AWS_SSO_ASSUME_ROLE

Copy page

Summary


Forestall ACL Alias	AWS_SSO_ASSUME_ROLE
Affected Object Types	`AWSSSOUser\|AWSSSOGroup → AWSReservedSSO (AWSIAMRole)`
Exploitation Certainty	High

Description

An SSO User can assume a specific IAM role provisioned by IAM Identity Center. These roles follow the naming pattern AWSReservedSSO_{PermissionSetName}_{hash} and are created automatically in each assigned account.

AWS_SSO_ASSUME_ROLE is the single SSO → IAM uplift: the SSO principal converts its Identity Center session into temporary credentials for the provisioned IAM role. It is derived structurally (an account assignment plus a provisioned AWSReservedSSO_* role, see AWS_SSO_MAPS_TO_ROLE), not from any IAM policy. The Permission Set’s policies set the role’s value, not the edge’s existence.

Edge semantics: (AWSSSOUser|AWSSSOGroup) -[AWS_SSO_ASSUME_ROLE]-> (AWSReservedSSO_* IAM Role). A group assignment reaches the role through membership: AWSSSOUser -member-> AWSSSOGroup -ASSUME_ROLE-> role.

Abuse methods (same edge, transport only):

console_saml: portal “Management console” → SAML POST → sts:AssumeRoleWithSAML. The reserved role trusts the IdC-managed AWSSSO_*_DO_NOT_DELETE SAML provider. CloudTrail: AssumeRoleWithSAML @ sts.amazonaws.com.
cli_token: aws sso login → sso-oidc device flow → access token (~/.aws/sso/cache/*.json, ~8h) → aws sso get-role-credentials --role-name <PS> --account-id <acct> --access-token <token>. IdC assumes the role on the user’s behalf and returns SigV4 credentials. CloudTrail: GetRoleCredentials @ sso.amazonaws.com. (sso:GetRoleCredentials is a Portal API call authorized by the bearer token, not a grantable IAM policy action. That is why it cannot be a separate, policy-derived edge.)

An attacker who controls this SSO identity (e.g. by stealing the cached access token) gets every permission the target IAM role carries in that account. If the role has AdministratorAccess, that is full account compromise.

Identification

Find which IAM roles an SSO user can assume:

# List AWSReservedSSO roles in the target account
aws iam list-roles --query "Roles[?starts_with(RoleName, 'AWSReservedSSO_')].[RoleName,Arn]"

# Review the trust policy of a specific SSO-provisioned role
aws iam get-role --role-name "AWSReservedSSO_<PermissionSetName>_<hash>" \
  --query "Role.AssumeRolePolicyDocument"

# Check the role's attached policies
aws iam list-attached-role-policies \
  --role-name "AWSReservedSSO_<PermissionSetName>_<hash>"

Forestall ISPM emits this edge when an SSO user’s effective permission set matches a provisioned AWSReservedSSO_* IAM role in an assigned account.

Mitigation

Keep AWSReservedSSO_* role permissions minimal. Build least-privilege permission sets from the start.
Audit permission set policies regularly and remove any * action or resource grants.
Restrict which accounts each permission set is assigned to.
Apply SCPs to limit what AWSReservedSSO_* roles can do, even if the permission set is broad.

Detection

The two abuse methods are logged separately. Cover both:

console_saml: AssumeRoleWithSAML @ sts.amazonaws.com: roleArn starts with AWSReservedSSO_, plus sourceIPAddress, responseElements.assumedRoleUser.
cli_token: GetRoleCredentials @ sso.amazonaws.com: roleName (Permission Set), accountId, userIdentity (portal identity), sourceIPAddress.

Alert on calls from unexpected source IPs or outside normal hours, and on token-credential retrieval that fans out across many accounts. Use Security Hub and GuardDuty to catch anomalous activity from SSO-provisioned roles after they assume.

Ask AI