SSO permission set inline policy should not grant full administrative privileges

What it checks

SSO permission set inline policy declares a same-statement Allow with Action "*" and Resource "*".

Where it applies

Terraform: aws_ssoadmin_permission_set_inline_policy

CloudFormation: AWS::SSO::PermissionSet

How to fix it

1. Review the declared wildcard Allow intent and replace it with the specific actions and resource ARNs the permission set needs. Preserve required statements and deliberate constraints; verify assignments, permissions boundaries and other policies separately. Review the policy manually before deployment.

Frameworks

• SOC 2 CC6.3
• NIST 800-53 rev5 AC-6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules