AWS_SSO_DETACH_MANAGED_POLICY

Copy page

Summary


Forestall ACL Alias	AWS_SSO_DETACH_MANAGED_POLICY
Affected Object Types	`AWSIAMUser\|AWSIAMRole\|AWSIAMGroup → AWSPermissionSet`
Exploitation Certainty	High
AWS IAM Action	`sso:DetachManagedPolicyFromPermissionSet` + `sso:ProvisionPermissionSet`

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all SSO Admin APIs regardless of their IAM permissions.

An attacker with sso:DetachManagedPolicyFromPermissionSet and sso:ProvisionPermissionSet can remove an AWS managed policy from a target Permission Set and re-provision it across all assigned accounts. When the detached policy is a DENY policy, removing it grants more privileges to every principal holding that Permission Set.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole|AWSIAMGroup) -[AWS_SSO_DETACH_MANAGED_POLICY]-> (Target:AWSPermissionSet)

Precondition: the target Permission Set must have at least one account assignment (poisonablePsGuids); without an assignment, provisioning has no effect.

Identification

# List all managed policies attached to a permission set
aws sso-admin list-managed-policies-in-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

# Check if the attacker has the required permissions
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:DetachManagedPolicyFromPermissionSet sso:ProvisionPermissionSet \
  --resource-arns "*"

# List account assignments for a permission set
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

Exploitation

# Step 1: Remove the DENY managed policy from the permission set
aws sso-admin detach-managed-policy-from-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --managed-policy-arn <deny-policy-arn>

# Step 2: Re-provision to push updated (less restrictive) policy to all accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS

Mitigation

Restrict sso:DetachManagedPolicyFromPermissionSet and sso:ProvisionPermissionSet to dedicated Identity Center administrator roles.
Use SCPs to block modification of Permission Sets assigned to privileged accounts.
Alert in CloudTrail whenever a policy is detached from a Permission Set.
Prefer Permission Boundaries over managed DENY policies for restricting Permission Set permissions.
Enable audit logging for all sso-admin API calls in AWS IAM Identity Center.

Detection

CloudTrail Event	Description	Key Fields
`DetachManagedPolicyFromPermissionSet`	An AWS managed policy was removed from a Permission Set	`requestParameters.permissionSetArn`, `requestParameters.managedPolicyArn`, `userIdentity.arn`
`ProvisionPermissionSet`	The Permission Set was re-provisioned to accounts	`requestParameters.permissionSetArn`, `requestParameters.targetType`, `userIdentity.arn`

Alert when DetachManagedPolicyFromPermissionSet is followed by ProvisionPermissionSet on the same Permission Set ARN, especially when the detached policy is an explicit DENY policy.

References