AWS_SSO_UPDATE_PERMISSION_SET

Copy page

Summary


Forestall ACL Alias	AWS_SSO_UPDATE_PERMISSION_SET
Affected Object Types	`AWSIAMUser\|AWSIAMRole → AWSPermissionSet`
Exploitation Certainty	High
AWS IAM Action	`sso:PutInlinePolicyToPermissionSet` \| `sso:AttachManagedPolicyToPermissionSet` \| `sso:AttachCustomerManagedPolicyReferenceToPermissionSet` + `sso:ProvisionPermissionSet`

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all SSO Admin APIs regardless of their IAM permissions.

An attacker who can modify a Permission Set’s policy and re-provision it can escalate privileges for every principal that holds that Permission Set. They expand the policy, then call sso:ProvisionPermissionSet to push the change to all assigned accounts at once.

This is a consolidated privesc edge. Any one of the three policy-attachment actions is enough when paired with sso:ProvisionPermissionSet on the same Permission Set ARN. Those actions are sso:PutInlinePolicyToPermissionSet, sso:AttachManagedPolicyToPermissionSet, and sso:AttachCustomerManagedPolicyReferenceToPermissionSet.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole) -[AWS_SSO_UPDATE_PERMISSION_SET]-> (Target:AWSPermissionSet)

Precondition: the target Permission Set must have at least one account assignment. Without an assignment, provisioning has no effect.

Identification

# List all permission sets in Identity Center
aws sso-admin list-permission-sets \
  --instance-arn <instance-arn>

# Check who can attach policies to a permission set
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:AttachManagedPolicyToPermissionSet sso:ProvisionPermissionSet \
  --resource-arns <permission-set-arn>

# View existing account assignments for a permission set
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

PowerShell (AWS Tools):

Get-SSOAdminPermissionSetList -InstanceArn "<instance-arn>"

Exploitation

# Step 1: Attach an administrator managed policy to the permission set
aws sso-admin attach-managed-policy-to-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --managed-policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Step 2: Re-provision the permission set to all assigned accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS

Mitigation

Restrict sso:PutInlinePolicyToPermissionSet, sso:AttachManagedPolicyToPermissionSet, sso:AttachCustomerManagedPolicyReferenceToPermissionSet, and sso:ProvisionPermissionSet to dedicated Identity Center administrator roles. Deny these actions for all other principals.
Use SCPs to block modification of Permission Sets assigned to privileged accounts.
Enforce permission boundaries on Permission Sets so that policy changes cannot exceed the boundary, even if the policy itself is rewritten.
Apply least-privilege policies to all Permission Sets. Avoid attaching AdministratorAccess unless there is no narrower alternative.
Enable AWS IAM Identity Center audit logging. Alert on any Permission Set policy change that is followed by a provisioning event.

Detection

CloudTrail Event	Description	Key Fields
`AttachManagedPolicyToPermissionSet`	A managed policy was attached to a Permission Set	`requestParameters.permissionSetArn`, `requestParameters.managedPolicyArn`, `userIdentity.arn`
`PutInlinePolicyToPermissionSet`	An inline policy was added or updated on a Permission Set	`requestParameters.permissionSetArn`, `requestParameters.inlinePolicy`, `userIdentity.arn`
`AttachCustomerManagedPolicyReferenceToPermissionSet`	A customer-managed policy was attached	`requestParameters.permissionSetArn`, `userIdentity.arn`
`ProvisionPermissionSet`	The Permission Set was provisioned to accounts	`requestParameters.permissionSetArn`, `requestParameters.targetType`, `userIdentity.arn`

Alert when a Permission Set policy is modified and a provisioning event follows within a short window. Pay extra attention if that Permission Set is assigned to privileged accounts.

Ask AI