View a markdown version of this page

Getting started with AWS Support authorization - AWS Support
PrerequisitesStep 1: Create an AWS KMS signing keyStep 2: Set up IAM permissionsStep 3: Create your first support permitStep 4: Review support permit requests from AWS SupportNext steps

Getting started with AWS Support authorization

This tutorial walks you through setting up AWS Support authorization and creating your first support permit. You complete the following steps:

This tutorial takes approximately 10 minutes to complete.

  1. Create an AWS KMS signing key

  2. Set up IAM permissions

  3. Create your first support permit

  4. Review support permit requests from AWS Support

Prerequisites

Before you begin, verify that you have the following:

  • An active AWS account

  • Permissions to create AWS KMS keys in your account

  • Permissions to create IAM policies and attach them to users or roles

Step 1: Create an AWS KMS signing key

AWS Support authorization requires a AWS KMS key with key spec ECC_NIST_P384 and key usage SIGN_VERIFY. The key must be in the same Region as your support permit.

Note

If you already have a AWS KMS key with key spec ECC_NIST_P384 and key usage SIGN_VERIFY in the same Region, you can skip this step and use that key.

To create the key, run the following AWS CLI command:

aws kms create-key \
    --key-usage SIGN_VERIFY \
    --key-spec ECC_NIST_P384 \
    --description "SupportAuthZ signing key" \
    --tags TagKey=supportauthz:managed,TagValue=true \
    --region us-east-1

Note the key ARN from the output. You use this value when you create support permits.

Include the required AWS Support authorization policy statements in the create-key call. For the required statements, see Configuring AWS KMS keys for AWS Support authorization.

Example output
{
    "KeyMetadata": {
        "KeyId": "1234abcd-12ab-34cd-56ef-1234567890ab",
        "Arn": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
        "KeySpec": "ECC_NIST_P384",
        "KeyUsage": "SIGN_VERIFY"
    }
}

Step 2: Set up IAM permissions

Attach an IAM policy that grants permissions for AWS Support authorization API operations. The following example policy grants access to all AWS Support authorization actions.

The supportauthz:RegisterKey action lets you associate AWS KMS keys with support permits. This permission-only action must be present in your IAM policy for AWS Support authorization to function.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "supportauthz:CreateSupportPermit",
                "supportauthz:RegisterKey",
                "supportauthz:DeleteSupportPermit",
                "supportauthz:GetSupportPermit",
                "supportauthz:ListSupportPermits",
                "supportauthz:ListSupportPermitRequests",
                "supportauthz:RejectSupportPermitRequest",
                "supportauthz:GetAction",
                "supportauthz:ListActions"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "supportauthz.us-east-1.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant"
            ],
            "Resource": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "supportauthz.us-east-1.amazonaws.com",
                    "kms:RetiringServicePrincipal": "us-east-1.supportauthz.amazonaws.com",
                    "kms:GranteeServicePrincipal": "us-east-1.supportauthz.amazonaws.com"
                },
                "ForAllValues:StringEquals": {
                    "kms:GrantOperations": [
                        "DescribeKey",
                        "GetPublicKey",
                        "Sign"
                    ]
                }
            }
        }
    ]
}

To attach this policy to an IAM user or role, see Adding and removing IAM identity permissions in the AWS Identity and Access Management User Guide.

Step 3: Create your first support permit

Create a support permit that authorizes AWS Support to access information about your services for specific resources.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Granted access section, choose Preconfigure access.

  4. For Access type, choose one of the following:

    • All supported resources in this Region – Applies broad access to your entire account in the selected Region.

    • Choose resource ARN – Limits access to a specific resource that you identify by ARN.

  5. (Optional) For Details, enter a Name and Description for the support permit.

  6. For Access duration, choose one of the following:

    • No expiration – Access remains active until you revoke it.

    • Custom duration – Set a specific time window during which the support permit is valid.

  7. For Actions, choose the actions that AWS Support is permitted to perform:

    • Select the All actions check box to permit all available actions on the covered resources. This removes the 10-action limit.

    • To choose specific actions, clear the All actions check box. Select a service from the Services list, and then select up to 10 individual actions from the actions table.

  8. For Signing key, choose an AWS KMS key from the dropdown list. To create a new key, choose Create KMS signing key.

  9. Choose Submit.

AWS CLI

Run the following command to create a time-bounded support permit for a specific resource:

aws supportauthz create-support-permit \
    --name "MyFirstPermit" \
    --signing-key-info '{"kmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
    --permit '{
        "actions": {"allActions": {}},
        "resources": {"resources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"]},
        "conditions": [
            {"allowAfter": "2026-06-01T00:00:00Z"},
            {"allowBefore": "2026-07-01T00:00:00Z"}
        ]
    }'

This support permit authorizes AWS Support to perform all available actions on the specified Amazon Aurora cluster during June 2026.

Step 4: Review support permit requests from AWS Support

When AWS Support needs access to information about your services and no matching support permit exists, AWS Support submits a support permit request. You can view pending requests and approve or reject them.

Console

  1. Sign in to the AWS Support Center Console.

  2. In the navigation pane, choose Support authorization.

  3. In the Pending access requests section, review the list of requests. Each request shows the associated support case, service, Support Permit Request ARN, status, and request access date.

  4. (Optional) To filter requests, use the Status and Service dropdown filters, or search by resource in the search field.

  5. To approve or reject a request, choose Manage support access.

AWS CLI

To list pending requests, run the following command:

aws supportauthz list-support-permit-requests
Example output
{
    "supportPermitRequests": [
        {
            "arn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/req-1234abcd",
            "status": "PENDING",
            "supportCaseDisplayId": "case-12345678",
            "requestedActions": ["rds:ReadClusterData"],
            "requestedResources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"],
            "createdAt": "2026-06-01T12:00:00Z"
        }
    ]
}

To approve this request, create a support permit that covers the requested scope:

aws supportauthz create-support-permit \
    --name "ApproveCase12345678" \
    --signing-key-info '{"kmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
    --support-case-display-id "case-12345678" \
    --permit '{
        "actions": {"actions": ["rds:ReadClusterData"]},
        "resources": {"resources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"]},
        "conditions": [
            {"allowBefore": "2026-06-15T00:00:00Z"}
        ]
    }'

To reject a request, run the following command. This notifies AWS Support that you don't want to accept the request. Rejecting a request doesn't prevent you from creating a support permit for the same actions and resources later.

aws supportauthz reject-support-permit-request \
    --request-arn "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/request-id"

Review each request and decide whether to approve or reject it:

  • To approve: Create a support permit that covers the requested scope. Include the supportCaseDisplayId parameter to automatically deactivate the support permit when the case closes.

  • To reject: Call RejectSupportPermitRequest to notify AWS Support that you don't want to accept the request. Rejecting a request doesn't prevent you from creating a support permit for the same actions and resources later.

Next steps

After you complete this tutorial, see the following topics: