2

I'm currently managing a AWS SSO solution using it with AzureAD. For our use case we need to be able to revoke access/session of a user.

In AzureAD it's pretty simple, go to the user, block him, revoke its session. It's done, user needs to relog but he won't be able to do so.

In AWS SSO, it looks a bit harder, I can't seem to find a way to instantly revoke a session. I can disable its access, but once he has a session, even deleting the user/group from AWS SSO will not terminate the session.

This causes quite a problem as this is compliant to my security standards.

Any ideas?

Thanks people

2 Answers 2

1

An option is to put in place a temporary SCP on the AWS account to deny all actions for the Role session of the user as shown below:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "UserRestrictions",
        "Effect": "Deny",
        "Action": "*",
        "Resource": [
            "*"
        ],
        "Condition": {
            "StringEquals": {
                "aws:userId": [
                    "AROAEXAMPLEROLEID:[email protected]"
                ]
            }
        }
    }
]}

After a day or so (or the max role duration) you could remove the SCP. This is useful if you only have a single role session but in the scenario of an AWS SSO user, the user probably has access to multiple Roles across multiple AWS accounts. Rather than adding multiple SCPs you could add a SCP higher up in the organizational hierarchy that denies actions for all Role sessions for the user as shown below:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "UserRestrictions",
        "Effect": "Deny",
        "Action": "*",
        "Resource": [
            "*"
        ],
        "Condition": {
            "StringLike": {
                "aws:userId": [
                    "*:[email protected]"
                ]
            }
        }
    }
]}
0

One harsh but working method:

  • go to management account
  • find the permission set that is related to the leaked credentials
  • remove the permission set from the affected account
  • re-attach the permission set to the same account

This will revoke the compromised temporary credentials in an emergency situation.

Why this works: SSO provisions roles that you assume in sub accounts. With re-attaching permission set, the roles are re-created and thus revoked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.