title: Connection between SSO Permission Set and IAM Role
body: <p>I have a few SSO permission sets defined for the users in my system.
  These are connected to IAM roles where it's defined which policies are attached to each role.</p>
  <p>Is it possible to see the connection between an SSO permission set and the connected role?
  If so where? Can this information be accessed via AWS CLI?</p>
  <p>From <a href="https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html" rel="nofollow noreferrer">AWS documentation</a>:</p>
  <blockquote>
  <p>Permission sets are stored in AWS SSO and are only used for AWS
  accounts. They are not used to manage access to cloud applications.
  <strong>Permission sets ultimately get created as IAM roles in a given AWS account, with trust policies that allow users to assume the role
  through AWS SSO.</strong></p>
  </blockquote>
  <p>If I understand correctly: when an SSO permission set is created, this permission set generates an IAM role automatically. When the permission set is updated, it also updates the connected IAM role. The name of the role matches the name of the SSO permission set with &quot;AWSReservedSSO_&quot; in front of the role name.</p>
  <p>Is it possible to see which permission set is responsible for which role or is the name the only clue to this connection?</p>