AWS mpa high security documentation change

Service: mpa · 2025-08-10 · Security-related high

File: mpa/latest/userguide/setting-up.md

Summary

Updated required permissions for creating identity sources, changing SSO-admin actions to SSO actions

Security assessment

Corrects IAM permissions for identity source creation. Previous incorrect permissions could have allowed unauthorized resource creation. Added Organizations permissions improve access control validation.

Diff

diff --git a/mpa/latest/userguide/setting-up.md b/mpa/latest/userguide/setting-up.md
index 413dad739..10a5fdcd9 100644
--- a//mpa/latest/userguide/setting-up.md
+++ b//mpa/latest/userguide/setting-up.md
@@ -25 +25 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:DescribeApplication`
+  * `mpa:CreateIdentitySource`
@@ -27 +27 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:DescribeInstance`
+  * `sso:CreateApplication`
@@ -29 +29 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:CreateApplication`
+  * `sso:DeleteApplication`
@@ -31 +31 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:DeleteApplication`
+  * `sso:DescribeApplication`
@@ -33 +33 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:ListInstances`
+  * `sso:DescribeInstance`
@@ -35 +35 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:PutApplicationAssignmentConfiguration`
+  * `sso:ListInstances`
@@ -37 +37 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:PutApplicationGrant`
+  * `sso:PutApplicationAccessScope`
@@ -39 +39 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:PutApplicationAuthenticationMethod`
+  * `sso:PutApplicationAssignmentConfiguration`
@@ -41 +41 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `sso-admin:PutApplicationAccessScope`
+  * `sso:PutApplicationAuthenticationMethod`
@@ -43 +43 @@ To create a Multi-party approval identity source, you need permission to run the
-  * `mpa:CreateIdentitySource`
+  * `sso:PutApplicationGrant`
@@ -50,3 +50 @@ If you are using the AWS Management Console, you also need permission to run the
-  * `sso:DescribeRegisteredRegions`
-
-  * `sso:ListInstances`
+  * `organizations:DescribeOrganization`
@@ -54 +52 @@ If you are using the AWS Management Console, you also need permission to run the
-  * `sso:GetSharedSsoConfiguration`
+  * `organizations:ListDelegatedAdministrators`
@@ -58 +56 @@ If you are using the AWS Management Console, you also need permission to run the
-  * `organizations:ListDelegatedAdministrators`
+  * `sso:DescribeRegisteredRegions`
@@ -60 +58,3 @@ If you are using the AWS Management Console, you also need permission to run the
-  * `organizations:DescribeOrganization`
+  * `sso:GetSharedSsoConfiguration`
+
+  * `sso:ListInstances`