> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/aws-identities/permission-sets.md). # Permission Sets The Permission Sets page provides a list of enumerated AWS IAM Identity Center permission sets. The list contains the Name, Permission Set ARN, Description, Inline Policy, Managed Policies, Session Duration, Tier, Risk Score, Exposure Point and Issue Counts.

## Permission Set Details Details page contains the Risk Score of the permission set, Exposure Point, Information and Issues panes. {% hint style="info" %} A permission set is a template. Identity Center provisions it into each assigned account as a real IAM role, and the assigned users and groups assume that role at sign-in. So a permission set that carries `AdministratorAccess` grants admin in every account it reaches. {% endhint %}

## Information Information Pane can contain different badges to highlight important attributes. | Badge | Description | | ------------ | ------------------------------------------------------------------------------------- | | Privileged | Indicates that the object is Privileged. | | Tier | Indicates the object tier according to risk score and importance. | | Shadow Admin | Indicates that the object can compromise admin objects with at least one attack path. | \ Information Pane contains Details, Assigned Users, Assigned Groups, Accounts, Policies and Roles tabs. \\ ## Details Details tab contains attributes below about the permission set object. | Attribute | Description | | -------------------- | --------------------------------------------------------------------------------- | | Name | The permission set name. | | Permission Set ARN | The ARN of the permission set in Identity Center. | | Description | The permission set description, if one is set. | | Instance ARN | The ARN of the Identity Center instance the permission set belongs to. | | Session Duration | The maximum session length for the role the permission set provisions (ISO 8601). | | Has Inline Policy | Indicates whether the permission set has an inline policy. | | Has Managed Policies | Indicates whether the permission set has one or more attached managed policies. | | Object ID | The unique identifier of the permission set object. | ## Assigned Users Assigned Users tab contains the SSO users assigned this permission set directly. Each assignment grants the user an assumable role in the accounts the permission set is provisioned to.

## Assigned Groups Assigned Groups tab contains the SSO groups assigned this permission set. Every member of an assigned group inherits the access.

## Accounts Accounts tab lists the accounts the permission set is provisioned to. These are the accounts where the permission set exists as an assumable IAM role.

## Policies Policies tab lists the managed and inline policies bound to the permission set. The AWS Managed and Grants Admin Privileges columns identify the scope and risk level of each policy. | Column | Description | | ------------ | ------------------------------------------------------------------- | | Name | The policy name. | | Type | AWS Managed, Customer Managed, or Inline. | | Grants Admin | Indicates whether the policy grants administrator-level privileges. |

## Roles Roles tab lists the IAM roles the permission set maps to in each provisioned account. These are the `AWSReservedSSO__` roles Identity Center creates, and they are the concrete grant a user assumes.

## Issues Issues pane contains identified security issues on the permission set object.