AWS_SSO_ASSIGN_PERMISSION_SET

Copy page

Summary


Forestall ACL Alias	AWS_SSO_ASSIGN_PERMISSION_SET
Affected Object Types	`AWSIAMUser\|AWSIAMRole → AWSAccount`
Exploitation Certainty	High
AWS IAM Action	`sso:CreateAccountAssignment`

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all SSO Admin APIs regardless of their IAM permissions.

An attacker with sso:CreateAccountAssignment can assign an already-privileged Permission Set to a principal they control (an SSO user or group they own). The permission set is the means; the account it provisions into is the prize. Once the assignment lands, the controlled principal signs in through the SSO portal and reaches that account with the provisioned AWSReservedSSO_* role. The edge therefore points to the account the attacker can take over.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole) -[AWS_SSO_ASSIGN_PERMISSION_SET]-> (Target:AWSAccount)

Resource-faithful gate: sso:CreateAccountAssignment is authorized against three resource types at once — the IdC instance, the permission set, and the account. The edge is emitted only when the attacker’s policy covers all three (a wildcard covers all of them). A policy that names only some resources fails the real call with an implicit deny on the missing one, so no edge is drawn.

Precondition: the assigned Permission Set must grant real privileges (managed or inline policy); assigning an empty Permission Set has no practical impact.

Identification

# Check if the attacker can create account assignments.
# Pass all three resource types — the action is authorized only when all are allowed.
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:CreateAccountAssignment \
  --resource-arns <instance-arn> <permission-set-arn> arn:aws:sso:::account/<account-id>

# List existing account assignments to understand scope
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

# List policies attached to the permission set
aws sso-admin list-managed-policies-in-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

PowerShell (AWS Tools):

Get-SSOAdminAccountAssignmentList -InstanceArn "<instance-arn>" -AccountId "<account-id>" -PermissionSetArn "<permission-set-arn>"

Exploitation

# Assign the privileged Permission Set to the attacker-controlled SSO user
aws sso-admin create-account-assignment \
  --instance-arn <instance-arn> \
  --target-id <account-id> \
  --target-type AWS_ACCOUNT \
  --permission-set-arn <permission-set-arn> \
  --principal-type USER \
  --principal-id <attacker-sso-user-id>

Mitigation

Restrict sso:CreateAccountAssignment to dedicated Identity Center administrator roles.
Use SCPs to limit which accounts and which Permission Sets can receive new assignments.
Regularly audit account assignments and alert on new assignments to privileged Permission Sets.
Apply just-in-time access controls so assignments require approval workflows.
Use permission boundaries on Permission Sets to limit blast radius even if an unauthorized assignment is created.

Detection

CloudTrail Event	Description	Key Fields
`CreateAccountAssignment`	A Permission Set was assigned to a principal in an account	`requestParameters.permissionSetArn`, `requestParameters.principalId`, `requestParameters.principalType`, `requestParameters.targetId`, `userIdentity.arn`

Alert on any CreateAccountAssignment event for Permission Sets with high-privilege policies. Pay extra attention when the assignee principal was recently created or is otherwise unexpected.

Ask AI