AWS_SSO_MAPS_TO_ROLE

Copy page

Summary


Forestall ACL Alias	AWS_SSO_MAPS_TO_ROLE
Affected Object Types	`Permission Set → IAM Role`
Exploitation Certainty	High

Description

When IAM Identity Center provisions a permission set into an account, it creates an IAM role named AWSReservedSSO_{PermissionSetName}_{hash} automatically. This happens for every account the permission set is assigned to.

AWS_SSO_MAPS_TO_ROLE connects the abstract permission set definition to the IAM role it becomes in a specific account. Without this edge, the full path is invisible: SSO User → Permission Set → IAM Role → AWS Account Access.

Edge semantics: (AWSPermissionSet) -[AWS_SSO_MAPS_TO_ROLE]-> (AWSIAMRole)

Identification

Find which IAM roles a permission set produces:

# List all provisioned permission sets in an account
aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>

# Find the role provisioned for a specific permission set
aws iam list-roles \
  --query "Roles[?starts_with(RoleName, 'AWSReservedSSO_<PermissionSetName>_')].[RoleName,Arn]"

Forestall ISPM creates this edge by matching permission set names against discovered AWSReservedSSO_* IAM roles via prefix matching.

Mitigation

Name permission sets after what they actually allow (e.g., ReadOnly, NetworkAdmin) so assignments are obviously intentional.
Review which permission sets are provisioned in each account regularly. Remove unused ones with aws sso-admin deprovision-permission-set.
Apply SCPs to cap what any AWSReservedSSO_* role can do across the whole organization.

Detection

Audit IAM roles in each account for names starting with AWSReservedSSO_ and reconcile against approved permission set assignments.
Monitor CloudTrail for ProvisionPermissionSet and DeprovisionPermissionSet events from sso-admin.
Alert on any CreateRole event in CloudTrail where the role name starts with AWSReservedSSO_.

Ask AI