From e888982305f59b15988bf9178cbdaeaf8ed31f32 Mon Sep 17 00:00:00 2001 From: Luisina Santos Date: Thu, 6 Aug 2026 11:15:19 -0300 Subject: [PATCH 1/5] docs: widen iam:GetRole scope and add missing organizations: actions in Identity Center setup (CXP-865) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Identity Center setup policy scoped iam:GetRole to SSO-provisioned roles only, but the connector calls GetRole for every IAM role returned by ListRoles — silently dropping grants for non-SSO-provisioned roles. Also adds organizations:DescribeAccount, organizations:DescribeOrganization, and organizations:ListParents, which are declared in baton_capabilities.json and called by the connector but were missing from the documented policy. Mirrors the fix proposed in ConductorOne/docs#442 in the source-of-truth docs/connector.mdx, and brings README.md's Identity Center policy in line with it (organizations:DescribeAccount was missing there too). Co-Authored-By: Claude Sonnet 5 --- README.md | 2 ++ docs/connector.mdx | 16 ++++++++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index d5f263af..8a6548bb 100644 --- a/README.md +++ b/README.md @@ -184,6 +184,7 @@ _These policies have comments prefixed with // that need to be removed before us "identitystore:ListGroupMemberships", "identitystore:GetGroupMembershipId", "organizations:ListAccounts", + "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListParents", "organizations:ListRoots", @@ -281,6 +282,7 @@ _These policies have comments prefixed with // that need to be removed before us "identitystore:ListGroupMemberships", "identitystore:GetGroupMembershipId", "organizations:ListAccounts", + "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListParents", "organizations:ListRoots", diff --git a/docs/connector.mdx b/docs/connector.mdx index 91926426..656c5f80 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -427,7 +427,8 @@ The permissions policy below is broken into several sections to align with these { "Action": [ "iam:GetGroup", - "iam:GetAccessKeyLastUsed", + "iam:GetAccessKeyLastUsed", + "iam:GetRole", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListRoles", @@ -436,7 +437,10 @@ The permissions policy below is broken into several sections to align with these "identitystore:ListGroupMemberships", "identitystore:ListGroups", "identitystore:ListUsers", + "organizations:DescribeAccount", + "organizations:DescribeOrganization", "organizations:ListAccounts", + "organizations:ListParents", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListAccountAssignments", @@ -557,9 +561,9 @@ The permissions policy below is broken into several sections to align with these **Section 1: Read-only access (“C1ReadAccess”)** This group of permissions is the minimum required for C1 to discover and sync your Identity Center users, groups, and permission sets. These are strictly read-only permissions. - `iam:CreateUser`: This permission is required to provision IAM user accounts. - - `iam:List..., iam:GetGroup`: These are standard IAM permissions for listing users, groups, and roles. They are necessary to identify resources within your AWS account. iam:GetGroup provides the members of a group. + - `iam:List..., iam:GetGroup, iam:GetRole`: These are standard IAM permissions for listing and retrieving users, groups, and roles. They are necessary to identify resources within your AWS account. `iam:GetGroup` provides the members of a group. `iam:GetRole` retrieves detailed information about each role, including its trust relationships. - `identitystore:List...`: These permissions are specific to AWS IAM Identity Center. They allow C1 to list and read information about your users and groups as they are defined within the Identity Center. - - `organizations:ListAccounts`: This permission is required to list all the accounts within your AWS Organization, enabling C1 to understand your account structure. + - `organizations:ListAccounts, organizations:DescribeAccount, organizations:DescribeOrganization, organizations:ListParents`: These permissions allow C1 to list all accounts within your AWS Organization, retrieve account and organization details, and understand the organizational unit hierarchy. - `sso:List..., sso:Describe..., sso:Get...`: These permissions allow C1 to list your permission sets, see how they are assigned to accounts and users, and read the inline and managed IAM policies attached to each permission set. - `organizations:ListRoots, organizations:ListOrganizationalUnitsForParent`: **Optional**, only needed for the Sparse ACLs Organization Root / Organizational Unit hierarchy (see [Sparse ACLs](#sparse-acls-organizations-and-permission-sets-as-scoped-bindings) above). If omitted, the connector logs a warning and skips the OU hierarchy instead of failing. - `iam:GetUser, and various iam:List... permissions`: These permissions are necessary for C1 to first retrieve all associated credentials and metadata for an IAM user before a complete deletion can be performed. @@ -573,7 +577,7 @@ The permissions policy below is broken into several sections to align with these - `iam:TagUser`: This permission is required to add tags to a newly created IAM user. **Section 3: Access to IAM Identity Center-provisioned roles (“AccessToSSOProvisionedRoles”)** This group of permissions allows C1 to inspect and manage the AWS-managed roles created by IAM Identity Center in your accounts. This is crucial for understanding how permission sets are being applied. - - `iam:AttachRolePolicy, iam:DeleteRole, iam:GetRole, etc.`: These are permissions to manage IAM roles. The key detail is the Resource constraint: `arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*`. This ensures that C1 can only interact with roles created and managed by the AWS IAM Identity Center service itself, preventing it from modifying other roles in your account. + - `iam:AttachRolePolicy, iam:DeleteRole, etc.`: These are permissions to manage IAM roles. The key detail is the Resource constraint: `arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*`. This ensures that C1 can only modify roles created and managed by the AWS IAM Identity Center service itself, preventing it from modifying other roles in your account. Note that read-only access (`iam:GetRole`) is granted separately in Section 1 for all roles. **Section 4: Other permissions** These are supporting permissions that enable specific features or functionality. Some of the permissions listed here can be omitted if your particular use case doesn’t require the data they pull in to C1. - `IAMListPermissions`: This section allows C1 to sync data on access keys. C1 does not store or access the access keys. If you do not want to sync access key data, you can omit this section. @@ -829,6 +833,7 @@ resource "aws_iam_role" "ConductorOneIntegration" { { "Action" : [ "iam:GetGroup", + "iam:GetRole", "iam:ListAccountAliases", "iam:ListGroups", "iam:ListRoles", @@ -837,7 +842,10 @@ resource "aws_iam_role" "ConductorOneIntegration" { "identitystore:GetGroupMembershipId", "identitystore:ListGroups", "identitystore:ListUsers", + "organizations:DescribeAccount", + "organizations:DescribeOrganization", "organizations:ListAccounts", + "organizations:ListParents", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListAccountAssignments", From 595e431fb66a04f7ff9ee01730598bb432dab44f Mon Sep 17 00:00:00 2001 From: Luisina Santos Date: Thu, 6 Aug 2026 11:47:30 -0300 Subject: [PATCH 2/5] docs: fix bot review findings on IAM setup permission edits MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Drop the now-redundant iam:GetRole from the AccessToSSOProvisionedRoles statements (JSON + Terraform in connector.mdx, footnote in README.md) now that Section 1 grants it at Resource:* — leaving it in both places contradicted the new explanatory note. - Drop the duplicate organizations:DescribeAccount added to README.md's provisioning policy; that policy already grants it via the dedicated AccountStatusValidationForProvisioning statement, which also carries the "Recommended" framing this duplicate would have undermined. - Split the new organizations: bullet in connector.mdx so ListParents/DescribeAccount are documented as Recommended-but-optional (matching their actual graceful-degradation behavior in account.go) rather than lumped in as hard requirements alongside ListAccounts. Co-Authored-By: Claude Sonnet 5 --- README.md | 2 -- docs/connector.mdx | 6 +++--- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 8a6548bb..51d68d55 100644 --- a/README.md +++ b/README.md @@ -282,7 +282,6 @@ _These policies have comments prefixed with // that need to be removed before us "identitystore:ListGroupMemberships", "identitystore:GetGroupMembershipId", "organizations:ListAccounts", - "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListParents", "organizations:ListRoots", @@ -439,7 +438,6 @@ If you've used the above policy and are still experiencing issues provisioning, "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", - "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:PutRolePolicy", diff --git a/docs/connector.mdx b/docs/connector.mdx index 656c5f80..ab9b1331 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -502,7 +502,6 @@ The permissions policy below is broken into several sections to align with these "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", - "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:PutRolePolicy", @@ -563,7 +562,9 @@ The permissions policy below is broken into several sections to align with these - `iam:CreateUser`: This permission is required to provision IAM user accounts. - `iam:List..., iam:GetGroup, iam:GetRole`: These are standard IAM permissions for listing and retrieving users, groups, and roles. They are necessary to identify resources within your AWS account. `iam:GetGroup` provides the members of a group. `iam:GetRole` retrieves detailed information about each role, including its trust relationships. - `identitystore:List...`: These permissions are specific to AWS IAM Identity Center. They allow C1 to list and read information about your users and groups as they are defined within the Identity Center. - - `organizations:ListAccounts, organizations:DescribeAccount, organizations:DescribeOrganization, organizations:ListParents`: These permissions allow C1 to list all accounts within your AWS Organization, retrieve account and organization details, and understand the organizational unit hierarchy. + - `organizations:ListAccounts, organizations:DescribeOrganization`: These permissions allow C1 to list all accounts within your AWS Organization and retrieve organization details. + - `organizations:ListParents`: **Recommended**, only needed to re-parent accounts onto their Organizational Unit for the Sparse ACLs by-inheritance hierarchy. If omitted, accounts sync flat without OU grouping instead of failing. + - `organizations:DescribeAccount`: **Recommended**, enables proactive validation of account status before creating assignments. If omitted, the connector proceeds anyway and surfaces a less clear error for suspended accounts. - `sso:List..., sso:Describe..., sso:Get...`: These permissions allow C1 to list your permission sets, see how they are assigned to accounts and users, and read the inline and managed IAM policies attached to each permission set. - `organizations:ListRoots, organizations:ListOrganizationalUnitsForParent`: **Optional**, only needed for the Sparse ACLs Organization Root / Organizational Unit hierarchy (see [Sparse ACLs](#sparse-acls-organizations-and-permission-sets-as-scoped-bindings) above). If omitted, the connector logs a warning and skips the OU hierarchy instead of failing. - `iam:GetUser, and various iam:List... permissions`: These permissions are necessary for C1 to first retrieve all associated credentials and metadata for an IAM user before a complete deletion can be performed. @@ -885,7 +886,6 @@ resource "aws_iam_role" "ConductorOneIntegration" { "iam:DeleteRole", "iam:DeleteRolePolicy", "iam:DetachRolePolicy", - "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:PutRolePolicy", From 0725a0f8f9e066fb08a92420352c62aa521cfe6e Mon Sep 17 00:00:00 2001 From: Luisina Santos Date: Thu, 6 Aug 2026 13:13:38 -0300 Subject: [PATCH 3/5] docs: drop organizations:DescribeAccount from sync-only policy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's only called from verifyAccountStatus (account.go:571), which runs exclusively from provisionAssignment/deprovisionAssignment — never during sync. Adding it to the sync-only policy granted a provisioning-only permission outside least-privilege; it's already covered by the dedicated AccountStatusValidationForProvisioning statement in the provisioning policy. Co-Authored-By: Claude Sonnet 5 --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 51d68d55..ddea22aa 100644 --- a/README.md +++ b/README.md @@ -184,7 +184,6 @@ _These policies have comments prefixed with // that need to be removed before us "identitystore:ListGroupMemberships", "identitystore:GetGroupMembershipId", "organizations:ListAccounts", - "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListParents", "organizations:ListRoots", From 297ca10d0fd056811ae5c4c6e557c54186073755 Mon Sep 17 00:00:00 2001 From: Luisina Santos Date: Fri, 7 Aug 2026 09:47:03 -0300 Subject: [PATCH 4/5] docs: address remaining bot review findings on Identity Center policy - Terraform ConductorOneReadAccess statement was missing organizations:ListRoots and organizations:ListOrganizationalUnitsForParent, unlike the JSON policy above it. Without both, granting only ListParents with the hierarchy opt-in enabled would parent accounts to Root/OU resources that organization.go skips creating. - organizations:DescribeOrganization is granted in every policy block but never called anywhere in pkg/ (only declared in capability metadata). Reworded its bullet to say so instead of claiming it's used to "retrieve organization details." - iam:GetRole was lumped into the same bullet as iam:List.../iam:GetGroup as if needed to "identify resources." It's actually only used in the Grants phase to read a role's trust policy (role.go:166) and degrades gracefully on failure. Split it into its own Recommended/fail-soft bullet, consistent with how ListParents and DescribeAccount are already documented. Co-Authored-By: Claude Sonnet 5 --- docs/connector.mdx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/connector.mdx b/docs/connector.mdx index ab9b1331..215944f1 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -560,9 +560,11 @@ The permissions policy below is broken into several sections to align with these **Section 1: Read-only access (“C1ReadAccess”)** This group of permissions is the minimum required for C1 to discover and sync your Identity Center users, groups, and permission sets. These are strictly read-only permissions. - `iam:CreateUser`: This permission is required to provision IAM user accounts. - - `iam:List..., iam:GetGroup, iam:GetRole`: These are standard IAM permissions for listing and retrieving users, groups, and roles. They are necessary to identify resources within your AWS account. `iam:GetGroup` provides the members of a group. `iam:GetRole` retrieves detailed information about each role, including its trust relationships. + - `iam:List..., iam:GetGroup`: These are standard IAM permissions for listing and retrieving users, groups, and roles. They are necessary to identify resources within your AWS account. `iam:GetGroup` provides the members of a group. + - `iam:GetRole`: **Recommended**, used to read a role's trust policy when syncing grants for that role. If omitted, the connector logs a warning and skips trust-policy grants for that role instead of failing. - `identitystore:List...`: These permissions are specific to AWS IAM Identity Center. They allow C1 to list and read information about your users and groups as they are defined within the Identity Center. - - `organizations:ListAccounts, organizations:DescribeOrganization`: These permissions allow C1 to list all accounts within your AWS Organization and retrieve organization details. + - `organizations:ListAccounts`: This permission allows C1 to list all accounts within your AWS Organization. + - `organizations:DescribeOrganization`: Not currently used by the connector; included for parity with the rest of this policy and to reserve it in case it's needed in the future. - `organizations:ListParents`: **Recommended**, only needed to re-parent accounts onto their Organizational Unit for the Sparse ACLs by-inheritance hierarchy. If omitted, accounts sync flat without OU grouping instead of failing. - `organizations:DescribeAccount`: **Recommended**, enables proactive validation of account status before creating assignments. If omitted, the connector proceeds anyway and surfaces a less clear error for suspended accounts. - `sso:List..., sso:Describe..., sso:Get...`: These permissions allow C1 to list your permission sets, see how they are assigned to accounts and users, and read the inline and managed IAM policies attached to each permission set. @@ -846,7 +848,9 @@ resource "aws_iam_role" "ConductorOneIntegration" { "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", + "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", + "organizations:ListRoots", "sso:DescribePermissionSet", "sso:GetInlinePolicyForPermissionSet", "sso:ListAccountAssignments", From 6b86cbd2b1e77dcc9da563e9a6db981bac72f155 Mon Sep 17 00:00:00 2001 From: Luisina Santos Date: Fri, 7 Aug 2026 10:41:46 -0300 Subject: [PATCH 5/5] docs: bring Terraform ConductorOneReadAccess/ProvisionAccess to iam:* parity with JSON The Terraform policy's ConductorOneReadAccess and ConductorOneProvisionAccess statements were missing several iam:* actions present in the equivalent JSON policy (iam:GetAccessKeyLastUsed, iam:GetUser, iam:ListAccessKeys, iam:ListSigningCertificates, iam:ListSSHPublicKeys, iam:ListServiceSpecificCredentials, iam:ListMFADevices, iam:ListUserPolicies, iam:ListAttachedUserPolicies, iam:ListGroupsForUser, iam:CreateUser, and the iam:Delete*/iam:Deactivate*/iam:TagUser cleanup actions used for full IAM user deprovisioning). Users following the Terraform path got a strictly weaker role than the console/JSON path for the same features. Co-Authored-By: Claude Sonnet 5 --- docs/connector.mdx | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/docs/connector.mdx b/docs/connector.mdx index 215944f1..f837f7dc 100644 --- a/docs/connector.mdx +++ b/docs/connector.mdx @@ -836,6 +836,7 @@ resource "aws_iam_role" "ConductorOneIntegration" { { "Action" : [ "iam:GetGroup", + "iam:GetAccessKeyLastUsed", "iam:GetRole", "iam:ListAccountAliases", "iam:ListGroups", @@ -858,7 +859,16 @@ resource "aws_iam_role" "ConductorOneIntegration" { "sso:ListInstances", "sso:ListManagedPoliciesInPermissionSet", "sso:ListPermissionSets", - "sso:ListPermissionSetsProvisionedToAccount" + "sso:ListPermissionSetsProvisionedToAccount", + "iam:GetUser", + "iam:ListAccessKeys", + "iam:ListSigningCertificates", + "iam:ListSSHPublicKeys", + "iam:ListServiceSpecificCredentials", + "iam:ListMFADevices", + "iam:ListUserPolicies", + "iam:ListAttachedUserPolicies", + "iam:ListGroupsForUser" ], "Effect" : "Allow", "Resource" : "*", @@ -868,6 +878,7 @@ resource "aws_iam_role" "ConductorOneIntegration" { "Action" : [ "iam:AddUserToGroup", "iam:RemoveUserFromGroup", + "iam:CreateUser", "sso:CreateAccountAssignment", "sso:DeleteAccountAssignment", "identitystore:CreateGroupMembership", @@ -875,7 +886,17 @@ resource "aws_iam_role" "ConductorOneIntegration" { "identitystore:CreateUser", "identitystore:DeleteUser", "sso:DescribeAccountAssignmentCreationStatus", - "sso:DescribeAccountAssignmentDeletionStatus" + "sso:DescribeAccountAssignmentDeletionStatus", + "iam:DeleteLoginProfile", + "iam:DeleteAccessKey", + "iam:DeleteSigningCertificate", + "iam:DeleteSSHPublicKey", + "iam:DeleteServiceSpecificCredential", + "iam:DeactivateMFADevice", + "iam:DeleteUserPolicy", + "iam:DetachUserPolicy", + "iam:DeleteUser", + "iam:TagUser" ], "Effect" : "Allow", "Resource" : "*",