aws-sso-trusted-token-issuer-create

A principal with sso:CreateTrustedTokenIssuer can register an external OIDC issuer configuration in IAM Identity Center, expanding the set of trusted token issuers - a policy modification capability.

derived aws emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ManagementService`
source	`?principal`
target	`?sso_instance`
permissions	`sso:CreateTrustedTokenIssuer`
conditions	`iam_permission` `scp_or_org_policy`
state logic	POTENTIAL: the attacker can CREATE a trusted token issuer (permission confirmed) but has not yet done so. Once created, the actual TrustsExternalIdentity fact is observed by the explicit rule aws-sso-trusted-token-issuer-trust and fed to federation-chains.yaml for exploitation evaluation. BLOCKED if an SCP denies sso-admin:CreateTrustedTokenIssuer.

source type

Identity

target type

ManagementService

source

?principal

target

?sso_instance

permissions

sso:CreateTrustedTokenIssuer

conditions

iam_permission scp_or_org_policy

state logic

POTENTIAL: the attacker can CREATE a trusted token issuer (permission confirmed) but has not yet done so. Once created, the actual TrustsExternalIdentity fact is observed by the explicit rule aws-sso-trusted-token-issuer-trust and fed to federation-chains.yaml for exploitation evaluation. BLOCKED if an SCP denies sso-admin:CreateTrustedTokenIssuer.

Narrative

{principal.name} has sso:CreateTrustedTokenIssuer and can register attacker-controlled OIDC issuers in IAM Identity Center, expanding the federation surface; the actual trust and its exploitability are evaluated by federation-chains against the explicit TrustsExternalIdentity edge.

Raw rule rules/derived/aws/sso.yaml

id: aws-sso-trusted-token-issuer-create
emits: CanModifyPolicy
description: "A principal with sso:CreateTrustedTokenIssuer can register an external OIDC issuer configuration\
  \ in IAM Identity Center, expanding the set of trusted token issuers \u2014 a policy modification capability."
match:
- - principal: null
  - HasPermission
  - sso_instance: null
where:
- EFFECTIVE action == 'sso:CreateTrustedTokenIssuer' on resource ?sso_instance
- 'node_type(?sso_instance) == ManagementService  # AWS::SSO::Instance'
emit:
  source_type: Identity
  target_type: ManagementService
  source: ?principal
  target: ?sso_instance
  permissions:
  - sso:CreateTrustedTokenIssuer
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: 'POTENTIAL: the attacker can CREATE a trusted token issuer (permission confirmed) but has
    not yet done so. Once created, the actual TrustsExternalIdentity fact is observed by the explicit
    rule aws-sso-trusted-token-issuer-trust and fed to federation-chains.yaml for exploitation evaluation.
    BLOCKED if an SCP denies sso-admin:CreateTrustedTokenIssuer.'
  confidence: 0.7
  derived_from:
  - ?principal HasPermission sso:CreateTrustedTokenIssuer on ?sso_instance
  - See explicit rule aws-sso-trusted-token-issuer-trust for the TrustsExternalIdentity fact
  false_positive_note: "This rule models the POTENTIAL capability to expand federation (CanModifyPolicy\
    \ on the SSO instance). The actual exploitation path (CanFederateAs) requires the issuer to be created\
    \ AND confirmed to be attacker-controlled AND verified to accept attacker-controlled tokens \u2014\
    \ all captured by federation-chains.yaml's evaluation of the explicit TrustsExternalIdentity edge.\
    \ Do not emit CanFederateAs here."
  narrative: '{principal.name} has sso:CreateTrustedTokenIssuer and can register attacker-controlled OIDC
    issuers in IAM Identity Center, expanding the federation surface; the actual trust and its exploitability
    are evaluated by federation-chains against the explicit TrustsExternalIdentity edge.'