AWS mpa high security documentation change

Service: mpa · 2025-08-10 · Security-related high

File: mpa/latest/userguide/delete-identity-source.md

Summary

Updated required permissions for deleting an identity source, changing SSO-admin actions to SSO actions and adding Organizations permissions

Security assessment

The change corrects required IAM permissions for a sensitive operation (deleting identity sources). Incorrect permissions could allow unauthorized deletions or privilege escalation. Added Organizations permissions suggest tighter access control validation.

Diff

diff --git a/mpa/latest/userguide/delete-identity-source.md b/mpa/latest/userguide/delete-identity-source.md
index 0322b5242..a78e95b73 100644
--- a//mpa/latest/userguide/delete-identity-source.md
+++ b//mpa/latest/userguide/delete-identity-source.md
@@ -19 +19 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:DescribeApplication`
+  * `mpa:DeleteIdentitySource`
@@ -21 +21 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:DescribeInstance`
+  * `sso:DeleteApplication`
@@ -23 +23 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:DeleteApplication`
+  * `sso:DescribeApplication`
@@ -25 +25 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:ListInstances`
+  * `sso:DescribeInstance`
@@ -27 +27 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:PutApplicationAssignmentConfiguration`
+  * `sso:ListInstances`
@@ -29 +29 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:PutApplicationGrant`
+  * `sso:PutApplicationAccessScope`
@@ -31 +31 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:PutApplicationAuthenticationMethod`
+  * `sso:PutApplicationAssignmentConfiguration`
@@ -33 +33 @@ To delete an identity source, you need permission to run the following action:
-  * `sso-admin:PutApplicationAccessScope`
+  * `sso:PutApplicationAuthenticationMethod`
@@ -35 +35 @@ To delete an identity source, you need permission to run the following action:
-  * `mpa:DeleteIdentitySource`
+  * `sso:PutApplicationGrant`
@@ -41,0 +42,4 @@ If you are using the AWS Management Console, you also need permission to run the
+  * `organizations:DescribeOrganization`
+
+  * `organizations:ListDelegatedAdministrators`
+
@@ -48,4 +51,0 @@ If you are using the AWS Management Console, you also need permission to run the
-  * `organizations:ListDelegatedAdministrators`
-
-  * `organizations:DescribeOrganization`
-