Policy: AWSServiceRoleForUserSubscriptions ARN: arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForUserSubscriptions Allowed Actions Actions Services identitystore:DescribeGroup identitystore identitystore:DescribeUser identitystore identitystore:IsMemberInGroups identitystore identitystore:ListGroupMemberships identitystore organizations:DescribeOrganization organizations sso:DescribeApplication sso sso:DescribeInstance sso sso:ListInstances sso sso-directory:DescribeUser sso-directory