Schema Reference

The application schema is used to configure the objects returned from a connector.

Note

The Account Schema tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as Entitlement or Multi-Valued. Refer to Managing Source Account Schemas for more information.
The schema attributes that are not present by default must be defined as strings if not specified.

The AWS connector uses the following default correlation and object configurations.

The following schema objects are supported:

Account
Group (Primary)
*AWS Managed Policy
*Customer Managed Policy
*Inline Policy
*Service Control Policy
*Roles
*Organization Unit
*AWS Accounts

Note

Schema objects with an asterisk (*) are only functional when you purchase SailPoint CIEM.

Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's schema. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to Managing Source Account Schemas for more information.

Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as account IDs.

Caution

Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.

To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

Account ID	Schema Object Type
ARN	Account
ARN	Group
Id	InlinePolicy
ARN	AWSManagedPolicy
ARN	CustomerManagedPolicy
ARN	Role
ARN	SCP
ARN	AWSAccount
ARN	OrganizationUnit

Default Account Attributes

The AWS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

Attribute Name	Type	Description
UserName	String	Friendly name of the user.
UserId	String	Unique ID of the user.
Path	String	Path to the user.
ARN	String	Amazon Resource Name of the user. This is an Account ID which must not be changed.
CreateDate	String	Creation date of the user.
ConsoleAccess	String	Password status of the user.
Groups	Group	Groups the user is a part of.
AWSManagedPolicies	AWSManagedPolicy	AWS Managed Policies directly assigned to the user.
CustomerManagedPolicies	CustomerManagedPolicy	Customer Managed Policies directly assigned to the user.
InlinePolicies	InlinePolicy	Inline Policies directly assigned to the user.
Access Keys	String	Access keys associated with the user.
AWS CodeCommit HTTPS Credentials	String	AWS CodeCommit HTTPS Git credentials associated with the user.
AWS CodeCommit SSH Keys	String	AWS CodeCommit SSH public keys associated with the user.
Signing Certificates	String	Signing Certificates associated with the user.
Multi-Factor Authentication Device	String	Multi-Factor Authentication device associated with the user.
PasswordLastUsed	String	Password last used date of the user.
AccessKeyLastUsed	String	Access key last used details of the user.
Tags	String	Tag list in the format TagKey~TagValue pair

Tags Attribute

A new Tags Attribute is available for aggregation to identify and organize AWS resources. Tags are displayed as Key/Value pairs for the aggregated entities.

This multivalued, string attribute stores the Key/Value pair as a single string in K=V,K2=V2 format with tags separated by commas. For example:

[Key~Value, Costcenter~Austin, Department~QA, Location~Offshore ]

The form-data appears as follows:

Key: Costcenter, Department, Location
Value: Austin, QA, Offshore

By default the tilda(~) delimiter is between the key value pair. However, the separator can be configured as tagKeyValueSeparator.

<entry key="tagKeyValueSeparator"value="="/>

Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to Managing Entitlements for more information.

Caution

Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

Default Group Attributes

The AWS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

Object Type: Group

Attribute Name	Type	Description
GroupName	String	Friendly name of the group.
GroupId	String	Unique ID of the group.
Path	String	Path to the group.
ARN	String	Amazon Resource Name of the group. This is an Account ID which must not be changed.
Create	String	Creation date of the group.
AWSManagedPolicies	AWSManagedPolicy	AWS Managed Policies directly assigned to the group.
CustomerManagedPolicies	CustomerManagedPolicy	Customer Managed Policies directly assigned to the group.
InlinePolicies	InlinePolicy	Inline Policies directly assigned to the group.

Object Type: AWSManagedPolicy

Attribute Name	Type	Description
PolicyName	String	The friendly name of the AWS managed policy.
PolicyId	String	The unique ID of the AWS managed policy.
Description	String	A friendly description of the AWS managed policy.
ARN	String	Amazon Resource Name of the AWS managed policy. This is an Account ID which must not be changed.
Path	String	The path to the AWS managed policy.
CreateDate	String	The creation date of the AWS managed policy.
UpdateDate	String	The last update date of the AWS managed policy.
DefaultVersionId	String	The currently enabled version ID of the AWS managed policy.
PolicyJSON	String	The JSON document for the AWS managed policy.

Object Type: Customer Managed Policy

Attribute Name	Type	Description
PolicyName	String	The friendly name of the customer managed policy.
PolicyId	String	The unique ID of the customer managed policy.
Description	String	A friendly description of the customer managed policy.
CreateDate	String	The creation date of the customer managed policy.
UpdateDate	String	The last update date of the customer managed policy.
ARN	String	Amazon Resource Name of the customer managed policy. This is an Account ID which must not be changed.
Path	String	The path to the customer managed policy.
DefaultVersionId	String	The currently enabled version ID of the customer managed policy.
PolicyJSON	String	The JSON document for the customer managed policy.
PolicyGroups	String	Groups attached to the customer managed policy.
PolicyRoles	String	Roles attached to the customer managed policy.
Tags	String	Tag list in the format TatKey~TagValue pair

Object Type: InlinePolicy

Attribute Name	Type	Description
Name	String	The friendly name of the policy.
Id	String	The unique ID of the policy. This is an Account ID which must not be changed.
PolicyJSON	String	The JSON document for the policy.

Object Type: Role

Attribute Name	Type	Description
RoleName	String	The friendly name of the role.
RoleId	String	The unique ID of the role.
Path	String	Path to the Role.
ARN	String	Amazon Resource Name of the role. This is an Account ID which must not be changed.
Description	String	Role Description.
CreateDate	String	Creation date of the role.
AWSManagedPolicies	AWSManagedPolicy	AWS Managed Policies directly assigned to the role.
CustomerManagedPolicies	CustomerManagedPolicy	Customer Managed Policies directly assigned to the role.
InlinePolicies	InlinePolicy	Inline Policies directly assigned to the role.
TrustPolicyJSON	String	Trust Relationship Policy JSON.
MaxSessionDuration	String	Maximum CLI/API session duration.
Tags	String	Tag list in the format TagKey~TagValue pair

Object Type: SCP

Attribute Name	Type	Description
SCPName	String	The friendly name of the Service Control Policy.
SCPId	String	The unique ID of the Service Control Policy.
ARN	String	Amazon Resource Name of the Service Control Policy. This is an Account ID which must not be changed.
Description	String	A friendly description of the Service Control Policy.
AWSManaged	String	A boolean value that indicates whether the Service Control Policy is an AWS managed policy.
PolicyJSON	String	The JSON document for the Service Control Policy.
Tags	String	Tag list in the format TagKey~TagValue pair

Object Type: AWSAccount

Attribute Name	Type	Description
AWSAccountName	String	The friendly name of the AWS account.
AWSAccountId	String	The unique ID of the AWS account.
ARN	String	Amazon Resource Name of the AWS account. This is an Account ID which must not be changed.
Email	String	The email address associated with the AWS account.
Status	String	The status of the AWS account in the organization.
JoinedMethod	String	The method by which the AWS account joined the organization.
JoinedTimestamp	String	The date the AWS account became a part of the organization.
OrganizationUnit	OrganizationUnit	Organization unit holding the AWS Account.
Tags	String	Tag list in the format TagKey~TagValue pair

Object Type: OrganizationUnit

Attribute Name	Type	Description
OUName	String	The friendly name of the Organization Unit.
OUId	String	The unique ID of the Organization Unit.
ARN	String	Amazon Resource Name of the Organization Unit. This is an Account ID which must not be changed.
ServiceControlPolicies	SCP	Service Control Policies attached to the Organization Unit.
Parent	OrganizationUnit	Parent Organization Unit.
AWSAccounts	AWSAccount	AWS Accounts attached to the Organization Unit.
Tags	String	Tag list in the format TagKey~TagValue pair

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.