# Using Multiple Group Entitlements

The AWS source supports multiple group objects. The details of the features are:

| Feature | IAM Users |
| --- | --- |
| Aggregate | ✔ |
| Create, Update, Enable, Disable, Delete | ✔ |
| Group Entitlements (Read, Request, Revoke) | Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies<br><br>**Note:** InlinePolicies can be read and revoked. |

## Group Entitlements

SailPoint provides the ability to aggregate additional details from the managed system through Group Entitlements. These objects have a separate schema defining list of attributes. The aggregation task fetches these as additional details when aggregation is run for that Group Entitlement type.

> [!NOTE]
>
> The following group objects are available with Cloud Infrastructure Entitlement Management (CIEM), Machine Identity Security, or Agentic Identity Security:
>
> - AWS Managed Policies
> - Customer Managed Policies
> - Inline Policies
>
> The following group objects are available only with CIEM:
>
> - Service Control Policy
> - Roles
> - Organization Unit
> - AWS Accounts

|  | Aggregation | Permissions | Read Heirarchy Group |
| --- | --- | --- | --- |
| Groups | ✔ | NA | NA |
| AWSManagedPolicies | ✔ | ✔ | NA |
| CustomerManagedPolicies | ✔ | ✔ | NA |
| InlinePolicies | ✔ | ✔ | NA |
| Roles | ✔ | ✔ | NA |
| SCP | ✔ | ✔ | NA |
| AWSAccount | ✔ | NA | NA |
| OrganizationUnit | ✔ | NA | ✔ |

- NA = Not Applicable.
- The objects such as, Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies, and Roles are the IAM entities.
- The objects, such as Service Control Policies (SCP), AWSAccount and OrganizationUnit (OU) are the Organization entities.
- The AWS source supports JSON Policy for Permission Policy, and Trust Policy is represented as Permissions.
- The Permission Policy for the following AWS entities are represented as Permissions:

  - AWS Managed Policies
  - Customer Managed Policies
  - Inline Policies
  - Service Control Policies
- The Trust Policy for the following AWS entity is represented as Permissions:

  - Roles

## Using Multiple Group Entitlements with a Pre-Existing Source

To start using Multiple Group Entitlements with your current (pre-existing) AWS source(s), perform the following steps:

1. Use [createSchema](<https://developer.sailpoint.com/docs/api/v3/create-source-schema/>) API to create new group schema for your source.

   > **Example of API body content for adding Project Roles to an existing source**
   >
   > ```text
   >  AWS Managed Policies:
   > {
   > "name": "AWSManagedPolicy",
   > "nativeObjectType": "AWSManagedPolicy",
   > "identityAttribute": "ARN",
   > "displayAttribute": "PolicyName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "PolicyName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the AWS managed policy ",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   >
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Path",
   > "type": "STRING",
   > "schema": null,
   > "description": "The path to the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The creation date of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "UpdateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The last update date of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "DefaultVersionId ",
   > "type": "STRING",
   > "schema": null,
   > "description": "The currently enabled version ID of the AWS managed policy ",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   > ##################################################### 
   >
   > Customer Managed Policies:
   >
   > {
   > "name": "CustomerManagedPolicy",
   > "nativeObjectType": "CustomerManagedPolicy",
   > "identityAttribute": "ARN",
   > "displayAttribute": "PolicyName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "PolicyName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the customer managed policy ",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The creation date of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "UpdateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The last update date of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Path",
   > "type": "STRING",
   > "schema": null,
   > "description": "The path to the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "DefaultVersionId ",
   > "type": "STRING",
   > "schema": null,
   > "description": "The currently enabled version ID of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyGroups",
   > "type": "STRING",
   > "schema": null,
   > "description": "Groups attached to the customer managed policy",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyRoles",
   > "type": "STRING",
   > "schema": null,
   > "description": "Roles attached to the customer managed policy",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > }
   > ]
   > }
   >
   > #################################################### 
   >
   > Inline Policies:
   >
   > {
   > "name": "InlinePolicy",
   > "nativeObjectType": "InlinePolicy",
   > "identityAttribute": "Id",
   > "displayAttribute": "Name",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "Name",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Id",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >
   > ################################################### 
   >
   >
   >
   >
   > Roles:
   >
   > {
   > "name": "Role",
   > "nativeObjectType": "Role",
   > "identityAttribute": "ARN",
   > "displayAttribute": "RoleName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "RoleName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "RoleId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Path",
   > "type": "STRING",
   > "schema": null,
   > "description": "Path to the Role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "Role Description",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "Creation date of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSManagedPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "AWS Managed Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "CustomerManagedPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Customer Managed Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "InlinePolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Inline Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "TrustPolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "Trust Relationship Policy JSON",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "MaxSessionDuration",
   > "type": "STRING",
   > "schema": null,
   > "description": "Maximum CLI/API session duration",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >
   >
   > ###################################################
   > Service Control Policies:
   >
   > {
   > "name": "SCP",
   > "nativeObjectType": "SCP",
   > "identityAttribute": "ARN",
   > "displayAttribute": "RoleName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "SCPName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "SCPId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSManaged",
   > "type": "STRING",
   > "schema": null,
   > "description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >
   >                ###################################################
   >                AWS Accounts:
   > {
   > "name": "AWSAccount",
   > "nativeObjectType": "AWSAccount",
   > "identityAttribute": "ARN",
   > "displayAttribute": "AWSAccountName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "AWSAccountName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSAccountId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Email",
   > "type": "STRING",
   > "schema": null,
   > "description": "The email address associated with the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Status",
   > "type": "STRING",
   > "schema": null,
   > "description": "The status of the AWS account in the organization.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "Creation date of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "JoinedMethod",
   > "type": "STRING",
   > "schema": null,
   > "description": "The method by which the AWS account joined the organization.",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "CustomerManagedPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Customer Managed Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "JoinedTimestamp",
   > "type": "STRING",
   > "schema": null,
   > "description": "The date the AWS account became a part of the organization.",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "OrganizationUnit",
   > "type": "STRING",
   > "schema": null,
   > "description": "Organization unit holding the AWS Account",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >               ###################################################
   >                Organization Units: 
   > {
   > "name": "OrganizationUnit",
   > "nativeObjectType": "OrganizationUnit",
   > "identityAttribute": "ARN",
   > "displayAttribute": "OUName",
   > "hierarchyAttribute": Parent,
   > "includePermissions": false,
   > "features": [],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "OUName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "OUId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ServiceControlPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Service Control Policies attached to the Organization Unit",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "Parent",
   > "type": "STRING",
   > "schema": null,
   > "description": "Parent Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSAccounts",
   > "type": "STRING",
   > "schema": null,
   > "description": "AWS Accounts attached to the Organization Unit",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > }
   > ]
   > }
   > ```
2. Update Account Schema with the following steps:

   1. Get account schema using [getSchema](<https://developer.sailpoint.com/docs/api/v3/get-source-schema/>) API.
   2. Copy the schema to a file.
   3. Search for the attribute corresponding to the group schema that was added in step 1.
   4. Add/update the below two properties for the attribute found in the previous step (2.c.)

      `"isGroup": true,`

      `"schema": {"type": "CONNECTOR_SCHEMA","id": "<Schema_ID_From_Step1>","name": "<Name_Of_Schema_Created_In_Step1>"}`
   5. Add the schema (modified in step 2.d.) to the payload to update the account schema in the source. Use [replaceSchema](<https://developer.sailpoint.com/docs/api/v3/put-source-schema/>) API for this task.

   > **Note**
   >
   > Remove `NO_PERMISSIONS_PROVISIONING` from the feature string so there won’t be any work item while removing associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through certification.