View a markdown version of this page

Managing support permit requests - AWS Support
How reactive authorization worksViewing support permit requestsApproving a support permit requestRejecting a support permit requestPermit request state transitions

Managing support permit requests

In the reactive authorization scenario, AWS Support submits a support permit request when access to information about your services is needed for support case resolution. You review each request and decide whether to approve or reject it.

How reactive authorization works

The reactive authorization workflow follows these steps:

  1. AWS Support identifies an issue with your resource that requires your permission to resolve.

  2. AWS Support submits a support permit request, which is visible to you through AWS Support authorization. A SupportPermitRequestCreated event appears in your AWS CloudTrail logs.

  3. You receive notifications through Amazon EventBridge events.

  4. You review the request details, including the requested actions, resources, and support case context.

  5. You approve the request by calling CreateSupportPermit with a support permit that covers the requested scope, or reject it by calling RejectSupportPermitRequest.

Viewing support permit requests

View pending permit requests from AWS Support.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Pending access requests section, review the list of requests. Each request shows the associated support case, service, Support Permit Request ARN, status, and request access date.

  4. (Optional) Use the Status and Service dropdown filters to narrow the results, or search by resource in the search field.

AWS CLI

Use ListSupportPermitRequests to view permit requests. You can filter results by support case ID.

List all support permit requests

aws supportauthz list-support-permit-requests

List requests for a specific support case

aws supportauthz list-support-permit-requests \
    --support-case-display-id "case-12345678"

The response includes up to 100 results per page. Use the nextToken value in subsequent requests to retrieve additional pages.

Approving a support permit request

To approve a support permit request, create a support permit that satisfies the requested scope.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Pending access requests section, choose Manage support access.

  4. Review the Request summary, including the Support Permit Request ARN, service, status, and associated support case.

  5. Review the Access configuration, which shows the name, description, requested actions, and access duration for the request.

  6. In the Resource access section, choose Approve for each resource that you want to authorize. To approve all resources, choose Approve all.

  7. For Signing key, choose an AWS KMS key from the dropdown list. To create a new key, choose Create KMS signing key.

  8. Choose Submit.

AWS CLI

To approve a support permit request, create a support permit that satisfies the requested scope. Include the supportCaseDisplayId from the request so that the support permit automatically transitions to INACTIVE when the case closes.

aws supportauthz create-support-permit \
    --name "ApprovedRequest123" \
    --signing-key-info '{"kmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
    --support-case-display-id "case-12345678" \
    --permit '{
        "actions": {"actions": ["rds:ReadClusterData"]},
        "resources": {"resources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-cluster"]},
        "conditions": [
            {"allowBefore": "2026-06-15T00:00:00Z"}
        ]
    }'

When you create a support permit that covers the requested scope, the request status transitions to ACCEPTED.

Rejecting a support permit request

Reject a support permit request to decline an access request from AWS Support.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Pending access requests section, choose Manage support access.

  4. In the Resource access section, choose Deny for each resource that you want to reject. To deny all resources, choose Deny all.

  5. Choose Submit.

AWS CLI

Use RejectSupportPermitRequest to decline an access request. The request transitions to REJECTED status and AWS Support receives notification through the support case.

aws supportauthz reject-support-permit-request \
    --request-arn "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/request-id"

You can only reject requests that are in PENDING status.
Note

If you reject a support permit request or don't create a support permit that satisfies the request, AWS Support can't access the requested information and might not be able to proceed with the investigation or resolution of your support case.

Permit request state transitions

A support permit request can transition to the following states from PENDING:

  • ACCEPTED: You created a support permit that satisfies the request.

  • REJECTED: You rejected the request by calling RejectSupportPermitRequest.

  • CANCELLED: AWS Support cancelled the request.