Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The AWS SaaS connector uses the following default correlation and object configurations.

For AWS IAM, Bedrock, AgentCore, Amazon Connect Customer, and Amazon Quick, and AWS Agent Registry resource schemas collected through Dataset Management, refer to Supported Resources.

The following table lists the schema objects supported by the connector and the license required for each object. Cloud Infrastructure Entitlement Management (CIEM), Machine Identity Security, and Agentic Identity Security are separate licenses. A Yes means that license includes the object.

Schema object	CIEM	Machine Identity Security or Agentic Identity Security	No additional license
Account This object represents IAM user accounts.	Yes	Yes	Yes
Group This is the primary group object, and the object type is `Group`.	Yes	Yes	Yes
AWS Managed Policy The object type is `AWSManagedPolicy`. These policies are created and managed by AWS.	Yes	Yes	No
Customer Managed Policy The object type is `Customer Managed Policy`. These policies are created in the AWS account.	Yes	Yes	No
Inline Policy The object type is `InlinePolicy`. The policy is embedded in one user, group, or role.	Yes	Yes	No
IAM Role The object type is `Role`. This role is managed as a group object.	Yes	No	No
Service Control Policy The object type is `SCP`.	Yes	No	No
Organization Unit The object type is `OrganizationUnit`.	Yes	No	No
AWS Account The object type is `AWSAccount`. This account is managed as a group object.	Yes	No	No

Note

IAM roles collected through Dataset Management are separate from the Role group object. For those resource schemas, refer to Supported Resources.

For the operations supported for each object, refer to Supported Features.

Correlation Configuration

There is no default correlation mapping, so prior to the aggregation you can map the account attribute with the identity attribute as per your requirement.

Account Attribute	Operation	Identity Attribute
UserName	Equals	Name
UserName	Equals	UserName

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

Caution

Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.

To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

Account ID	Schema Object Type
ARN	Account
ARN	Group
Id	InlinePolicy
ARN	AWSManagedPolicy
ARN	CustomerManagedPolicy
ARN	Role
ARN	SCP
ARN	AWSAccount
ARN	OrganizationUnit

Default Account Attributes

The AWS SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Attribute Name	Type	Description
UserName	String	Friendly name of the user.
UserId	String	Unique ID of the user.
Path	String	Path to the user.
ARN	String	Amazon Resource Name of the user. This is an Account ID which must not be changed.
CreateDate	String	Creation date of the user.
ConsoleAccess	String	Password status of the user.
Groups	Group	Groups the user is a part of.
AWSManagedPolicies	AWSManagedPolicy	AWS Managed Policies directly assigned to the user.
CustomerManagedPolicies	CustomerManagedPolicy	Customer Managed Policies directly assigned to the user.
InlinePolicies	InlinePolicy	Inline Policies directly assigned to the user.
Access Keys	String	Access keys associated with the user.
AWS CodeCommit HTTPS Credentials	String	AWS CodeCommit HTTPS Git credentials associated with the user.
AWS CodeCommit SSH Keys	String	AWS CodeCommit SSH public keys associated with the user.
Signing Certificates	String	Signing Certificates associated with the user.
Multi-Factor Authentication Device	String	Multi-Factor Authentication device associated with the user.
PasswordLastUsed	String	Password last used date of the user.
AccessKeyLastUsed	String	Access key last used details of the user.
Tags	String	Tag list in the format TagKey~TagValue pair

Tags Attribute

A new Tags Attribute is available for aggregation to identify and organize AWS resources. Tags are displayed as Key/Value pairs for the aggregated entities.

This multivalued, string attribute stores the Key/Value pair as a single string in K=V,K2=V2 format with tags separated by commas. For example:

[Key~Value, Costcenter~Austin, Department~QA, Location~Offshore ]

The form-data appears as follows:

Key: Costcenter, Department, Location
Value: Austin, QA, Offshore

By default the tilda(~) delimiter is between the key value pair. However, the separator can be configured as tagKeyValueSeparator.

<entry key="tagKeyValueSeparator"value="="/>

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

Default Group Attributes

The AWS SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

Object Type: Group

Attribute Name	Type	Description
GroupName	String	Friendly name of the group.
GroupId	String	Unique ID of the group.
Path	String	Path to the group.
ARN	String	Amazon Resource Name of the group. This is an Account ID which must not be changed.
Create	String	Creation date of the group.
AWSManagedPolicies	AWSManagedPolicy	AWS Managed Policies directly assigned to the group.
CustomerManagedPolicies	CustomerManagedPolicy	Customer Managed Policies directly assigned to the group.
InlinePolicies	InlinePolicy	Inline Policies directly assigned to the group.

Object Type: AWSManagedPolicy

Attribute Name	Type	Description
PolicyName	String	The friendly name of the AWS managed policy.
PolicyId	String	The unique ID of the AWS managed policy.
Description	String	A friendly description of the AWS managed policy.
ARN	String	Amazon Resource Name of the AWS managed policy. This is an Account ID which must not be changed.
Path	String	The path to the AWS managed policy.
CreateDate	String	The creation date of the AWS managed policy.
UpdateDate	String	The last update date of the AWS managed policy.
DefaultVersionId	String	The currently enabled version ID of the AWS managed policy.
PolicyJSON	String	The JSON document for the AWS managed policy.

Object Type: Customer Managed Policy

Attribute Name	Type	Description
PolicyName	String	The friendly name of the customer managed policy.
PolicyId	String	The unique ID of the customer managed policy.
Description	String	A friendly description of the customer managed policy.
CreateDate	String	The creation date of the customer managed policy.
UpdateDate	String	The last update date of the customer managed policy.
ARN	String	Amazon Resource Name of the customer managed policy. This is an Account ID which must not be changed.
Path	String	The path to the customer managed policy.
DefaultVersionId	String	The currently enabled version ID of the customer managed policy.
PolicyJSON	String	The JSON document for the customer managed policy.
PolicyGroups	String	Groups attached to the customer managed policy.
PolicyRoles	String	Roles attached to the customer managed policy.
Tags	String	Tag list in the format TatKey~TagValue pair

Object Type: InlinePolicy

Attribute Name	Type	Description
Name	String	The friendly name of the policy.
Id	String	The unique ID of the policy. This is an Account ID which must not be changed.
PolicyJSON	String	The JSON document for the policy.

Object Type: Role

Attribute Name	Type	Description
RoleName	String	The friendly name of the role.
RoleId	String	The unique ID of the role.
Path	String	Path to the Role.
ARN	String	Amazon Resource Name of the role. This is an Account ID which must not be changed.
Description	String	Role Description.
CreateDate	String	Creation date of the role.
AWSManagedPolicies	AWSManagedPolicy	AWS Managed Policies directly assigned to the role.
CustomerManagedPolicies	CustomerManagedPolicy	Customer Managed Policies directly assigned to the role.
InlinePolicies	InlinePolicy	Inline Policies directly assigned to the role.
TrustPolicyJSON	String	Trust Relationship Policy JSON.
MaxSessionDuration	String	Maximum CLI/API session duration.
Tags	String	Tag list in the format TagKey~TagValue pair

Object Type: SCP

Attribute Name	Type	Description
SCPName	String	The friendly name of the Service Control Policy.
SCPId	String	The unique ID of the Service Control Policy.
ARN	String	Amazon Resource Name of the Service Control Policy. This is an Account ID which must not be changed.
Description	String	A friendly description of the Service Control Policy.
AWSManaged	String	A boolean value that indicates whether the Service Control Policy is an AWS managed policy.
PolicyJSON	String	The JSON document for the Service Control Policy.
Tags	String	Tag list in the format TagKey~TagValue pair

Object Type: AWSAccount

Attribute Name	Type	Description
AWSAccountName	String	The friendly name of the AWS account.
AWSAccountId	String	The unique ID of the AWS account.
ARN	String	Amazon Resource Name of the AWS account. This is an Account ID which must not be changed.
Email	String	The email address associated with the AWS account.
Status	String	The status of the AWS account in the organization.
JoinedMethod	String	The method by which the AWS account joined the organization.
JoinedTimestamp	String	The date the AWS account became a part of the organization.
OrganizationUnit	OrganizationUnit	Organization unit holding the AWS Account.
Tags	String	Tag list in the format TagKey~TagValue pair

Object Type: OrganizationUnit

Attribute Name	Type	Description
OUName	String	The friendly name of the Organization Unit.
OUId	String	The unique ID of the Organization Unit.
ARN	String	Amazon Resource Name of the Organization Unit. This is an Account ID which must not be changed.
ServiceControlPolicies	SCP	Service Control Policies attached to the Organization Unit.
Parent	OrganizationUnit	Parent Organization Unit.
AWSAccounts	AWSAccount	AWS Accounts attached to the Organization Unit.
Tags	String	Tag list in the format TagKey~TagValue pair

Default Machine Identity Attributes

Machine Identity attributes define the multiple types of machine identities that can be assigned to the managed system's user accounts.

For more information, refer to Machine Identity Security Overview.

The following table describes the Agent Bedrock and Agentcore Bedrock schema attributes.

Note

The description and name attributes will be displayed at the top level but not at the connector level.

Object Type: bedrock

Attribute Name	Type	Description
aliasId	string	The unique identifier of the alias of the agent.
name	string	The name with combination of agent name & agent alias name.
agentArn	string	The Amazon Resource Name (ARN) of the bedrock agent.
foundationModel	string	The foundation model that the version invokes.
region	string	The region of the agent alias.
role	string	The Amazon Resource Name (ARN) of the IAM role with permissions to invoke API operations on the agent.
customerEncryptionKeyArn	string	The Amazon Resource Name (ARN) of the AWS KMS key that encrypts the agent.
description	string	The description of the bedrock agent alias.
version	string	Contains details about the version of the agent associated to alias.
agentName	string	The name of the agent that the version belongs to.
aliasName	string	The name of the alias of the agent.
agentAliasStatus	string	The status of the alias.
agentCollaboration	string	The agent’s collaboration settings.
createdAt	string	The timestamp when the agent runtime endpoint was created.
updatedAt	string	The timestamp when the agent runtime endpoint was last updated.
resources	array	-
connectedAgents	array	-

Object Type: bedrockagentcore

Attribute Name	Type	Description
name	string	The name with combination of agent runtime & agent runtime endpoint names.
agentRuntimeId	string	The unique identifier of agent runtime Id.
description	string	The description of the agent runtime endpoint.
agentRuntimeEndpointArn	string	The Amazon Resource Name (ARN) of the agent runtime endpoint.
agentRuntimeEndpointStatus	string	The current status of the agent runtime endpoint.
region	string	The region of the agent runtime endpoint.
endpointName	string	The name of the agent runtime endpoint.
endpointId	string	The unique identifier of agent runtime endpoint.
associatedVersion	string	The live version of the agent runtime endpoint. This is the version that is currently serving requests.
agentRuntimeArn	string	The Amazon Resource Name (ARN) of the agent runtime associated with the endpoint.
agentRuntimeName	string	The name of the agent runtime.
role	string	The IAM role ARN that provides permissions for the agent runtime.
workloadIdentityArn	string	The Amazon Resource Name (ARN) of the workload identity.
workloadIdentityName	string	The name of the workload identity.
createdAt	string	The timestamp when the agent runtime endpoint was created.
updatedAt	string	The timestamp when the agent runtime endpoint was last updated.
resources	array	-
inboundAccess	array	-

AWS SaaS Account ID Correlation Configuration Default Account Attributes Default Entitlement Attributes Default Group Attributes Default Machine Identity Attributes SaaS Schema Reference

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.