AWS SSO Identity Store records not currently read

[jcmadick]

AWS has released an update to AWS SSO (now IAM Identity Center) that exposes access to users using SSO for AWS access.

https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html

These users and groups are not included in the normal AWS Security Audit permissions and are not pulled through the current cartography code. In my case, most of the relationships I'm interested in analyzing are tied to the SSO users and groups. I have pulled a list of users and a list of groups from our AWS SSO. I do not see anything in the fields to create or tie relationships. I've attached a sanitized copy of a user record and a group record

I had to have permissions added to my sp to allow read access to users and groups in the identity store (unique from the normal identity store.) From AWSCLI, the command is "aws identitystore list-users --identity-store-id d-*******" There are other list options including groups and group membership.

I don't think integrating the pulls would be a challenge, but finding the relationships is where I'm having challenges.

[jcmadick]

AWS_SSO_User_json.txt
AWS_SSO_Group_json.txt

[ramonpetgrave64]

Hey there! I just saw this Discussion thread. somehow I'm not getting notifications for this, and I suspect many others are not. Can you open this as a Github Issue, please?

I looked through your files attached and I suspect the relationship-building would require more info from your internal identity provider, but I'm not sure yet. Let's continue the discussion in the github issue you create.

[jcmadick]

I'm currently working on the permissions to describe group and user to find the relationships. I was hoping to have all this information prior to opening as an issue.