AWS singlesignon documentation change
Summary
Rewrote documentation to focus on removing permission sets from users/groups/accounts rather than deletion. Added detailed console procedures, removed session revocation references, and restructured content with new sections.
Security assessment
While permission set management relates to access control, there's no evidence this change addresses a specific security vulnerability. The modifications focus on procedural clarity and workflow changes (remove vs delete semantics) rather than patching a security flaw or disclosing a vulnerability. Security-related content about revoking sessions was removed rather than added.
Diff
diff --git a/singlesignon/latest/userguide/howtoremovepermissionset.md index 125d106b3..eb510ff46 100644 --- a/singlesignon/latest/userguide/howtoremovepermissionset.md +++ b/singlesignon/latest/userguide/howtoremovepermissionset.md @@ -1 +1 @@ -[](/pdfs/singlesignon/latest/userguide/sso-ug.pdf#howtodeletepermissionset "Open PDF") +[](/pdfs/singlesignon/latest/userguide/sso-ug.pdf#howtoremovepermissionset "Open PDF") @@ -5 +5 @@ -# Delete permission sets in IAM Identity Center +# Remove permission sets in IAM Identity Center @@ -7 +7 @@ -Before you can delete a permission set from IAM Identity Center, you should [remove](./howtoremovepermissionset.html) it from all AWS accounts that use the permission set. To check existing user and group access, see [View user and group assignments](./get-started-view-assignments.html). +You can remove a permission set from IAM Identity Center users and groups in the IAM Identity Center console. You can also remove a permission set from an AWS account. @@ -9 +9 @@ Before you can delete a permission set from IAM Identity Center, you should [rem -###### Considerations +For more information about permission sets and how they are used in IAM Identity Center, see [Manage AWS accounts with permission sets](./permissionsetsconcept.html). @@ -11 +11 @@ Before you can delete a permission set from IAM Identity Center, you should [rem - * If you want to revoke an active permission set session, see [Revoke active IAM role sessions created by permission sets](./revoke-user-permissions.html). +Remove permission set from a user @@ -13 +12,0 @@ Before you can delete a permission set from IAM Identity Center, you should [rem - * You should remove permission sets and applications assignments from users or groups you want to delete before deleting them. Otherwise, you'll have unassigned and unused permission sets and applications in IAM Identity Center. @@ -14,0 +14 @@ Before you can delete a permission set from IAM Identity Center, you should [rem +###### Remove permission set from a user @@ -15,0 +16 @@ Before you can delete a permission set from IAM Identity Center, you should [rem +Use this procedure to remove a permission set from a user with the IAM Identity Center console. @@ -16,0 +18 @@ Before you can delete a permission set from IAM Identity Center, you should [rem + 1. Sign in to the AWS Management Console and open the AWS IAM Identity Center console at [https://console.aws.amazon.com/singlesignon/](https://console.aws.amazon.com/singlesignon/). @@ -18 +20 @@ Before you can delete a permission set from IAM Identity Center, you should [rem -Use the following procedure to delete one or more permission sets so that they can no longer be used by any AWS account in the organization. + 2. Under **IAM Identity Center** , select **Users**. @@ -20 +22 @@ Use the following procedure to delete one or more permission sets so that they c -###### Important + 3. Select the username of the user you want to remove a permission set from. @@ -22 +24 @@ Use the following procedure to delete one or more permission sets so that they c -All users and groups that have been assigned this permission set, regardless of what AWS account is using it, will no longer be able to sign in. To check existing user and group access, see [View user and group assignments](./get-started-view-assignments.html). + 4. On the user details page, select the **AWS accounts** tab. Under **AWS account access** , select your AWS account. @@ -24 +26 @@ All users and groups that have been assigned this permission set, regardless of -###### To delete a permission set from an AWS account + 5. In the right pane, the applied permissions for the selected user appears. Select the permission set you want to remove. Under **Account Access details** , select **Remove**. @@ -26 +28 @@ All users and groups that have been assigned this permission set, regardless of - 1. Open the [IAM Identity Center console](https://console.aws.amazon.com/singlesignon). + 6. A dialog box appears asking if you want to remove this permission set. Select **Remove**. @@ -28 +30 @@ All users and groups that have been assigned this permission set, regardless of - 2. Under **Multi-account permissions** , choose **Permission sets**. + @@ -30 +31,0 @@ All users and groups that have been assigned this permission set, regardless of - 3. Select the permission set that you want to delete, and then choose **Delete**. @@ -32 +33,34 @@ All users and groups that have been assigned this permission set, regardless of - 4. In the **Delete permission set** dialog box, type the name of the permission set to confirm deletion, and then choose **Delete**. The name is case-sensitive. + + +Remove permission set from a group + + +###### Remove permission set from a group + +Use this procedure to remove a permission set from a group with the IAM Identity Center console. + + 1. Sign in to the AWS Management Console and open the AWS IAM Identity Center console at [https://console.aws.amazon.com/singlesignon/](https://console.aws.amazon.com/singlesignon/). + + 2. Under **Multi-account permissions** , select **AWS accounts**. Select the link to your management account. + + + + 3. Under the **Assigned users and groups** tab, select the group you want to remove the permission set from and then select **Change permission set**. + + 4. On the **Change permission sets** page, clear the permission set you want to remove and then select **Save changes**. + + + + +Remove permission set from an AWS account + + +Use this procedure to remove a permission set from the AWS account with the IAM Identity Center console. + + 1. Sign in to the AWS Management Console and open the AWS IAM Identity Center console at [https://console.aws.amazon.com/singlesignon/](https://console.aws.amazon.com/singlesignon/). + + 2. Under **Multi-account permissions** , select **AWS accounts**. Select the name of the AWS account from which you want to remove the permission set. + + 3. On the **Overview** page of the AWS account, choose the **Permission sets** tab. Select the permission set you want to remove. Then select **Remove**. + + 4. In the **Remove permission set** dialog box, confirm that the correct permission set is selected, type `Delete` to confirm removal, and then choose **Remove access**. @@ -43 +77 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Remove permission sets +Use IAM policies @@ -45 +79 @@ Remove permission sets -Configure permission set properties +Delete permission sets