rage.fail

aws-ds-can-enable-sso

explicit aws emits CanModifyConfiguration

match (effective permission)

{ "action": "ds:EnableSso", "resource_type": "AWS::DirectoryService::MicrosoftAD" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<directory node (GenericManagement)>`
permissions	`ds:EnableSso`

Narrative

{principal.name} can enable Single Sign-On (SSO) for directory {directory.name} (ds:EnableSso), modifying the directory's SSO client settings and federation configuration (e.g., Kerberos delegation, WorkSpaces/WorkDocs SSO, SAML IdP integration).

Raw rule rules/explicit/aws-ds.yaml

id: aws-ds-can-enable-sso
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
  action: ds:EnableSso
  resource_type: AWS::DirectoryService::MicrosoftAD
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <directory node (GenericManagement)>
  api_source: iam:SimulatePrincipalPolicy | policy evaluation
  permissions:
  - ds:EnableSso
  evidence_field: effective ds:EnableSso on directory ARN
  narrative: '{principal.name} can enable Single Sign-On (SSO) for directory {directory.name} (ds:EnableSso),
    modifying the directory''s SSO client settings and federation configuration (e.g., Kerberos delegation,
    WorkSpaces/WorkDocs SSO, SAML IdP integration).'
  note: ds:EnableSso configures the directory's browser-based SSO and federation client settings; it does
    NOT modify the trust policy for who may assume or impersonate identities. The action is a configuration
    change that expands the federation surface, but assumes control of the IdP infrastructure remains
    with the principal's organization. Classified as CanModifyConfiguration (modifies directory config,
    not trust boundary) to accurately reflect the capability scope. An attacker controlling the IdP infrastructure
    could redirect authentication, but that is a downstream integration risk, not a CanModifyTrust operation.
    Only applicable to Managed AD.