aws-sso-create-user

A principal with identitystore:CreateUser can inject a phantom user into the Identity Store. The phantom user has no privilege until assigned via CreateGroupMembership (rule 4) or CreateAccountAssignment (rule 1); this rule documents the capability to create, not the escalation.

derived aws emits CanCreate

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ManagementService`
source	`?principal`
target	`?identity_store`
permissions	`identitystore:CreateUser`
conditions	`iam_permission` `scp_or_org_policy` `service_state`
state logic	POTENTIAL if identitystore:CreateUser is effective and the identity store allows local user creation. The phantom user has no privilege until assigned. CONDITIONAL(service_state) if local user creation is allowed but external IdP SCIM sync may deactivate the phantom user. BLOCKED if the identity store is locked to external IdP only (SCIM-only mode, no local accounts) or if an SCP denies identitystore:CreateUser.

source type

Identity

target type

ManagementService

source

?principal

target

?identity_store

permissions

identitystore:CreateUser

conditions

iam_permission scp_or_org_policy service_state

state logic

POTENTIAL if identitystore:CreateUser is effective and the identity store allows local user creation. The phantom user has no privilege until assigned. CONDITIONAL(service_state) if local user creation is allowed but external IdP SCIM sync may deactivate the phantom user. BLOCKED if the identity store is locked to external IdP only (SCIM-only mode, no local accounts) or if an SCP denies identitystore:CreateUser.

Narrative

{principal.name} has identitystore:CreateUser and can inject a phantom user into the Identity Store; that user will subsequently require assignment via group membership or account assignment to gain privilege.

Raw rule rules/derived/aws/sso.yaml

id: aws-sso-create-user
emits: CanCreate
description: A principal with identitystore:CreateUser can inject a phantom user into the Identity Store.
  The phantom user has no privilege until assigned via CreateGroupMembership (rule 4) or CreateAccountAssignment
  (rule 1); this rule documents the capability to create, not the escalation.
match:
- - principal: null
  - HasPermission
  - identity_store: null
where:
- EFFECTIVE action == 'identitystore:CreateUser' on resource ?identity_store
- 'node_type(?identity_store) == ManagementService  # AWS::IdentityStore::IdentityStore'
- identity store is NOT configured for external-IdP-only provisioning that prevents local user creation
emit:
  source_type: Identity
  target_type: ManagementService
  source: ?principal
  target: ?identity_store
  permissions:
  - identitystore:CreateUser
  conditions:
  - iam_permission
  - scp_or_org_policy
  - service_state
  state_logic: POTENTIAL if identitystore:CreateUser is effective and the identity store allows local
    user creation. The phantom user has no privilege until assigned. CONDITIONAL(service_state) if local
    user creation is allowed but external IdP SCIM sync may deactivate the phantom user. BLOCKED if the
    identity store is locked to external IdP only (SCIM-only mode, no local accounts) or if an SCP denies
    identitystore:CreateUser.
  confidence: 0.75
  derived_from:
  - ?principal HasPermission identitystore:CreateUser on ?identity_store
  false_positive_note: "If the Identity Store is SCIM-provisioned from external IdP (Okta, Azure AD) and\
    \ local user creation is not permitted, this action fails or the user is overwritten on next sync\
    \ \u2014 downgrade to BLOCKED or CONDITIONAL. The phantom user has NO privilege until assigned; this\
    \ rule only marks the POTENTIAL creation. Downstream privilege depends on rule 1 or rule 4 succeeding."
  narrative: '{principal.name} has identitystore:CreateUser and can inject a phantom user into the Identity
    Store; that user will subsequently require assignment via group membership or account assignment to
    gain privilege.'