How to revoke a user session when using AWS SSO?

Question

I'm currently managing a AWS SSO solution using it with AzureAD. For our use case we need to be able to revoke access/session of a user.

In AzureAD it's pretty simple, go to the user, block him, revoke its session. It's done, user needs to relog but he won't be able to do so.

In AWS SSO, it looks a bit harder, I can't seem to find a way to instantly revoke a session. I can disable its access, but once he has a session, even deleting the user/group from AWS SSO will not terminate the session.

This causes quite a problem as this is compliant to my security standards.

Any ideas?

Thanks people

user_17145140 · Answer

An option is to put in place a temporary SCP on the AWS account to deny all actions for the Role session of the user as shown below:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "UserRestrictions",
        "Effect": "Deny",
        "Action": "*",
        "Resource": [
            "*"
        ],
        "Condition": {
            "StringEquals": {
                "aws:userId": [
                    "AROAEXAMPLEROLEID:alice@example.com"
                ]
            }
        }
    }
]}

After a day or so (or the max role duration) you could remove the SCP. This is useful if you only have a single role session but in the scenario of an AWS SSO user, the user probably has access to multiple Roles across multiple AWS accounts. Rather than adding multiple SCPs you could add a SCP higher up in the organizational hierarchy that denies actions for all Role sessions for the user as shown below:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "UserRestrictions",
        "Effect": "Deny",
        "Action": "*",
        "Resource": [
            "*"
        ],
        "Condition": {
            "StringLike": {
                "aws:userId": [
                    "*:alice@example.com"
                ]
            }
        }
    }
]}

How to revoke a user session when using AWS SSO?

1 Answers