From 517a9c3ca7edf25db5a1b7efedbfefc9e3565bfa Mon Sep 17 00:00:00 2001
From: "c1-dev-bot[bot]" <2740113+c1-dev-bot[bot]@users.noreply.github.com>
Date: Fri, 17 Jul 2026 13:18:21 +0000
Subject: [PATCH 1/2] Add missing SSO permission-set read permissions to AWS
 connector IAM policy

Add sso:GetInlinePolicyForPermissionSet and sso:ListManagedPoliciesInPermissionSet
to both IAM policy blocks (JSON and Terraform). These read-only actions are required
when Identity Center is enabled to sync permission set policy composition, and their
absence causes AccessDenied failures on sync.
---
 baton/aws.mdx | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/baton/aws.mdx b/baton/aws.mdx
index f00bf9cf..ae6c9d5f 100644
--- a/baton/aws.mdx
+++ b/baton/aws.mdx
@@ -346,8 +346,10 @@ The permissions policy below is broken into several sections to align with these
 	        "identitystore:ListUsers",
 	        "organizations:ListAccounts",
 	        "sso:DescribePermissionSet",
+	        "sso:GetInlinePolicyForPermissionSet",
 	        "sso:ListAccountAssignments",
 	        "sso:ListInstances",
+	        "sso:ListManagedPoliciesInPermissionSet",
 	        "sso:ListPermissionSets",
 	        "sso:ListPermissionSetsProvisionedToAccount",
 	        "iam:GetUser",
@@ -731,8 +733,10 @@ resource "aws_iam_role" "ConductorOneIntegration" {
             "identitystore:ListUsers",
             "organizations:ListAccounts",
             "sso:DescribePermissionSet",
+            "sso:GetInlinePolicyForPermissionSet",
             "sso:ListAccountAssignments",
             "sso:ListInstances",
+            "sso:ListManagedPoliciesInPermissionSet",
             "sso:ListPermissionSets",
             "sso:ListPermissionSetsProvisionedToAccount"
           ],

From 98d39aa5de871a7a3480b3ecc4807f2d6bdc10cd Mon Sep 17 00:00:00 2001
From: Melinda Moreland <mindy.moreland@conductorone.com>
Date: Thu, 30 Jul 2026 15:12:03 -0700
Subject: [PATCH 2/2] docs: apply style guide fixes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 baton/aws.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/baton/aws.mdx b/baton/aws.mdx
index ae6c9d5f..dd214633 100644
--- a/baton/aws.mdx
+++ b/baton/aws.mdx
@@ -447,7 +447,7 @@ The permissions policy below is broken into several sections to align with these
 	- `iam:List..., iam:GetGroup`: These are standard IAM permissions for listing users, groups, and roles. They are necessary to identify resources within your AWS account. iam:GetGroup provides the members of a group.
 	- `identitystore:List...`: These permissions are specific to AWS IAM Identity Center. They allow C1 to list and read information about your users and groups as they are defined within the Identity Center.
 	- `organizations:ListAccounts`: This permission is required to list all the accounts within your AWS Organization, enabling C1 to understand your account structure.
-	- `sso:List..., sso:Describe...`: These permissions allow C1 to list your permission sets and see how they are assigned to accounts and users.
+	- `sso:List..., sso:Describe..., sso:Get...`: These permissions allow C1 to list your permission sets, see how they are assigned to accounts and users, and read the inline and managed IAM policies attached to each permission set.
 	- `iam:GetUser, and various iam:List... permissions`: These permissions are necessary for C1 to first retrieve all associated credentials and metadata for an IAM user before a complete deletion can be performed.
 	**Section 2: Provisioning access (“C1ProvisionAccess”)**
 	This group of permissions is only required if you want to provision (create or delete) user assignments in AWS, including managing IAM users directly. For example, if you plan to use C1 to add a user to a group, assign a permission set to a user, create an IAM user, or fully delete an IAM user, you will need to include these permissions.