Non Multiple-group Object Source Policies

Note
Single account configuration requires an organization policy and is not supported by AWS SaaS.

This aggregation policy must be assigned to the role of AWS accounts you want to manage.

Copy 
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0", "Effect": "Allow", "Action": [ 
            "iam:GetPolicyVersion",
            "iam:ListServiceSpecificCredentials",
            "iam:ListMFADevices",
            "iam:ListSigningCertificates",
            "iam:GetGroup",
            "iam:ListSSHPublicKeys",
            "iam:ListAttachedRolePolicies",
            "iam:ListAttachedUserPolicies",
            "iam:ListAttachedGroupPolicies",
            "iam:ListRolePolicies",
            "iam:ListAccessKeys",
            "iam:ListPolicies",
            "iam:GetRole",
            "iam:GetPolicy",
            "iam:ListGroupPolicies",
            "iam:ListRoles",
            "iam:ListUserPolicies",
            "iam:GetUserPolicy",
            "iam:ListGroupsForUser",
            "iam:ListAccountAliases",
            "iam:ListUsers",
            "iam:ListGroups",
            "iam:GetGroupPolicy",
            "iam:GetUser",
            "iam:GetRolePolicy",
            "iam:GetLoginProfile",
            "iam:ListEntitiesForPolicy",
            "iam:GetAccessKeyLastUsed",
            "iam:ListUserTags",
           "iam:ListRoleTags",
           "iam:ListPolicyTags"
],
        "Resource": "*"
    }
] } 
Copy 
{
 "Version": "2012-10-17",
  "Statement": [
   {
    "Sid": "VisualEditor0",
     "Effect": "Allow",
      "Action": [
     "organizations:ListAccounts"
    ],
   "Resource": "*"
   }
 ] 
} 

Must be assigned to the Role of AWS Account which needs to be managed.

Copy 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "iam:UpdateLoginProfile",
              "iam:UpdateAccessKey",
              "iam:CreateUser",
              "iam:CreateAccessKey",
              "iam:CreateLoginProfile",
              "iam:RemoveUserFromGroup",
              "iam:AddUserToGroup",
              "iam:DeleteLoginProfile",
              "iam:AttachUserPolicy"
          ],
          "Resource": "*"
      }
  ]
}

Activity Insights Policies are required to pull activity data in the form of events like user logins, password changes, and content updates within the application. Policies must be assigned to the role of the AWS Account that needs to be managed. If you have a license of activity insights, you must add this permission to see the activity data of the connector.

Important
Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on utilizing activity data, refer to Activity Insights.

Copy 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudtrail:Get*",
                "cloudtrail:Describe*",
                "cloudtrail:List*",
                "cloudtrail:LookupEvents"
            ],
            "Resource": "*"
        }
    ]
}