AWS_SSO_IN_GROUP

Copy page

Summary


Forestall ACL Alias	AWS_SSO_IN_GROUP
Affected Object Types	`SSO User → SSO Group`
Exploitation Certainty	High

Description

An SSO User belongs to an IAM Identity Center Group. This is how SSO users get access to AWS accounts: groups are assigned to account and permission set combinations, and every member picks up that access automatically.

The AWS_SSO_IN_GROUP edge records direct group membership in Identity Center. This holds whether the identity store is AWS-native or backed by an external IdP like Entra ID or Okta.

Edge semantics: (AWSSSOUser) -[AWS_SSO_IN_GROUP]-> (AWSSSOGroup)

An attacker who can add a controlled identity to a privileged SSO group inherits all account assignments that group holds. No direct IAM changes needed.

Identification

Query group memberships in IAM Identity Center:

# List groups a user belongs to
aws identitystore list-group-memberships-for-member \
  --identity-store-id <identity-store-id> \
  --member-id "UserId=<user-id>"

# List all members of a specific group
aws identitystore list-group-memberships \
  --identity-store-id <identity-store-id> \
  --group-id <group-id>

Forestall ISPM emits this edge during Identity Center enumeration by resolving group memberships from the identity store API.

Mitigation

Review group memberships at least quarterly, using access reviews or CIEM tooling.
Create separate groups per permission set and account. Avoid broad groups that span multiple access levels.
Wire your IdP’s group lifecycle management so users are removed automatically when they change roles.
Use Just-In-Time (JIT) provisioning for privileged groups instead of persistent membership.

Detection

Watch CloudTrail identity store events for CreateGroupMembership and DeleteGroupMembership.
Alert on additions to groups assigned privileged permission sets like AdministratorAccess.
Use AWS Security Hub to correlate membership changes with subsequent role assumptions.

Ask AI