# Required Permissions This following permissions are required to perform connector operations: ## Non Multiple-Group Object Source Policies > [!IMPORTANT] > > For single-account setups, you must enable **AWS Organizations**. This automatically designates the account as the **Management Account**, which is required for the AWS SaaS connector. Single accounts without the Organizations service are not supported. > [!NOTE] > > **SPAggregationPolicy** > > This aggregation policy must be assigned to the role of AWS accounts you want to manage. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPOrganizationPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "organizations:ListAccounts" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPProvisioningPolicy** > > Must be assigned to the Role of AWS Account which needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:UpdateLoginProfile", > "iam:UpdateAccessKey", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DeleteLoginProfile", > "iam:AttachUserPolicy" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **AWSCloudTrail\_ReadOnlyAccess** > > Activity Insights Policies are required to pull activity data in the form of events like user logins, password changes, and content updates within the application. Policies must be assigned to the role of the AWS Account that needs to be managed. If you have a license of activity insights, you must add this permission to see the activity data of the connector. > > > **Important** > > > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Action": [ > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudtrail:LookupEvents" > ], > "Resource": "*" > } > ] > } > ``` ## Multiple Group Object Source Policies ### Policy Examples for Role > [!NOTE] > > **SPOrganizationPolicy** > > Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "organizations:ListPoliciesForTarget", > "organizations:ListAccountsForParent", > "organizations:ListRoots", > "organizations:ListAccounts", > "organizations:ListTargetsForPolicy", > "organizations:DescribeOrganization", > "organizations:DescribeOrganizationalUnit", > "organizations:DescribeAccount", > "organizations:ListParents", > "organizations:ListOrganizationalUnitsForParent", > "organizations:DescribePolicy", > "organizations:ListPolicies", > "organizations:ListTagsForResource" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPAggregationPolicy** > > Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:GetPolicyVersion", > "iam:ListServiceSpecificCredentials", > "iam:ListMFADevices", > "iam:ListSigningCertificates", > "iam:GetGroup", > "iam:ListSSHPublicKeys", > "iam:ListAttachedRolePolicies", > "iam:ListAttachedUserPolicies", > "iam:ListAttachedGroupPolicies", > "iam:ListRolePolicies", > "iam:ListAccessKeys", > "iam:ListPolicies", > "iam:GetRole", > "iam:GetPolicy", > "iam:ListGroupPolicies", > "iam:ListRoles", > "iam:ListUserPolicies", > "iam:GetUserPolicy", > "iam:ListGroupsForUser", > "iam:ListAccountAliases", > "iam:ListUsers", > "iam:ListGroups", > "iam:GetGroupPolicy", > "iam:GetUser", > "iam:GetRolePolicy", > "iam:GetLoginProfile", > "iam:ListEntitiesForPolicy", > "iam:GetAccessKeyLastUsed", > "iam:ListUserTags", > "iam:ListRoleTags", > "iam:ListPolicyTags" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **SPProvisioningPolicy** > > Required for Multiple-group Object Source and must be assigned to the Role of the AWS Account that needs to be managed. > > ```json > { > "Version": "2012-10-17", > "Statement": [{ > "Sid": "VisualEditor0", > "Effect": "Allow", > "Action": [ > "iam:UpdateLoginProfile", > "iam:CreateGroup", > "iam:DeleteAccessKey", > "iam:DeleteGroup", > "iam:AttachUserPolicy", > "iam:DeleteUserPolicy", > "iam:UpdateAccessKey", > "iam:AttachRolePolicy", > "iam:DeleteUser", > "iam:CreateUser", > "iam:CreateAccessKey", > "iam:CreatePolicy", > "iam:CreateLoginProfile", > "iam:RemoveUserFromGroup", > "iam:AddUserToGroup", > "iam:DetachRolePolicy", > "iam:DeleteSigningCertificate", > "iam:AttachGroupPolicy", > "iam:DeleteRolePolicy", > "iam:DetachGroupPolicy", > "iam:DetachUserPolicy", > "iam:DeleteGroupPolicy", > "iam:DeleteLoginProfile" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **AWSCloudTrail\_ReadOnlyAccess** > > Activity Insights Policies are required to pull activity data in the form of events like user logins, password changes, and content updates within the application. Policies must be assigned to the role of the AWS Account that needs to be managed. If you have a license of activity insights, you must add this permission to see the activity data of the connector. > > > **Important** > > > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to [Activity Insights](). > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Effect": "Allow", > "Action": [ > "cloudtrail:Get*", > "cloudtrail:Describe*", > "cloudtrail:List*", > "cloudtrail:LookupEvents" > ], > "Resource": "*" > } > ] > } > ``` ## Machine Identity Governance Policies > [!NOTE] > > **BedrockAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "BedrockAgentDiscovery", > "Effect": "Allow", > "Action": [ > "bedrock:ListAgents", > "bedrock:GetAgent", > "bedrock:ListAgentActionGroups", > "bedrock:GetAgentActionGroup", > "bedrock:ListAgentKnowledgeBases", > "bedrock:GetAgentKnowledgeBase", > "bedrock:ListKnowledgeBases", > "bedrock:GetKnowledgeBase", > "bedrock:ListAgentAliases", > "bedrock:GetAgentAlias", > "bedrock:ListAgentVersions", > "bedrock:GetAgentVersion", > "bedrock:ListDataSources", > "bedrock:GetDataSource", > "bedrock:ListAgentCollaborators", > "bedrock:GetAgentCollaborator", > "kms:Decrypt", > "kms:GenerateDataKey" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **BedrockAgentCoreAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "BedrockAgentCoreAgentDiscovery", > "Effect": "Allow", > "Action": [ > "bedrock-agentcore:ListAgentRuntimes", > "bedrock-agentcore:GetAgentRuntime", > "bedrock-agentcore:ListAgentRuntimeEndpoints", > "bedrock-agentcore:GetAgentRuntimeEndpoint", > "bedrock-agentcore:ListAgentRuntimeVersions", > "bedrock-agentcore:ListWorkloadIdentities", > "bedrock-agentcore:GetWorkloadIdentity", > "bedrock-agentcore:ListOauth2CredentialProviders", > "bedrock-agentcore:GetApiKeyCredentialProvider", > "bedrock-agentcore:ListApiKeyCredentialProviders", > "bedrock-agentcore:GetOauth2CredentialProvider" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **ConnectCustomerAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "ConnectCustomerAgentDiscovery", > "Effect": "Allow", > "Action": [ > "connect:ListInstances", > "connect:DescribeInstance", > "connect:ListIntegrationAssociations", > "connect:ListEntitySecurityProfiles", > "connect:DescribeSecurityProfile", > "wisdom:GetAssistant", > "wisdom:ListAIAgents", > "wisdom:ListAIAgentVersions", > "wisdom:GetAIAgent", > "wisdom:GetAssistantAssociation", > "wisdom:GetKnowledgeBase", > "wisdom:GetAIPrompt", > "wisdom:GetAIGuardrail" > ], > "Resource": "*" > } > ] > } > ``` > [!NOTE] > > **QuickAgentDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "QuickAgentDiscovery", > "Effect": "Allow", > "Action": [ > "quicksight:ListAgents", > "quicksight:DescribeAgent", > "quicksight:DescribeAgentPermissions", > "quicksight:ListActionConnectors", > "quicksight:DescribeActionConnector", > "quicksight:DescribeActionConnectorPermissions" > ], > "Resource": "*" > } > ] > } > ``` > > > **Note** > > > > This policy applies to the AWS Commercial (`aws`) partition only. > [!NOTE] > > **AgentRegistryDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "AgentRegistryDiscovery", > "Effect": "Allow", > "Action": [ > "agent-registry:ListRegistries", > "agent-registry:ListRegistryRecords", > "agent-registry:GetRegistryRecord", > "agent-registry:ListTagsForResource" > ], > "Resource": "*" > } > ] > } > ``` > > > **Note** > > > > - This policy uses the `agent-registry` control-plane namespace (AgentRegistryControl API). > > - Deprecated preview `bedrock-agentcore` Registry APIs aren't supported. Those APIs shut down on September 17, 2026. > > - `ListRegistries` enumerates records in each catalog. Registry catalogs aren't collected as resources. > > - `GetRegistry` isn't required. > > - The policy is read-only. No create, update, or delete permissions are required. > > - The connector collects records in every lifecycle status, including `DRAFT`, `PENDING_APPROVAL`, and `APPROVED`. The approved-only discoverable view isn't used for inventory. > [!NOTE] > > **IAMCredentialsDiscoveryPolicy** > > ```json > { > "Version": "2012-10-17", > "Statement": [ > { > "Sid": "IAMCredentialsDiscovery", > "Effect": "Allow", > "Action": [ > "iam:ListUsers", > "iam:ListAccessKeys", > "iam:GetAccessKeyLastUsed", > "iam:ListServiceSpecificCredentials", > "iam:ListSSHPublicKeys", > "iam:ListSigningCertificates" > ], > "Resource": "*" > } > ] > } > ```