AWS singlesignon medium security documentation change
Summary
Updated SCIM group patch operations documentation to remove support for full member list replacement and add restrictions on bulk member removal
Security assessment
The change explicitly prevents replacing/removing all group members in a single request (throws ValidationException) and limits bulk removal to 100 members. This mitigates potential security risks of accidental or malicious mass membership changes, which could lead to privilege escalation or denial of service.
Diff
diff --git a/singlesignon/latest/developerguide/patchgroup.md b/singlesignon/latest/developerguide/patchgroup.md index 171de5c6b..567c9211b 100644 --- a//singlesignon/latest/developerguide/patchgroup.md +++ b//singlesignon/latest/developerguide/patchgroup.md @@ -15 +15 @@ The IAM Identity Center SCIM implementation does not support the following aspec - * None + * If you attempt to replace or remove all group memberships as part of a single request the result will be a `ValidationException` (HTTP/400). @@ -76 +76 @@ Following are example requests and responses for this API operation. -The following three different member operations are supported using the patch operation for a group. +The following member operations are supported using the patch operation for a group. @@ -80,2 +79,0 @@ The following three different member operations are supported using the patch op - * Replace members in a group (full member list replacement) - @@ -125,41 +122,0 @@ In the value field, provide a list of objects containing the value of the user * -### Replace members in a group - -In the value field, provide a list of objects containing the value of the user id. Please note that the new list of members provided in the API call will replace all existing members in the group. - -For example, if you want to replace all of the members in the group with an **id** of `9067729b3d-f987ac4d-a175-44f0-a528-6d23c5d2ec4d` with a list of two members, use the following call: - -###### Example Request - - - PATCH https://scim.us-east-1.amazonaws.com/{tenant_id}/scim/v2/Groups/9067729b3d-f987ac4d-a175-44f0-a528-6d23c5d2ec4d - User-Agent: Mozilla/5.0 - Authorization: Bearer <bearer_token> - - { - "schemas":[ - "urn:ietf:params:scim:api:messages:2.0:PatchOp" - ], - "Operations":[ - { - "op":"replace", - "path":"members", - "value":[ - { - "value":"906722b2be-61c204e7-56d0-4dad-882d-f41911b31ccb" - }, - { - "value":"906722b2be-da1f7ef3-3e37-473e-95be-df2efaa2590d" - } - ] - } - ] - } - -###### Example Response - - - HTTP/1.1 204 - Date: Mon, 21 Sep 2020 16:43:52 GMT - Content-Type: application/json - x-amzn-RequestId: 3155a146-f729-4765-af66-fe01c862e688 - @@ -168 +125 @@ For example, if you want to replace all of the members in the group with an **id -In the value field, provide a list of objects containing the value of the user id. Multiple members can be removed at a time. If the value field contains an empty list or is not provided, all of the path’s members will be removed. +In the value field, provide a list of objects containing the value of the user id. Multiple members can be removed at a time, but you can remove up to 100 members in one API call, and providing an empty list in the request (with the intent of deleting all) is not supported.