Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Discovering support actions

Support actions are service-specific operations that AWS Support can perform on your resources. Each action has a descriptive name and description that explains what the operation does. Actions use a namespaced format that identifies the AWS service and the specific operation. Use the ListActions API to view the actions available for a service before you create a scoped support permit.

Listing actions for a service

Use ListActions to view the actions available for a specific service. The service parameter is required.

aws supportauthz list-actions \
    --service "rds"

Example output

{
    "actionSummaries": [
        {
            "action": "rds:ReadClusterData",
            "service": "rds",
            "description": "Read diagnostic data from the database cluster."
        },
        {
            "action": "rds:ViewQueryLogsWithParameters",
            "service": "rds",
            "description": "View query logs including query parameters."
        }
    ]
}

The response includes up to 100 results per page. Use the nextToken value in subsequent requests to retrieve additional pages.

Getting action details

Use GetAction to retrieve details about a specific action.

aws supportauthz get-action \
    --action "rds:ReadClusterData"

Example output

{
    "action": "rds:ReadClusterData",
    "service": "rds",
    "description": "Read diagnostic data from the database cluster."
}

Using actions in support permits

After you identify the available actions, use specific action names in your support permit to apply least-privilege scoping. Specify individual actions in the actions list rather than using allActions when you want to limit what AWS Support can do on your resources.

Create a support permit with specific actions

aws supportauthz create-support-permit \
    --name "ScopedPermit" \
    --signing-key-info '{"kmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"}' \
    --permit '{
        "actions": {"actions": ["rds:ReadClusterData"]},
        "resources": {"resources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-cluster"]},
        "conditions": [
            {"allowBefore": "2026-06-15T00:00:00Z"}
        ]
    }'