# SailPoint AWS Connector Documentation

> AWS Connector Documentation

# Documentation

# Connecting SailPoint and AWS

To connect SailPoint with AWS, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
10. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
8. Select **Save**.

## Connection Settings

Securely connect SailPoint and Amazon Web Services by choosing an authentication method and providing the required information. See [Required Permissions](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html>) for more information.

### IAM Role Authentication Method

This authentication method is used when a Virtual Appliance (VA) is deployed on the AWS EC2 instance. The IAM role must be associated with any AWS account in the EC2 instance. Permissions for the role must be configured in the management AWS account and a trust relationship must be established.

> [!IMPORTANT]
>
> To manage organizational entities like service control policies, organization units, or AWS accounts, you must provide the Management Account ID and role permissions must be configured in the management AWS account.

> [!NOTE]
>
> **Screenshot**
>
> [![IAM Role Authentication Method](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_connection_settings_iam_role.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_connection_settings_iam_role.png>)

1. Enter the IAM **Role Name** that has authorization to call all the AWS accounts to be aggregated. This role must have the permissions specified in [Prerequisites](<https://documentation.sailpoint.com/connectors/aws/va/help/index.html#prerequisites>) and [IAM Role Authentication Method](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html#iam-role-authentication-method>).
2. Enter the **External ID** for the role. This ID is included in the IAM role trust policy to designate who can assume the role.
3. Enter the **Management Account ID** for the organization. This is required to manage all AWS accounts as well as organization entities like service control policies, organization units.
4. Enter the **Region** name for the AWS data center. The default region is `us-east-1`.
5. Select **Save**.

### IAM User Authentication Method

This method uses the Access Key ID and Secret Access Key associated with the user. The IAM user is created in the management AWS or member AWS account based on the application configuration.

> [!IMPORTANT]
>
> To manage organizational entities like service control policies, organization units, or AWS accounts, the user account must be created in the management AWS account and permissions must be given through the cross-account role in the management AWS account.

> [!NOTE]
>
> **Screenshot**
>
> [![IAM User Authentication Method](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_connection_settings_iam_user.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_connection_settings_iam_user.png>)

1. Enter the **Access Key ID** for the IAM user configured for IAM database authentication.
2. Enter the **Secret Access Key** for the IAM user configured for IAM database authentication.
3. Enter the IAM **Role Name** that has authorization to call all the AWS accounts to be aggregated. This role must have the permissions specified in [Prerequisites](<https://documentation.sailpoint.com/connectors/aws/va/help/index.html#prerequisites>) and [IAM Role Authentication Method](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html#iam-role-authentication-method>).
4. Enter the **Region** name for the AWS data center. The default region is `us-east-1`.
5. Select **Save**.

## Aggregation Settings

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

1. Enable **Manage All Accounts** if you want to manage IAM entities from all the AWS accounts on the AWS system except for some exclusions. Leave it disabled if you want to specify all the AWS accounts to include. Default: Disabled.

   > **Note**
   >
   > The test configuration will work regardless of whether the fields include or exclude AWS Account IDs.

   > **Screenshot**
   >
   > [![Aggregation Settings](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_agg_manage_accounts.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_agg_manage_accounts.png>)

   To manage all AWS accounts:

   - IAM User authentication - The IAM User must be configured in the management AWS account.
   - IAM Role authentication - The **Management Account ID** is required in [Connection Settings](<#connection-settings>).
2. If **Manage All Accounts** is enabled, enter the AWS account IDs, separated by a comma, to be excluded in the aggregation in **Exclude AWS Account IDs**. If it is disabled, enter the AWS account IDs, separated by a comma, to be included in the aggregation in **Include AWS Account IDs**.
3. Enter the number of records per page in **Page Size**.

   - Default: 10
   - Minimum: 1
   - Maximum: 1000

### Switch Role

You can change the role session name to a user friendly name that appears in the CloudTrail logs. You can specify the role and the duration of the session for that role to be used. For more information about how AWS handles this feature, refer to [Switching to a role (console)](<https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html>) in the AWS documentation.

> [!NOTE]
>
> This configuration has been moved from the API to the user interface.

> [!NOTE]
>
> **Screenshot**
>
> [![Switch Role](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_agg_role_session.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws_agg_role_session.png>)

1. Enter the role name to be used in **Role Session Name**.
2. Specify the length of the session in seconds in **Role Session Duration**.

   - Default: 3600 (1 hour)
   - Maximum: 43200 (12 hours)
   - Minimum: 3600 (1 hour)
3. Select **Save**.

## Additional Settings

Configure the settings for retry attempts when a timeout error occurs. For detailed information about AWS recommendations, refer to [Retries and backoff in the Amazon Builder's Library](<https://aws.amazon.com/builders-library/timeouts-retries-and-backoff-with-jitter/#Retries_and_backoff>).

> [!NOTE]
>
> The linked document is not maintained by SailPoint and is subject to change without notice.

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/aws/va/help/img/additional_settings.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/additional_settings.png>)

1. Specify the maximum number of retry attempts in **Maximum Retry Limit**. After the maximum number for retries, the job fails with an error log message. Default: 5
2. In **Base Delay (Milliseconds)**, specify the amount of time to wait before retrying the connection. The base delay exponentially increases after every retry attempt. For example, if the default base delay is 10 seconds, subsequent retry attempts will be 20 seconds, then 40 seconds, and so on. Default: 500
3. In **Throttled Base Delay (Milliseconds)**, specify the amount of time to wait if the initial retry fails. This time duration increases after every retry attempt. The value automatically increases exponentially with each failed attempt. Default: 1000
4. In **Maximum Backoff Time (Milliseconds)**, specify the amount of time to wait between attempts. After the delay reaches this maximum limit, the time between retries will stop increasing. Default: 20000

### Provisioning Configuration

> [!NOTE]
>
> **Screenshot**
>
> [![Provisioning Configuration](<https://documentation.sailpoint.com/connectors/aws/va/help/img/additional_provisioning.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/additional_provisioning.png>)

1. Provide the Amazon Resource Name (ARN) that applies to creating AWS accounts or password changes in **Change Password Policy ARN**.
2. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Frequently Asked Questions

## How do I require workloads to use temporary credentials with IAM roles to access AWS?

Follow the [Security Best Practices](<https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-workloads-use-roles>).

## What are "Non Multiple-group Object Source Policies" and "Multiple Group Object Source Policies"?

See an example of the [Multiple Group Object Source Policies](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html#multiple-group-object-source-policies>) here.

# Integrating SailPoint with Amazon Web Services (AWS)

The SailPoint Amazon Web Services (AWS) connector enables organizations to extend existing identity lifecycle and compliance management capabilities within SailPoint to mission-critical AWS IaaS environments to provide a central point of visibility, administration, and governance across the entire enterprise. This includes policy discovery and access history across all organization accounts, provisioning AWS entities and objects, access review and certification, and federated access support.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of an AWS source.

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features (for example, visualization of effective access) for your AWS Cloud Infrastructure, you must have a CIEM license. Contact your SailPoint Customer Success Manager to request access and for more information.
>
> For more information on the additional features supported with cloud governance, refer to the table in the [Supported Features](<#supported-features>) section.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site.

The AWS supports the following features:

- Load AWS Accounts
- \*Provision AWS Accounts
- \*Access Certifications (certification of entitlements connected to AWS accounts)
- \*Password management

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

### Account Management

- Manage IAM Users under the AWS Account as Accounts
- Aggregate, Refresh Accounts
- Create, Update, Delete, Enable, Disable

  > **Note**
  >
  > For more information on enabling and disabling, see [IAM User Status](<#iam-user-status>).
- Change Password
- Add/Remove Entitlements (Groups, AWS Managed Policies, Customer Managed Policies, Inline Policies)

### IAM Entities

- **IAM Groups**: Aggregate, Refresh
- **AWS Managed Policy Management**: Aggregate, Refresh
- **Customer Managed Policies**: Aggregate, Refresh
- **Inline Policies**: Aggregate, Refresh
- **Role Management**: Aggregate, Refresh

### Tags Management

This connector supports the aggregation and refresh of tags attribute for the following entities:

- IAM User
- IAM Role
- Customer Managed Policy
- Service Control Policy
- Organization Unit
- AWS Account

### Organization Entities

This connector supports the following on Organization Entities (managed as group object only):

- AWS Accounts Management: Aggregate, Refresh
- Organization Unit Management: Aggregate, Refresh
- Service Control Policy Management: Aggregate, Refresh

### Permissions Management

This connector supports the JSON Policy for Permission Policy and Trust Policy as a direct permission.

The Permission Policy for the following AWS entities are represented as Permissions:

- AWS Managed Policies
- Customer Managed Policies
- Inline Policies
- Service Control Policies

The Trust Policy for the following AWS entity is represented as direct permission:

- Roles

> [!NOTE]
>
> \*Role aggregation takes care of aggregating the trust polices (entities that can assume a role) as direct permission.

### Supported Features Comparison with Cloud Governance

> [!IMPORTANT]
>
> If you want to enable additional cloud governance features (for example, visualization of effective access) for your AWS Cloud Infrastructure, you must have a CIEM license. If you already have a Cloud Access Management license, no additional license purchase is required. Contact your SailPoint Customer Success Manager to request access and for more information.

| Supported Features | AWS Connector (Standard Features) | AWS Connector (With Cloud Governance) |
| --- | --- | --- |
| **Account Management**<br><br>Manage IAM Users under the AWS Account as Accounts<br>Aggregate, Refresh Accounts<br>Create, Update, Delete<br>Change Password<br>Enable and Disable<br><br>**Note:** For more information on enabling and disabling, refer to [IAM User Status](<#iam-user-status>).<br><br>Aggregate IAM Users and its connected Entitlements (Groups, AWS Managed Policies, Customer Managed Policies, and Inline Policies)<br>Add/Remove Entitlements (Groups, AWS Managed Policies, Customer Managed Policies, and Inline Policies) | Yes<br><br>**Note:** Only IAM groups have user-friendly names, while all other Entitlements are displayed using ARN. | Yes<br><br>**Note:** Every Entitlement is displayed using user-friendly names. |
| **Group Management**\*<br><br>Manage IAM Groups<br>Aggregate, Refresh Group | Yes | Yes |
| **AWS Managed Policies**<br><br>Manage as group object<br>Aggregate, Refresh | No | Yes |
| **Customer Managed Policies**<br><br>Manage as group object<br>Aggregate, Refresh | No | Yes |
| **Inline Policies Management**<br><br>Manage as group object<br>Aggregate, Refresh | No | Yes |
| **Organization Unit**<br><br>Manage as group object<br>Aggregate, Refresh | No | Yes |
| **Service Control Policy**<br><br>Manage as group object<br>Aggregate, Refresh | No | Yes |
| **AWS Accounts**<br><br>Manage as group object<br>Aggregate, Refresh | No | Yes |
| **Tags Management**<br><br>Aggregate and refresh of tags attribute for IAM User | Yes | Yes |
| **Tags Management**<br><br>Aggregate and refresh of tags attribute for the following entities:<br><br>IAM Role<br>Customer Managed Policy<br>Service Control Policy<br>Organization Unit<br>AWS Account | No | Yes |
| IAM Role Management<br><br>Manage as group object<br>Aggregate, Refresh<br>Provisioning \* | No | Yes |

### IAM User Status

The following are the SailPoint operations with the corresponding IAM User Status:

#### Enable

- Set Console Password (This would also activate the Signing Certificate if it is associated with an IAM User.)
- Activates Last Created Access Keys
- Activates Last Created AWS CodeCommit HTTPS Credentials
- Activates Last Created AWS CodeCommit SSH Keys
- Activates Signing Certificates

#### Disable

- Deletes Console Password
- Inactivates Both Access Keys
- Inactivates Both AWS CodeCommit HTTPS Credentials
- Inactivates All AWS CodeCommit SSH Keys
- Inactivates Signing Certificates

> [!NOTE]
>
> When you enable an AWS IAM (Identity Access Management) user for the AWS source it activates the Signing Certificate (if the certificate is associated with that user) along with setting the console password. When you disable the user, the source will deactivate the Signing Certificate.

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

#### Examples

> [!NOTE]
>
> **Privilege Level: High**
>
> [![Privilege Level: High](<https://documentation.sailpoint.com/connectors/aws/va/help/img/privilege_level_high.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/privilege_level_high.png>)

> [!NOTE]
>
> **Privilege Level: Medium**
>
> [![Privilege Level: Medium](<https://documentation.sailpoint.com/connectors/aws/va/help/img/privilege_level_medium.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/privilege_level_medium.png>)

> [!NOTE]
>
> **Privilege Level: Low**
>
> [![Privilege Level: Low](<https://documentation.sailpoint.com/connectors/aws/va/help/img/privilege_level_low.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/privilege_level_low.png>)

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Prerequisites

- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- IAM role authentication requires an AWS EC2 instance to perform aggregation and provisioning operations.
- Based on authentication method, [create an IAM user or IAM role and assign required permission](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html>) to it so that it uses all the cross-account roles.
- Create a customer/Inline managed policy in each AWS account that you want to manage with policy document specified in [Multiple Group Object Source Policies](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html#multiple-group-object-source-policies>) and [Non Multiple-group Object Source Policies](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html#non-multiple-group-object-source-policies>).
- [Create Cross Account Roles](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html#create-cross-account-roles>) in each AWS account that you want to manage and attach the appropriate policies to the role.
- Based on the authentication method, create the IAM user or IAM role and assign required permission to it so that it can assume all cross-account roles.
- For each AWS cross-account role, [establish the trust relationship with the IAM user or IAM role](<https://documentation.sailpoint.com/connectors/aws/va/help/required_permissions.html#set-up-service-user-or-service-role>).

  > **Note**
  >
  > Ensure you create the cross-account role across the AWS Accounts with the same name and assign the permissions as mentioned.
- The AWS System Administrator can refine the Permission Policies as needed.
- The IMDS hop limit must be set to 2. Example of expected output:

  ```text
  aws ec2 --profile dev describe-instances --instance-id i-0c42f9be78225a897 --query 'Reservations[].Instances[].MetadataOptions'
  [
   {
    "State": "applied",
      "HttpTokens": "required",
       "HttpPutResponseHopLimit": 2,
       "HttpEndpoint": "enabled",
      "HttpProtocolIpv6": "disabled",
     "InstanceMetadataTags": "disabled"
   }
  ]
  ```

# Machine Account Attributes

Machine account creation uses the same source attributes as standard account creation. For the complete list of supported attributes and their descriptions, refer to [Default Account Attributes](<https://documentation.sailpoint.com/connectors/aws/va/help/schema.html#default-account-attributes>)

For more information, refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>).

# Using Multiple Group Entitlements

The AWS source supports multiple group objects. The details of the features are:

| Feature | IAM Users |
| --- | --- |
| Aggregate | ✔ |
| Create, Update, Enable, Disable, Delete | ✔ |
| Group Entitlements (Read, Request, Revoke) | Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies<br><br>**Note:** InlinePolicies can be read and revoked. |

## Group Entitlements

SailPoint provides the ability to aggregate additional details from the managed system through Group Entitlements. These objects have a separate schema defining list of attributes. The aggregation task fetches these as additional details when aggregation is run for that Group Entitlement type.

> [!NOTE]
>
> Group objects with an asterisk (\*) are only functional when you purchase SailPoint Cloud Infrastructure Entitlement Management (CIEM).

|  | Aggregation | Permissions | Read Heirarchy Group |
| --- | --- | --- | --- |
| Groups | ✔ | NA | NA |
| \*AWSManagedPolicies | ✔ | ✔ | NA |
| \*CustomerManagedPolicies | ✔ | ✔ | NA |
| \*InlinePolicies | ✔ | ✔ | NA |
| \*Roles | ✔ | ✔ | NA |
| \*SCP | ✔ | ✔ | NA |
| \*AWSAccount | ✔ | NA | NA |
| \*OrganizationUnit | ✔ | NA | ✔ |

- NA = Not Applicable.
- The objects such as, Groups, AWSManagedPolicies, CustomerManagedPolicies, InlinePolicies, and Roles are the IAM entities.
- The objects, such as Service Control Policies (SCP), AWSAccount and OrganizationUnit (OU) are the Organization entities.
- The AWS source supports JSON Policy for Permission Policy, and Trust Policy is represented as Permissions.
- The Permission Policy for the following AWS entities are represented as Permissions:

  - AWS Managed Policies
  - Customer Managed Policies
  - Inline Policies
  - Service Control Policies
- The Trust Policy for the following AWS entity is represented as Permissions:

  - Roles

## Using Multiple Group Entitlements with a Pre-Existing Source

To start using Multiple Group Entitlements with your current (pre-existing) AWS source(s), perform the following steps:

1. Use [createSchema](<https://developer.sailpoint.com/docs/api/v3/create-source-schema/>) API to create new group schema for your source.

   > **Example of API body content for adding Project Roles to an existing source**
   >
   > ```text
   >  AWS Managed Policies:
   > {
   > "name": "AWSManagedPolicy",
   > "nativeObjectType": "AWSManagedPolicy",
   > "identityAttribute": "ARN",
   > "displayAttribute": "PolicyName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "PolicyName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the AWS managed policy ",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   >
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Path",
   > "type": "STRING",
   > "schema": null,
   > "description": "The path to the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The creation date of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "UpdateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The last update date of the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "DefaultVersionId ",
   > "type": "STRING",
   > "schema": null,
   > "description": "The currently enabled version ID of the AWS managed policy ",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   > ##################################################### 
   >
   > Customer Managed Policies:
   >
   > {
   > "name": "CustomerManagedPolicy",
   > "nativeObjectType": "CustomerManagedPolicy",
   > "identityAttribute": "ARN",
   > "displayAttribute": "PolicyName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "PolicyName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the customer managed policy ",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The creation date of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "UpdateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "The last update date of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Path",
   > "type": "STRING",
   > "schema": null,
   > "description": "The path to the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "DefaultVersionId ",
   > "type": "STRING",
   > "schema": null,
   > "description": "The currently enabled version ID of the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the customer managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyGroups",
   > "type": "STRING",
   > "schema": null,
   > "description": "Groups attached to the customer managed policy",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyRoles",
   > "type": "STRING",
   > "schema": null,
   > "description": "Roles attached to the customer managed policy",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > }
   > ]
   > }
   >
   > #################################################### 
   >
   > Inline Policies:
   >
   > {
   > "name": "InlinePolicy",
   > "nativeObjectType": "InlinePolicy",
   > "identityAttribute": "Id",
   > "displayAttribute": "Name",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "Name",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Id",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >
   > ################################################### 
   >
   >
   >
   >
   > Roles:
   >
   > {
   > "name": "Role",
   > "nativeObjectType": "Role",
   > "identityAttribute": "ARN",
   > "displayAttribute": "RoleName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "PROVISIONING, NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "RoleName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "RoleId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Path",
   > "type": "STRING",
   > "schema": null,
   > "description": "Path to the Role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "Role Description",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "Creation date of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSManagedPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "AWS Managed Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "CustomerManagedPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Customer Managed Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "InlinePolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Inline Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "TrustPolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "Trust Relationship Policy JSON",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "MaxSessionDuration",
   > "type": "STRING",
   > "schema": null,
   > "description": "Maximum CLI/API session duration",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >
   >
   > ###################################################
   > Service Control Policies:
   >
   > {
   > "name": "SCP",
   > "nativeObjectType": "SCP",
   > "identityAttribute": "ARN",
   > "displayAttribute": "RoleName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [
   > "NO_GROUP_PERMISSIONS_PROVISIONING"
   > ],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "SCPName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "SCPId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Description",
   > "type": "STRING",
   > "schema": null,
   > "description": "A friendly description of the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSManaged",
   > "type": "STRING",
   > "schema": null,
   > "description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "PolicyJSON",
   > "type": "STRING",
   > "schema": null,
   > "description": "The JSON document for the Service Control Policy",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >
   >                ###################################################
   >                AWS Accounts:
   > {
   > "name": "AWSAccount",
   > "nativeObjectType": "AWSAccount",
   > "identityAttribute": "ARN",
   > "displayAttribute": "AWSAccountName",
   > "hierarchyAttribute": null,
   > "includePermissions": false,
   > "features": [],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "AWSAccountName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSAccountId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Email",
   > "type": "STRING",
   > "schema": null,
   > "description": "The email address associated with the AWS account.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "Status",
   > "type": "STRING",
   > "schema": null,
   > "description": "The status of the AWS account in the organization.",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "CreateDate",
   > "type": "STRING",
   > "schema": null,
   > "description": "Creation date of the role",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "JoinedMethod",
   > "type": "STRING",
   > "schema": null,
   > "description": "The method by which the AWS account joined the organization.",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "CustomerManagedPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Customer Managed Policies directly assigned to the role",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "JoinedTimestamp",
   > "type": "STRING",
   > "schema": null,
   > "description": "The date the AWS account became a part of the organization.",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "OrganizationUnit",
   > "type": "STRING",
   > "schema": null,
   > "description": "Organization unit holding the AWS Account",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > }
   > ]
   > }
   >
   >               ###################################################
   >                Organization Units: 
   > {
   > "name": "OrganizationUnit",
   > "nativeObjectType": "OrganizationUnit",
   > "identityAttribute": "ARN",
   > "displayAttribute": "OUName",
   > "hierarchyAttribute": Parent,
   > "includePermissions": false,
   > "features": [],
   > "configuration": {},
   > "attributes": [
   > {
   > "name": "OUName",
   > "type": "STRING",
   > "schema": null,
   > "description": "The friendly name of the Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "OUId",
   > "type": "STRING",
   > "schema": null,
   > "description": "The unique ID of the Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ARN",
   > "type": "STRING",
   > "schema": null,
   > "description": "Amazon Resource Name of the Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "ServiceControlPolicies",
   > "type": "STRING",
   > "schema": null,
   > "description": "Service Control Policies attached to the Organization Unit",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > },
   > {
   > "name": "Parent",
   > "type": "STRING",
   > "schema": null,
   > "description": "Parent Organization Unit",
   > "isMulti": false,
   > "isEntitlement": false,
   > "isGroup": false
   > },
   > {
   > "name": "AWSAccounts",
   > "type": "STRING",
   > "schema": null,
   > "description": "AWS Accounts attached to the Organization Unit",
   > "isMulti": true,
   > "isEntitlement": true,
   > "isGroup": false
   > }
   > ]
   > }
   > ```
2. Update Account Schema with the following steps:

   1. Get account schema using [getSchema](<https://developer.sailpoint.com/docs/api/v3/get-source-schema/>) API.
   2. Copy the schema to a file.
   3. Search for the attribute corresponding to the group schema that was added in step 1.
   4. Add/update the below two properties for the attribute found in the previous step (2.c.)

      `"isGroup": true,`

      `"schema": {"type": "CONNECTOR_SCHEMA","id": "<Schema_ID_From_Step1>","name": "<Name_Of_Schema_Created_In_Step1>"}`
   5. Add the schema (modified in step 2.d.) to the payload to update the account schema in the source. Use [replaceSchema](<https://developer.sailpoint.com/docs/api/v3/put-source-schema/>) API for this task.

   > **Note**
   >
   > Remove `NO_PERMISSIONS_PROVISIONING` from the feature string so there won’t be any work item while removing associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through certification.

# Provisioning

The AWS connector supports provisioning, allowing you to create and manage accounts and entitlements in AWS directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

| Account Attribute | Generator | Description |
| --- | --- | --- |
| UserName | Identity Attribute | The user name as taken from the SailPoint user name. |
| password | Create Password | This generator creates an initial password for the new AWS account that matches the password policy assigned to the associated AWS source in SailPoint. |
| AccountId | Disabled | The Account ID or ARN of the AWS Account under which the IAM user is to be created.<br><br>**Note:** By default, this attribute is 'Disabled', you can set it as per your requirement.<br><br>For example, you can set it to 'Static' and provide the AWS Account ID or ARN in which you want to create an IAM user. |
| AccessKey | Static | The Access key associated with a user. |
| PasswordResetRequired | Static | Indication for user to create a new password.<br><br>**Note:** Users automatically get the IAMUserChangePassword policy to allow them to change their own password. |

# Required Permissions

This section provides the administrator permissions for the following users authentication method:

- [IAM Role Authentication Method](<#iam-role-authentication-method>)
- [IAM User Authentication Method](<#iam-user-authentication-method>)

See [Non Multiple-group Object Source Policies](<#non-multiple-group-object-source-policies>) or [Multiple Group Object Source Policies](<#multiple-group-object-source-policies>) for examples of required policies.

## Set Up Service User or Service Role

> [!NOTE]
>
> **You must attach this policy document using the Inline policy to the service user or service role.**
>
> ```json
> {
>     "Version": "2012-10-17",
>
>     "Statement": [{
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>                 "sts:AssumeRole"
>             ],
>             "Resource": "arn:aws:iam::<<AWS account ID>>:role/<<cross account role name>>"
>         }
>     ]
> }
> ```
>
> Where `<< cross account role name >>` is a cross account role that has the customer managed / inline policies mentioned above and it enables the service account / role to perform all the necessary tasks needed for the source.
>
> > **Note**
> >
> > This policy must be created under each AWS account that you want to manage. The `<<AWS account ID>>` above is the ID of the Master Account ID.

### GetUserInlinePolicy Document

> [!NOTE]
>
> **iam:GetUser API permission is required when the authentication method is IAM User and you want to manage organization group objects.**
>
> ```json
> {
>     "Version": "2012-10-17",
>
>     "Statement": [{
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>                 "iam:GetUser"
>             ],
>             "Resource": "arn:aws:iam::<Service User's AWS Account Id>:user/<<Service User name>>"
>         }
>     ]
> }
> ```

## IAM Role Authentication Method

- IAM Role based Authentication can be used when the virtual appliance is hosted on the AWS EC2 instance.
- The EC2 instance must not have IAM User AWS credentials stored as credential chain.
- The EC2 instance can be present in any of the AWS Accounts (that is, either the Management AWS Account or in Member AWS Account).

See [Non Multiple-group Object Source Policies](<#non-multiple-group-object-source-policies>) or [Multiple Group Object Source Policies](<#multiple-group-object-source-policies>) for examples of these policies.

### Trust Relationship

The role must be added in the Account from where the data would be aggregated

```text
arn:aws:iam::AccountId1:role/<Cross Role created in AWS accounts>
```

> [!NOTE]
>
> The External ID can also be provided while creating the Role.

> [!NOTE]
>
> **Assume Role Permissions for EC2 Instances**
>
> For Role Authentication, the role associated with the EC2 instance must have the assume role permissions with the common role across the AWS accounts from where the data must be aggregated.
>
> For example, the following is the JSON format for the policy permissions:
>
> ```json
>  {
>   "Version": "2012-10-17",
>   "Statement": [
>      {
>        "Effect": "Allow",
>        "Principal": {
>        "AWS": [
>                "arn:aws:iam::AccountId1:role/<Cross Role created in AWS accounts>"
>               ]
>                 },
>                  "Action": "sts:AssumeRole",
>                  "Condition": {
>                  "StringEquals": {
>                                  "sts:ExternalId": "External ID associated with role"
>            }
>         }
>      }
>    ]
> }   
> ```

## IAM User Authentication Method

Customer Managed Policies must be created and attached to the AWS Service IAM User and Role respectively as mentioned in the table below.

> [!NOTE]
>
> The AWS System Administrator can refine the Permission Policies as needed.

> [!NOTE]
>
> If ‘Include AWS Account IDs’ list is specified and organization schema is not present in the application, then ‘iam:GetUser’ API permission is not required for AWS Service IAM User.

The description for the policy name and role that are used is as follows:

- **SPServiceIAMUser**: an IAM account in the management (or designated Service IAM User) account that is used as the connector’s service account to your AWS environment.
- **SPOrganizationPolicy**: allows management of Organization entities. This will only be created if the ServiceIAMUser is created in your organization’s management AWS account.
- **SPAggregationPolicy**: allows mostly read access in order to aggregate IAM entities from your AWS environment.
- **SPProvisioningPolicy**: allows write access for provisioning IAM entities back to your AWS environment.
- **SPServiceIAMUserAccess**: a role that will have the above mentioned policies and will allow the ServiceIAMUser to perform all the necessary tasks needed for the connector to work.

See [Non Multiple-group Object Source Policies](<#non-multiple-group-object-source-policies>) or [Multiple Group Object Source Policies](<#multiple-group-object-source-policies>) for examples of these policies.

## Create Cross Account Roles

To aggregate the data present in AWS accounts in an organization, the AWS Connector uses the assume role functionality of the AWS System. This functionality helps return data from different AWS accounts.

Create the cross-account role to allow the IAM user or IAM role from one AWS Account to access the resources in another AWS Account.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          arn:aws:iam::<IAM role AWS Account ID>:role/<IAM role assciated with EC2 instance>,
          OR
          arn:aws:iam::<IAM user AWS Account ID>:user/<IAM user name>
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

Trusted entities in the above case can be the IAM user or IAM Role associated with the EC2 instance based on the authentication method selected.

## Non Multiple-Group Object Source Policies

> [!NOTE]
>
> **SPAggregationPolicy**
>
> This aggregation policy must be assigned to the role of AWS accounts you want to manage.
>
> ```json
> {
>     "Version": "2012-10-17",
>     "Statement": [{
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>                 "iam:GetPolicyVersion",
>                 "iam:ListServiceSpecificCredentials",
>                 "iam:ListMFADevices",
>                 "iam:ListSigningCertificates",
>                 "iam:GetGroup",
>                 "iam:ListSSHPublicKeys",
>                 "iam:ListAttachedRolePolicies",
>                 "iam:ListAttachedUserPolicies",
>                 "iam:ListAttachedGroupPolicies",
>                 "iam:ListRolePolicies",
>                 "iam:ListAccessKeys",
>                 "iam:ListPolicies",
>                 "iam:GetRole",
>                 "iam:GetPolicy",
>                 "iam:ListGroupPolicies",
>                 "iam:ListRoles",
>                 "iam:ListUserPolicies",
>                 "iam:GetUserPolicy",
>                 "iam:ListGroupsForUser",
>                 "iam:ListAccountAliases",
>                 "iam:ListUsers",
>                 "iam:ListGroups",
>                 "iam:GetGroupPolicy",
>                 "iam:GetUser",
>                 "iam:GetRolePolicy",
>                 "iam:GetLoginProfile",
>                 "iam:ListEntitiesForPolicy",
>                 "iam:GetAccessKeyLastUsed",
>                 "iam:ListUserTags",
>                 "iam:ListRoleTags",
>                 "iam:ListPolicyTags"
>             ],
>             "Resource": "*"
>         }
>     ]
> }
> ```

> [!NOTE]
>
> **SPProvisioningPolicy**
>
> Must be assigned to the Role of AWS Account which needs to be managed.
>
> ```json
> {
>     "Version": "2012-10-17",
>     "Statement": [
>         {
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>               "iam:UpdateLoginProfile",
>               "iam:UpdateAccessKey",
>               "iam:CreateUser",
>               "iam:CreateAccessKey",
>               "iam:CreateLoginProfile",
>               "iam:RemoveUserFromGroup",
>               "iam:AddUserToGroup",
>               "iam:DeleteLoginProfile",
>               "iam:AttachUserPolicy"
>           ],
>           "Resource": "*"
>       }
>   ]
> }
> ```

## Multiple Group Object Source Policies

Examples of policies for the respective policy names:

### For AWS Service IAM User

> [!NOTE]
>
> **SPServiceIAMUSer**
>
> ```json
> {
>     "Version": "2012-10-17",
>     "Statement": [{
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>                 "sts:AssumeRole"
>             ],
>             "Resource": "arn:aws:iam::*:role/SPServiceUserAccountAccess"
>         }
>     ]
> }
> ```
>
> > **Note**
> >
> > The above role name is an example. Replace **SPServiceUserAccountAccess** with the specific role name that was created on your AWS system.

### For Role

> [!NOTE]
>
> **SPOrganizationPolicy**
>
> Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.
>
> ```json
> {
>     "Version": "2012-10-17",
>     "Statement": [{
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>                 "organizations:ListPoliciesForTarget",
>                 "organizations:ListAccountsForParent",
>                 "organizations:ListRoots",
>                 "organizations:ListAccounts",
>                 "organizations:ListTargetsForPolicy",
>                 "organizations:DescribeOrganization",
>                 "organizations:DescribeOrganizationalUnit",
>                 "organizations:DescribeAccount",
>                 "organizations:ListParents",
>                 "organizations:ListOrganizationalUnitsForParent",
>                 "organizations:DescribePolicy",
>                 "organizations:ListPolicies",
>                 "organizations:ListTagsForResource"
>             ],
>             "Resource": "*"
>         }
>     ]
> }
> ```

> [!NOTE]
>
> **SPAggregationPolicy**
>
> Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.
>
> ```json
> {
>     "Version": "2012-10-17",
>     "Statement": [{
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>                 "iam:GetPolicyVersion",
>                 "iam:ListServiceSpecificCredentials",
>                 "iam:ListMFADevices",
>                 "iam:ListSigningCertificates",
>                 "iam:GetGroup",
>                 "iam:ListSSHPublicKeys",
>                 "iam:ListAttachedRolePolicies",
>                 "iam:ListAttachedUserPolicies",
>                 "iam:ListAttachedGroupPolicies",
>                 "iam:ListRolePolicies",
>                 "iam:ListAccessKeys",
>                 "iam:ListPolicies",
>                 "iam:GetRole",
>                 "iam:GetPolicy",
>                 "iam:ListGroupPolicies",
>                 "iam:ListRoles",
>                 "iam:ListUserPolicies",
>                 "iam:GetUserPolicy",
>                 "iam:ListGroupsForUser",
>                 "iam:ListAccountAliases",
>                 "iam:ListUsers",
>                 "iam:ListGroups",
>                 "iam:GetGroupPolicy",
>                 "iam:GetUser",
>                 "iam:GetRolePolicy",
>                 "iam:GetLoginProfile",
>                 "iam:ListEntitiesForPolicy",
>                 "iam:GetAccessKeyLastUsed",
>                 "iam:ListUserTags",
>                 "iam:ListRoleTags",
>                 "iam:ListPolicyTags"
>             ],
>             "Resource": "*"
>         }
>     ]
> }
> ```

> [!NOTE]
>
> **SPProvisioningPolicy**
>
> Required for Multiple-group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.
>
> ```json
> {
>     "Version": "2012-10-17",
>     "Statement": [{
>             "Sid": "VisualEditor0",
>             "Effect": "Allow",
>             "Action": [
>                 "iam:UpdateLoginProfile",
>                 "iam:CreateGroup",
>                 "iam:DeleteAccessKey",
>                 "iam:DeleteGroup",
>                 "iam:AttachUserPolicy",
>                 "iam:DeleteUserPolicy",
>                 "iam:UpdateAccessKey",
>                 "iam:AttachRolePolicy",
>                 "iam:DeleteUser",
>                 "iam:CreateUser",
>                 "iam:CreateAccessKey",
>                 "iam:CreatePolicy",
>                 "iam:CreateLoginProfile",
>                 "iam:RemoveUserFromGroup",
>                 "iam:AddUserToGroup",
>                 "iam:DetachRolePolicy",
>                 "iam:DeleteSigningCertificate",
>                 "iam:AttachGroupPolicy",
>                 "iam:DeleteRolePolicy",
>                 "iam:DetachGroupPolicy",
>                 "iam:DetachUserPolicy",
>                 "iam:DeleteGroupPolicy",
>                 "iam:DeleteLoginProfile"
>             ],
>             "Resource": "*"
>         }
>     ]
> }
> ```

> [!NOTE]
>
> - For all provisioning operations, in addition to the provisioning policy permissions listed for SPProvisioningPolicy the permissions for Refresh Operations are also required.
> - For more information on operation specific administrator permissions required for IAM and Organization APIs, see Operation Specific Service IAM User permissions.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The AWS connector uses the following default correlation and object configurations.

The following schema objects are supported:

- Account
- Group (Primary)
- \*AWS Managed Policy
- \*Customer Managed Policy
- \*Inline Policy
- \*Service Control Policy
- \*Roles
- \*Organization Unit
- \*AWS Accounts

> [!NOTE]
>
> Schema objects with an asterisk (\*) are only functional when you purchase SailPoint CIEM.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| ARN | Account |
| ARN | Group |
| Id | InlinePolicy |
| ARN | AWSManagedPolicy |
| ARN | CustomerManagedPolicy |
| ARN | Role |
| ARN | SCP |
| ARN | AWSAccount |
| ARN | OrganizationUnit |

### Default Account Attributes

The AWS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Type | Description |
| --- | --- | --- |
| UserName | String | Friendly name of the user. |
| UserId | String | Unique ID of the user. |
| Path | String | Path to the user. |
| ARN | String | Amazon Resource Name of the user.<br><br>This is an Account ID which must not be changed. |
| CreateDate | String | Creation date of the user. |
| ConsoleAccess | String | Password status of the user. |
| Groups | Group | Groups the user is a part of. |
| AWSManagedPolicies | AWSManagedPolicy | AWS Managed Policies directly assigned to the user. |
| CustomerManagedPolicies | CustomerManagedPolicy | Customer Managed Policies directly assigned to the user. |
| InlinePolicies | InlinePolicy | Inline Policies directly assigned to the user. |
| Access Keys | String | Access keys associated with the user. |
| AWS CodeCommit HTTPS Credentials | String | AWS CodeCommit HTTPS Git credentials associated with the user. |
| AWS CodeCommit SSH Keys | String | AWS CodeCommit SSH public keys associated with the user. |
| Signing Certificates | String | Signing Certificates associated with the user. |
| Multi-Factor Authentication Device | String | Multi-Factor Authentication device associated with the user. |
| PasswordLastUsed | String | Password last used date of the user. |
| AccessKeyLastUsed | String | Access key last used details of the user. |
| Tags | String | Tag list in the format TagKey\~TagValue pair |

### Tags Attribute

A new Tags Attribute is available for aggregation to identify and organize AWS resources. Tags are displayed as Key/Value pairs for the aggregated entities.

This multivalued, string attribute stores the Key/Value pair as a single string in K=V,K2=V2 format with tags separated by commas. For example:

```text
[Key~Value, Costcenter~Austin, Department~QA, Location~Offshore ]
```

The form-data appears as follows:

- Key: `Costcenter, Department, Location`
- Value: `Austin, QA, Offshore`

By default the tilda(\~) delimiter is between the key value pair. However, the separator can be configured as `tagKeyValueSeparator`.

```text
<entry key="tagKeyValueSeparator"value="="/>
```

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The AWS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

#### Object Type: Group

| Attribute Name | Type | Description |
| --- | --- | --- |
| GroupName | String | Friendly name of the group. |
| GroupId | String | Unique ID of the group. |
| Path | String | Path to the group. |
| ARN | String | Amazon Resource Name of the group.<br><br>This is an Account ID which must not be changed. |
| Create | String | Creation date of the group. |
| AWSManagedPolicies | AWSManagedPolicy | AWS Managed Policies directly assigned to the group. |
| CustomerManagedPolicies | CustomerManagedPolicy | Customer Managed Policies directly assigned to the group. |
| InlinePolicies | InlinePolicy | Inline Policies directly assigned to the group. |

#### Object Type: AWSManagedPolicy

| Attribute Name | Type | Description |
| --- | --- | --- |
| PolicyName | String | The friendly name of the AWS managed policy. |
| PolicyId | String | The unique ID of the AWS managed policy. |
| Description | String | A friendly description of the AWS managed policy. |
| ARN | String | Amazon Resource Name of the AWS managed policy.<br><br>This is an Account ID which must not be changed. |
| Path | String | The path to the AWS managed policy. |
| CreateDate | String | The creation date of the AWS managed policy. |
| UpdateDate | String | The last update date of the AWS managed policy. |
| DefaultVersionId | String | The currently enabled version ID of the AWS managed policy. |
| PolicyJSON | String | The JSON document for the AWS managed policy. |

#### Object Type: Customer Managed Policy

| Attribute Name | Type | Description |
| --- | --- | --- |
| PolicyName | String | The friendly name of the customer managed policy. |
| PolicyId | String | The unique ID of the customer managed policy. |
| Description | String | A friendly description of the customer managed policy. |
| CreateDate | String | The creation date of the customer managed policy. |
| UpdateDate | String | The last update date of the customer managed policy. |
| ARN | String | Amazon Resource Name of the customer managed policy.<br><br>This is an Account ID which must not be changed. |
| Path | String | The path to the customer managed policy. |
| DefaultVersionId | String | The currently enabled version ID of the customer managed policy. |
| PolicyJSON | String | The JSON document for the customer managed policy. |
| PolicyGroups | String | Groups attached to the customer managed policy. |
| PolicyRoles | String | Roles attached to the customer managed policy. |
| Tags | String | Tag list in the format TatKey\~TagValue pair |

#### Object Type: InlinePolicy

| Attribute Name | Type | Description |
| --- | --- | --- |
| Name | String | The friendly name of the policy. |
| Id | String | The unique ID of the policy.<br><br>This is an Account ID which must not be changed. |
| PolicyJSON | String | The JSON document for the policy. |

#### Object Type: Role

| Attribute Name | Type | Description |
| --- | --- | --- |
| RoleName | String | The friendly name of the role. |
| RoleId | String | The unique ID of the role. |
| Path | String | Path to the Role. |
| ARN | String | Amazon Resource Name of the role.<br><br>This is an Account ID which must not be changed. |
| Description | String | Role Description. |
| CreateDate | String | Creation date of the role. |
| AWSManagedPolicies | AWSManagedPolicy | AWS Managed Policies directly assigned to the role. |
| CustomerManagedPolicies | CustomerManagedPolicy | Customer Managed Policies directly assigned to the role. |
| InlinePolicies | InlinePolicy | Inline Policies directly assigned to the role. |
| TrustPolicyJSON | String | Trust Relationship Policy JSON. |
| MaxSessionDuration | String | Maximum CLI/API session duration. |
| Tags | String | Tag list in the format TagKey\~TagValue pair |

#### Object Type: SCP

| Attribute Name | Type | Description |
| --- | --- | --- |
| SCPName | String | The friendly name of the Service Control Policy. |
| SCPId | String | The unique ID of the Service Control Policy. |
| ARN | String | Amazon Resource Name of the Service Control Policy.<br><br>This is an Account ID which must not be changed. |
| Description | String | A friendly description of the Service Control Policy. |
| AWSManaged | String | A boolean value that indicates whether the Service Control Policy is an AWS managed policy. |
| PolicyJSON | String | The JSON document for the Service Control Policy. |
| Tags | String | Tag list in the format TagKey\~TagValue pair |

#### Object Type: AWSAccount

| Attribute Name | Type | Description |
| --- | --- | --- |
| AWSAccountName | String | The friendly name of the AWS account. |
| AWSAccountId | String | The unique ID of the AWS account. |
| ARN | String | Amazon Resource Name of the AWS account.<br><br>This is an Account ID which must not be changed. |
| Email | String | The email address associated with the AWS account. |
| Status | String | The status of the AWS account in the organization. |
| JoinedMethod | String | The method by which the AWS account joined the organization. |
| JoinedTimestamp | String | The date the AWS account became a part of the organization. |
| OrganizationUnit | OrganizationUnit | Organization unit holding the AWS Account. |
| Tags | String | Tag list in the format TagKey\~TagValue pair |

#### Object Type: OrganizationUnit

| Attribute Name | Type | Description |
| --- | --- | --- |
| OUName | String | The friendly name of the Organization Unit. |
| OUId | String | The unique ID of the Organization Unit. |
| ARN | String | Amazon Resource Name of the Organization Unit.<br><br>This is an Account ID which must not be changed. |
| ServiceControlPolicies | SCP | Service Control Policies attached to the Organization Unit. |
| Parent | OrganizationUnit | Parent Organization Unit. |
| AWSAccounts | AWSAccount | AWS Accounts attached to the Organization Unit. |
| Tags | String | Tag list in the format TagKey\~TagValue pair |

# Source Configuration Guide

There are currently two authentication choices when configuring the AWS connector. **IAM User** and **IAM Role**. Refer to the respective section below for configuration information.

> [!NOTE]
>
> It’s a good idea to establish a naming convention for the policies and roles that you create during this process. For example, "SPAggregationPolicy", "SPAssumeRolePolicy", and "SPCrossAccountRole".

> [!IMPORTANT]
>
> This guide assumes you are connecting to an AWS environment that uses AWS Organizations with multiple AWS accounts under it. This is the most common deployment method. If you are connecting to a single AWS account without access to an AWS organization (for testing, POCs, etc.), you must manually remove the AWS organization schema objects as those are included by default with the AWS connector. Instructions on how to remove the schema objects are included at the [end](<#how-to-remove-the-schema-objects-for-use-with-a-single-aws-account>) of this guide.

- [IAM User Authentication](<#iam-user-authentication>)
- [IAM Role Authentication](<#iam-role-authentication>)

  - [Overview](<#overview>)
  - [Policies](<#policies>)
  - [Cross-account Roles](<#cross-account-roles>)
  - [IAM Service Role](<#iam-service-role>)
- [How to Remove the Schema Objects for use with a single AWS Account](<#how-to-remove-the-schema-objects-for-use-with-a-single-aws-account>)

## IAM User Authentication

IAM User needs be created in the management AWS account or member AWS account based on application configuration.

### IAM User in the Management AWS Account

To manage the organization entities like SCPs, OUs and AWS Accounts, it is required to create the Service IAM User in the management AWS Account. Additionally, all the organization related permissions must be given through the cross-account role present in the management AWS account.

To manage all AWS accounts (the **Manage All Accounts** checkbox in configuration parameters), the service user must be in the management AWS account to get all the AWS Account IDs.

## IAM Role Authentication

> [!IMPORTANT]
>
> Your SailPoint Virtual Appliance must be hosted in AWS and it must have a role attached to it. The role also needs to have a policy attached to it that allows it to assume the cross-account role(s) you will create. The Virtual Appliance may reside in either the management AWS account or a member AWS account.

## Overview

You will be creating two different role types and 4 different policies.

1. IAM Service Role - attached to the SailPoint Virtual Appliance in AWS

   1. Attached Policy:

      1. Assume Role Policy - this grants the VA permission to assume the cross-account roles.
2. IAM Cross-account role(s) - one for each AWS account you want to manage

   1. Attached Policies:

      These grant the permissions needed for IDN to perform its normal operations.

      1. Aggregation Policy
      2. Organization Policy
      3. Provisioning Policy

> [!IMPORTANT]
>
> Our documentation outlines two sets of policies you can choose from depending on whether or not you need multi-group object support. If you only want to manage one entitlement in AWS, such as a group, then use the "Policies Required for Non Multiple-group Object Source". If you want to manage more than one entitlement type in AWS, such as groups, AWS Managed Policies, Customer Managed Policies, Inline Policies, Service Control Policies (SCPs), AWS Organization OUs, AWS Accounts, etc. then use the "Policies Required for Multiple-group Object Source". Multi-group object support is a more recent enhancement and provides more capability/visibility. In most cases, you should use the multi-group object policies.

> [!NOTE]
>
> Perform these steps in the order outlined below as they are dependent on one another.

### Policies

Create 3 policies in each AWS account you want to manage:

1. Aggregation Policy
2. Organization Policy
3. Provisioning Policy

These will be attached to your cross-account roles.

1. Create a new policy.
2. Select the JSON tab
3. Paste in the JSON provided in the connector documentation. For most deployments, you will be using the multiple group object policies found in this guide.

### Cross-Account Roles

Create a cross-account role in each AWS account you want to manage and attach the 3 policies you created above. When creating this role, select the second option in the role creation wizard for **Another AWS account**. Enter the Account ID for the management account in your AWS Organization (even for the one you create in the management account). You must use the same name for every cross-account role.

> [!NOTE]
>
> **Screenshot**
>
> [![Cross-account Roles](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws1.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws1.png>)

> [!NOTE]
>
> You must modify the Trust Relationship for the cross-account role at the management account level to include a trust for all other member AWS account IDs that you want to manage.

> [!NOTE]
>
> **Screenshot**
>
> [![Cross-account Roles](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws2.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws2.png>)

Example JSON:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<MasterAccountID>:root",
          "arn:aws:iam::<MemberAccountID>:root",
          "arn:aws:iam::<MemberAccountID>:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}
```

> [!NOTE]
>
> The cross-account roles you create on each member AWS account only need to trust the management account ID.

### IAM Service Role

When creating the role for your VA, the role creation wizard will ask you to select a type of trusted entity. Choose the first option, **AWS service**, and then select **EC2** under the common use cases list. This role will get attached to your Virtual Appliance EC2 instance.

> [!NOTE]
>
> **Screenshot**
>
> [![IAM Service Role](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws3.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws3.png>)

The role also needs to have a policy attached to it that allows it to assume the cross-account role(s) you will create.

1. Create a new policy.
2. Select the JSON tab.
3. Paste in the following JSON:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::<MasterAccountID>:role/<CrossAccountRoleName>",
                "arn:aws:iam::<MemberAccountID1>:role/<CrossAccountRoleName>",
                "arn:aws:iam::<MemberAccountID2>:role/<CrossAccountRoleName>"
            ]
        }
    ]
}
```

> [!NOTE]
>
> The Resource section will contain references to all of the cross-account roles you create. You can copy the Role ARN from the top of the role summary screen.

> [!NOTE]
>
> **Screenshot**
>
> [![IAM Service Role](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws4.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws4.png>)

> [!NOTE]
>
> Example Role ARN: "arn:aws:iam::012345678901:role/SPCrossAccountRole"

The result should look similar to this:

> [!NOTE]
>
> **Screenshot**
>
> [![IAM Service Role](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws5.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws5.png>)

Attach it to your EC2 instance for your Virtual Appliance:

> [!NOTE]
>
> **Screenshot**
>
> [![IAM Service Role](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws6.png>)](<https://documentation.sailpoint.com/connectors/aws/va/help/img/aws6.png>)

## How to Remove the Schema Objects for Use with a Single AWS Account

The default AWS connector assumes you will be connecting to an AWS Organization structure, therefore, it includes default group schema objects related to AWS Organization objects. If you attempt to connect to a single AWS account, you will likely encounter error messages during a test connection regarding AWS Organizations. Today, the workaround is to manually remove the group schema objects related to AWS Organization objects. This requires API work as there is currently no UI for group schema.

You must remove the following group schema objects using Postman:

- OrganizationUnit
- SCP
- AWSAccount

To modify the schema, use Postman to do the following:

1. List all the sources in your IDN tenant to find the AWS source ID:

   1. GET https://{tenant}.api.identitynow.com/v3/sources
   2. [https://developer.sailpoint.com/docs/api/list-sources-v-1/](<https://developer.sailpoint.com/docs/api/list-sources-v-1/>)
2. List the AWS source schema using the ID you obtained from step 1:

   1. GET https://{tenant}.api.identitynow.com/v3/sources/{sourceId}/schemas
   2. [https://developer.sailpoint.com/docs/api/get-source-schemas-v-1/](<https://developer.sailpoint.com/docs/api/get-source-schemas-v-1/>)
   3. Note the schemaId for each of the section you will remove (OrganizationUnit, SCP, AWSAccount)
3. Delete each of the schema sections for OrganizationUnit, SCP and AWSAccount using the appropriate schemaId for each:

   1. DELETE https://{tenant}.api.identitynow.com/v3/sources/{sourceId}/schemas/{schemaId}
   2. [https://developer.sailpoint.com/docs/api/delete-source-schema-v-1/](<https://developer.sailpoint.com/docs/api/delete-source-schema-v-1/>)

As a reference, here is the default schema. You will see a section for OrganizationUnit, SCP and AWSAccount near the very bottom of the schema:

> [!NOTE]
>
> Each section has a unique schemaId. You will need those IDs to delete each section.

```json
[
    {
        "nativeObjectType": "account",
        "identityAttribute": "ARN",
        "displayAttribute": "UserName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "UserName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "UserId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "Path to the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "User Creation date",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ConsoleAccess",
                "type": "STRING",
                "schema": null,
                "description": "Password Status",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Groups",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260c",
                    "name": "group"
                },
                "description": "Groups the user is a part of",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "AWSManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260d",
                    "name": "AWSManagedPolicy"
                },
                "description": "AWS Managed Policies directly assigned to this user",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "CustomerManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260e",
                    "name": "CustomerManagedPolicy"
                },
                "description": "Customer Managed Policies directly assigned to this user",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "InlinePolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260f",
                    "name": "InlinePolicy"
                },
                "description": "Inline Policies directly assigned to this user",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "Access Keys",
                "type": "STRING",
                "schema": null,
                "description": "Access keys associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWS CodeCommit HTTPS Credentials",
                "type": "STRING",
                "schema": null,
                "description": "AWS CodeCommit HTTPS Git credentials associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWS CodeCommit SSH Keys",
                "type": "STRING",
                "schema": null,
                "description": "AWS CodeCommit SSH public keys associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Signing Certificates",
                "type": "STRING",
                "schema": null,
                "description": "Signing Certificates associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PasswordLastUsed",
                "type": "STRING",
                "schema": null,
                "description": "Password last used date of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AccessKeyLastUsed",
                "type": "STRING",
                "schema": null,
                "description": "Access key last used details of the user ",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260b",
        "name": "account",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "group",
        "identityAttribute": "ARN",
        "displayAttribute": "GroupName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "GroupName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "GroupId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "Path to the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "Creation date of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSManagedPolicies",
                "type": "STRING",
                "schema": null,
                "description": "AWS Managed Policies directly assigned to the group",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": false
            },
            {
                "name": "CustomerManagedPolicies",
                "type": "STRING",
                "schema": null,
                "description": "Customer Managed Policies directly assigned to the group",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": false
            },
            {
                "name": "InlinePolicies",
                "type": "STRING",
                "schema": null,
                "description": "Inline Policies directly assigned to the group",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260c",
        "name": "group",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": "2021-08-12T19:11:37.673Z"
    },
    {
        "nativeObjectType": "AWSManagedPolicy",
        "identityAttribute": "ARN",
        "displayAttribute": "PolicyName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "PolicyName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "A friendly description of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "The path to the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "The creation date of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "UpdateDate",
                "type": "STRING",
                "schema": null,
                "description": "The last update date of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "DefaultVersionId",
                "type": "STRING",
                "schema": null,
                "description": "The currently enabled version ID of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260d",
        "name": "AWSManagedPolicy",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "CustomerManagedPolicy",
        "identityAttribute": "ARN",
        "displayAttribute": "PolicyName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING",
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "PolicyName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "A friendly description of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "The creation date of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "UpdateDate",
                "type": "STRING",
                "schema": null,
                "description": "The last update date of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "The path to the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "DefaultVersionId",
                "type": "STRING",
                "schema": null,
                "description": "The currently enabled version ID of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyGroups",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260c",
                    "name": "group"
                },
                "description": "Groups attached to the customer managed policy",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "PolicyRoles",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692610",
                    "name": "Role"
                },
                "description": "Roles attached to the customer managed policy",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260e",
        "name": "CustomerManagedPolicy",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "InlinePolicy",
        "identityAttribute": "Id",
        "displayAttribute": "Name",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "Name",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Id",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260f",
        "name": "InlinePolicy",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "Role",
        "identityAttribute": "ARN",
        "displayAttribute": "RoleName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING",
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "RoleName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "RoleId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "Path to the Role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "Role Description",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "Creation date of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260d",
                    "name": "AWSManagedPolicy"
                },
                "description": "AWS Managed Policies directly assigned to the role",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "CustomerManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260e",
                    "name": "CustomerManagedPolicy"
                },
                "description": "Customer Managed Policies directly assigned to the role",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "InlinePolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260f",
                    "name": "InlinePolicy"
                },
                "description": "Inline Policies directly assigned to the role",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "TrustPolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "Trust Relationship Policy JSON",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "MaxSessionDuration",
                "type": "STRING",
                "schema": null,
                "description": "Maximum CLI/API session duration",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692610",
        "name": "Role",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "SCP",
        "identityAttribute": "ARN",
        "displayAttribute": "SCPName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "SCPName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "SCPId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "A friendly description of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSManaged",
                "type": "STRING",
                "schema": null,
                "description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692611",
        "name": "SCP",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "AWSAccount",
        "identityAttribute": "ARN",
        "displayAttribute": "AWSAccountName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "AWSAccountName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSAccountId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Email",
                "type": "STRING",
                "schema": null,
                "description": "The email address associated with the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Status",
                "type": "STRING",
                "schema": null,
                "description": "The status of the AWS account in the organization.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "JoinedMethod",
                "type": "STRING",
                "schema": null,
                "description": "The method by which the AWS account joined the organization.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "JoinedTimestamp",
                "type": "STRING",
                "schema": null,
                "description": "The date the AWS account became a part of the organization.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "OrganizationUnit",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692613",
                    "name": "OrganizationUnit"
                },
                "description": "Organization unit holding the AWS Account",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": true
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692612",
        "name": "AWSAccount",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "OrganizationUnit",
        "identityAttribute": "ARN",
        "displayAttribute": "OUName",
        "hierarchyAttribute": "Parent",
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "OUName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "OUId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ServiceControlPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692611",
                    "name": "SCP"
                },
                "description": "Service Control Policies attached to the Organization Unit",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "Parent",
                "type": "STRING",
                "schema": null,
                "description": "Parent Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": true
            },
            {
                "name": "AWSAccounts",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692612",
                    "name": "AWSAccount"
                },
                "description": "AWS Accounts attached to the Organization Unit",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692613",
        "name": "OrganizationUnit",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    }
]
```

Here is the section that must be removed:

```json
{
        "nativeObjectType": "SCP",
        "identityAttribute": "ARN",
        "displayAttribute": "SCPName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "SCPName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "SCPId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "A friendly description of the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSManaged",
                "type": "STRING",
                "schema": null,
                "description": "A boolean value that indicates whether the Service Control Policy is an AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the Service Control Policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692611",
        "name": "SCP",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "AWSAccount",
        "identityAttribute": "ARN",
        "displayAttribute": "AWSAccountName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "AWSAccountName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSAccountId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Email",
                "type": "STRING",
                "schema": null,
                "description": "The email address associated with the AWS account.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Status",
                "type": "STRING",
                "schema": null,
                "description": "The status of the AWS account in the organization.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "JoinedMethod",
                "type": "STRING",
                "schema": null,
                "description": "The method by which the AWS account joined the organization.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "JoinedTimestamp",
                "type": "STRING",
                "schema": null,
                "description": "The date the AWS account became a part of the organization.",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "OrganizationUnit",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692613",
                    "name": "OrganizationUnit"
                },
                "description": "Organization unit holding the AWS Account",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": true
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692612",
        "name": "AWSAccount",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "OrganizationUnit",
        "identityAttribute": "ARN",
        "displayAttribute": "OUName",
        "hierarchyAttribute": "Parent",
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "OUName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "OUId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ServiceControlPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692611",
                    "name": "SCP"
                },
                "description": "Service Control Policies attached to the Organization Unit",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "Parent",
                "type": "STRING",
                "schema": null,
                "description": "Parent Organization Unit",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": true
            },
            {
                "name": "AWSAccounts",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692612",
                    "name": "AWSAccount"
                },
                "description": "AWS Accounts attached to the Organization Unit",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692613",
        "name": "OrganizationUnit",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    }
```

Here is what it should look like after you modify it:

```json
[
    {
        "nativeObjectType": "account",
        "identityAttribute": "ARN",
        "displayAttribute": "UserName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [],
        "configuration": {},
        "attributes": [
            {
                "name": "UserName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "UserId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "Path to the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "User Creation date",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ConsoleAccess",
                "type": "STRING",
                "schema": null,
                "description": "Password Status",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Groups",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260c",
                    "name": "group"
                },
                "description": "Groups the user is a part of",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "AWSManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260d",
                    "name": "AWSManagedPolicy"
                },
                "description": "AWS Managed Policies directly assigned to this user",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "CustomerManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260e",
                    "name": "CustomerManagedPolicy"
                },
                "description": "Customer Managed Policies directly assigned to this user",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "InlinePolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260f",
                    "name": "InlinePolicy"
                },
                "description": "Inline Policies directly assigned to this user",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "Access Keys",
                "type": "STRING",
                "schema": null,
                "description": "Access keys associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWS CodeCommit HTTPS Credentials",
                "type": "STRING",
                "schema": null,
                "description": "AWS CodeCommit HTTPS Git credentials associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWS CodeCommit SSH Keys",
                "type": "STRING",
                "schema": null,
                "description": "AWS CodeCommit SSH public keys associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Signing Certificates",
                "type": "STRING",
                "schema": null,
                "description": "Signing Certificates associated with the user",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PasswordLastUsed",
                "type": "STRING",
                "schema": null,
                "description": "Password last used date of the user",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AccessKeyLastUsed",
                "type": "STRING",
                "schema": null,
                "description": "Access key last used details of the user ",
                "isMulti": true,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260b",
        "name": "account",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "group",
        "identityAttribute": "ARN",
        "displayAttribute": "GroupName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "GroupName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "GroupId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "Path to the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "Creation date of the group",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSManagedPolicies",
                "type": "STRING",
                "schema": null,
                "description": "AWS Managed Policies directly assigned to the group",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": false
            },
            {
                "name": "CustomerManagedPolicies",
                "type": "STRING",
                "schema": null,
                "description": "Customer Managed Policies directly assigned to the group",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": false
            },
            {
                "name": "InlinePolicies",
                "type": "STRING",
                "schema": null,
                "description": "Inline Policies directly assigned to the group",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260c",
        "name": "group",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": "2021-08-12T19:11:37.673Z"
    },
    {
        "nativeObjectType": "AWSManagedPolicy",
        "identityAttribute": "ARN",
        "displayAttribute": "PolicyName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "PolicyName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "A friendly description of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "The path to the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "The creation date of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "UpdateDate",
                "type": "STRING",
                "schema": null,
                "description": "The last update date of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "DefaultVersionId",
                "type": "STRING",
                "schema": null,
                "description": "The currently enabled version ID of the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the AWS managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260d",
        "name": "AWSManagedPolicy",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "CustomerManagedPolicy",
        "identityAttribute": "ARN",
        "displayAttribute": "PolicyName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING",
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "PolicyName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "A friendly description of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "The creation date of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "UpdateDate",
                "type": "STRING",
                "schema": null,
                "description": "The last update date of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "The path to the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "DefaultVersionId",
                "type": "STRING",
                "schema": null,
                "description": "The currently enabled version ID of the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the customer managed policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyGroups",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260c",
                    "name": "group"
                },
                "description": "Groups attached to the customer managed policy",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "PolicyRoles",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec692610",
                    "name": "Role"
                },
                "description": "Roles attached to the customer managed policy",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260e",
        "name": "CustomerManagedPolicy",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "InlinePolicy",
        "identityAttribute": "Id",
        "displayAttribute": "Name",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "Name",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Id",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "PolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "The JSON document for the policy",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec69260f",
        "name": "InlinePolicy",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    },
    {
        "nativeObjectType": "Role",
        "identityAttribute": "ARN",
        "displayAttribute": "RoleName",
        "hierarchyAttribute": null,
        "includePermissions": false,
        "features": [
            "PROVISIONING",
            "NO_GROUP_PERMISSIONS_PROVISIONING"
        ],
        "configuration": {},
        "attributes": [
            {
                "name": "RoleName",
                "type": "STRING",
                "schema": null,
                "description": "The friendly name of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "RoleId",
                "type": "STRING",
                "schema": null,
                "description": "The unique ID of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Path",
                "type": "STRING",
                "schema": null,
                "description": "Path to the Role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "ARN",
                "type": "STRING",
                "schema": null,
                "description": "Amazon Resource Name of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "Description",
                "type": "STRING",
                "schema": null,
                "description": "Role Description",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "CreateDate",
                "type": "STRING",
                "schema": null,
                "description": "Creation date of the role",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "AWSManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260d",
                    "name": "AWSManagedPolicy"
                },
                "description": "AWS Managed Policies directly assigned to the role",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "CustomerManagedPolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260e",
                    "name": "CustomerManagedPolicy"
                },
                "description": "Customer Managed Policies directly assigned to the role",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "InlinePolicies",
                "type": "STRING",
                "schema": {
                    "type": "CONNECTOR_SCHEMA",
                    "id": "2c9180887b36bc33017b3bc6ec69260f",
                    "name": "InlinePolicy"
                },
                "description": "Inline Policies directly assigned to the role",
                "isMulti": true,
                "isEntitlement": true,
                "isGroup": true
            },
            {
                "name": "TrustPolicyJSON",
                "type": "STRING",
                "schema": null,
                "description": "Trust Relationship Policy JSON",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            },
            {
                "name": "MaxSessionDuration",
                "type": "STRING",
                "schema": null,
                "description": "Maximum CLI/API session duration",
                "isMulti": false,
                "isEntitlement": false,
                "isGroup": false
            }
        ],
        "id": "2c9180887b36bc33017b3bc6ec692610",
        "name": "Role",
        "created": "2021-08-12T19:11:37.577Z",
        "modified": null
    }    
]
```

# Migrate VA-based Source to a SaaS Source

Some sources that are connected to virtual appliance (VA) clusters can be migrated to SaaS connections. This ensures data (users and entitlements) remain intact and can maintains your source configurations like access profiles, roles, password settings, and correlation configurations when switching from a VA cluster to a SaaS connection.

To migrate a source from a VA-based source to a SaaS source, you will provide configuration details on a draft version of the source before publishing the source.

> [!NOTE]
>
> - You must have an Admin or Source Admin user level to migrate a source.

A draft version of the source is created. As your migration process is in progress the live source will continue to work as it is.

For more information on the AWS SaaS connector, refer to the [AWS SaaS Supported Features](<https://documentation.sailpoint.com/aws/saas/help/index.html#supported-features>).

## Important Considerations Before Migrating

- You do not need to edit additional configurations (other than connection credentials) to migrate the source.
- If your source migration is in progress, please do not make any configuration changes to your live source as those can be overwritten once you apply the migration your draft version.
- Once you've gone ahead with your migration, it can't be rolled back. Your source is permanently migrated to a SaaS source.
- Any preview operations or configuration changes on the draft source will not impact the live source until you apply the migration.

## Migrating Sources

To migrate your source, complete the following:

1. Go to **Admin \> Connections \> Sources**.
2. Select or edit the VA-based source you want to migrate.
3. Open the source configuration, and select **Migrate to SaaS**.
4. When prompted, select **Continue**.

   A draft version of the source is created. The live source will continue to work.
5. Select **Connection Settings**.
6. Re-enter encrypted configuration details. For example, you might need to re-enter the Client Secret, Password, Refresh Token, Personal Access Token (PAT), or Certificates to migrate from the VA cluster to the SaaS connection.

   > **Important**
   >
   > Avoid editing the other configuration options in the draft source.
7. Select **Review and Test**.
8. Select **Test Connection**.
9. (Optional) Select **Accounts**. If you successfully tested your connection in **Review and Test**, you can select **Preview** to display a subset of accounts from the application that will be mapped to SailPoint identities. This can help ensure you are accurately connecting identity data from the application with SailPoint identities.
10. (Optional) Select **Entitlements**. If you successfully tested your connection in **Review and Test** and your source type supports entitlement type configuration, you can select **Preview** to view a preview of entitlements using the current configuration settings.
11. When you've finished reviewing your changes and successfully tested your connection, select **Apply Migration**.

    Your changes will be applied to the live source and the draft source will be deleted.

## Viewing Source Migration Status

You can view the status and creation date of draft sources.

1. Go to **Admin \> Connections \> Sources \> Source Migration Status**.
2. Select **Source Migration Status**.
3. To view or edit the draft source, select **Actions** ![](<https://documentation.sailpoint.com/connectors/aws/va/help/common/assets/img/actions_menu.png>) **\> Preview** on the draft source.
4. To delete the draft source, select **Actions** ![](<https://documentation.sailpoint.com/connectors/aws/va/help/common/assets/img/actions_menu.png>) **\> Delete** on the draft source.

# Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Test Connection Errors

```text
aws_default_errorAWS Client creation failed : Cannot invoke "software.amazon.awssdk.services.iam.IamClient.getUser()" because "iamClient" is null").
```

**Resolution**: Disable the `CONUMSHIAN_9288_USE_AWS_SDK_V2` feature flag for the respected org.

```text
Failed to connect to service endpoint.
```

**Resolution**: The VA on the EC2 instance must have secure tunneling turned off.

```text
[ InvalidConfigurationException ] [ Possible suggestions ] Ensure that the AWS Management Account ID is correctly configured. [ Error details ] Management Account ID must be configured when "Manage All Accounts" is checked or AWS organization entities needs to be managed.
```

For IAMRole Authentication, if **Manage All Accounts** is selected or if the included AWS Account IDs are mentioned, then the test connection fails.

**Resolution**: Provide 'Management Account ID' on the configuration settings page (Management Account ID is root AWS Account ID).

```text
[ InsufficientPermissionException ] [ Possible suggestions ] Service account must be present in management account with the required permissions. [ Error details ] Test Connection Failed: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: <actual alpha-numerical request ID>)
```

If **Manage All Accounts** is selected, and the service account is in any of the member AWS accounts, test connection fails.

**Resolution**: Ensure the service account is created in the management AWS account with required permissions.

```text
[InsufficientPermissionException] [Possible suggestions] Service account must be present in the management account with the required permissions. [Error details] Test Connection Failed: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: 65fc15e5-7e90-11e8-9d6a-6fc388fd2d28)
```

If Service user is in Member AWS account, Test Connection fails.

**Resolution**: Ensure that the service user is created in the management account with required permission to manage organization entities. If you do not want to manage the Organization entities, remove them from schema.

When configuring a new Amazon Web Services source, the Test Connection fails with the following error message:

```text
sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Your account is not a member of an organization. (Service: AWSOrganizations; Status Code: 400; Error Code: AWSOrganizationsNotInUseException; Request ID: c8d77e54-ec98-11e8-b722-bb0efb7fc919)
```

If Service user is in Member AWS account, Test Connection fails.

**Resolution**: Ensure that the AWS Account is a member of the AWS Organization which must be managed.

For the upgraded sources, if multiple group objects are configured, work item(s) got created while revoking associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through **certification**.

**Resolution:** Remove `NO_PERMISSIONS_PROVISIONING` from the feature string in Source XML.

## Role Not Created Error

```text
[ InvalidConfigurationException ] [ Possible suggestions ] Ensure that the required role is created in the specified AWS accounts and the user has required permissions. [ Error details ] Test connection failed for accounts [list of AWS account IDs] Failure Reason=Access denied (Service: AWSSecurityTokenService)
```

If **Manage All Accounts** is selected, and the provided role is not present in any of the AWS accounts, then the test connection fails .

```text
Exception during aggregation. Reason:openconnector.InvalidRequestException: Aggregation is failed for following AWS Account Ids: [comma separated list of accounts]
```

Aggregation fails

**Resolution:** Ensure the role is created in all the AWS Accounts with the same name and having sufficient permissions.

## AWS Account IDs Error

```text
[ InvalidConfigurationException ] [ Error details ] "Include AWS Account IDs" must be empty if "Manage All Accounts" is checked.
```

**Include AWS Account IDs** is populated and the **Manage All Accounts** checkbox is selected.

**Resolution:** The **Include AWS Account IDs** list must be empty if the **Manage All Accounts** checkbox is selected .

## Exclude AWS Accounts Error

```text
[ InvalidConfigurationException ] [ Error details ] Either "Manage All Accounts" is checked (with or without "Exclude AWS Account IDs") or "Include AWS Account IDs" must be populated.
```

**Exclude AWS Account Ids** is populated and **Manage All Accounts** checkbox is not selected.

**Resolution:** Select the **Manage All Accounts** checkbox if **Exclude AWS Account IDs** is populated.

## Manage All Accounts Error

```text
[ InvalidConfigurationException ] [ Error details ] Either "Manage All Accounts" is checked (with or without "Exclude AWS Account IDs") or "Include AWS Account IDs" must be populated.
```

**Manage All Accounts** is not selected and both the **Include AWS Account IDs** list and **Exclude AWS Account IDs** list are empty.

**Resolution:** Either **Manage All Accounts** (with or without **Exclude AWS Account IDs**) or **Include AWS Account IDs** must be populated.

## Create Account or Add Entitlement Error

```text
sailpoint.connector.ConnectorException: Invalid provisioning request. Attribute AWS Account does not match the entitlement requested : arn:aws:iam::<AWS Account ID>:group/<IAM Group Name>
```

If the IAM groups present in access profile do not belong to the AWS Account in which the IAM User needs to be created, then create account or add entitlement fails.

**Resolution**: Ensure that the access profile contains the IAM Groups as entitlements of the same AWS Account in which the IAM User needs to be created.

## Aggregation time-out error

```text
java.lang.RuntimeException: java.lang.InterruptedException: Timeout waiting for response
```

```text
Exception during aggregation. Reason: java.lang.RuntimeException: An error occurred while aggregating Application <Source Name> [source-<Source ID>]
```

You may see this error while performing account aggregation or entitlement aggregation.

**Resolution:** Set the `aggregateTimeout` attribute using the REST API. Enter the time-out value in milliseconds.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Create Account Error

```text
sailpoint.connector.ConnectorException: Access denied (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: f56b8ec5-1e7e-11e9-bab1-d124100fa000)
```

Error while creating an account.

**Resolution**: Ensure that the Account ID or ARN of the AWS Account is correctly mentioned in the Account ID of the account attribute. For example:

```text
arn:aws:organizations::441113549707:account/o-lqs5akk5dy/170915734915
```

## Identity Attribute Error

```text
sailpoint.connector.ConnectorException: Un-supported identity attribute for account
```

**Resolution**: The Account ID must be mapped with the ARN in the attribute schema.

## Throttling Error

Aggregation fails with the following error:

```text
openconnector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Rate exceeded (Service: AmazonIdentityManagement; Status Code: 400; Error Code: Throttling; Request ID: <id>)]
```

**Resolution**: Configure the throttling and set a higher value as per the requirement and allowed API limit.

## Aggregation Error

```text
Exception during aggregation of Object Type InlinePolicy on Application AWSDemo1 [source]. Reason: java.lang.RuntimeException: An error occurred while aggregating Application 'ApplicationName' [source]
```

While performing Entitlement Aggregation when multiple group objects are supported.

**Resolution:** Set the `aggregate_timeout` attribute with a value in milliseconds (300, 1000) using the REST API.

```text
POST <url>/cc/api/source/update/<sourceID>
```

`<url>` : The URL for the customer's SailPoint tenant

`<sourceID`: The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

**Key**: `connector_aggregateTimeout`

**Value**: Enter the time-out value in milliseconds (300, 1000)

**Confirmation**: Search for the "aggregateTimeout" attribute using the endpoint

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Miscellaneous Errors

Tags are not aggregated for Role after upgrade.

**Resolution**: Ensure `updateRole` provisioning policy is configured for the application with the Tags attribute ReadOnly='True'

```text
<Field displayName="con_prov_policy_AWS_Role_Tags" helpKey="help_con_form_AWS_Role_Tags" name="Tags" reviewRequired="true" type="string">
        <Attributes>
            <Map>
              <entry key="readOnly" value="true"/>
            </Map>
          </Attributes>
        </Field>
```

## A timeout error occurs when attempting to connect

**Resolution**: Utilize the API calls to increase the timeout value to 60 seconds:

PATCH https://{tenant}.api.identitynow.com/v3/sources/{id}

Content-Type: application/json-patch+json

Body:

```json
[
{
"op": "add",
"path": "/connectorAttributes/healthCheckTimeout",
"value": 60
}
]
```

## InsufficientPermissionException

**Error**: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: a90d35bd-9832-4211-9e7a-1f966063b642; Proxy: null)

**Resolution**: The service account must be present in the management account with the required permissions.

Permissions should be:

```json
{

    "Statement": [
        {
            "Action": [
                "iam:ListUsers",
                "iam:ListUserTags",
                "iam:ListUserPolicies",
                "iam:ListSigningCertificates",
                "iam:ListServiceSpecificCredentials",
                "iam:ListSSHPublicKeys",
                "iam:ListRoles",
                "iam:ListRoleTags",
                "iam:ListRolePolicies",
                "iam:ListPolicyTags",
                "iam:ListPolicies",
                "iam:ListMFADevices",
                "iam:ListGroupsForUser",
                "iam:ListGroups",
                "iam:ListGroupPolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListAccountAliases",
                "iam:ListAccessKeys",
                "iam:GetUserPolicy",
                "iam:GetUser",
                "iam:GetRolePolicy",
                "iam:GetRole",
                "iam:GetPolicyVersion",
                "iam:GetPolicy",
                "iam:GetLoginProfile",
                "iam:GetGroupPolicy",
                "iam:GetGroup",
                "iam:GetAccessKeyLastUsed"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "SPAggregationPolicy"
        },
        {
            "Action": [
                "organizations:ListTargetsForPolicy",
                "organizations:ListTagsForResource",
                "organizations:ListRoots",
                "organizations:ListPoliciesForTarget",
                "organizations:ListPolicies",
                "organizations:ListParents",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListAccountsForParent",
                "organizations:ListAccounts",
                "organizations:DescribePolicy",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeOrganization",
                "organizations:DescribeAccount"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "SPOrganizationPolicy"
        }
    ],
    "Version": "2012-10-17"
}
```

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

> [!IMPORTANT]
>
> Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```

### timeoutInSeconds

**Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests.

For example:

If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeoutInSeconds",
        "value": "15"
    }
]
```