signin:CreateOAuth2Token is a Read access-level action in the signin service. Grants permission to exchange an authorization code, refresh token, SigV4 credentials, or JWT for OAuth 2 access token that can be used to access AWS services from developer tools and applications
ARNs that signin:CreateOAuth2Token can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants signin:CreateOAuth2Token.
Filters access by the client authentication method used in the OAuth token request
Filters access by the OAuth client ID used in the authorization or token request
Filters access by the OAuth grant type used in the token request
Filters access by the redirect URI specified in the OAuth authorization request
A minimal policy that allows signin:CreateOAuth2Token. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSigninCreateOAuth2Token",
"Effect": "Allow",
"Action": "signin:CreateOAuth2Token",
"Resource": "*"
}
]
}