Policy: AWSSSOReadOnly ARN: arn:aws:iam::aws:policy/AWSSSOReadOnly Allowed Actions Actions Services access-analyzer:ValidatePolicy access-analyzer ds:DescribeDirectories ds ds:DescribeTrusts ds iam:ListPolicies iam organizations:DescribeAccount organizations organizations:DescribeOrganization organizations organizations:ListAccounts organizations organizations:ListAccountsForParent organizations organizations:ListChildren organizations organizations:ListDelegatedAdministrators organizations organizations:ListOrganizationalUnitsForParent organizations organizations:ListParents organizations organizations:ListRoots organizations signin:ListTrustedIdentityPropagationApplicationsForConsole signin sso:Describe* sso sso:Get* sso sso:List* sso sso:Search* sso sso-directory:DescribeDirectory sso-directory