aws-sso-assigned-principal-can-assume-role
match (record)
{
"field": "PrincipalId",
"resource_type": "AWS::SSO::Assignment"
}
where
AWSReservedSSO_<PermSetName>_<hash> role exists in the AccountId account
trust policy of that role allows 'signin.aws.amazon.com' (or regional OIDC endpoint)
the assigned principal (User or
Group members) has an active SSO session
emit
| source type | HumanIdentity |
|---|---|
| target type | Role |
| source | <Identity Store User (HumanIdentity) or Group-member User inheriting the assignment> |
| target | <AWSReservedSSO_* provisioned Role in the assigned Account> |
Narrative
{principal.name} is assigned to permission set {permset.name} in account {account.name}; {principal.name} can call sso:GetRoleCredentials to obtain session credentials for the provisioned role {provisioned_role.name}, which has the permission set's policies.
Raw rule rules/explicit/aws-sso.yaml
id: aws-sso-assigned-principal-can-assume-role
emits: CanAssume
applies_to:
- aws
match_record:
resource_type: AWS::SSO::Assignment
field: PrincipalId
where:
- AWSReservedSSO_<PermSetName>_<hash> role exists in the AccountId account
- trust policy of that role allows 'signin.aws.amazon.com' (or regional OIDC endpoint)
- the assigned principal (User or Group members) has an active SSO session
emit:
source_type: HumanIdentity
target_type: Role
source: <Identity Store User (HumanIdentity) or Group-member User inheriting the assignment>
target: <AWSReservedSSO_* provisioned Role in the assigned Account>
api_source: sso-admin:ListAccountAssignments (AccountId, PermissionSetArn, PrincipalId, PrincipalType)
+ iam:GetRole (AssumeRolePolicyDocument) on the AWSReservedSSO_* role
evidence_field: AccountAssignment.AccountId + PermissionSetArn + PrincipalId
narrative: '{principal.name} is assigned to permission set {permset.name} in account {account.name};
{principal.name} can call sso:GetRoleCredentials to obtain session credentials for the provisioned
role {provisioned_role.name}, which has the permission set''s policies.'