View a markdown version of this page

Managing support permits - AWS Support
Creating a support permitScoping a support permitViewing a support permitListing support permitsRevoking a support permitBest practices

Managing support permits

Support permits define the scope and conditions under which AWS Support can access information about your services. This topic describes how to create, view, list, and delete support permits.

Creating a support permit

Create a support permit to define the scope and conditions under which AWS Support can access information about your services.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Granted access section, choose Preconfigure access.

  4. For Access type, choose one of the following:

    • All supported resources in this Region – Applies broad access to your entire account in the selected Region.

    • Choose resource ARN – Limits access to a specific resource that you identify by ARN.

  5. (Optional) For Details, enter a Name and Description for the support permit.

  6. For Access duration, choose one of the following:

    • No expiration – Access remains active until you revoke it.

    • Custom duration – Set a specific time window during which the support permit is valid.

  7. For Actions, choose the actions that AWS Support is permitted to perform:

    • Select the All actions check box to permit all available actions on the covered resources. This removes the 10-action limit.

    • To choose specific actions, clear the All actions check box. Select a service from the Services list, and then select up to 10 individual actions from the actions table.

  8. For Signing key, choose an AWS KMS key from the dropdown list. To create a new key, choose Create KMS signing key.

  9. Choose Submit.

AWS CLI

Use CreateSupportPermit to create a new support permit. The following parameters are available:

Required parameters: name, a unique name for the support permit (1–256 alphanumeric characters).

Optional parameters: description, a human-readable description (maximum 1,024 characters).

Create a support permit with specific actions and resources

aws supportauthz create-support-permit \
    --name "AuroraDBPermit" \
    --description "Access to Aurora cluster diagnostic data" \
    --signing-key-info '{"kmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
    --support-case-display-id "case-12345678" \
    --permit '{
        "actions": {"actions": ["rds:ReadClusterData", "rds:ViewQueryLogsWithParameters"]},
        "resources": {"resources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-cluster"]},
        "conditions": [
            {"allowAfter": "2026-06-01T00:00:00Z"},
            {"allowBefore": "2026-06-15T00:00:00Z"}
        ]
    }'

Scoping a support permit

You control the scope of a support permit by specifying actions, resources, and conditions.

Actions

You can permit actions in two ways:

  • allActions: Permits all support actions for the specified resources.

  • actions: A list of up to 10 specific action names. Use ListActions to view available actions.

Resources

You can specify resources in two ways:

  • allResourcesInRegion: Permits access to service information for all resources in the Region.

  • resources: A list of up to 10 specific resource ARNs for which AWS Support can access service information.

Conditions

You can define up to 2 time-based conditions:

  • allowAfter: The support permit is not valid before this time (ISO 8601 format).

  • allowBefore: The support permit is not valid after this time (ISO 8601 format).

Use both conditions together to create a time window during which the support permit is valid.

Viewing a support permit

Retrieve the configuration and status of a support permit.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Granted access section, locate the support permit. The table displays the support case, service, Support Permit ARN, name, status, creation date, and duration for each support permit.

AWS CLI

Use GetSupportPermit to retrieve the configuration and status of a support permit. You can identify the support permit by name or ARN.

aws supportauthz get-support-permit \
    --support-permit-identifier "AuroraDBPermit"

Listing support permits

View all support permits in your account and Region.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Granted access section, view the list of support permits. Use the Status and Service dropdown filters to narrow the results, or search by resource in the search field.

AWS CLI

Use ListSupportPermits to list support permits in your account and Region. You can filter results by status.

aws supportauthz list-support-permits \
    --support-permit-statuses '["ACTIVE"]'

The response includes up to 100 results per page. Use the nextToken value in subsequent requests to retrieve additional pages.

Revoking a support permit

Revoke a support permit to terminate active access for the selected resources. This action can't be undone. New authorizations stop being issued for the revoked support permit.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Granted access section, select the support permit that you want to revoke.

  4. Choose Revoke access.

Important

Revoking access terminates active access for the selected resources. This action can't be undone.

AWS CLI

Use DeleteSupportPermit to delete a support permit.

aws supportauthz delete-support-permit \
    --arn "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/AuroraDBPermit"

To prevent new signing operations, you can revoke the grant on the associated AWS KMS key. For more information, see Revoking AWS Support authorization access. Alternatively, you can disable or schedule deletion of the key, but both AWS KMS and AWS Support authorization are eventually consistent. After you disable a key, it can take up to several minutes for the change to take effect. During this period, signed authorizations might continue to be issued by using the key.

Best practices

Follow these recommendations when you create support permits:

  • Use time-based conditions: Set allowAfter and allowBefore conditions to limit support permit validity to specific time windows.

  • Apply least-privilege scoping: Specify only the actions and resources that AWS Support needs for the investigation. Avoid using allActions and allResourcesInRegion together unless necessary.

  • Link support permits to support cases: Use the supportCaseDisplayId parameter to automatically deactivate the support permit when the support case closes.

  • Audit regularly: Use ListSupportPermits to review active support permits and delete support permits that are no longer needed.