> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_maps_to_role.md).

# AWS\_SSO\_MAPS\_TO\_ROLE

## Summary

|                        |                             |
| ---------------------- | --------------------------- |
| Forestall ACL Alias    | AWS\_SSO\_MAPS\_TO\_ROLE    |
| Affected Object Types  | `Permission Set → IAM Role` |
| Exploitation Certainty | High                        |

## Description

When IAM Identity Center provisions a permission set into an account, it creates an IAM role named `AWSReservedSSO_{PermissionSetName}_{hash}` automatically. This happens for every account the permission set is assigned to.

`AWS_SSO_MAPS_TO_ROLE` connects the abstract permission set definition to the IAM role it becomes in a specific account. Without this edge, the full path is invisible: SSO User → Permission Set → IAM Role → AWS Account Access.

**Edge semantics:** `(AWSPermissionSet) -[AWS_SSO_MAPS_TO_ROLE]-> (AWSIAMRole)`

## Identification

Find which IAM roles a permission set produces:

```bash
# List all provisioned permission sets in an account
aws sso-admin list-permission-sets-provisioned-to-account \
  --instance-arn <instance-arn> \
  --account-id <account-id>

# Find the role provisioned for a specific permission set
aws iam list-roles \
  --query "Roles[?starts_with(RoleName, 'AWSReservedSSO_<PermissionSetName>_')].[RoleName,Arn]"
```

Forestall ISPM creates this edge by matching permission set names against discovered `AWSReservedSSO_*` IAM roles via prefix matching.

## Mitigation

* Name permission sets after what they actually allow (e.g., `ReadOnly`, `NetworkAdmin`) so assignments are obviously intentional.
* Review which permission sets are provisioned in each account regularly. Remove unused ones with `aws sso-admin deprovision-permission-set`.
* Apply SCPs to cap what any `AWSReservedSSO_*` role can do across the whole organization.

## Detection

* Audit IAM roles in each account for names starting with `AWSReservedSSO_` and reconcile against approved permission set assignments.
* Monitor CloudTrail for `ProvisionPermissionSet` and `DeprovisionPermissionSet` events from `sso-admin`.
* Alert on any `CreateRole` event in CloudTrail where the role name starts with `AWSReservedSSO_`.

## References

* [AWS IAM Identity Center: Provision permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html)
* [AWS: Permission set role provisioning](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html)
* [MITRE ATT\&CK T1078.004 - Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)