rage.fail

aws-sso-user-retrieves-role-credentials

explicit aws emits CanRetrieveToken

match (record)

{ "field": "PrincipalId", "resource_type": "AWS::SSO::Assignment" }

where

AWSReservedSSO_<PermSetName>_<hash> role exists in the AccountId account the assigned principal (User or Group members) can call sso:GetRoleCredentials

emit

source type	`HumanIdentity`
target type	`Role`
source	`<Identity Store User (HumanIdentity) or Group-member User inheriting the assignment>`
target	`<AWSReservedSSO_* provisioned Role in the assigned Account>`

Narrative

{principal.name} assigned to permission set {permset.name} in account {account.name} can call sso:GetRoleCredentials to retrieve session credentials for the provisioned role {provisioned_role.name}.

Raw rule rules/explicit/aws-sso.yaml

id: aws-sso-user-retrieves-role-credentials
emits: CanRetrieveToken
applies_to:
- aws
match_record:
  resource_type: AWS::SSO::Assignment
  field: PrincipalId
where:
- AWSReservedSSO_<PermSetName>_<hash> role exists in the AccountId account
- the assigned principal (User or Group members) can call sso:GetRoleCredentials
emit:
  source_type: HumanIdentity
  target_type: Role
  source: <Identity Store User (HumanIdentity) or Group-member User inheriting the assignment>
  target: <AWSReservedSSO_* provisioned Role in the assigned Account>
  api_source: sso-admin:ListAccountAssignments + iam:GetRole (for trust verification)
  evidence_field: AccountAssignment.AccountId + PermissionSetArn + PrincipalId
  narrative: '{principal.name} assigned to permission set {permset.name} in account {account.name} can
    call sso:GetRoleCredentials to retrieve session credentials for the provisioned role {provisioned_role.name}.'