AWS_SSO_IN_ACCOUNT

Copy page

Summary


Forestall ACL Alias	AWS_SSO_IN_ACCOUNT
Edge Type	Structural
Affected Object Types	Permission Sets, AWS Accounts
Exploitation Certainty	N/A
AWS IAM Action / Condition	`sso:ProvisionPermissionSet` (account assignment)

Description

AWS_SSO_IN_ACCOUNT connects an IAM Identity Center permission set to an AWS account it has been provisioned to. It is a structural relationship, not an attack action.

When a permission set is assigned to a user or group for an account, Identity Center provisions it into that account as an AWSReservedSSO_<name>_<hash> IAM role. This edge records where that provisioning lands — the accounts where the permission set exists as a concrete, assumable role.

The edge matters because it is the link that turns an assignment into real reach. A permission set on its own grants nothing; provisioned into an account, it becomes a role that assigned users and groups can assume at sign-in. Following AWS_SSO_IN_ACCOUNT from a permission set shows every account the permission set can operate in, and pairs with AWS_SSO_MAPS_TO_ROLE to name the exact role in each one.

Identification

AWS CLI

List the accounts a permission set is provisioned to:

aws sso-admin list-accounts-for-provisioned-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

List the permission sets provisioned to a specific account:

aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>

Mitigation

Review which accounts each permission set is provisioned to, and remove provisioning from accounts that no longer need it.
Keep permission sets scoped to the accounts that require them rather than provisioning broadly across the organization.
Prefer group assignments with least-privilege permission sets so account reach is easy to trace and revoke.

Detection

Monitor CloudTrail for provisioning and assignment activity:

Event source: sso.amazonaws.com
Event names: ProvisionPermissionSet, CreateAccountAssignment, DeleteAccountAssignment

High-value signals:

A permission set provisioned to a new account outside a change window.
Assignment of a broad or admin-carrying permission set to additional accounts.

Ask AI