> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_in_account.md).

# AWS\_SSO\_IN\_ACCOUNT

## Summary

|                                |                                                   |
| ------------------------------ | ------------------------------------------------- |
| **Forestall ACL Alias**        | AWS\_SSO\_IN\_ACCOUNT                             |
| **Edge Type**                  | Structural                                        |
| **Affected Object Types**      | Permission Sets, AWS Accounts                     |
| **Exploitation Certainty**     | N/A                                               |
| **AWS IAM Action / Condition** | `sso:ProvisionPermissionSet` (account assignment) |

## Description

`AWS_SSO_IN_ACCOUNT` connects an IAM Identity Center permission set to an AWS account it has been provisioned to. It is a structural relationship, not an attack action.

When a permission set is assigned to a user or group for an account, Identity Center provisions it into that account as an `AWSReservedSSO_<name>_<hash>` IAM role. This edge records where that provisioning lands — the accounts where the permission set exists as a concrete, assumable role.

The edge matters because it is the link that turns an assignment into real reach. A permission set on its own grants nothing; provisioned into an account, it becomes a role that assigned users and groups can assume at sign-in. Following `AWS_SSO_IN_ACCOUNT` from a permission set shows every account the permission set can operate in, and pairs with `AWS_SSO_MAPS_TO_ROLE` to name the exact role in each one.

## Identification

### AWS CLI

List the accounts a permission set is provisioned to:

```bash
aws sso-admin list-accounts-for-provisioned-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn>
```

List the permission sets provisioned to a specific account:

```bash
aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>
```

### AWS Console

1. Open **IAM Identity Center** → **Permission sets** → select the permission set.
2. Open the **AWS accounts** tab to see the accounts it is provisioned to.

## Mitigation

* Review which accounts each permission set is provisioned to, and remove provisioning from accounts that no longer need it.
* Keep permission sets scoped to the accounts that require them rather than provisioning broadly across the organization.
* Prefer group assignments with least-privilege permission sets so account reach is easy to trace and revoke.

## Detection

Monitor CloudTrail for provisioning and assignment activity:

* **Event source**: `sso.amazonaws.com`
* **Event names**: `ProvisionPermissionSet`, `CreateAccountAssignment`, `DeleteAccountAssignment`

High-value signals:

* A permission set provisioned to a new account outside a change window.
* Assignment of a broad or admin-carrying permission set to additional accounts.

## References

* <https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html>
* <https://docs.aws.amazon.com/singlesignon/latest/userguide/useraccess.html>
* <https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountsForProvisionedPermissionSet.html>