Skip to main content

Component: aws-sso

This component is responsible for creating AWS SSO Permission Sets and creating AWS SSO Account Assignments, that is, assigning IdP (Okta) groups and/or users to AWS SSO permission sets in specific AWS Accounts.

This component assumes that AWS SSO has already been enabled via the AWS Console (there isn't terraform or AWS CLI support for this currently) and that the IdP has been configured to sync users and groups to AWS SSO.



  1. Go to root admin account
  2. Select primary region
  3. Go to AWS SSO
  4. Enable AWS SSO

Previously, Cloud Posse recommended delegating SSO to the identity account by following the next 2 steps:

  1. Click Settings > Management
  2. Delegate Identity as an administrator. This can take up to 30 minutes to take effect.

However, this is no longer recommended. Because the delegated SSO administrator cannot make changes in the root account and this component needs to be able to make changes in the root account, any purported security advantage achieved by delegating SSO to the identity account is lost.

Nevertheless, it is also not worth the effort to remove the delegation. If you have already delegated SSO to the identity, continue on, leaving the stack configuration in the gbl-identity stack rather than the currently recommended gbl-root stack.

Google Workspace


Your identity source is currently configured as 'External identity provider'. To add new groups or edit their memberships, you must do this using your external identity provider.

Groups cannot be created with ClickOps in the AWS console and instead must be created with AWS API.

Google Workspace is now supported by AWS Identity Center, but Group creation is not automatically handled. After configuring SAML and SCIM with Google Workspace and IAM Identity Center following the AWS documentation, add any Group name to var.groups to create the Group with Terraform. Once the setup steps as described in the AWS documentation have been completed and the Groups are created with Terraform, Users should automatically populate each created Group.

- "Developers"
- "Dev Ops"


Stack Level: Global Deployment: Must be deployed by root-admin using atmos CLI

Add catalog to gbl-root root stack.


The account_assignments setting configures access to permission sets for users and groups in accounts, in the following structure:

- <permission-set-name>
- <permission-set-name>
  • The account names (a.k.a. "stages") must already be configured via the accounts component.
  • The user and group names must already exist in AWS SSO. Usually this is accomplished by configuring them in Okta and syncing Okta with AWS SSO.
  • The permission sets are defined (by convention) in files names policy-<permission-set-name>.tf in the aws-sso component. The definition includes the name of the permission set. See components/terraform/aws-sso/ for an example.


The identity_roles_accessible element provides a list of role names corresponding to roles created in the iam-primary-roles component. For each named role, a corresponding permission set will be created which allows the user to assume that role. The permission set name is generated in Terraform from the role name using this statement:

format("Identity%sTeamAccess", replace(title(role), "-", ""))

Defining a new permission set

  1. Give the permission set a name, capitalized, in CamelCase, e.g. AuditManager. We will use NAME as a placeholder for the name in the instructions below. In Terraform, convert the name to lowercase snake case, e.g. audit_manager.

  2. Create a file in the aws-sso directory with the name

  3. In that file, create a policy as follows:

    data "aws_iam_policy_document" "TerraformUpdateAccess" {
    # Define the custom policy here

    locals {
    NAME_permission_set = { # e.g. audit_manager_permission_set
    name = "NAME", # e.g. AuditManager
    description = "<description>",
    relay_state = "",
    session_duration = "PT1H", # One hour, maximum allowed for chained assumed roles
    tags = {},
    inline_policy = data.aws_iam_policy_document.NAME.json,
    policy_attachments = [] # ARNs of AWS managed IAM policies to attach, e.g. arn:aws:iam::aws:policy/ReadOnlyAccess
    customer_managed_policy_attachments = [] # ARNs of customer managed IAM policies to attach
  4. Create a file named in the aws-sso directory (if it does not already exist). This is a terraform override file, meaning its contents will be merged with the main terraform file, and any locals defined in it will override locals defined in other files. Having your code in this separate override file makes it possible for the component to provide a placeholder local variable so that it works without customization, while allowing you to customize the component and still update it without losing your customizations.

  5. In that file, redefine the local variable overridable_additional_permission_sets as follows:

    locals {
    overridable_additional_permission_sets = [

    If you have multiple custom policies, add each one to the list.

  6. With that done, the new permission set will be created when the changes are applied. You can then use it just like the others.

  7. If you want the permission set to be able to use Terraform, enable access to the Terraform state read/write (default) role in tfstate-backend.


The example snippet below shows how to use this module with various combinations (plain YAML, YAML Anchors and a combination of the two):

prod-cloud-engineers: &prod-cloud-engineers
Production Cloud Infrastructure Engineers:
- AdministratorAccess
- ReadOnlyAccess

<<: *prod-cloud-engineers
Production Cloud Engineers:
- ReadOnlyAccess
groups: *prod-cloud-engineers
- AdministratorAccess
- ReadOnlyAccess
- ReadOnlyAccess
- AdministratorAccess
- ReadOnlyAccess
- AdministratorAccess
- ReadOnlyAccess
- "developers"
- "devops"
- "managers"
- "support"


terraform>= 1.0.0
aws>= 4.0


aws>= 4.0




aws_iam_policy_document.assume_aws_teamdata source
aws_iam_policy_document.dns_administrator_accessdata source
aws_iam_policy_document.eks_read_onlydata source
aws_iam_policy_document.terraform_update_accessdata source
aws_partition.currentdata source
aws_ssoadmin_instances.thisdata source


account_assignmentsEnables access to permission sets for users and groups in accounts, in the following structure:
- <permission-set-name>
- <permission-set-name>
permission_sets = list(string)
additional_tag_mapAdditional key-value pairs to add to each map in tags_as_list_of_maps. Not added to tags or id.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.
attributesID element. Additional attributes (e.g. workers or cluster) to add to id,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the delimiter
and treated as a single ID element.
aws_teams_accessibleList of IAM roles (e.g. ["admin", "terraform"]) for which to create permission
sets that allow the user to assume that role. Named like
admin -> IdentityAdminTeamAccess
contextSingle object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as null to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
delimiterDelimiter to be used between ID elements.
Defaults to - (hyphen). Set to "" to use no delimiter at all.
descriptor_formatsDescribe additional descriptors to be output in the descriptors output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
{<br/> format = string<br/> labels = list(string)<br/>}
(Type is any so the map values can later be enhanced to provide additional options.)
format is a Terraform format string to be passed to the format() function.
labels is a list of labels, in order, to pass to format() function.
Label values will be normalized before being passed to format() so they will be
identical to how they appear in id.
Default is {} (descriptors output will be empty).
enabledSet to false to prevent the module from creating any resourcesboolnullno
environmentID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'stringnullno
groupsList of AWS Identity Center Groups to be created with the AWS API.

When provisioning the Google Workspace Integration with AWS, Groups need to be created with API in order for automatic provisioning to work as intended.
id_length_limitLimit id to this many characters (minimum 6).
Set to 0 for unlimited length.
Set to null for keep the existing setting, which defaults to 0.
Does not affect id_full.
label_key_caseControls the letter case of the tags keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the tags input.
Possible values: lower, title, upper.
Default value: title.
label_orderThe order in which the labels (ID elements) appear in the id.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
label_value_caseControls the letter case of ID elements (labels) as included in id,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the tags input.
Possible values: lower, title, upper and none (no transformation).
Set this to title and set delimiter to "" to yield Pascal Case IDs.
Default value: lower.
labels_as_tagsSet of labels (ID elements) to include as tags in the tags output.
Default is to include all labels.
Tags with empty values will not be included in the tags output.
Set to [] to suppress all generated tags.
The value of the name tag, if included, will be the id, not the name.
Unlike other null-label inputs, the initial setting of labels_as_tags cannot be
changed in later chained modules. Attempts to change it will be silently ignored.
nameID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a tag.
The "name" tag is set to the full id string. There is no tag with the value of the name input.
namespaceID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally uniquestringnullno
privilegedTrue if the user running the Terraform command already has access to the Terraform backendboolfalseno
regex_replace_charsTerraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits.
regionAWS Regionstringn/ayes
stageID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'stringnullno
tagsAdditional tags (e.g. {'BusinessUnit': 'XYZ'}).
Neither the tag keys nor the tag values will be modified by this module.
tenantID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is forstringnullno
tfstate_environment_nameThe name of the environment where tfstate-backend is provisioned. If not set, the TerraformUpdateAccess permission set will not be created.stringnullno


group_idsGroup IDs created for Identity Center
permission_setsPermission sets
sso_account_assignmentsSSO account assignments



Change log for aws-sso component

NOTE: This file is manually generated and is a work-in-progress.

PR 830
  • Fix to properly assign roles for root account when deploying to identity account.
  • Restore the sts:SetSourceIdentity permission for Identity-role-TeamAccess permission sets added in PR 738 and inadvertently removed in PR 740.
  • Update comments and documentation to reflect Cloud Posse's current recommendation that SSO not be delegated to the identity account.
Version 1.240.1, PR 740

This PR restores compatibility with account-map prior to version 1.227.0 and fixes bugs that made versions 1.227.0 up to this release unusable.

Access control configuration (aws-teams, iam-primary-roles, aws-sso, etc.) has undergone several transformations over the evolution of Cloud Posse's reference architecture. This update resolves a number of compatibility issues with some of them.

If the roles you are using to deploy this component are allowed to assume the tfstate-backend access roles (typically ...-gbl-root-tfstate, possibly ...-gbl-root-tfstate-ro or ...-gbl-root-terraform), then you can use the defaults. This configuration was introduced in terraform-aws-components v1.227.0 and is the default for all new deployments.

If the roles you are using to deploy this component are not allowed to assume the tfstate-backend access roles, then you will need to configure this component to include the following:

role_arn: null
privileged: true

If you are deploying this component to the identity account, then this restriction will require you to deploy it via the SuperAdmin user. If you are deploying this component to the root account, then any user or role in the root account with the AdministratorAccess policy attached will be able to deploy this component.


This component was broken by changes made in v1.227.0. Either use a version before v1.227.0 or use the version released by PR 740 or later.