> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/unified-identities/aws-identities/sso-groups.md).

# SSO Groups

Open **Unified Identities › Group**, filter **Providers** to **AWS › SSO Group**, then select a row to open its details. SSO groups are the groups of AWS IAM Identity Center (formerly AWS SSO).

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-beb515c035b44e9c39fe93c431f0a4f80f0e0a32%2Faws-sso-groups.png?alt=media" alt=""><figcaption><p>SSO Groups</p></figcaption></figure>

## SSO Group Details

Details page contains the `Risk` and `Exposure Point` of the group, and the Information and Issues panes.

{% hint style="info" %}
A permission set assigned to a group is inherited by every member. One group assignment can grant many users access to an account, so groups are often the shortest path to broad standing access.
{% endhint %}

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-035debe8d637458895357e9692d1f78c2fc4555b%2Faws-sso-group-details.png?alt=media" alt=""><figcaption><p>SSO Group Details</p></figcaption></figure>

## Information

Information Pane contains Details, Members, Permission Sets and AWS accounts tabs. The Information Pane shows no badges for SSO groups.

## Details

Details tab contains attributes below about the SSO group object.

| Attribute          | Description                                                                                                                                                                    |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Display Name       | The group's display name.                                                                                                                                                      |
| Member Count       | The number of SSO users in the group.                                                                                                                                          |
| Description        | The group description, if one is set.                                                                                                                                          |
| Account ID         | The account that hosts the Identity Center instance (management or delegated admin).                                                                                           |
| Group ID           | The Identity Store group identifier.                                                                                                                                           |
| Identity Store ID  | The identity store the group belongs to (e.g., `d-1234567890`).                                                                                                                |
| Object ID          | The unique identifier of the group object.                                                                                                                                     |
| External ID        | The identifier the upstream identity provider assigned to this group, carried over by SCIM provisioning. Empty when the identity store is managed directly in Identity Center. |
| External ID Issuer | The identity store that issued the External ID, as an ARN.                                                                                                                     |

## Members

Members tab contains a list of SSO users that belong to the group. Every member inherits the group's permission set assignments. The list contains the Name, Username and Display Name columns.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-1f93f3fa4ea7be2271e81474fdb2ba218461e5d4%2Faws-sso-group-members.png?alt=media" alt=""><figcaption><p>Members</p></figcaption></figure>

## Permission Sets

Permission Sets tab contains a list of permission sets assigned to the group. Each one becomes an assumable role for every member in every account it is provisioned to. The list contains the Name, Description and Privileged columns.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-d6c952648700466630c996bdc5c53ffbe7f77e52%2Faws-sso-group-permission-sets.png?alt=media" alt=""><figcaption><p>Permission Sets</p></figcaption></figure>

## AWS accounts

AWS accounts tab lists the accounts the group can reach through its permission sets, and the role each permission set becomes in that account.

| Column         | Description                                                |
| -------------- | ---------------------------------------------------------- |
| Account        | The account the group can access.                          |
| Permission Set | The permission set that grants the access in that account. |
| Assumable Role | The IAM role the permission set provisions in the account. |

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-62a601aeb506cdefb19fab707b8e6fc332e49ab2%2Faws-sso-group-accounts.png?alt=media" alt=""><figcaption><p>AWS accounts</p></figcaption></figure>

## Issues

Issues pane contains identified security issues on the SSO group object.