> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_has_permission_set.md).

# AWS\_SSO\_HAS\_PERMISSION\_SET

## Summary

|                        |                                |
| ---------------------- | ------------------------------ |
| Forestall ACL Alias    | AWS\_SSO\_HAS\_PERMISSION\_SET |
| Affected Object Types  | `SSO Group → Permission Set`   |
| Exploitation Certainty | High                           |

## Description

When an IAM Identity Center group is assigned a Permission Set in one or more AWS accounts, this edge captures that relationship. It shows which Permission Set governs what group members can do in the assigned accounts.

The chain runs: `SSO User → SSO Group → Permission Set → IAM Role → Account Access`.

**Edge semantics:** `(AWSSSOGroup) -[AWS_SSO_HAS_PERMISSION_SET]-> (AWSPermissionSet)`

**Edge property `AccountId`:** Each assignment is the AWS triple *principal × permission set × account*, so the edge carries the `AccountId` it was granted in and there is one edge per assigned account. This lets account access be reported faithfully: a permission set provisioned to many accounts no longer implies the principal has it in every account.

An attacker who adds themselves to a group with a high-privilege permission set gets full access to the assigned accounts. No IAM policies get touched directly.

## Identification

Check which permission sets a group has been assigned:

```bash
# List all account assignments for a specific group
aws sso-admin list-account-assignments-for-principal \
  --instance-arn <instance-arn> \
  --principal-type GROUP \
  --principal-id <group-id>

# List permission sets provisioned to a specific account
aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>
```

Forestall ISPM emits this edge during Identity Center graph construction by resolving group-level account assignments.

## Mitigation

* Assign the least-privileged permission set to each group.
* Do not assign `AdministratorAccess` permission sets to groups with many members; use dedicated break-glass groups with strict membership controls.
* Review all group-to-permission-set-to-account assignments at least quarterly.
* Use AWS Organizations SCPs to constrain what any SSO-assigned permission set can do at the organizational level.

## Detection

* Monitor CloudTrail for `CreateAccountAssignment` and `DeleteAccountAssignment` events with `PrincipalType=GROUP`.
* Alert on assignments of privileged permission sets (e.g., those containing `Administrator` or `PowerUser`) to groups.
* Track group membership changes for groups with high-privilege permission sets to detect lateral movement.

## References

* [AWS IAM Identity Center: Create account assignments](https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html)
* [AWS: Least privilege for permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/bestpractices.html)
* [MITRE ATT\&CK T1078.004 - Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)