aws-sso-attach-policy-to-permset

A principal that can attach a policy to a permission set (via sso:PutInlinePolicyToPermissionSet or sso:AttachManagedPolicyToPermissionSet) widens the effective permissions of every current assignee of that permission set across all assigned accounts.

derived aws emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'permset': None}

where

EFFECTIVE action in ['sso:PutInlinePolicyToPermissionSet', 'sso:AttachManagedPolicyToPermissionSet', 'sso-admin:AttachCustomerManagedPolicyReferenceToPermissionSet'] on resource ?permset node_type(?permset) == Role # AWS::SSO::PermissionSet

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`<all current assignees of ?permset (Identity nodes)>`
permissions	`sso:PutInlinePolicyToPermissionSet` `sso:AttachManagedPolicyToPermissionSet` `sso-admin:AttachCustomerManagedPolicyReferenceToPermissionSet`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE if the effective policy action is confirmed on ?permset. BLOCKED if an SCP or permission boundary denies the action. Note: widening the permission set is immediately effective; sso-admin:ProvisionPermissionSet may be needed to propagate to member accounts if the permission set is not set to auto-provision — if auto-provisioning is off, downgrade to CONDITIONAL(service_state) until reprovisioned. When auto-provisioning is OFF, sso-admin:ProvisionPermissionSet is additionally required to realize the privilege gain in member accounts.

Narrative

{principal.name} can attach additional policies to permission set {permset.name} (sso:PutInlinePolicyToPermissionSet / AttachManagedPolicyToPermissionSet), widening the effective permissions of every principal assigned to that permission set across all accounts where it is deployed.

Raw rule rules/derived/aws/sso.yaml

id: aws-sso-attach-policy-to-permset
emits: CanGrantPermission
description: A principal that can attach a policy to a permission set (via sso:PutInlinePolicyToPermissionSet
  or sso:AttachManagedPolicyToPermissionSet) widens the effective permissions of every current assignee
  of that permission set across all assigned accounts.
match:
- - principal: null
  - HasPermission
  - permset: null
where:
- EFFECTIVE action in ['sso:PutInlinePolicyToPermissionSet', 'sso:AttachManagedPolicyToPermissionSet',
  'sso-admin:AttachCustomerManagedPolicyReferenceToPermissionSet'] on resource ?permset
- 'node_type(?permset) == Role  # AWS::SSO::PermissionSet'
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: <all current assignees of ?permset (Identity nodes)>
  permissions:
  - sso:PutInlinePolicyToPermissionSet
  - sso:AttachManagedPolicyToPermissionSet
  - sso-admin:AttachCustomerManagedPolicyReferenceToPermissionSet
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE if the effective policy action is confirmed on ?permset. BLOCKED if an SCP or permission\
    \ boundary denies the action. Note: widening the permission set is immediately effective; sso-admin:ProvisionPermissionSet\
    \ may be needed to propagate to member accounts if the permission set is not set to auto-provision\
    \ \u2014 if auto-provisioning is off, downgrade to CONDITIONAL(service_state) until reprovisioned.\
    \ When auto-provisioning is OFF, sso-admin:ProvisionPermissionSet is additionally required to realize\
    \ the privilege gain in member accounts."
  confidence: 0.9
  derived_from:
  - ?principal HasPermission sso:PutInlinePolicyToPermissionSet|AttachManagedPolicyToPermissionSet on
    ?permset
  false_positive_note: "Widening a permission set only affects accounts where that permission set is currently\
    \ provisioned. If the permission set has no account assignments, there are no affected assignees \u2014\
    \ do not emit if assignment list is empty. Auto-provisioning: if auto-provisioning is disabled, the\
    \ wider policy does not take effect in member accounts until sso-admin:ProvisionPermissionSet is called;\
    \ downgrade state to CONDITIONAL(service_state) when auto-provision is off. Honor SCP denials of the\
    \ policy-attachment action."
  narrative: '{principal.name} can attach additional policies to permission set {permset.name} (sso:PutInlinePolicyToPermissionSet
    / AttachManagedPolicyToPermissionSet), widening the effective permissions of every principal assigned
    to that permission set across all accounts where it is deployed.'