> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_assign_permission_set.md).

# AWS\_SSO\_ASSIGN\_PERMISSION\_SET

## Summary

|                            |                                       |
| -------------------------- | ------------------------------------- |
| **Forestall ACL Alias**    | AWS\_SSO\_ASSIGN\_PERMISSION\_SET     |
| **Affected Object Types**  | `AWSIAMUser\|AWSIAMRole → AWSAccount` |
| **Exploitation Certainty** | High                                  |
| **AWS IAM Action**         | `sso:CreateAccountAssignment`         |

## Description

> **Account gate:** This edge is only emitted for IAM principals that reside in the Organizations **management account** or an IAM Identity Center **delegated-administrator account** (service principal `sso.amazonaws.com`). Principals in any other member account receive `AccessDenied` from all SSO Admin APIs regardless of their IAM permissions.

An attacker with `sso:CreateAccountAssignment` can assign an already-privileged Permission Set to a principal they control (an SSO user or group they own). The permission set is the means; the account it provisions into is the prize. Once the assignment lands, the controlled principal signs in through the SSO portal and reaches that account with the provisioned `AWSReservedSSO_*` role. The edge therefore points to the account the attacker can take over.

**Edge semantics:** `(Attacker:AWSIAMUser|AWSIAMRole) -[AWS_SSO_ASSIGN_PERMISSION_SET]-> (Target:AWSAccount)`

**Resource-faithful gate:** `sso:CreateAccountAssignment` is authorized against three resource types at once — the IdC instance, the permission set, and the account. The edge is emitted only when the attacker's policy covers all three (a wildcard covers all of them). A policy that names only some resources fails the real call with an implicit deny on the missing one, so no edge is drawn.

Precondition: the assigned Permission Set must grant real privileges (managed or inline policy); assigning an empty Permission Set has no practical impact.

## Identification

```bash
# Check if the attacker can create account assignments.
# Pass all three resource types — the action is authorized only when all are allowed.
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:CreateAccountAssignment \
  --resource-arns <instance-arn> <permission-set-arn> arn:aws:sso:::account/<account-id>

# List existing account assignments to understand scope
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>

# List policies attached to the permission set
aws sso-admin list-managed-policies-in-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>
```

PowerShell (AWS Tools):

```powershell
Get-SSOAdminAccountAssignmentList -InstanceArn "<instance-arn>" -AccountId "<account-id>" -PermissionSetArn "<permission-set-arn>"
```

## Exploitation

```bash
# Assign the privileged Permission Set to the attacker-controlled SSO user
aws sso-admin create-account-assignment \
  --instance-arn <instance-arn> \
  --target-id <account-id> \
  --target-type AWS_ACCOUNT \
  --permission-set-arn <permission-set-arn> \
  --principal-type USER \
  --principal-id <attacker-sso-user-id>
```

## Mitigation

* Restrict `sso:CreateAccountAssignment` to dedicated Identity Center administrator roles.
* Use SCPs to limit which accounts and which Permission Sets can receive new assignments.
* Regularly audit account assignments and alert on new assignments to privileged Permission Sets.
* Apply just-in-time access controls so assignments require approval workflows.
* Use permission boundaries on Permission Sets to limit blast radius even if an unauthorized assignment is created.

## Detection

| CloudTrail Event          | Description                                                | Key Fields                                                                                                                                                 |
| ------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `CreateAccountAssignment` | A Permission Set was assigned to a principal in an account | `requestParameters.permissionSetArn`, `requestParameters.principalId`, `requestParameters.principalType`, `requestParameters.targetId`, `userIdentity.arn` |

Alert on any `CreateAccountAssignment` event for Permission Sets with high-privilege policies. Pay extra attention when the assignee principal was recently created or is otherwise unexpected.

## References

* [AWS IAM Identity Center: Manage Account Assignments](https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html)
* [AWS SSO Admin API: CreateAccountAssignment](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html)
* [HackTricks: AWS IAM Identity Center Privilege Escalation](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-iam-identity-center-privesc)
* [Rhino Security Labs: AWS Privilege Escalation Methods](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)