AWS_SSO_IN_ACCOUNT

Summary

Forestall ACL Alias	AWS_SSO_IN_ACCOUNT
Edge Type	Structural
Affected Object Types	Permission Sets, AWS Accounts
Exploitation Certainty	N/A
AWS IAM Action / Condition	sso:ProvisionPermissionSet (account assignment)

Description

AWS_SSO_IN_ACCOUNT connects an IAM Identity Center permission set to an AWS account it has been provisioned to. It is a structural relationship, not an attack action.

When a permission set is assigned to a user or group for an account, Identity Center provisions it into that account as an AWSReservedSSO_<name>_<hash> IAM role. This edge records where that provisioning lands — the accounts where the permission set exists as a concrete, assumable role.

The edge matters because it is the link that turns an assignment into real reach. A permission set on its own grants nothing; provisioned into an account, it becomes a role that assigned users and groups can assume at sign-in. Following AWS_SSO_IN_ACCOUNT from a permission set shows every account the permission set can operate in, and pairs with AWS_SSO_MAPS_TO_ROLE to name the exact role in each one.

Identification

AWS CLI

List the accounts a permission set is provisioned to:

aws sso-admin list-accounts-for-provisioned-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

List the permission sets provisioned to a specific account:

aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>

AWS Console

1. Open IAM Identity Center → Permission sets → select the permission set.

2. Open the AWS accounts tab to see the accounts it is provisioned to.

Mitigation

• Review which accounts each permission set is provisioned to, and remove provisioning from accounts that no longer need it.

• Keep permission sets scoped to the accounts that require them rather than provisioning broadly across the organization.

• Prefer group assignments with least-privilege permission sets so account reach is easy to trace and revoke.

Detection

Monitor CloudTrail for provisioning and assignment activity:

• Event source: sso.amazonaws.com

• Event names: ProvisionPermissionSet, CreateAccountAssignment, DeleteAccountAssignment

High-value signals:

• A permission set provisioned to a new account outside a change window.

• Assignment of a broad or admin-carrying permission set to additional accounts.

References

• https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html

• https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html

• https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountsForProvisionedPermissionSet.html