AWS_SSO_MAPS_TO_ROLE

Summary

Forestall ACL Alias	AWS_SSO_MAPS_TO_ROLE
Affected Object Types	Permission Set → IAM Role
Exploitation Certainty	High

Description

When IAM Identity Center provisions a permission set into an account, it creates an IAM role named AWSReservedSSO_{PermissionSetName}_{hash} automatically. This happens for every account the permission set is assigned to.

AWS_SSO_MAPS_TO_ROLE connects the abstract permission set definition to the IAM role it becomes in a specific account. Without this edge, the full path is invisible: SSO User → Permission Set → IAM Role → AWS Account Access.

Edge semantics: (AWSPermissionSet) -[AWS_SSO_MAPS_TO_ROLE]-> (AWSIAMRole)

Identification

Find which IAM roles a permission set produces:

# List all provisioned permission sets in an account
aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>

# Find the role provisioned for a specific permission set
aws iam list-roles \
  --query "Roles[?starts_with(RoleName, 'AWSReservedSSO_<PermissionSetName>_')].[RoleName,Arn]"

Forestall ISPM creates this edge by matching permission set names against discovered AWSReservedSSO_* IAM roles via prefix matching.

Mitigation

• Name permission sets after what they actually allow (e.g., ReadOnly, NetworkAdmin) so assignments are obviously intentional.

• Review which permission sets are provisioned in each account regularly. Remove unused ones with aws sso-admin deprovision-permission-set.

• Apply SCPs to cap what any AWSReservedSSO_* role can do across the whole organization.

Detection

• Audit IAM roles in each account for names starting with AWSReservedSSO_ and reconcile against approved permission set assignments.

• Monitor CloudTrail for ProvisionPermissionSet and DeprovisionPermissionSet events from sso-admin.

• Alert on any CreateRole event in CloudTrail where the role name starts with AWSReservedSSO_.

References

• AWS IAM Identity Center: Provision permission sets

• AWS: Permission set role provisioning

• MITRE ATT&CK T1078.004 - Valid Accounts: Cloud Accounts