "STRING",
"schema": null,
"description": "The friendly name of the customer managed policy ",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "PolicyId",
"type": "STRING",
"schema": null,
"description": "The unique ID of the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Description",
"type": "STRING",
"schema": null,
"description": "A friendly description of the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "CreateDate",
"type": "STRING",
"schema": null,
"description": "The creation date of the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "UpdateDate",
"type": "STRING",
"schema": null,
"description": "The last update date of the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "ARN",
"type": "STRING",
"schema": null,
"description": "Amazon Resource Name of the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Path",
"type": "STRING",
"schema": null,
"description": "The path to the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "DefaultVersionId ",
"type": "STRING",
"schema": null,
"description": "The currently enabled version ID of the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "PolicyJSON",
"type": "STRING",
"schema": null,
"description": "The JSON document for the customer managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "PolicyGroups",
"type": "STRING",
"schema": null,
"description": "Groups attached to the customer managed policy",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "PolicyRoles",
"type": "STRING",
"schema": null,
"description": "Roles attached to the customer managed policy",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
}
]
}

#################################################### 

Inline Policies:

{
"name": "InlinePolicy",
"nativeObjectType": "InlinePolicy",
"identityAttribute": "Id",
"displayAttribute": "Name",
"hierarchyAttribute": null,
"includePermissions": false,
"features": [
"NO_GROUP_PERMISSIONS_PROVISIONING"
],
"configuration": {},
"attributes": [
{
"name": "Name",
"type": "STRING",
"schema": null,
"description": "The friendly name of the policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Id",
"type": "STRING",
"schema": null,
"description": "The unique ID of the policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "PolicyJSON",
"type": "STRING",
"schema": null,
"description": "The JSON document for the policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
}
]
}


################################################### 




Roles:

{
"name": "Role",
"nativeObjectType": "Role",
"identityAttribute": "ARN",
"displayAttribute": "RoleName",
"hierarchyAttribute": null,
"includePermissions": false,
"features": [
"PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING"
],
"configuration": {},
"attributes": [
{
"name": "RoleName",
"type": "STRING",
"schema": null,
"description": "The friendly name of the role",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "RoleId",
"type": "STRING",
"schema": null,
"description": "The unique ID of the role",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Path",
"type": "STRING",
"schema": null,
"description": "Path to the Role",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "ARN",
"type": "STRING",
"schema": null,
"description": "Amazon Resource Name of the role",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Description",
"type": "STRING",
"schema": null,
"description": "Role Description",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "CreateDate",
"type": "STRING",
"schema": null,
"description": "Creation date of the role",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "AWSManagedPolicies",
"type": "STRING",
"schema": null,
"description": "AWS Managed Policies directly assigned to the role",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "CustomerManagedPolicies",
"type": "STRING",
"schema": null,
"description": "Customer Managed Policies directly assigned to the role",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "InlinePolicies",
"type": "STRING",
"schema": null,
"description": "Inline Policies directly assigned to the role",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "TrustPolicyJSON",
"type": "STRING",
"schema": null,
"description": "Trust Relationship Policy JSON",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "MaxSessionDuration",
"type": "STRING",
"schema": null,
"description": "Maximum CLI/API session duration",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
}
]
}



###################################################
Service Control Policies:

{
"name": "SCP",
"nativeObjectType": "SCP",
"identityAttribute": "ARN",
"displayAttribute": "RoleName",
"hierarchyAttribute": null,
"includePermissions": false,
"features": [
"NO_GROUP_PERMISSIONS_PROVISIONING"
],
"configuration": {},
"attributes": [
{
"name": "SCPName",
"type": "STRING",
"schema": null,
"description": "The friendly name of the Service Control Policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "SCPId",
"type": "STRING",
"schema": null,
"description": "The unique ID of the Service Control Policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "ARN",
"type": "STRING",
"schema": null,
"description": "A friendly description of the Service Control Policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Description",
"type": "STRING",
"schema": null,
"description": "A friendly description of the Service Control Policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "AWSManaged",
"type": "STRING",
"schema": null,
"description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "PolicyJSON",
"type": "STRING",
"schema": null,
"description": "The JSON document for the Service Control Policy",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
}
]
}


               ###################################################
               AWS Accounts:
{
"name": "AWSAccount",
"nativeObjectType": "AWSAccount",
"identityAttribute": "ARN",
"displayAttribute": "AWSAccountName",
"hierarchyAttribute": null,
"includePermissions": false,
"features": [],
"configuration": {},
"attributes": [
{
"name": "AWSAccountName",
"type": "STRING",
"schema": null,
"description": "The friendly name of the AWS account.",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "AWSAccountId",
"type": "STRING",
"schema": null,
"description": "The unique ID of the AWS account.",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "ARN",
"type": "STRING",
"schema": null,
"description": "Amazon Resource Name of the AWS account.",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Email",
"type": "STRING",
"schema": null,
"description": "The email address associated with the AWS account.",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "Status",
"type": "STRING",
"schema": null,
"description": "The status of the AWS account in the organization.",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "CreateDate",
"type": "STRING",
"schema": null,
"description": "Creation date of the role",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "JoinedMethod",
"type": "STRING",
"schema": null,
"description": "The method by which the AWS account joined the organization.",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "CustomerManagedPolicies",
"type": "STRING",
"schema": null,
"description": "Customer Managed Policies directly assigned to the role",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "JoinedTimestamp",
"type": "STRING",
"schema": null,
"description": "The date the AWS account became a part of the organization.",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "OrganizationUnit",
"type": "STRING",
"schema": null,
"description": "Organization unit holding the AWS Account",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
}
]
}

              ###################################################
               Organization Units: 
{
"name": "OrganizationUnit",
"nativeObjectType": "OrganizationUnit",
"identityAttribute": "ARN",
"displayAttribute": "OUName",
"hierarchyAttribute": Parent,
"includePermissions": false,
"features": [],
"configuration": {},
"attributes": [
{
"name": "OUName",
"type": "STRING",
"schema": null,
"description": "The friendly name of the Organization Unit",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "OUId",
"type": "STRING",
"schema": null,
"description": "The unique ID of the Organization Unit",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "ARN",
"type": "STRING",
"schema": null,
"description": "Amazon Resource Name of the Organization Unit",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "ServiceControlPolicies",
"type": "STRING",
"schema": null,
"description": "Service Control Policies attached to the Organization Unit",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
},
{
"name": "Parent",
"type": "STRING",
"schema": null,
"description": "Parent Organization Unit",
"isMulti": false,
"isEntitlement": false,
"isGroup": false
},
{
"name": "AWSAccounts",
"type": "STRING",
"schema": null,
"description": "AWS Accounts attached to the Organization Unit",
"isMulti": true,
"isEntitlement": true,
"isGroup": false
}
]
}

Update Account Schema with the following steps:
1. Get account schema using getSchema API.
2. Copy the schema to a file.
3. Search for the attribute corresponding to the group schema that was added in step 1.
4. Add/update the below two properties for the attribute found in the previous step (2.c.)
  
  "isGroup": true,
  
  "schema": {"type": "CONNECTOR_SCHEMA","id": "<Schema_ID_From_Step1>","name": "<Name_Of_Schema_Created_In_Step1>"}
5. Add the schema (modified in step 2.d.) to the payload to update the account schema in the source. Use replaceSchema API for this task.
Note

Remove NO_PERMISSIONS_PROVISIONING from the feature string so there won’t be any work item while removing associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through certification.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.