Required Permissions

This section provides the administrator permissions for the following users authentication method:

IAM Role Authentication Method
IAM User Authentication Method

See Non Multiple-group Object Source Policies or Multiple Group Object Source Policies for examples of required policies.

Set Up Service User or Service Role

You must attach this policy document using the Inline policy to the service user or service role.

{
    "Version": "2012-10-17",

    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": "arn:aws:iam::<<AWS account ID>>:role/<<cross account role name>>"
        }
    ]
}

Where << cross account role name >> is a cross account role that has the customer managed / inline policies mentioned above and it enables the service account / role to perform all the necessary tasks needed for the source.

Note

This policy must be created under each AWS account that you want to manage. The <<AWS account ID>> above is the ID of the Master Account ID.

GetUserInlinePolicy Document

iam:GetUser API permission is required when the authentication method is IAM User and you want to manage organization group objects.

{
    "Version": "2012-10-17",

    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetUser"
            ],
            "Resource": "arn:aws:iam::<Service User's AWS Account Id>:user/<<Service User name>>"
        }
    ]
}

IAM Role Authentication Method

IAM Role based Authentication can be used when the virtual appliance is hosted on the AWS EC2 instance.
The EC2 instance must not have IAM User AWS credentials stored as credential chain.
The EC2 instance can be present in any of the AWS Accounts (that is, either the Management AWS Account or in Member AWS Account).

See Non Multiple-group Object Source Policies or Multiple Group Object Source Policies for examples of these policies.

Trust Relationship

The role must be added in the Account from where the data would be aggregated

arn:aws:iam::AccountId1:role/<Cross Role created in AWS accounts>

Note

The External ID can also be provided while creating the Role.

Assume Role Permissions for EC2 Instances

For Role Authentication, the role associated with the EC2 instance must have the assume role permissions with the common role across the AWS accounts from where the data must be aggregated.

For example, the following is the JSON format for the policy permissions:

 {
  "Version": "2012-10-17",
  "Statement": [
     {
       "Effect": "Allow",
       "Principal": {
       "AWS": [
               "arn:aws:iam::AccountId1:role/<Cross Role created in AWS accounts>"
              ]
                },
                 "Action": "sts:AssumeRole",
                 "Condition": {
                 "StringEquals": {
                                 "sts:ExternalId": "External ID associated with role"
           }
        }
     }
   ]
}

IAM User Authentication Method

Customer Managed Policies must be created and attached to the AWS Service IAM User and Role respectively as mentioned in the table below.

Note

The AWS System Administrator can refine the Permission Policies as needed.

Note

If ‘Include AWS Account IDs’ list is specified and organization schema is not present in the application, then ‘iam:GetUser’ API permission is not required for AWS Service IAM User.

The description for the policy name and role that are used is as follows:

SPServiceIAMUser: an IAM account in the management (or designated Service IAM User) account that is used as the connector’s service account to your AWS environment.
SPOrganizationPolicy: allows management of Organization entities. This will only be created if the ServiceIAMUser is created in your organization’s management AWS account.
SPAggregationPolicy: allows mostly read access in order to aggregate IAM entities from your AWS environment.
SPProvisioningPolicy: allows write access for provisioning IAM entities back to your AWS environment.
SPServiceIAMUserAccess: a role that will have the above mentioned policies and will allow the ServiceIAMUser to perform all the necessary tasks needed for the connector to work.

See Non Multiple-group Object Source Policies or Multiple Group Object Source Policies for examples of these policies.

Create Cross Account Roles

To aggregate the data present in AWS accounts in an organization, the AWS Connector uses the assume role functionality of the AWS System. This functionality helps return data from different AWS accounts.

Create the cross-account role to allow the IAM user or IAM role from one AWS Account to access the resources in another AWS Account.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          arn:aws:iam::<IAM role AWS Account ID>:role/<IAM role assciated with EC2 instance>,
          OR
          arn:aws:iam::<IAM user AWS Account ID>:user/<IAM user name>
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Trusted entities in the above case can be the IAM user or IAM Role associated with the EC2 instance based on the authentication method selected.

Non Multiple-Group Object Source Policies

SPAggregationPolicy

This aggregation policy must be assigned to the role of AWS accounts you want to manage.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetPolicyVersion",
                "iam:ListServiceSpecificCredentials",
                "iam:ListMFADevices",
                "iam:ListSigningCertificates",
                "iam:GetGroup",
                "iam:ListSSHPublicKeys",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListRolePolicies",
                "iam:ListAccessKeys",
                "iam:ListPolicies",
                "iam:GetRole",
                "iam:GetPolicy",
                "iam:ListGroupPolicies",
                "iam:ListRoles",
                "iam:ListUserPolicies",
                "iam:GetUserPolicy",
                "iam:ListGroupsForUser",
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:ListGroups",
                "iam:GetGroupPolicy",
                "iam:GetUser",
                "iam:GetRolePolicy",
                "iam:GetLoginProfile",
                "iam:ListEntitiesForPolicy",
                "iam:GetAccessKeyLastUsed",
                "iam:ListUserTags",
                "iam:ListRoleTags",
                "iam:ListPolicyTags"
            ],
            "Resource": "*"
        }
    ]
}

SPProvisioningPolicy

Must be assigned to the Role of AWS Account which needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "iam:UpdateLoginProfile",
              "iam:UpdateAccessKey",
              "iam:CreateUser",
              "iam:CreateAccessKey",
              "iam:CreateLoginProfile",
              "iam:RemoveUserFromGroup",
              "iam:AddUserToGroup",
              "iam:DeleteLoginProfile",
              "iam:AttachUserPolicy"
          ],
          "Resource": "*"
      }
  ]
}

Multiple Group Object Source Policies

Examples of policies for the respective policy names:

For AWS Service IAM User

SPServiceIAMUSer

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": "arn:aws:iam::*:role/SPServiceUserAccountAccess"
        }
    ]
}

Note

The above role name is an example. Replace SPServiceUserAccountAccess with the specific role name that was created on your AWS system.

For Role

SPOrganizationPolicy

Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "organizations:ListPoliciesForTarget",
                "organizations:ListAccountsForParent",
                "organizations:ListRoots",
                "organizations:ListAccounts",
                "organizations:ListTargetsForPolicy",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeAccount",
                "organizations:ListParents",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:DescribePolicy",
                "organizations:ListPolicies",
                "organizations:ListTagsForResource"
            ],
            "Resource": "*"
        }
    ]
}

SPAggregationPolicy

Required for Multiple Group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetPolicyVersion",
                "iam:ListServiceSpecificCredentials",
                "iam:ListMFADevices",
                "iam:ListSigningCertificates",
                "iam:GetGroup",
                "iam:ListSSHPublicKeys",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListRolePolicies",
                "iam:ListAccessKeys",
                "iam:ListPolicies",
                "iam:GetRole",
                "iam:GetPolicy",
                "iam:ListGroupPolicies",
                "iam:ListRoles",
                "iam:ListUserPolicies",
                "iam:GetUserPolicy",
                "iam:ListGroupsForUser",
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:ListGroups",
                "iam:GetGroupPolicy",
                "iam:GetUser",
                "iam:GetRolePolicy",
                "iam:GetLoginProfile",
                "iam:ListEntitiesForPolicy",
                "iam:GetAccessKeyLastUsed",
                "iam:ListUserTags",
                "iam:ListRoleTags",
                "iam:ListPolicyTags"
            ],
            "Resource": "*"
        }
    ]
}

SPProvisioningPolicy

Required for Multiple-group Object Source and must be assigned to the Role of the AWS Account that needs to be managed.

{
    "Version": "2012-10-17",
    "Statement": [{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:UpdateLoginProfile",
                "iam:CreateGroup",
                "iam:DeleteAccessKey",
                "iam:DeleteGroup",
                "iam:AttachUserPolicy",
                "iam:DeleteUserPolicy",
                "iam:UpdateAccessKey",
                "iam:AttachRolePolicy",
                "iam:DeleteUser",
                "iam:CreateUser",
                "iam:CreateAccessKey",
                "iam:CreatePolicy",
                "iam:CreateLoginProfile",
                "iam:RemoveUserFromGroup",
                "iam:AddUserToGroup",
                "iam:DetachRolePolicy",
                "iam:DeleteSigningCertificate",
                "iam:AttachGroupPolicy",
                "iam:DeleteRolePolicy",
                "iam:DetachGroupPolicy",
                "iam:DetachUserPolicy",
                "iam:DeleteGroupPolicy",
                "iam:DeleteLoginProfile"
            ],
            "Resource": "*"
        }
    ]
}

Note

For all provisioning operations, in addition to the provisioning policy permissions listed for SPProvisioningPolicy the permissions for Refresh Operations are also required.
For more information on operation specific administrator permissions required for IAM and Organization APIs, see Operation Specific Service IAM User permissions.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.