> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_in_group.md).

# AWS\_SSO\_IN\_GROUP

## Summary

|                        |                        |
| ---------------------- | ---------------------- |
| Forestall ACL Alias    | AWS\_SSO\_IN\_GROUP    |
| Affected Object Types  | `SSO User → SSO Group` |
| Exploitation Certainty | High                   |

## Description

An SSO User belongs to an IAM Identity Center Group. This is how SSO users get access to AWS accounts: groups are assigned to account and permission set combinations, and every member picks up that access automatically.

The `AWS_SSO_IN_GROUP` edge records direct group membership in Identity Center. This holds whether the identity store is AWS-native or backed by an external IdP like Entra ID or Okta.

**Edge semantics:** `(AWSSSOUser) -[AWS_SSO_IN_GROUP]-> (AWSSSOGroup)`

An attacker who can add a controlled identity to a privileged SSO group inherits all account assignments that group holds. No direct IAM changes needed.

## Identification

Query group memberships in IAM Identity Center:

```bash
# List groups a user belongs to
aws identitystore list-group-memberships-for-member \
  --identity-store-id <identity-store-id> \
  --member-id "UserId=<user-id>"

# List all members of a specific group
aws identitystore list-group-memberships \
  --identity-store-id <identity-store-id> \
  --group-id <group-id>
```

Forestall ISPM emits this edge during Identity Center enumeration by resolving group memberships from the identity store API.

## Mitigation

* Review group memberships at least quarterly, using access reviews or CIEM tooling.
* Create separate groups per permission set and account. Avoid broad groups that span multiple access levels.
* Wire your IdP's group lifecycle management so users are removed automatically when they change roles.
* Use Just-In-Time (JIT) provisioning for privileged groups instead of persistent membership.

## Detection

* Watch CloudTrail identity store events for `CreateGroupMembership` and `DeleteGroupMembership`.
* Alert on additions to groups assigned privileged permission sets like `AdministratorAccess`.
* Use AWS Security Hub to correlate membership changes with subsequent role assumptions.

## References

* [AWS Identity Center: Manage group memberships](https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html)
* [AWS Identity Store API: ListGroupMemberships](https://docs.aws.amazon.com/identitystore/latest/APIReference/API_ListGroupMemberships.html)
* [MITRE ATT\&CK T1078.004 - Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
* [MITRE ATT\&CK T1136.003 - Create Account: Cloud Account](https://attack.mitre.org/techniques/T1136/003/)