# AWS - SSO & identitystore Post Exploitation

{{#include ../../../../banners/hacktricks-training.md}}

## SSO & identitystore

For more information check:

{{#ref}}
../../aws-services/aws-iam-enum.md
{{#endref}}

### `sso:DeletePermissionSet` | `sso:PutPermissionsBoundaryToPermissionSet` | `sso:DeleteAccountAssignment`

These permissions can be used to disrupt permissions:

```bash
aws sso-admin delete-permission-set --instance-arn <SSOInstanceARN> --permission-set-arn <PermissionSetARN>

aws sso-admin put-permissions-boundary-to-permission-set --instance-arn <SSOInstanceARN> --permission-set-arn <PermissionSetARN> --permissions-boundary-policy-arn <PolicyARN>

aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target-id <TargetID> --target-type <TargetType> --permission-set-arn <PermissionSetARN> --principal-type <PrincipalType> --principal-id <PrincipalID>
```

{{#include ../../../../banners/hacktricks-training.md}}




