Required Permissions

This following permissions are required to perform connector operations:

Non Multiple-Group Object Source Policies

Important

For single-account setups, you must enable AWS Organizations. This automatically designates the account as the Management Account, which is required for the AWS SaaS connector. Single accounts without the Organizations service are not supported.

SPAggregationPolicy

This aggregation policy must be assigned to the role of AWS accounts you want to manage.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetPolicyVersion",
                "iam:ListServiceSpecificCredentials",
                "iam:ListMFADevices",
                "iam:ListSigningCertificates",
                "iam:GetGroup",
                "iam:ListSSHPublicKeys",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListRolePolicies",
                "iam:ListAccessKeys",
                "iam:ListPolicies",
                "iam:GetRole",
                "iam:GetPolicy",
                "iam:ListGroupPolicies",
                "iam:ListRoles",
                "iam:ListUserPolicies",
                "iam:GetUserPolicy",
                "iam:ListGroupsForUser",
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:ListGroups",
                "iam:GetGroupPolicy",
                "iam:GetUser",
                "iam:GetRolePolicy",
                "iam:GetLoginProfile",
                "iam:ListEntitiesForPolicy",
                "iam:GetAccessKeyLastUsed",
                "iam:ListUserTags",
                "iam:ListRoleTags",
                "iam:ListPolicyTags"
            ],
            "Resource": "*"
        }
    ]
}

SPOrganizationPolicy

{
 "Version": "2012-10-17",
  "Statement": [
   {
    "Sid": "VisualEditor0",
     "Effect": "Allow",
      "Action": [
     "organizations:ListAccounts"
    ],
   "Resource": "*"
   }
 ] 
}

SPProvisioningPolicy

Must be assigned to the Role of AWS Account which needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "iam:UpdateLoginProfile",
              "iam:UpdateAccessKey",
              "iam:CreateUser",
              "iam:CreateAccessKey",
              "iam:CreateLoginProfile",
              "iam:RemoveUserFromGroup",
              "iam:AddUserToGroup",
              "iam:DeleteLoginProfile",
              "iam:AttachUserPolicy"
          ],
          "Resource": "*"
      }
  ]
}

AWSCloudTrail_ReadOnlyAccess

Activity Insights Policies are required to pull activity data in the form of events like user logins, password changes, and content updates within the application. Policies must be assigned to the role of the AWS Account that needs to be managed. If you have a license of activity insights, you must add this permission to see the activity data of the connector.

Important

Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to Activity Insights.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudtrail:Get*",
                "cloudtrail:Describe*",
                "cloudtrail:List*",
                "cloudtrail:LookupEvents"
            ],
            "Resource": "*"
        }
    ]
}

Multiple Group Object Source Policies

Policy Examples for Role

SPOrganizationPolicy

Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "organizations:ListPoliciesForTarget",
                "organizations:ListAccountsForParent",
                "organizations:ListRoots",
                "organizations:ListAccounts",
                "organizations:ListTargetsForPolicy",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeAccount",
                "organizations:ListParents",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:DescribePolicy",
                "organizations:ListPolicies",
                "organizations:ListTagsForResource"
            ],
            "Resource": "*"
        }
    ]
}

SPAggregationPolicy

Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetPolicyVersion",
                "iam:ListServiceSpecificCredentials",
                "iam:ListMFADevices",
                "iam:ListSigningCertificates",
                "iam:GetGroup",
                "iam:ListSSHPublicKeys",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListRolePolicies",
                "iam:ListAccessKeys",
                "iam:ListPolicies",
                "iam:GetRole",
                "iam:GetPolicy",
                "iam:ListGroupPolicies",
                "iam:ListRoles",
                "iam:ListUserPolicies",
                "iam:GetUserPolicy",
                "iam:ListGroupsForUser",
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:ListGroups",
                "iam:GetGroupPolicy",
                "iam:GetUser",
                "iam:GetRolePolicy",
                "iam:GetLoginProfile",
                "iam:ListEntitiesForPolicy",
                "iam:GetAccessKeyLastUsed",
                "iam:ListUserTags",
                "iam:ListRoleTags",
                "iam:ListPolicyTags"
            ],
            "Resource": "*"
        }
    ]
}

SPProvisioningPolicy

Required for Multiple-group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:UpdateLoginProfile",
                "iam:CreateGroup",
                "iam:DeleteAccessKey",
                "iam:DeleteGroup",
                "iam:AttachUserPolicy",
                "iam:DeleteUserPolicy",
                "iam:UpdateAccessKey",
                "iam:AttachRolePolicy",
                "iam:DeleteUser",
                "iam:CreateUser",
                "iam:CreateAccessKey",
                "iam:CreatePolicy",
                "iam:CreateLoginProfile",
                "iam:RemoveUserFromGroup",
                "iam:AddUserToGroup",
                "iam:DetachRolePolicy",
                "iam:DeleteSigningCertificate",
                "iam:AttachGroupPolicy",
                "iam:DeleteRolePolicy",
                "iam:DetachGroupPolicy",
                "iam:DetachUserPolicy",
                "iam:DeleteGroupPolicy",
                "iam:DeleteLoginProfile"
            ],
            "Resource": "*"
        }
    ]
}

AWSCloudTrail_ReadOnlyAccess

Activity Insights Policies are required to pull activity data in the form of events like user logins, password changes, and content updates within the application. Policies must be assigned to the role of the AWS Account that needs to be managed. If you have a license of activity insights, you must add this permission to see the activity data of the connector.

Important

Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to Activity Insights.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudtrail:Get*",
                "cloudtrail:Describe*",
                "cloudtrail:List*",
                "cloudtrail:LookupEvents"
            ],
            "Resource": "*"
        }
    ]
}

Machine Identity Governance Policies

BedrockAgentDiscoveryPolicy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockAgentDiscovery",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListAgents",
        "bedrock:GetAgent",
        "bedrock:ListAgentActionGroups",
        "bedrock:GetAgentActionGroup",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:GetAgentKnowledgeBase",
        "bedrock:ListKnowledgeBases",
        "bedrock:GetKnowledgeBase",
        "bedrock:ListAgentAliases",
        "bedrock:GetAgentAlias",
        "bedrock:ListAgentVersions",
        "bedrock:GetAgentVersion",
        "bedrock:ListDataSources",
        "bedrock:GetDataSource",
        "bedrock:ListAgentCollaborators",
        "bedrock:GetAgentCollaborator",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*"
    }
  ]
}

BedrockAgentCoreAgentDiscoveryPolicy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockAgentCoreAgentDiscovery",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:ListAgentRuntimes",
                "bedrock-agentcore:GetAgentRuntime",
                "bedrock-agentcore:ListAgentRuntimeEndpoints",
                "bedrock-agentcore:GetAgentRuntimeEndpoint",
                "bedrock-agentcore:ListAgentRuntimeVersions",
                "bedrock-agentcore:ListWorkloadIdentities",
                "bedrock-agentcore:GetWorkloadIdentity",
                "bedrock-agentcore:ListOauth2CredentialProviders",
                "bedrock-agentcore:GetApiKeyCredentialProvider",
                "bedrock-agentcore:ListApiKeyCredentialProviders",
                "bedrock-agentcore:GetOauth2CredentialProvider"
            ],
            "Resource": "*"
        }
    ]
}

ConnectCustomerAgentDiscoveryPolicy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ConnectCustomerAgentDiscovery",
      "Effect": "Allow",
      "Action": [
        "connect:ListInstances",
        "connect:DescribeInstance",
        "connect:ListIntegrationAssociations",
        "connect:ListEntitySecurityProfiles",
        "connect:DescribeSecurityProfile",
        "wisdom:GetAssistant",
        "wisdom:ListAIAgents",
        "wisdom:ListAIAgentVersions",
        "wisdom:GetAIAgent",
        "wisdom:GetAssistantAssociation",
        "wisdom:GetKnowledgeBase",
        "wisdom:GetAIPrompt",
        "wisdom:GetAIGuardrail"
      ],
      "Resource": "*"
    }
  ]
}

QuickAgentDiscoveryPolicy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "QuickAgentDiscovery",
      "Effect": "Allow",
      "Action": [
        "quicksight:ListAgents",
        "quicksight:DescribeAgent",
        "quicksight:DescribeAgentPermissions",
        "quicksight:ListActionConnectors",
        "quicksight:DescribeActionConnector",
        "quicksight:DescribeActionConnectorPermissions"
      ],
      "Resource": "*"
    }
  ]
}

Note

This policy applies to the AWS Commercial (aws) partition only.

AgentRegistryDiscoveryPolicy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AgentRegistryDiscovery",
      "Effect": "Allow",
      "Action": [
        "agent-registry:ListRegistries",
        "agent-registry:ListRegistryRecords",
        "agent-registry:GetRegistryRecord",
        "agent-registry:ListTagsForResource"
      ],
      "Resource": "*"
    }
  ]
}

Note

This policy uses the agent-registry control-plane namespace (AgentRegistryControl API).
Deprecated preview bedrock-agentcore Registry APIs aren't supported. Those APIs shut down on September 17, 2026.
ListRegistries enumerates records in each catalog. Registry catalogs aren't collected as resources.
GetRegistry isn't required.
The policy is read-only. No create, update, or delete permissions are required.
The connector collects records in every lifecycle status, including DRAFT, PENDING_APPROVAL, and APPROVED. The approved-only discoverable view isn't used for inventory.

IAMCredentialsDiscoveryPolicy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IAMCredentialsDiscovery",
      "Effect": "Allow",
      "Action": [
        "iam:ListUsers",
        "iam:ListAccessKeys",
        "iam:GetAccessKeyLastUsed",
        "iam:ListServiceSpecificCredentials",
        "iam:ListSSHPublicKeys",
        "iam:ListSigningCertificates"
      ],
      "Resource": "*"
    }
  ]
}

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.