SSO Admin

Introduction

SSO Admin is a service provided by Amazon Web Services (AWS) that enables you to manage your AWS Single Sign-On (AWS SSO) resources. It allows you to create, update, and delete AWS SSO resources such as directories, groups, and users.

LocalStack provides a mock implementation of the SSO Admin API that allows you to create and manage your AWS SSO resources. The supported APIs are available on our API Coverage section, which provides information on the extent of SSO Admin’s integration with LocalStack.

Getting started

This guide is designed for users new to SSO Admin and assumes basic knowledge of the AWS CLI and our lstk aws command.

Start your LocalStack container using your preferred method. We will demonstrate how to create a permission set, add tags to a permission set, and list permission sets.

Create a permission set

You can create a permission set using the CreatePermissionSet API.

lstk aws sso-admin create-permission-set \
    --name my-permission-set \
    --description "My permission set" \
    --instance-arn arn:aws:sso:::instance/d-1234567890 \
    --tags Key=Name,Value=my-permission-set

{
    "PermissionSet": {
        "CreatedDate": "2025-07-02T12:15:33.352631+05:30",
        "Description": "My permission set",
        "Name": "my-permission-set",
        "PermissionSetArn": "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8",
        "SessionDuration": 3600
    }
}

List permission sets

You can list permission sets using the ListPermissionSets API.

lstk aws sso-admin list-permission-sets --instance-arn arn:aws:sso:::instance/d-1234567890

{
    "PermissionSets": [
        "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8"
    ]
}

You can list tags for a permission set using the ListTagsForResource API.

lstk aws sso-admin list-tags-for-resource --resource-arn arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8 --instance-arn arn:aws:sso:::instance/d-1234567890

{
    "Tags": [
        {
            "Key": "Name",
            "Value": "my-permission-set"
        }
    ]
}

API Coverage

26 of 79 operations implemented

Available from the Ultimate plan. Licensing details

Find an API

Search the full operation list, then sort the table to compare current support.

Loading operations…

Search by operation name

		Verified on Kubernetes
Loading operations…

Complete static API list All 79 operations and their current support status

Operation	Status
AddRegion	Not implemented
AttachCustomerManagedPolicyReferenceToPermissionSet	Implemented
AttachManagedPolicyToPermissionSet	Implemented
CreateAccountAssignment	Implemented
CreateApplication	Not implemented
CreateApplicationAssignment	Not implemented
CreateInstance	Not implemented
CreateInstanceAccessControlAttributeConfiguration	Not implemented
CreatePermissionSet	Implemented
CreateTrustedTokenIssuer	Not implemented
DeleteAccountAssignment	Implemented
DeleteApplication	Not implemented
DeleteApplicationAccessScope	Not implemented
DeleteApplicationAssignment	Not implemented
DeleteApplicationAuthenticationMethod	Not implemented
DeleteApplicationGrant	Not implemented
DeleteInlinePolicyFromPermissionSet	Implemented
DeleteInstance	Not implemented
DeleteInstanceAccessControlAttributeConfiguration	Not implemented
DeletePermissionSet	Implemented
DeletePermissionsBoundaryFromPermissionSet	Not implemented
DeleteTrustedTokenIssuer	Not implemented
DescribeAccountAssignmentCreationStatus	Implemented
DescribeAccountAssignmentDeletionStatus	Implemented
DescribeApplication	Not implemented
DescribeApplicationAssignment	Not implemented
DescribeApplicationProvider	Not implemented
DescribeInstance	Not implemented
DescribeInstanceAccessControlAttributeConfiguration	Not implemented
DescribePermissionSet	Implemented
DescribePermissionSetProvisioningStatus	Not implemented
DescribeRegion	Not implemented
DescribeTrustedTokenIssuer	Not implemented
DetachCustomerManagedPolicyReferenceFromPermissionSet	Implemented
DetachManagedPolicyFromPermissionSet	Implemented
GetApplicationAccessScope	Not implemented
GetApplicationAssignmentConfiguration	Not implemented
GetApplicationAuthenticationMethod	Not implemented
GetApplicationGrant	Not implemented
GetApplicationSessionConfiguration	Not implemented
GetInlinePolicyForPermissionSet	Implemented
GetPermissionsBoundaryForPermissionSet	Not implemented
ListAccountAssignmentCreationStatus	Not implemented
ListAccountAssignmentDeletionStatus	Not implemented
ListAccountAssignments	Implemented
ListAccountAssignmentsForPrincipal	Implemented
ListAccountsForProvisionedPermissionSet	Implemented
ListApplicationAccessScopes	Not implemented
ListApplicationAssignments	Not implemented
ListApplicationAssignmentsForPrincipal	Not implemented
ListApplicationAuthenticationMethods	Not implemented
ListApplicationGrants	Not implemented
ListApplicationProviders	Not implemented
ListApplications	Not implemented
ListCustomerManagedPolicyReferencesInPermissionSet	Implemented
ListInstances	Implemented
ListManagedPoliciesInPermissionSet	Implemented
ListPermissionSetProvisioningStatus	Not implemented
ListPermissionSets	Implemented
ListPermissionSetsProvisionedToAccount	Implemented
ListRegions	Not implemented
ListTagsForResource	Implemented
ListTrustedTokenIssuers	Not implemented
ProvisionPermissionSet	Implemented
PutApplicationAccessScope	Not implemented
PutApplicationAssignmentConfiguration	Not implemented
PutApplicationAuthenticationMethod	Not implemented
PutApplicationGrant	Not implemented
PutApplicationSessionConfiguration	Not implemented
PutInlinePolicyToPermissionSet	Implemented
PutPermissionsBoundaryToPermissionSet	Not implemented
RemoveRegion	Not implemented
TagResource	Not implemented
UntagResource	Not implemented
UpdateApplication	Not implemented
UpdateInstance	Implemented
UpdateInstanceAccessControlAttributeConfiguration	Not implemented
UpdatePermissionSet	Implemented
UpdateTrustedTokenIssuer	Not implemented

Was this page helpful?