Component: `aws-sso`

This component is responsible for creating AWS SSO Permission Sets and creating AWS SSO Account Assignments, that is, assigning IdP (Okta) groups and/or users to AWS SSO permission sets in specific AWS Accounts.

This component assumes that AWS SSO has already been enabled via the AWS Console (there isn't terraform or AWS CLI support for this currently) and that the IdP has been configured to sync users and groups to AWS SSO.

Usage

Clickops

Go to root admin account
Select primary region
Go to AWS SSO
Enable AWS SSO

Delegation no longer recommended

Previously, Cloud Posse recommended delegating SSO to the identity account by following the next 2 steps:

Click Settings > Management
Delegate Identity as an administrator. This can take up to 30 minutes to take effect.

However, this is no longer recommended. Because the delegated SSO administrator cannot make changes in the root account and this component needs to be able to make changes in the root account, any purported security advantage achieved by delegating SSO to the identity account is lost.

Nevertheless, it is also not worth the effort to remove the delegation. If you have already delegated SSO to the identity, continue on, leaving the stack configuration in the gbl-identity stack rather than the currently recommended gbl-root stack.

Atmos

Stack Level: Global Deployment: Must be deployed by root-admin using atmos CLI

Add catalog to gbl-root root stack.

`account_assignments`

The account_assignments setting configures access to permission sets for users and groups in accounts, in the following structure:

<account-name>:
  groups:
    <group-name>:
      permission_sets:
        - <permission-set-name>
  users:
    <user-name>:
      permission_sets:
        - <permission-set-name>

The account names (a.k.a. "stages") must already be configured via the accounts component.
The user and group names must already exist in AWS SSO. Usually this is accomplished by configuring them in Okta and syncing Okta with AWS SSO.
The permission sets are defined (by convention) in files names policy-<permission-set-name>.tf in the aws-sso component. The definition includes the name of the permission set. See components/terraform/aws-sso/policy-AdminstratorAccess.tf for an example.

`identity_roles_accessible`

The identity_roles_accessible element provides a list of role names corresponding to roles created in the iam-primary-roles component. For each named role, a corresponding permission set will be created which allows the user to assume that role. The permission set name is generated in Terraform from the role name using this statement:

format("Identity%sTeamAccess", replace(title(role), "-", ""))

Defining a new permission set

Give the permission set a name, capitalized, in CamelCase, e.g. AuditManager. We will use NAME as a placeholder for the name in the instructions below. In Terraform, convert the name to lowercase snake case, e.g. audit_manager.
Create a file in the aws-sso directory with the name policy-NAME.tf.

In that file, create a policy as follows:

data "aws_iam_policy_document" "TerraformUpdateAccess" {
  # Define the custom policy here
}

locals {
  NAME_permission_set = {                         # e.g. audit_manager_permission_set
    name                                = "NAME",  # e.g. AuditManager
    description                         = "<description>",
    relay_state                         = "",
    session_duration                    = "PT1H", # One hour, maximum allowed for chained assumed roles
    tags                                = {},
    inline_policy                       = data.aws_iam_policy_document.NAME.json,
    policy_attachments                  = []  # ARNs of AWS managed IAM policies to attach, e.g. arn:aws:iam::aws:policy/ReadOnlyAccess
    customer_managed_policy_attachments = []  # ARNs of customer managed IAM policies to attach
  }
}

Create a file named additional-permission-sets-list_override.tf in the aws-sso directory (if it does not already exist). This is a terraform override file, meaning its contents will be merged with the main terraform file, and any locals defined in it will override locals defined in other files. Having your code in this separate override file makes it possible for the component to provide a placeholder local variable so that it works without customization, while allowing you to customize the component and still update it without losing your customizations.
In that file, redefine the local variable overridable_additional_permission_sets as follows:
```
locals {
  overridable_additional_permission_sets = [
    local.NAME_permission_set,
  ]
}
```
If you have multiple custom policies, add each one to the list.
With that done, the new permission set will be created when the changes are applied. You can then use it just like the others.
If you want the permission set to be able to use Terraform, enable access to the Terraform state read/write (default) role in tfstate-backend.

Example

The example snippet below shows how to use this module with various combinations (plain YAML, YAML Anchors and a combination of the two):

prod-cloud-engineers: &prod-cloud-engineers
  Production Cloud Infrastructure Engineers:
    permission_sets:
      - AdministratorAccess
      - ReadOnlyAccess

components:
  terraform:
    aws-sso:
      vars:
        account_assignments:
          audit:
            groups:
              <<: *prod-cloud-engineers
              Production Cloud Engineers:
                permission_sets:
                  - ReadOnlyAccess
          corp:
            groups: *prod-cloud-engineers
          prod:
            groups:
              Admininstrators:
                permission_sets:
                  - AdministratorAccess
                  - ReadOnlyAccess
              Developers:
                permission_sets:
                  - ReadOnlyAccess
          dev:
            groups:
              Admininstrators:
                permission_sets:
                  - AdministratorAccess
                  - ReadOnlyAccess
              Developers:
                permission_sets:
                  - AdministratorAccess
                  - ReadOnlyAccess
        aws_teams_accessible:
        - "developers"
        - "devops"
        - "managers"
        - "support"

Requirements

Name	Version
terraform	>= 1.0.0
aws	>= 4.0

Providers

Name	Version
aws	>= 4.0

Modules

Name	Source	Version
account_map	cloudposse/stack-config/yaml//modules/remote-state	1.5.0
iam_roles	../account-map/modules/iam-roles	n/a
iam_roles_root	../account-map/modules/iam-roles	n/a
permission_sets	cloudposse/sso/aws//modules/permission-sets	1.1.1
role_map	../account-map/modules/roles-to-principals	n/a
sso_account_assignments	cloudposse/sso/aws//modules/account-assignments	1.1.1
sso_account_assignments_root	cloudposse/sso/aws//modules/account-assignments	1.1.1
tfstate	cloudposse/stack-config/yaml//modules/remote-state	1.5.0
this	cloudposse/label/null	0.25.0

Resources

Name	Type
aws_iam_policy_document.assume_aws_team	data source
aws_iam_policy_document.dns_administrator_access	data source
aws_iam_policy_document.eks_read_only	data source
aws_iam_policy_document.terraform_update_access	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
account_assignments	Enables access to permission sets for users and groups in accounts, in the following structure: `yaml <account-name>: groups: <group-name>: permission_sets: - <permission-set-name> users: <user-name>: permission_sets: - <permission-set-name>`	`map(map(map(object({ permission_sets = list(string) } ))))`	`{}`	no
additional_tag_map	Additional key-value pairs to add to each map in `tags_as_list_of_maps`. Not added to `tags` or `id`. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration.	`map(string)`	`{}`	no
attributes	ID element. Additional attributes (e.g. `workers` or `cluster`) to add to `id`, in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the `delimiter` and treated as a single ID element.	`list(string)`	`[]`	no
aws_teams_accessible	List of IAM roles (e.g. ["admin", "terraform"]) for which to create permission sets that allow the user to assume that role. Named like admin -> IdentityAdminTeamAccess	`set(string)`	`[]`	no
context	Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as `null` to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged.	`any`	`{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "descriptor_formats": {}, "enabled": true, "environment": null, "id_length_limit": null, "label_key_case": null, "label_order": [], "label_value_case": null, "labels_as_tags": [ "unset" ], "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {}, "tenant": null }`	no
delimiter	Delimiter to be used between ID elements. Defaults to `-` (hyphen). Set to `""` to use no delimiter at all.	`string`	`null`	no
descriptor_formats	Describe additional descriptors to be output in the `descriptors` output map. Map of maps. Keys are names of descriptors. Values are maps of the form `{<br/> format = string<br/> labels = list(string)<br/>}` (Type is `any` so the map values can later be enhanced to provide additional options.) `format` is a Terraform format string to be passed to the `format()` function. `labels` is a list of labels, in order, to pass to `format()` function. Label values will be normalized before being passed to `format()` so they will be identical to how they appear in `id`. Default is `{}` (`descriptors` output will be empty).	`any`	`{}`	no
enabled	Set to false to prevent the module from creating any resources	`bool`	`null`	no
environment	ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'	`string`	`null`	no
id_length_limit	Limit `id` to this many characters (minimum 6). Set to `0` for unlimited length. Set to `null` for keep the existing setting, which defaults to `0`. Does not affect `id_full`.	`number`	`null`	no
label_key_case	Controls the letter case of the `tags` keys (label names) for tags generated by this module. Does not affect keys of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper`. Default value: `title`.	`string`	`null`	no
label_order	The order in which the labels (ID elements) appear in the `id`. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.	`list(string)`	`null`	no
label_value_case	Controls the letter case of ID elements (labels) as included in `id`, set as tag values, and output by this module individually. Does not affect values of tags passed in via the `tags` input. Possible values: `lower`, `title`, `upper` and `none` (no transformation). Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs. Default value: `lower`.	`string`	`null`	no
labels_as_tags	Set of labels (ID elements) to include as tags in the `tags` output. Default is to include all labels. Tags with empty values will not be included in the `tags` output. Set to `[]` to suppress all generated tags. Notes: The value of the `name` tag, if included, will be the `id`, not the `name`. Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be changed in later chained modules. Attempts to change it will be silently ignored.	`set(string)`	`[ "default" ]`	no
name	ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a `tag`. The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input.	`string`	`null`	no
namespace	ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique	`string`	`null`	no
privileged	True if the user running the Terraform command already has access to the Terraform backend	`bool`	`false`	no
regex_replace_chars	Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits.	`string`	`null`	no
region	AWS Region	`string`	n/a	yes
stage	ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'	`string`	`null`	no
tags	Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`). Neither the tag keys nor the tag values will be modified by this module.	`map(string)`	`{}`	no
tenant	ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for	`string`	`null`	no
tfstate_environment_name	The name of the environment where `tfstate-backend` is provisioned. If not set, the TerraformUpdateAccess permission set will not be created.	`string`	`null`	no

Outputs

Name	Description
permission_sets	Permission sets
sso_account_assignments	SSO account assignments

References

cloudposse/terraform-aws-sso

CHANGELOG

Change log for aws-sso component

NOTE: This file is manually generated and is a work-in-progress.

PR 830

Fix providers.tf to properly assign roles for root account when deploying to identity account.
Restore the sts:SetSourceIdentity permission for Identity-role-TeamAccess permission sets added in PR 738 and inadvertently removed in PR 740.
Update comments and documentation to reflect Cloud Posse's current recommendation that SSO not be delegated to the identity account.

Version 1.240.1, PR 740

This PR restores compatibility with account-map prior to version 1.227.0 and fixes bugs that made versions 1.227.0 up to this release unusable.

Access control configuration (aws-teams, iam-primary-roles, aws-sso, etc.) has undergone several transformations over the evolution of Cloud Posse's reference architecture. This update resolves a number of compatibility issues with some of them.

If the roles you are using to deploy this component are allowed to assume the tfstate-backend access roles (typically ...-gbl-root-tfstate, possibly ...-gbl-root-tfstate-ro or ...-gbl-root-terraform), then you can use the defaults. This configuration was introduced in terraform-aws-components v1.227.0 and is the default for all new deployments.

If the roles you are using to deploy this component are not allowed to assume the tfstate-backend access roles, then you will need to configure this component to include the following:

components:
  terraform:
    aws-sso:
      backend:
        s3:
          role_arn: null
      vars:
        privileged: true

If you are deploying this component to the identity account, then this restriction will require you to deploy it via the SuperAdmin user. If you are deploying this component to the root account, then any user or role in the root account with the AdministratorAccess policy attached will be able to deploy this component.

v1.227.0

This component was broken by changes made in v1.227.0. Either use a version before v1.227.0 or use the version released by PR 740 or later.

Component: aws-sso

Usage​

Clickops​

Delegation no longer recommended​

Atmos​

account_assignments​

identity_roles_accessible​

Defining a new permission set​

Example​

Requirements​

Providers​

Modules​

Resources​

Inputs​

Outputs​

References​

CHANGELOG​

Change log for aws-sso component​

PR 830​

Version 1.240.1, PR 740​

v1.227.0​