AWS_SSO_IN_GROUP

Summary

Forestall ACL Alias	AWS_SSO_IN_GROUP
Affected Object Types	SSO User → SSO Group
Exploitation Certainty	High

Description

An SSO User belongs to an IAM Identity Center Group. This is how SSO users get access to AWS accounts: groups are assigned to account and permission set combinations, and every member picks up that access automatically.

The AWS_SSO_IN_GROUP edge records direct group membership in Identity Center. This holds whether the identity store is AWS-native or backed by an external IdP like Entra ID or Okta.

Edge semantics: (AWSSSOUser) -[AWS_SSO_IN_GROUP]-> (AWSSSOGroup)

An attacker who can add a controlled identity to a privileged SSO group inherits all account assignments that group holds. No direct IAM changes needed.

Identification

Query group memberships in IAM Identity Center:

# List groups a user belongs to
aws identitystore list-group-memberships-for-member \
  --identity-store-id <identity-store-id> \
  --member-id "UserId=<user-id>"

# List all members of a specific group
aws identitystore list-group-memberships \
  --identity-store-id <identity-store-id> \
  --group-id <group-id>

Forestall ISPM emits this edge during Identity Center enumeration by resolving group memberships from the identity store API.

Mitigation

• Review group memberships at least quarterly, using access reviews or CIEM tooling.

• Create separate groups per permission set and account. Avoid broad groups that span multiple access levels.

• Wire your IdP's group lifecycle management so users are removed automatically when they change roles.

• Use Just-In-Time (JIT) provisioning for privileged groups instead of persistent membership.

Detection

• Watch CloudTrail identity store events for CreateGroupMembership and DeleteGroupMembership.

• Alert on additions to groups assigned privileged permission sets like AdministratorAccess.

• Use AWS Security Hub to correlate membership changes with subsequent role assumptions.

References

• AWS Identity Center: Manage group memberships

• AWS Identity Store API: ListGroupMemberships

• MITRE ATT&CK T1078.004 - Valid Accounts: Cloud Accounts

• MITRE ATT&CK T1136.003 - Create Account: Cloud Account