Policy: AWSSSODirectoryReadOnly ARN: arn:aws:iam::aws:policy/AWSSSODirectoryReadOnly Allowed Actions Actions Services identitystore:Describe* identitystore identitystore:List* identitystore identitystore-auth:BatchGetSession identitystore-auth identitystore-auth:ListSessions identitystore-auth sso-directory:Describe* sso-directory sso-directory:Get* sso-directory sso-directory:List* sso-directory sso-directory:Search* sso-directory