Add missing SSO permission-set read permissions to AWS connector IAM policy

baton/aws.mdx

@@ -2,7 +2,7 @@
 title: "Set up an AWS connector"
 description: "C1 provides identity governance for AWS. Integrate your AWS instance with C1 to run user access reviews (UARs) and enable just-in-time (JIT) access requests."
 og:title: "Set up an AWS connector"
 og:description: "C1 provides identity governance for AWS. Integrate your AWS instance with C1 to run user access reviews (UARs) and enable just-in-time (JIT) access requests."
 sidebarTitle: "AWS"
 ---
 
@@ -50,7 +50,7 @@
 
 To sync IAM data (like users, roles, and groups) from multiple AWS child accounts, C1 uses a secure, read-only mechanism called **cross-account access**. This setup works by allowing a central role in your root account to temporarily assume a specific role in each child account. This method ensures that the connector can gather the necessary data without storing credentials or requiring permanent access.
 
 If you're using this setup, make sure to click **Enable support for AWS Organizations** when setting up the connector in the C1 web UI. You may also enable **Enable support for AWS IAM Identity Center** at the same time. By default, enabling Identity Center alongside Organizations syncs only Identity Center data (users, groups, permission sets, account assignments) and skips cross-account IAM. To also sync IAM users, roles, and groups from every child account in this combined mode, additionally enable **Also sync cross-account IAM when Identity Center is enabled**. This flag is off by default so existing Identity Center deployments don't suddenly require child-account `sts:AssumeRole` access.
 
 **In order to use the connector to gather IAM AWS data, you'll need to configure each sub-account to have a role with a trust policy.** There are two options here:
 
@@ -71,7 +71,7 @@
     </Step>
     <Step>
     Choose how to set up the new AWS connector:
 	- Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)
 	- Add the connector to a managed app (select from the list of existing managed apps)
 	- Create a new managed app
     </Step>
@@ -251,7 +251,7 @@
     </Step>
     <Step>
     Choose how to set up the new AWS connector:
 	- Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with C1)
 	- Add the connector to a managed app (select from the list of existing managed apps)
 	- Create a new managed app
     </Step>
@@ -346,8 +346,10 @@
 	        "identitystore:ListUsers",
 	        "organizations:ListAccounts",
 	        "sso:DescribePermissionSet",
+	        "sso:GetInlinePolicyForPermissionSet",
 	        "sso:ListAccountAssignments",
 	        "sso:ListInstances",
+	        "sso:ListManagedPoliciesInPermissionSet",
 	        "sso:ListPermissionSets",
 	        "sso:ListPermissionSetsProvisionedToAccount",
 	        "iam:GetUser",
@@ -445,7 +447,7 @@
 	- `iam:List..., iam:GetGroup`: These are standard IAM permissions for listing users, groups, and roles. They are necessary to identify resources within your AWS account. iam:GetGroup provides the members of a group.
 	- `identitystore:List...`: These permissions are specific to AWS IAM Identity Center. They allow C1 to list and read information about your users and groups as they are defined within the Identity Center.
 	- `organizations:ListAccounts`: This permission is required to list all the accounts within your AWS Organization, enabling C1 to understand your account structure.
-	- `sso:List..., sso:Describe...`: These permissions allow C1 to list your permission sets and see how they are assigned to accounts and users.
+	- `sso:List..., sso:Describe..., sso:Get...`: These permissions allow C1 to list your permission sets, see how they are assigned to accounts and users, and read the inline and managed IAM policies attached to each permission set.
 	- `iam:GetUser, and various iam:List... permissions`: These permissions are necessary for C1 to first retrieve all associated credentials and metadata for an IAM user before a complete deletion can be performed.
 	**Section 2: Provisioning access (“C1ProvisionAccess”)**
 	This group of permissions is only required if you want to provision (create or delete) user assignments in AWS, including managing IAM users directly. For example, if you plan to use C1 to add a user to a group, assign a permission set to a user, create an IAM user, or fully delete an IAM user, you will need to include these permissions.
@@ -657,7 +659,7 @@
 
 <Steps>
     <Step>
     Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
     </Step>
     <Step>
     Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the AWS connector to. AWS data should be found on the **Entitlements** and **Accounts** tabs.
@@ -731,8 +733,10 @@
             "identitystore:ListUsers",
             "organizations:ListAccounts",
             "sso:DescribePermissionSet",
+            "sso:GetInlinePolicyForPermissionSet",
             "sso:ListAccountAssignments",
             "sso:ListInstances",
+            "sso:ListManagedPoliciesInPermissionSet",
             "sso:ListPermissionSets",
             "sso:ListPermissionSetsProvisionedToAccount"
           ],