{
  "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_iam-identity-center.html",
  "name": "AWS IAM Identity Center",
  "prefix": "sso",
  "timestamp": "1791806406",
  "actions": [
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AddRegion.html",
      "name": "AddRegion",
      "description": "Grants permission to add a region to an IAM Identity Center instance",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "AssociateDirectory",
      "description": "Grants permission to connect a directory to be used by AWS IAM Identity Center",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "AssociateProfile",
      "description": "Grants permission to create an association between a directory user or group and a profile",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachCustomerManagedPolicyReferenceToPermissionSet.html",
      "name": "AttachCustomerManagedPolicyReferenceToPermissionSet",
      "description": "Grants permission to attach a customer managed policy reference to a permission set",
      "access": "Permissions management",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachManagedPolicyToPermissionSet.html",
      "name": "AttachManagedPolicyToPermissionSet",
      "description": "Grants permission to attach an AWS managed policy to a permission set",
      "access": "Permissions management",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html",
      "name": "CreateAccountAssignment",
      "description": "Grants permission to assign access to a Principal for a specified AWS account using a specified permission set",
      "access": "Write",
      "resources": [
        {
          "name": "Account",
          "is_required": true
        },
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateApplication.html",
      "name": "CreateApplication",
      "description": "Grants permission to create an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        },
        {
          "name": "ApplicationProvider",
          "is_required": true
        },
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateApplicationAssignment.html",
      "name": "CreateApplicationAssignment",
      "description": "Grants permission to create an application assignment",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "CreateApplicationInstance",
      "description": "Grants permission to add an application instance to AWS IAM Identity Center",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "CreateApplicationInstanceCertificate",
      "description": "Grants permission to add a new certificate for an application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateInstance.html",
      "name": "CreateInstance",
      "description": "Grants permission to create an identity center instance",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateInstanceAccessControlAttributeConfiguration.html",
      "name": "CreateInstanceAccessControlAttributeConfiguration",
      "description": "Grants permission to enable the instance for ABAC and specify the attributes",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "CreateManagedApplicationInstance",
      "description": "Grants permission to add a managed application instance to AWS IAM Identity Center",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreatePermissionSet.html",
      "name": "CreatePermissionSet",
      "description": "Grants permission to create a permission set",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "CreateProfile",
      "description": "Grants permission to create a profile for an application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "CreateTrust",
      "description": "Grants permission to create a federation trust in a target account",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateTrustedTokenIssuer.html",
      "name": "CreateTrustedTokenIssuer",
      "description": "Grants permission to create a trusted token issuer for an instance",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "TrustedTokenIssuer",
          "is_required": true
        }
      ],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteAccountAssignment.html",
      "name": "DeleteAccountAssignment",
      "description": "Grants permission to delete a Principal's access from a specified AWS account using a specified permission set",
      "access": "Write",
      "resources": [
        {
          "name": "Account",
          "is_required": true
        },
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteApplication.html",
      "name": "DeleteApplication",
      "description": "Grants permission to delete an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteApplicationAccessScope.html",
      "name": "DeleteApplicationAccessScope",
      "description": "Grants permission to delete an access scope to an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteApplicationAssignment.html",
      "name": "DeleteApplicationAssignment",
      "description": "Grants permission to delete an application assignment",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteApplicationAuthenticationMethod.html",
      "name": "DeleteApplicationAuthenticationMethod",
      "description": "Grants permission to delete an authentication method to an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteApplicationGrant.html",
      "name": "DeleteApplicationGrant",
      "description": "Grants permission to delete a grant from an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "DeleteApplicationInstance",
      "description": "Grants permission to delete the application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "DeleteApplicationInstanceCertificate",
      "description": "Grants permission to delete an inactive or expired certificate from the application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteInlinePolicyFromPermissionSet.html",
      "name": "DeleteInlinePolicyFromPermissionSet",
      "description": "Grants permission to delete the inline policy from a specified permission set",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteInstance.html",
      "name": "DeleteInstance",
      "description": "Grants permission to delete an identity center instance",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteInstanceAccessControlAttributeConfiguration.html",
      "name": "DeleteInstanceAccessControlAttributeConfiguration",
      "description": "Grants permission to disable ABAC and remove the attributes list for the instance",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "DeleteManagedApplicationInstance",
      "description": "Grants permission to delete the managed application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeletePermissionSet.html",
      "name": "DeletePermissionSet",
      "description": "Grants permission to delete a permission set",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeletePermissionsBoundaryFromPermissionSet.html",
      "name": "DeletePermissionsBoundaryFromPermissionSet",
      "description": "Grants permission to remove permissions boundary from a permission set",
      "access": "Permissions management",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "DeleteProfile",
      "description": "Grants permission to delete the profile for an application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DeleteTrustedTokenIssuer.html",
      "name": "DeleteTrustedTokenIssuer",
      "description": "Grants permission to delete a trusted token issuer for an instance",
      "access": "Write",
      "resources": [
        {
          "name": "TrustedTokenIssuer",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeAccountAssignmentCreationStatus.html",
      "name": "DescribeAccountAssignmentCreationStatus",
      "description": "Grants permission to describe the status of the assignment creation request",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeAccountAssignmentDeletionStatus.html",
      "name": "DescribeAccountAssignmentDeletionStatus",
      "description": "Grants permission to describe the status of an assignment deletion request",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeApplication.html",
      "name": "DescribeApplication",
      "description": "Grants permission to obtain information about an application",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeApplicationAssignment.html",
      "name": "DescribeApplicationAssignment",
      "description": "Grants permission to retrieve an application assignment",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeApplicationProvider.html",
      "name": "DescribeApplicationProvider",
      "description": "Grants permission to describe an application provider",
      "access": "Read",
      "resources": [
        {
          "name": "ApplicationProvider",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeInstance.html",
      "name": "DescribeInstance",
      "description": "Grants permission to obtain information about an identity center instance",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeInstanceAccessControlAttributeConfiguration.html",
      "name": "DescribeInstanceAccessControlAttributeConfiguration",
      "description": "Grants permission to get the list of attributes used by the instance for ABAC",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribePermissionSet.html",
      "name": "DescribePermissionSet",
      "description": "Grants permission to describe a permission set",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribePermissionSetProvisioningStatus.html",
      "name": "DescribePermissionSetProvisioningStatus",
      "description": "Grants permission to describe the status for the given Permission Set Provisioning request",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeRegion.html",
      "name": "DescribeRegion",
      "description": "Grants permission to retrieve configuration details for a specific IAM Identity Center instance region",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "DescribeRegisteredRegions",
      "description": "Grants permission to obtain the regions where your organization has enabled AWS IAM Identity Center",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeTrustedTokenIssuer.html",
      "name": "DescribeTrustedTokenIssuer",
      "description": "Grants permission to describe a trusted token issuer for an instance",
      "access": "Read",
      "resources": [
        {
          "name": "TrustedTokenIssuer",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DetachCustomerManagedPolicyReferenceFromPermissionSet.html",
      "name": "DetachCustomerManagedPolicyReferenceFromPermissionSet",
      "description": "Grants permission to detach a customer managed policy reference from a permission set",
      "access": "Permissions management",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DetachManagedPolicyFromPermissionSet.html",
      "name": "DetachManagedPolicyFromPermissionSet",
      "description": "Grants permission to detach the attached AWS managed policy from the specified permission set",
      "access": "Permissions management",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "DisassociateDirectory",
      "description": "Grants permission to disassociate a directory to be used by AWS IAM Identity Center",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "DisassociateProfile",
      "description": "Grants permission to disassociate a directory user or group from a profile",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetApplicationAccessScope.html",
      "name": "GetApplicationAccessScope",
      "description": "Grants permission to get an access scope to an application",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetApplicationAssignmentConfiguration.html",
      "name": "GetApplicationAssignmentConfiguration",
      "description": "Grants permission to read assignment configurations for an application",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetApplicationAuthenticationMethod.html",
      "name": "GetApplicationAuthenticationMethod",
      "description": "Grants permission to get an authentication method to an application",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetApplicationGrant.html",
      "name": "GetApplicationGrant",
      "description": "Grants permission to obtain details about a grant belonging to an application",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetApplicationInstance",
      "description": "Grants permission to retrieve details for an application instance",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetApplicationSessionConfiguration.html",
      "name": "GetApplicationSessionConfiguration",
      "description": "Grants permission to get session configuration for an application",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetApplicationTemplate",
      "description": "Grants permission to retrieve application template details",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetInlinePolicyForPermissionSet.html",
      "name": "GetInlinePolicyForPermissionSet",
      "description": "Grants permission to obtain the inline policy assigned to the permission set",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetManagedApplicationInstance",
      "description": "Grants permission to retrieve details for an application instance",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetMfaDeviceManagementForDirectory",
      "description": "Grants permission to retrieve Mfa Device Management settings for the directory",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetPermissionSet",
      "description": "Grants permission to retrieve details of a permission set",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_GetPermissionsBoundaryForPermissionSet.html",
      "name": "GetPermissionsBoundaryForPermissionSet",
      "description": "Grants permission to get permissions boundary for a permission set",
      "access": "Read",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetProfile",
      "description": "Grants permission to retrieve a profile for an application instance",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetSSOStatus",
      "description": "Grants permission to check if AWS IAM Identity Center is enabled",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetSharedSsoConfiguration",
      "description": "Grants permission to retrieve shared configuration for the current SSO instance",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetSsoConfiguration",
      "description": "Grants permission to retrieve configuration for the current SSO instance",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "GetTrust",
      "description": "Grants permission to retrieve the federation trust in a target account",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "ImportApplicationInstanceServiceProviderMetadata",
      "description": "Grants permission to update the application instance by uploading an application SAML metadata file provided by the service provider",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignmentCreationStatus.html",
      "name": "ListAccountAssignmentCreationStatus",
      "description": "Grants permission to list the status of the AWS account assignment creation requests for a specified SSO instance",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignmentDeletionStatus.html",
      "name": "ListAccountAssignmentDeletionStatus",
      "description": "Grants permission to list the status of the AWS account assignment deletion requests for a specified SSO instance",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignments.html",
      "name": "ListAccountAssignments",
      "description": "Grants permission to list the assignee of the specified AWS account with the specified permission set",
      "access": "List",
      "resources": [
        {
          "name": "Account",
          "is_required": true
        },
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignmentsForPrincipal.html",
      "name": "ListAccountAssignmentsForPrincipal",
      "description": "Grants permission to list accounts assigned to user or group",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountsForProvisionedPermissionSet.html",
      "name": "ListAccountsForProvisionedPermissionSet",
      "description": "Grants permission to list all the AWS accounts where the specified permission set is provisioned",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListApplicationAccessScopes.html",
      "name": "ListApplicationAccessScopes",
      "description": "Grants permission to list access scopes to an application",
      "access": "List",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListApplicationAssignments.html",
      "name": "ListApplicationAssignments",
      "description": "Grants permission to list application assignments",
      "access": "List",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListApplicationAssignmentsForPrincipal.html",
      "name": "ListApplicationAssignmentsForPrincipal",
      "description": "Grants permission to list applications assigned to user or group",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListApplicationAuthenticationMethods.html",
      "name": "ListApplicationAuthenticationMethods",
      "description": "Grants permission to list authentication methods to an application",
      "access": "List",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListApplicationGrants.html",
      "name": "ListApplicationGrants",
      "description": "Grants permission to list grants from an application",
      "access": "List",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "ListApplicationInstanceCertificates",
      "description": "Grants permission to retrieve all of the certificates for a given application instance",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "ListApplicationInstances",
      "description": "Grants permission to retrieve all application instances",
      "access": "List",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListApplicationProviders.html",
      "name": "ListApplicationProviders",
      "description": "Grants permission to list application providers",
      "access": "List",
      "resources": [
        {
          "name": "ApplicationProvider",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "ListApplicationTemplates",
      "description": "Grants permission to retrieve all supported application templates",
      "access": "List",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListApplications.html",
      "name": "ListApplications",
      "description": "Grants permission to retrieve all applications associated with the instance of IAM Identity Center",
      "access": "List",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListCustomerManagedPolicyReferencesInPermissionSet.html",
      "name": "ListCustomerManagedPolicyReferencesInPermissionSet",
      "description": "Grants permission to list the customer managed policy references that are attached to a permission set",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "ListDirectoryAssociations",
      "description": "Grants permission to retrieve details about the directory connected to AWS IAM Identity Center",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListInstances.html",
      "name": "ListInstances",
      "description": "Grants permission to list the SSO Instances that the caller has access to",
      "access": "List",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListManagedPoliciesInPermissionSet.html",
      "name": "ListManagedPoliciesInPermissionSet",
      "description": "Grants permission to list the AWS managed policies that are attached to a specified permission set",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListPermissionSetProvisioningStatus.html",
      "name": "ListPermissionSetProvisioningStatus",
      "description": "Grants permission to list the status of the Permission Set Provisioning requests for a specified SSO instance",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListPermissionSets.html",
      "name": "ListPermissionSets",
      "description": "Grants permission to retrieve all permission sets",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListPermissionSetsProvisionedToAccount.html",
      "name": "ListPermissionSetsProvisionedToAccount",
      "description": "Grants permission to list all the permission sets that are provisioned to a specified AWS account",
      "access": "List",
      "resources": [
        {
          "name": "Account",
          "is_required": true
        },
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "ListProfileAssociations",
      "description": "Grants permission to retrieve the directory user or group associated with the profile",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "ListProfiles",
      "description": "Grants permission to retrieve all profiles for an application instance",
      "access": "List",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListRegions.html",
      "name": "ListRegions",
      "description": "Grants permission to list all regions configured for an IAM Identity Center instance",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListTagsForResource.html",
      "name": "ListTagsForResource",
      "description": "Grants permission to list the tags that are attached to a specified resource",
      "access": "Read",
      "resources": [
        {
          "name": "Application",
          "is_required": false
        },
        {
          "name": "Instance",
          "is_required": false
        },
        {
          "name": "PermissionSet",
          "is_required": false
        },
        {
          "name": "TrustedTokenIssuer",
          "is_required": false
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListTrustedTokenIssuers.html",
      "name": "ListTrustedTokenIssuers",
      "description": "Grants permission to list trusted token issuers for an instance",
      "access": "List",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html",
      "name": "ProvisionPermissionSet",
      "description": "Grants permission to provision a specified permission set to the specified target",
      "access": "Write",
      "resources": [
        {
          "name": "Account",
          "is_required": true
        },
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutApplicationAccessScope.html",
      "name": "PutApplicationAccessScope",
      "description": "Grants permission to create/update an access scope to an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutApplicationAssignmentConfiguration.html",
      "name": "PutApplicationAssignmentConfiguration",
      "description": "Grants permission to add assignment configurations to an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutApplicationAuthenticationMethod.html",
      "name": "PutApplicationAuthenticationMethod",
      "description": "Grants permission to create/update an authentication method to an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutApplicationGrant.html",
      "name": "PutApplicationGrant",
      "description": "Grants permission to create/update a grant to an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutApplicationSessionConfiguration.html",
      "name": "PutApplicationSessionConfiguration",
      "description": "Grants permission to put session configuration for an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutInlinePolicyToPermissionSet.html",
      "name": "PutInlinePolicyToPermissionSet",
      "description": "Grants permission to attach an IAM inline policy to a permission set",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "PutMfaDeviceManagementForDirectory",
      "description": "Grants permission to put Mfa Device Management settings for the directory",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_PutPermissionsBoundaryToPermissionSet.html",
      "name": "PutPermissionsBoundaryToPermissionSet",
      "description": "Grants permission to add permissions boundary to a permission set",
      "access": "Permissions management",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "PutPermissionsPolicy",
      "description": "Grants permission to add a policy to a permission set",
      "access": "Permissions management",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_RemoveRegion.html",
      "name": "RemoveRegion",
      "description": "Grants permission to remove a region from an IAM Identity Center instance",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "SearchGroups",
      "description": "Grants permission to search for groups within the associated directory",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "SearchUsers",
      "description": "Grants permission to search for users within the associated directory",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "StartSSO",
      "description": "Grants permission to initialize AWS IAM Identity Center",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_TagResource.html",
      "name": "TagResource",
      "description": "Grants permission to associate a set of tags with a specified resource",
      "access": "Tagging",
      "resources": [
        {
          "name": "Application",
          "is_required": false
        },
        {
          "name": "Instance",
          "is_required": false
        },
        {
          "name": "PermissionSet",
          "is_required": false
        },
        {
          "name": "TrustedTokenIssuer",
          "is_required": false
        }
      ],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UntagResource.html",
      "name": "UntagResource",
      "description": "Grants permission to disassociate a set of tags from a specified resource",
      "access": "Tagging",
      "resources": [
        {
          "name": "Application",
          "is_required": false
        },
        {
          "name": "Instance",
          "is_required": false
        },
        {
          "name": "PermissionSet",
          "is_required": false
        },
        {
          "name": "TrustedTokenIssuer",
          "is_required": false
        }
      ],
      "conditions": [
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UpdateApplication.html",
      "name": "UpdateApplication",
      "description": "Grants permission to update an application",
      "access": "Write",
      "resources": [
        {
          "name": "Application",
          "is_required": true
        }
      ],
      "conditions": [
        "sso:ApplicationAccount"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateApplicationInstanceActiveCertificate",
      "description": "Grants permission to set a certificate as the active one for this application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateApplicationInstanceDisplayData",
      "description": "Grants permission to update display data of an application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateApplicationInstanceResponseConfiguration",
      "description": "Grants permission to update federation response configuration for the application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateApplicationInstanceResponseSchemaConfiguration",
      "description": "Grants permission to update federation response schema configuration for the application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateApplicationInstanceSecurityConfiguration",
      "description": "Grants permission to update security details for the application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateApplicationInstanceServiceProviderConfiguration",
      "description": "Grants permission to update service provider related configuration for the application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateApplicationInstanceStatus",
      "description": "Grants permission to update the status of an application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UpdateInstance.html",
      "name": "UpdateInstance",
      "description": "Grants permission to update an identity center instance",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UpdateInstanceAccessControlAttributeConfiguration.html",
      "name": "UpdateInstanceAccessControlAttributeConfiguration",
      "description": "Grants permission to update the attributes to use with the instance for ABAC",
      "access": "Write",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateManagedApplicationInstanceStatus",
      "description": "Grants permission to update the status of a managed application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UpdatePermissionSet.html",
      "name": "UpdatePermissionSet",
      "description": "Grants permission to update the permission set",
      "access": "Permissions management",
      "resources": [
        {
          "name": "Instance",
          "is_required": true
        },
        {
          "name": "PermissionSet",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateProfile",
      "description": "Grants permission to update the profile for an application instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateSSOConfiguration",
      "description": "Grants permission to update the configuration for the current SSO instance",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/iam-auth-access-using-id-policies.html#policyexample",
      "name": "UpdateTrust",
      "description": "Grants permission to update the federation trust in a target account",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_UpdateTrustedTokenIssuer.html",
      "name": "UpdateTrustedTokenIssuer",
      "description": "Grants permission to update a trusted token issuer for an instance",
      "access": "Write",
      "resources": [
        {
          "name": "TrustedTokenIssuer",
          "is_required": true
        }
      ],
      "conditions": []
    }
  ],
  "resources": [
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-accounts.html",
      "name": "Account",
      "arn": "arn:${Partition}:sso:::account/${AccountId}",
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_Application.html",
      "name": "Application",
      "arn": "arn:${Partition}:sso::${AccountId}:application/${InstanceId}/${ApplicationId}",
      "conditions": [
        "aws:ResourceTag/${TagKey}",
        "sso:ApplicationAccount",
        "sso:PrimaryRegion"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ApplicationProvider.html",
      "name": "ApplicationProvider",
      "arn": "arn:${Partition}:sso::aws:applicationProvider/${ApplicationProviderId}",
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_InstanceMetadata.html",
      "name": "Instance",
      "arn": "arn:${Partition}:sso:::instance/${InstanceId}",
      "conditions": [
        "aws:ResourceTag/${TagKey}",
        "sso:PrimaryRegion"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html",
      "name": "PermissionSet",
      "arn": "arn:${Partition}:sso:::permissionSet/${InstanceId}/${PermissionSetId}",
      "conditions": [
        "aws:ResourceTag/${TagKey}",
        "sso:PrimaryRegion"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_TrustedTokenIssuerMetadata.html",
      "name": "TrustedTokenIssuer",
      "arn": "arn:${Partition}:sso::${AccountId}:trustedTokenIssuer/${InstanceId}/${TrustedTokenIssuerId}",
      "conditions": [
        "aws:ResourceTag/${TagKey}",
        "sso:PrimaryRegion"
      ]
    }
  ],
  "conditions": [
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/tagging.html",
      "name": "aws:RequestTag/${TagKey}",
      "description": "Filters access by the tags that are passed in the request",
      "type": "String"
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/tagging.html",
      "name": "aws:ResourceTag/${TagKey}",
      "description": "Filters access by the tags associated with the resource",
      "type": "String"
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/tagging.html",
      "name": "aws:TagKeys",
      "description": "Filters access by the tag keys that are passed in the request",
      "type": "ArrayOfString"
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/API_Application.html",
      "name": "identitycenter:ApplicationArn",
      "description": "Filters access by the ARN of the IAM Identity Center application",
      "type": "ARN"
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/API_InstanceMetadata.html",
      "name": "identitycenter:InstanceArn",
      "description": "Filters access by the ARN of the IAM Identity Center instance",
      "type": "ARN"
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/API_Application.html",
      "name": "sso:ApplicationAccount",
      "description": "Filters access by the account which creates the application. This condition key is not supported for customer managed SAML applications",
      "type": "String"
    },
    {
      "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/API_InstanceMetadata.html",
      "name": "sso:PrimaryRegion",
      "description": "Filters access by the primary region of the IAM Identity Center instance",
      "type": "String"
    }
  ]
}