AWS_SSO_HAS_PERMISSION_SET

Summary

Forestall ACL Alias	AWS_SSO_HAS_PERMISSION_SET
Affected Object Types	SSO Group → Permission Set
Exploitation Certainty	High

Description

When an IAM Identity Center group is assigned a Permission Set in one or more AWS accounts, this edge captures that relationship. It shows which Permission Set governs what group members can do in the assigned accounts.

The chain runs: SSO User → SSO Group → Permission Set → IAM Role → Account Access.

Edge semantics: (AWSSSOGroup) -[AWS_SSO_HAS_PERMISSION_SET]-> (AWSPermissionSet)

Edge property AccountId: Each assignment is the AWS triple principal × permission set × account, so the edge carries the AccountId it was granted in and there is one edge per assigned account. This lets account access be reported faithfully: a permission set provisioned to many accounts no longer implies the principal has it in every account.

An attacker who adds themselves to a group with a high-privilege permission set gets full access to the assigned accounts. No IAM policies get touched directly.

Identification

Check which permission sets a group has been assigned:

# List all account assignments for a specific group
aws sso-admin list-account-assignments-for-principal \
  --instance-arn <instance-arn> \
  --principal-type GROUP \
  --principal-id <group-id>

# List permission sets provisioned to a specific account
aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>

Forestall ISPM emits this edge during Identity Center graph construction by resolving group-level account assignments.

Mitigation

• Assign the least-privileged permission set to each group.

• Do not assign AdministratorAccess permission sets to groups with many members; use dedicated break-glass groups with strict membership controls.

• Review all group-to-permission-set-to-account assignments at least quarterly.

• Use AWS Organizations SCPs to constrain what any SSO-assigned permission set can do at the organizational level.

Detection

• Monitor CloudTrail for CreateAccountAssignment and DeleteAccountAssignment events with PrincipalType=GROUP.

• Alert on assignments of privileged permission sets (e.g., those containing Administrator or PowerUser) to groups.

• Track group membership changes for groups with high-privilege permission sets to detect lateral movement.

References

• AWS IAM Identity Center: Create account assignments

• AWS: Least privilege for permission sets

• MITRE ATT&CK T1078.004 - Valid Accounts: Cloud Accounts