aws-sso-create-account-assignment
A principal with sso:CreateAccountAssignment can assign any user or group to any permission set (including AdministratorAccess) in any member account, granting org-wide privilege - the SSO equivalent of iam:AttachUserPolicy at org scope.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
EFFECTIVE action == 'sso:CreateAccountAssignment' on resource ?sso_instance
node_type(?sso_instance) == ManagementService # AWS::SSO::Instance
account_of(?principal) is the management account OR the delegated SSO administrator account
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?sso_instance |
| permissions | sso:CreateAccountAssignment |
| conditions | iam_permission scp_or_org_policy |
| state logic | ACTIVE if sso:CreateAccountAssignment is effective on the SSO instance and no SCP denies it. BLOCKED if an SCP explicitly denies sso:CreateAccountAssignment for the caller's principal type. CONDITIONAL(scp_or_org_policy) if an SCP restricts the action on a subset of accounts but not all — scope the target to the accounts not denied. |
Narrative
{principal.name} has sso:CreateAccountAssignment on the IAM Identity Center instance and can therefore assign any user or group to any permission set - including AdministratorAccess - in any member account in the organization, granting org-wide privilege on demand.
Raw rule rules/derived/aws/sso.yaml
id: aws-sso-create-account-assignment
emits: CanGrantPermission
description: "A principal with sso:CreateAccountAssignment can assign any user or group to any permission\
\ set (including AdministratorAccess) in any member account, granting org-wide privilege \u2014 the\
\ SSO equivalent of iam:AttachUserPolicy at org scope."
match:
- - principal: null
- HasPermission
- sso_instance: null
where:
- EFFECTIVE action == 'sso:CreateAccountAssignment' on resource ?sso_instance
- 'node_type(?sso_instance) == ManagementService # AWS::SSO::Instance'
- account_of(?principal) is the management account OR the delegated SSO administrator account
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?sso_instance
permissions:
- sso:CreateAccountAssignment
conditions:
- iam_permission
- scp_or_org_policy
state_logic: "ACTIVE if sso:CreateAccountAssignment is effective on the SSO instance and no SCP denies\
\ it. BLOCKED if an SCP explicitly denies sso:CreateAccountAssignment for the caller's principal type.\
\ CONDITIONAL(scp_or_org_policy) if an SCP restricts the action on a subset of accounts but not all\
\ \u2014 scope the target to the accounts not denied."
confidence: 0.95
derived_from:
- ?principal HasPermission sso:CreateAccountAssignment on ?sso_instance
false_positive_note: "Honor SCP denials: an SCP on the management account OU or on a specific member\
\ account OU can deny sso:CreateAccountAssignment and BLOCK this edge. The effective scope is the\
\ SSO instance (Resource: arn:aws:sso:::instance/*), which spans all accounts in the org. Delegated-admin\
\ accounts also hold this permission; verify account context. The scope of affected identities is\
\ org-wide; the resulting CanEnterAccount per member account is derived by can-control's enter-account-via-assume\
\ off the provisioned role CanAssume edge (see explicit/aws-sso.yaml) \u2014 do NOT emit CanEnterAccount\
\ directly from this rule."
narrative: "{principal.name} has sso:CreateAccountAssignment on the IAM Identity Center instance and\
\ can therefore assign any user or group to any permission set \u2014 including AdministratorAccess\
\ \u2014 in any member account in the organization, granting org-wide privilege on demand."