> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_assume_role.md).

# AWS\_SSO\_ASSUME\_ROLE

## Summary

|                        |                                                         |
| ---------------------- | ------------------------------------------------------- |
| Forestall ACL Alias    | AWS\_SSO\_ASSUME\_ROLE                                  |
| Affected Object Types  | `AWSSSOUser\|AWSSSOGroup → AWSReservedSSO (AWSIAMRole)` |
| Exploitation Certainty | High                                                    |

## Description

An SSO User can assume a specific IAM role provisioned by IAM Identity Center. These roles follow the naming pattern `AWSReservedSSO_{PermissionSetName}_{hash}` and are created automatically in each assigned account.

`AWS_SSO_ASSUME_ROLE` is the single SSO → IAM uplift: the SSO principal converts its Identity Center session into temporary credentials for the provisioned IAM role. It is derived structurally (an account assignment plus a provisioned `AWSReservedSSO_*` role, see `AWS_SSO_MAPS_TO_ROLE`), not from any IAM policy. The Permission Set's policies set the role's value, not the edge's existence.

**Edge semantics:** `(AWSSSOUser|AWSSSOGroup) -[AWS_SSO_ASSUME_ROLE]-> (AWSReservedSSO_* IAM Role)`. A group assignment reaches the role through membership: `AWSSSOUser -member-> AWSSSOGroup -ASSUME_ROLE-> role`.

**Abuse methods (same edge, transport only):**

* **console\_saml**: portal "Management console" → SAML POST → `sts:AssumeRoleWithSAML`. The reserved role trusts the IdC-managed `AWSSSO_*_DO_NOT_DELETE` SAML provider. CloudTrail: `AssumeRoleWithSAML` @ `sts.amazonaws.com`.
* **cli\_token**: `aws sso login` → sso-oidc device flow → access token (`~/.aws/sso/cache/*.json`, \~8h) → `aws sso get-role-credentials --role-name <PS> --account-id <acct> --access-token <token>`. IdC assumes the role on the user's behalf and returns SigV4 credentials. CloudTrail: `GetRoleCredentials` @ `sso.amazonaws.com`. (`sso:GetRoleCredentials` is a Portal API call authorized by the bearer token, not a grantable IAM policy action. That is why it cannot be a separate, policy-derived edge.)

An attacker who controls this SSO identity (e.g. by stealing the cached access token) gets every permission the target IAM role carries in that account. If the role has `AdministratorAccess`, that is full account compromise.

## Identification

Find which IAM roles an SSO user can assume:

```bash
# List AWSReservedSSO roles in the target account
aws iam list-roles --query "Roles[?starts_with(RoleName, 'AWSReservedSSO_')].[RoleName,Arn]"

# Review the trust policy of a specific SSO-provisioned role
aws iam get-role --role-name "AWSReservedSSO_<PermissionSetName>_<hash>" \
  --query "Role.AssumeRolePolicyDocument"

# Check the role's attached policies
aws iam list-attached-role-policies \
  --role-name "AWSReservedSSO_<PermissionSetName>_<hash>"
```

Forestall ISPM emits this edge when an SSO user's effective permission set matches a provisioned `AWSReservedSSO_*` IAM role in an assigned account.

## Mitigation

* Keep `AWSReservedSSO_*` role permissions minimal. Build least-privilege permission sets from the start.
* Audit permission set policies regularly and remove any `*` action or resource grants.
* Restrict which accounts each permission set is assigned to.
* Apply SCPs to limit what `AWSReservedSSO_*` roles can do, even if the permission set is broad.

## Detection

The two abuse methods are logged separately. Cover both:

* **console\_saml:** `AssumeRoleWithSAML` @ `sts.amazonaws.com`: `roleArn` starts with `AWSReservedSSO_`, plus `sourceIPAddress`, `responseElements.assumedRoleUser`.
* **cli\_token:** `GetRoleCredentials` @ `sso.amazonaws.com`: `roleName` (Permission Set), `accountId`, `userIdentity` (portal identity), `sourceIPAddress`.

Alert on calls from unexpected source IPs or outside normal hours, and on token-credential retrieval that fans out across many accounts. Use Security Hub and GuardDuty to catch anomalous activity from SSO-provisioned roles after they assume.

## References

* [AWS IAM Identity Center: Permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html)
* [AWS: AWSReservedSSO role naming](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html)
* [MITRE ATT\&CK T1078.004 - Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
* [MITRE ATT\&CK T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005/)