sso-oauth:RevokeTokenWithIAM

Write

sso-oauth:RevokeTokenWithIAM is a Write access-level action in the sso-oauth service. Grants permission to revoke OAuth 2.0 access tokens and refresh tokens, invalidating them before their normal expiration. This permission is used only by AWS managed applications and is not documented in the IAM Identity Center OIDC API Reference

Resource types

ARNs that sso-oauth:RevokeTokenWithIAM can be scoped to in an IAM policy.

arn:${Partition}:sso::${AccountId}:application/${InstanceId}/${ApplicationId} required
Application

Condition keys

No condition keys are documented for this action.

Example IAM policy

A minimal policy that allows sso-oauth:RevokeTokenWithIAM. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSsooauthRevokeTokenWithIAM",
      "Effect": "Allow",
      "Action": "sso-oauth:RevokeTokenWithIAM",
      "Resource": "*"
    }
  ]
}

Related actions in sso-oauth

sso-oauth:CreateTokenWithIAM Write sso-oauth:IntrospectTokenWithIAM Write

View all sso-oauth actions →