rage.fail

aws-sso-update-trusted-token-issuer

explicit aws emits TrustsExternalIdentity

match (record)

{ "field": "TrustedTokenIssuerConfiguration.OidcJwtConfiguration.IssuerUrl", "resource_type": "AWS::SSO::TrustedTokenIssuer" }

where

caller has sso-admin:UpdateTrustedTokenIssuer permission on this TrustedTokenIssuer ARN

emit

source type	`ResourcePolicy`
target type	`FederatedIdentity`
source	`<ResourcePolicy node representing the SSO instance's trusted issuer configuration (keyed by issuer ARN)>`
target	`<FederatedIdentity node representing the (attacker-controlled) OIDC issuer endpoint>`

Narrative

{principal.name} has sso-admin:UpdateTrustedTokenIssuer on trusted issuer {issuer.name} and can modify its endpoint (IssuerUrl) to point to an attacker-controlled OIDC endpoint, enabling immediate token forgery without new trust confirmation delays.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-update-trusted-token-issuer
emits: TrustsExternalIdentity
applies_to:
- aws
match_record:
  resource_type: AWS::SSO::TrustedTokenIssuer
  field: TrustedTokenIssuerConfiguration.OidcJwtConfiguration.IssuerUrl
where:
- caller has sso-admin:UpdateTrustedTokenIssuer permission on this TrustedTokenIssuer ARN
emit:
  source_type: ResourcePolicy
  target_type: FederatedIdentity
  source: <ResourcePolicy node representing the SSO instance's trusted issuer configuration (keyed by
    issuer ARN)>
  target: <FederatedIdentity node representing the (attacker-controlled) OIDC issuer endpoint>
  api_source: sso-admin:ListTrustedTokenIssuers + sso-admin:DescribeTrustedTokenIssuer + iam:ListPolicies
    for permission evaluation
  evidence_field: TrustedTokenIssuer.TrustedTokenIssuerConfiguration.OidcJwtConfiguration.IssuerUrl
  narrative: '{principal.name} has sso-admin:UpdateTrustedTokenIssuer on trusted issuer {issuer.name}
    and can modify its endpoint (IssuerUrl) to point to an attacker-controlled OIDC endpoint, enabling
    immediate token forgery without new trust confirmation delays.'