> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/aws-identities/sso-groups.md).

# SSO Groups

The SSO Groups page provides a list of enumerated groups from AWS IAM Identity Center (formerly AWS SSO). The list contains the Display Name, Description, Tier, Risk Score, Exposure Point and Issue Counts.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-f531e506d2d764e5f5d73407a7bae51ecbca52dd%2Faws-sso-groups.png?alt=media" alt=""><figcaption><p>SSO Groups</p></figcaption></figure>

## SSO Group Details

Details page contains the Risk Score of the group, Exposure Point, Information and Issues panes.

{% hint style="info" %}
A permission set assigned to a group is inherited by every member. One group assignment can grant many users access to an account, so groups are often the shortest path to broad standing access.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-035debe8d637458895357e9692d1f78c2fc4555b%2Faws-sso-group-details.png?alt=media" alt=""><figcaption><p>SSO Group Details</p></figcaption></figure>

## Information

Information Pane can contain different badges to highlight important attributes.

| Badge        | Description                                                                           |
| ------------ | ------------------------------------------------------------------------------------- |
| Privileged   | Indicates that the object is Privileged.                                              |
| Tier         | Indicates the object tier according to risk score and importance.                     |
| Shadow Admin | Indicates that the object can compromise admin objects with at least one attack path. |

\
Information Pane contains Details, Members, Permission Sets and AWS accounts tabs.

\\

## Details

Details tab contains attributes below about the SSO group object.

| Attribute          | Description                                                                                                                                                                    |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Display Name       | The group's display name.                                                                                                                                                      |
| Description        | The group description, if one is set.                                                                                                                                          |
| Group ID           | The Identity Store group identifier.                                                                                                                                           |
| Identity Store ID  | The identity store the group belongs to (e.g., `d-1234567890`).                                                                                                                |
| Object ID          | The unique identifier of the group object.                                                                                                                                     |
| External ID        | The identifier the upstream identity provider assigned to this group, carried over by SCIM provisioning. Empty when the identity store is managed directly in Identity Center. |
| External ID Issuer | The identity store that issued the External ID, as an ARN.                                                                                                                     |

## Members

Members tab contains a list of SSO users that belong to the group. Every member inherits the group's permission set assignments.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-1f93f3fa4ea7be2271e81474fdb2ba218461e5d4%2Faws-sso-group-members.png?alt=media" alt=""><figcaption><p>Members</p></figcaption></figure>

## Permission Sets

Permission Sets tab contains a list of permission sets assigned to the group. Each one becomes an assumable role for every member in every account it is provisioned to.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-d6c952648700466630c996bdc5c53ffbe7f77e52%2Faws-sso-group-permission-sets.png?alt=media" alt=""><figcaption><p>Permission Sets</p></figcaption></figure>

## AWS accounts

AWS accounts tab lists the accounts the group can reach through its permission sets, and the role each permission set becomes in that account.

| Column         | Description                                                |
| -------------- | ---------------------------------------------------------- |
| Account        | The account the group can access.                          |
| Permission Set | The permission set that grants the access in that account. |
| Assumable Role | The IAM role the permission set provisions in the account. |
| Access Type    | Always `Direct` for a group assignment.                    |

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-62a601aeb506cdefb19fab707b8e6fc332e49ab2%2Faws-sso-group-accounts.png?alt=media" alt=""><figcaption><p>AWS accounts</p></figcaption></figure>

## Issues

Issues pane contains identified security issues on the SSO group object.