AWS_SSO_ADD_MEMBER

Summary

Forestall ACL Alias	AWS_SSO_ADD_MEMBER
Affected Object Types	AWSIAMUser|AWSIAMRole → AWSSSOGroup
Exploitation Certainty	High
AWS IAM Action	identitystore:CreateGroupMembership

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all IdentityStore APIs regardless of their IAM permissions.

An attacker with identitystore:CreateGroupMembership can add any SSO user they control to a privileged SSO group. If the target group has account assignments that grant high-privilege Permission Sets, the attacker's SSO user immediately inherits those assignments and can access the associated AWS accounts.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole) -[AWS_SSO_ADD_MEMBER]-> (Target:AWSSSOGroup)

Precondition: the target SSO group must have at least one account assignment; without assignments, membership in the group grants no AWS account access.

Identification

# Check if the attacker can create group memberships
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names identitystore:CreateGroupMembership \
  --resource-arns "*"

# List all SSO groups
aws identitystore list-groups \
  --identity-store-id <identity-store-id>

# List members of a specific group
aws identitystore list-group-memberships \
  --identity-store-id <identity-store-id> \
  --group-id <group-id>

# Check account assignments for the group
aws sso-admin list-account-assignments-for-principal \
  --instance-arn <instance-arn> \
  --principal-id <group-id> \
  --principal-type GROUP

PowerShell (AWS Tools):

Get-IDSGroupMembershipList -IdentityStoreId "<identity-store-id>" -GroupId "<group-id>"

Exploitation

# Add the attacker-controlled SSO user to the privileged group
aws identitystore create-group-membership \
  --identity-store-id <identity-store-id> \
  --group-id <target-group-id> \
  --member-id '{"UserId":"<attacker-sso-user-id>"}'

Mitigation

• Restrict identitystore:CreateGroupMembership to dedicated Identity Center administrator roles; deny for all application and service principals.

• Apply SCPs to deny identitystore:CreateGroupMembership from all but a small set of trusted management roles.

• Regularly audit group memberships for high-privilege groups and alert on unexpected additions.

• Use just-in-time access workflows (approval required) for membership changes in groups assigned to privileged accounts.

• Integrate with an external identity provider (e.g., Azure AD, Okta) for authoritative group membership so that the Identity Store API cannot be used to bypass IdP controls.

Detection

CloudTrail Event	Description	Key Fields
CreateGroupMembership	A user was added to an SSO group	requestParameters.groupId, requestParameters.memberId.userId, userIdentity.arn

Alert when a new membership is created in any SSO group with account assignments. Prioritize events where the added user was recently created or the change falls outside normal windows.

References

• AWS Identity Store API: CreateGroupMembership

• AWS IAM Identity Center: Group Management

• HackTricks: AWS IAM Identity Center Privilege Escalation

• Rhino Security Labs: AWS Privilege Escalation Methods