AWS Systems Manager Incident Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Incident Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see AWS Systems Manager Incident Manager availability change.
Resource-based policy examples for AWS Systems Manager Incident Manager
AWS Systems Manager Incident Manager supports resource-based permissions policies for Incident Manager response plans and contacts.
Incident Manager doesn't support resource-based policies that deny access to resources shared using AWS RAM.
To learn how to create a response plan or contact, see Creating and configuring response plans in Incident Manager and Creating and configuring contacts in Incident Manager.
Restricting Incident Manager response plan access by organization
The following example grants permissions to users in the organization with the
organization ID: o-abc123def45 to respond to incidents created using the
response plan myplan.
The Condition block uses the StringEquals conditions and the
aws:PrincipalOrgID condition key, which is an AWS Organizations specific condition
key. For more information about these condition keys, see Specifying conditions in a policy.
Providing Incident Manager contact access to a principal
The following example grants permission to the principal with the ARN
arn:aws:iam::999988887777:root to create engagements to the contact
mycontact.
