AWS singlesignon: Enhanced user revocation steps with account access manager
Summary
Added explicit step to remove IAM role assignments via account access manager before disabling users.
Security assessment
Directly addresses authorization gap where disabled users could still assume new roles via active sessions, closing a privilege escalation vector.
Evidence
+ 4. Remove all IAM role assignments for the user in account access manager. If access is assigned through group memberships, remove the user from all groups and all direct IAM role assignments. This step prevents the user from assuming any additional IAM roles managed in account access manager. If a user has an active AWS account access portal session and you disable the user, they can continue to assume new roles until you remove their access.
Diff
diff --git a/singlesignon/latest/userguide/revoke-user-permissions.md b/singlesignon/latest/userguide/revoke-user-permissions.md index c170b7e35..fb434c22b 100644 --- a//singlesignon/latest/userguide/revoke-user-permissions.md +++ b//singlesignon/latest/userguide/revoke-user-permissions.md @@ -7 +7 @@ -# Revoke active IAM role sessions created by permission sets +# Revoke user access @@ -21 +21 @@ AWS recommends you build automation to handle all steps except console-only oper - 4. If you use an identity provider (IdP) or Microsoft Active Directory as an identity source, disable the user in the identity source. Disabling the user prevents the creation of additional AWS access portal sessions. Use your IdP or Microsoft Active Directory API documentation to learn how to automate this step. If you are using the IAM Identity Center directory as an identity source, do not disable user access yet. You'll disable user access in step 6. + 4. Remove all IAM role assignments for the user in account access manager. If access is assigned through group memberships, remove the user from all groups and all direct IAM role assignments. This step prevents the user from assuming any additional IAM roles managed in account access manager. If a user has an active AWS account access portal session and you disable the user, they can continue to assume new roles until you remove their access. @@ -23 +23,3 @@ AWS recommends you build automation to handle all steps except console-only oper - 5. In the IAM Identity Center console, find the user and delete their active session. + 5. If you use an identity provider (IdP) or Microsoft Active Directory as an identity source, disable the user in the identity source. Disabling the user prevents the creation of additional AWS access portal sessions. Use your IdP or Microsoft Active Directory API documentation to learn how to automate this step. If you are using the IAM Identity Center directory as an identity source, do not disable user access yet. You'll disable user access in step 7. + + 6. In the IAM Identity Center console, find the user and delete their active session. @@ -35 +37 @@ After deleting a user session, the user will immediately lose access to the AWS - 6. In the IAM Identity Center console, disable user access. + 7. In the IAM Identity Center console, disable user access. @@ -43 +45 @@ After deleting a user session, the user will immediately lose access to the AWS - 7. Leave the Deny policy in place for at least 12 hours. Otherwise, the user with an active IAM role session will have restored actions with the IAM role. If you wait 12 hours, active sessions expire and the user will not be able to access the IAM role again. + 8. Leave the Deny policy in place for at least 12 hours. Otherwise, the user with an active IAM role session will have restored actions with the IAM role. If you wait 12 hours, active sessions expire and the user will not be able to access the IAM role again. @@ -50 +52 @@ After deleting a user session, the user will immediately lose access to the AWS -If you disable a user’s access before stopping the user session (you completed step 6 without completing step 5), you can no longer stop the user session through the IAM Identity Center console. If you inadvertently disable user access before stopping the user session, you can re-enable the user, stop their session, and then disable their access again. +If you disable a user’s access before stopping the user session (you completed step 7 without completing step 6), you can no longer stop the user session through the IAM Identity Center console. If you inadvertently disable user access before stopping the user session, you can re-enable the user, stop their session, and then disable their access again.