AWS IAM Identity Center SSO configuration updated
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detects when the configuration for the current SSO instance is modified. This rule monitors for changes to AWS SSO settings that could impact authentication and access control.
Strategy
This rule monitors AWS CloudTrail logs for UpdateSsoConfiguration events originating from AWS IAM Identity Center. AWS SSO configuration updates can include changes to identity provider settings, authentication methods, and access control policies that govern how users authenticate and access AWS resources.
Triage & Response
- Review the
@userIdentity.arn to identify the user or role that made the configuration change. - Check if the change was made during a scheduled maintenance window or by an authorized administrator.
- Verify if the configuration change aligns with documented change management procedures.
- Examine the specific parameters modified in the SSO configuration to determine the scope of changes.
