identity-center

This component is responsible for creating AWS SSO Permission Sets and creating AWS SSO Account Assignments, that is, assigning IdP (Okta) groups and/or users to AWS SSO permission sets in specific AWS Accounts.

This component assumes that AWS SSO has already been enabled via the AWS Console (there isn't terraform or AWS CLI support for this currently) and that the IdP has been configured to sync users and groups to AWS SSO.

Usage

Clickops

Go to root admin account
Select primary region
Go to AWS SSO
Enable AWS SSO

Delegation no longer recommended

Previously, Cloud Posse recommended delegating SSO to the identity account by following the next 2 steps:

Click Settings > Management
Delegate Identity as an administrator. This can take up to 30 minutes to take effect.

However, this is no longer recommended. Because the delegated SSO administrator cannot make changes in the root account and this component needs to be able to make changes in the root account, any purported security advantage achieved by delegating SSO to the identity account is lost.

Nevertheless, it is also not worth the effort to remove the delegation. If you have already delegated SSO to the identity, continue on, leaving the stack configuration in the gbl-identity stack rather than the currently recommended gbl-root stack.

Google Workspace

important

Your identity source is currently configured as 'External identity provider'. To add new groups or edit their memberships, you must do this using your external identity provider.

Groups cannot be created with ClickOps in the AWS console and instead must be created with AWS API.

Google Workspace is now supported by AWS Identity Center, but Group creation is not automatically handled. After configuring SAML and SCIM with Google Workspace and IAM Identity Center following the AWS documentation, add any Group name to var.groups to create the Group with Terraform. Once the setup steps as described in the AWS documentation have been completed and the Groups are created with Terraform, Users should automatically populate each created Group.

components:
  terraform:
    aws-sso:
      vars:
        groups:
          - "Developers"
          - "Dev Ops"

Atmos

Stack Level: Global Deployment: Must be deployed by root-admin using atmos CLI

Add catalog to gbl-root root stack.

`account_assignments`

The account_assignments setting configures access to permission sets for users and groups in accounts, in the following structure:

<account-name>:
  groups:
    <group-name>:
      permission_sets:
        - <permission-set-name>
  users:
    <user-name>:
      permission_sets:
        - <permission-set-name>

The account names (a.k.a. "stages") must already be configured via the accounts component.
The user and group names must already exist in AWS SSO. Usually this is accomplished by configuring them in Okta and syncing Okta with AWS SSO.
The permission sets are defined (by convention) in files names policy-<permission-set-name>.tf in the aws-sso component. The definition includes the name of the permission set. See components/terraform/aws-sso/policy-AdminstratorAccess.tf for an example.

`identity_roles_accessible`

The identity_roles_accessible element provides a list of role names corresponding to roles created in the iam-primary-roles component. For each named role, a corresponding permission set will be created which allows the user to assume that role. The permission set name is generated in Terraform from the role name using this statement:

format("Identity%sTeamAccess", replace(title(role), "-", ""))

Defining a new permission set

Give the permission set a name, capitalized, in CamelCase, e.g. AuditManager. We will use NAME as a placeholder for the name in the instructions below. In Terraform, convert the name to lowercase snake case, e.g. audit_manager.
Create a file in the aws-sso directory with the name policy-NAME.tf.

In that file, create a policy as follows:

data "aws_iam_policy_document" "TerraformUpdateAccess" {
  # Define the custom policy here
}

locals {
  NAME_permission_set = {                         # e.g. audit_manager_permission_set
    name                                = "NAME",  # e.g. AuditManager
    description                         = "<description>",
    relay_state                         = "",
    session_duration                    = "PT1H", # One hour, maximum allowed for chained assumed roles
    tags                                = {},
    inline_policy                       = data.aws_iam_policy_document.NAME.json,
    policy_attachments                  = []  # ARNs of AWS managed IAM policies to attach, e.g. arn:aws:iam::aws:policy/ReadOnlyAccess
    customer_managed_policy_attachments = []  # ARNs of customer managed IAM policies to attach
  }
}

Create a file named additional-permission-sets-list_override.tf in the aws-sso directory (if it does not already exist). This is a terraform override file, meaning its contents will be merged with the main terraform file, and any locals defined in it will override locals defined in other files. Having your code in this separate override file makes it possible for the component to provide a placeholder local variable so that it works without customization, while allowing you to customize the component and still update it without losing your customizations.
In that file, redefine the local variable overridable_additional_permission_sets as follows:
```
locals {
  overridable_additional_permission_sets = [
    local.NAME_permission_set,
  ]
}
```
If you have multiple custom policies, add each one to the list.
With that done, the new permission set will be created when the changes are applied. You can then use it just like the others.
If you want the permission set to be able to use Terraform, enable access to the Terraform state read/write (default) role in tfstate-backend.

Example

The example snippet below shows how to use this module with various combinations (plain YAML, YAML Anchors and a combination of the two):

prod-cloud-engineers: &prod-cloud-engineers
  Production Cloud Infrastructure Engineers:
    permission_sets:
      - AdministratorAccess
      - ReadOnlyAccess

components:
  terraform:
    aws-sso:
      vars:
        account_assignments:
          audit:
            groups:
              <<: *prod-cloud-engineers
              Production Cloud Engineers:
                permission_sets:
                  - ReadOnlyAccess
          corp:
            groups: *prod-cloud-engineers
          prod:
            groups:
              Administrators:
                permission_sets:
                  - AdministratorAccess
                  - ReadOnlyAccess
              Developers:
                permission_sets:
                  - ReadOnlyAccess
          dev:
            groups:
              Administrators:
                permission_sets:
                  - AdministratorAccess
                  - ReadOnlyAccess
              Developers:
                permission_sets:
                  - AdministratorAccess
                  - ReadOnlyAccess
        aws_teams_accessible:
          - "developers"
          - "devops"
          - "managers"
          - "support"

Variables

Required Variables

region (string) required: AWS Region

Optional Variables

account_assignments optional

Enables access to permission sets for users and groups in accounts, in the following structure:

<account-name>:<br/>
  groups:<br/>
    <group-name>:<br/>
      permission_sets:<br/>
        - <permission-set-name><br/>
  users:<br/>
    <user-name>:<br/>
      permission_sets:<br/>
        - <permission-set-name><br/>
```<br/>
<br/>
<br/>
<br/>

**Type:**
```hcl
map(map(map(object({
permission_sets = list(string)
}
))))

Default value: { }

aws_teams_accessible (set(string)) optional

List of IAM roles (e.g. ["admin", "terraform"]) for which to create permission
sets that allow the user to assume that role. Named like
admin -> IdentityAdminTeamAccess

Default value: [ ]

groups (list(string)) optional

List of AWS Identity Center Groups to be created with the AWS API.

When provisioning the Google Workspace Integration with AWS, Groups need to be created with API in order for automatic provisioning to work as intended.

Default value: [ ]

privileged (bool) optional

True if the user running the Terraform command already has access to the Terraform backend

Default value: false

tfstate_environment_name (string) optional

The name of the environment where tfstate-backend is provisioned. If not set, the TerraformUpdateAccess permission set will not be created.

Default value: null

Context Variables

The following variables are defined in the context.tf file of this module and part of the terraform-null-label pattern.

additional_tag_map (map(string)) optional

Additional key-value pairs to add to each map in tags_as_list_of_maps. Not added to tags or id.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.

Required: No

Default value: { }

attributes (list(string)) optional

ID element. Additional attributes (e.g. workers or cluster) to add to id,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the delimiter
and treated as a single ID element.

Required: No

Default value: [ ]

context (any) optional

Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as null to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.

Required: No

Default value:

{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}

delimiter (string) optional

Delimiter to be used between ID elements.
Defaults to - (hyphen). Set to "" to use no delimiter at all.

Required: No

Default value: null

descriptor_formats (any) optional

Describe additional descriptors to be output in the descriptors output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
\{<br/> format = string<br/> labels = list(string)<br/> \}
(Type is any so the map values can later be enhanced to provide additional options.)
format is a Terraform format string to be passed to the format() function.
labels is a list of labels, in order, to pass to format() function.
Label values will be normalized before being passed to format() so they will be
identical to how they appear in id.
Default is {} (descriptors output will be empty).

Required: No

Default value: { }

enabled (bool) optional

Set to false to prevent the module from creating any resources
Required: No

Default value: null

environment (string) optional

ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'
Required: No

Default value: null

id_length_limit (number) optional

Limit id to this many characters (minimum 6).
Set to 0 for unlimited length.
Set to null for keep the existing setting, which defaults to 0.
Does not affect id_full.

Required: No

Default value: null

label_key_case (string) optional

Controls the letter case of the tags keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the tags input.
Possible values: lower, title, upper.
Default value: title.

Required: No

Default value: null

label_order (list(string)) optional

The order in which the labels (ID elements) appear in the id.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.

Required: No

Default value: null

label_value_case (string) optional

Controls the letter case of ID elements (labels) as included in id,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the tags input.
Possible values: lower, title, upper and none (no transformation).
Set this to title and set delimiter to "" to yield Pascal Case IDs.
Default value: lower.

Required: No

Default value: null

labels_as_tags (set(string)) optional

Set of labels (ID elements) to include as tags in the tags output.
Default is to include all labels.
Tags with empty values will not be included in the tags output.
Set to [] to suppress all generated tags.
Notes:
The value of the name tag, if included, will be the id, not the name.
Unlike other null-label inputs, the initial setting of labels_as_tags cannot be
changed in later chained modules. Attempts to change it will be silently ignored.

Required: No

Default value:

[
  "default"
]

name (string) optional

ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a tag.
The "name" tag is set to the full id string. There is no tag with the value of the name input.

Required: No

Default value: null

namespace (string) optional

ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique
Required: No

Default value: null

regex_replace_chars (string) optional

Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits.

Required: No

Default value: null

stage (string) optional

ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'
Required: No

Default value: null

tags (map(string)) optional

Additional tags (e.g. {'BusinessUnit': 'XYZ'}).
Neither the tag keys nor the tag values will be modified by this module.

Required: No

Default value: { }

tenant (string) optional

ID element (Rarely used, not included by default). A customer identifier, indicating who this instance of a resource is for
Required: No

Default value: null

Outputs

group_ids: Group IDs created for Identity Center
permission_sets: Permission sets
sso_account_assignments: SSO account assignments

Dependencies

Requirements

terraform, version: >= 1.0.0
aws, version: >= 4.0

Providers

aws, version: >= 4.0

Modules

Name	Version	Source	Description
`account_map`	1.5.0	`cloudposse/stack-config/yaml//modules/remote-state`	n/a
`iam_roles`	latest	`../account-map/modules/iam-roles`	n/a
`iam_roles_root`	latest	`../account-map/modules/iam-roles`	n/a
`permission_sets`	1.1.1	`cloudposse/sso/aws//modules/permission-sets`	n/a
`role_map`	latest	`../account-map/modules/roles-to-principals`	n/a
`sso_account_assignments`	1.1.1	`cloudposse/sso/aws//modules/account-assignments`	n/a
`sso_account_assignments_root`	1.1.1	`cloudposse/sso/aws//modules/account-assignments`	n/a
`tfstate`	1.5.0	`cloudposse/stack-config/yaml//modules/remote-state`	n/a
`this`	0.25.0	`cloudposse/label/null`	n/a

Resources

The following resources are used by this module:

aws_identitystore_group.manual (resource)

Data Sources

The following data sources are used by this module:

aws_iam_policy_document.assume_aws_team (data source)
aws_iam_policy_document.dns_administrator_access (data source)
aws_iam_policy_document.eks_read_only (data source)
aws_iam_policy_document.terraform_update_access (data source)
aws_partition.current (data source)
aws_ssoadmin_instances.this (data source)

References

cloudposse/terraform-aws-sso

Changelog

Change log for aws-sso component

NOTE: This file is manually generated and is a work-in-progress.

PR 830

Fix providers.tf to properly assign roles for root account when deploying to identity account.
Restore the sts:SetSourceIdentity permission for Identity-role-TeamAccess permission sets added in PR 738 and inadvertently removed in PR 740.
Update comments and documentation to reflect Cloud Posse's current recommendation that SSO not be delegated to the identity account.

Version 1.240.1, PR 740

This PR restores compatibility with account-map prior to version 1.227.0 and fixes bugs that made versions 1.227.0 up to this release unusable.

Access control configuration (aws-teams, iam-primary-roles, aws-sso, etc.) has undergone several transformations over the evolution of Cloud Posse's reference architecture. This update resolves a number of compatibility issues with some of them.

If the roles you are using to deploy this component are allowed to assume the tfstate-backend access roles (typically ...-gbl-root-tfstate, possibly ...-gbl-root-tfstate-ro or ...-gbl-root-terraform), then you can use the defaults. This configuration was introduced in terraform-aws-components v1.227.0 and is the default for all new deployments.

If the roles you are using to deploy this component are not allowed to assume the tfstate-backend access roles, then you will need to configure this component to include the following:

components:
  terraform:
    aws-sso:
      backend:
        s3:
          role_arn: null
      vars:
        privileged: true

If you are deploying this component to the identity account, then this restriction will require you to deploy it via the SuperAdmin user. If you are deploying this component to the root account, then any user or role in the root account with the AdministratorAccess policy attached will be able to deploy this component.

v1.227.0

This component was broken by changes made in v1.227.0. Either use a version before v1.227.0 or use the version released by PR 740 or later.

Usage​

Clickops​

Delegation no longer recommended​

Google Workspace​

Atmos​

account_assignments​

identity_roles_accessible​

Defining a new permission set​

Example​

Variables​

Required Variables​

Optional Variables​

Context Variables​

Outputs​

Dependencies​

Requirements​

Providers​

Modules​

Resources​

Data Sources​

References​

Changelog​

Change log for aws-sso component​

PR 830​

Version 1.240.1, PR 740​

v1.227.0​

Usage

Clickops

Delegation no longer recommended

Google Workspace

Atmos

`account_assignments`

`identity_roles_accessible`

Defining a new permission set

Example

Variables

Required Variables

Optional Variables

Context Variables

Outputs

Dependencies

Requirements

Providers

Modules

Resources

Data Sources

References

Changelog

Change log for aws-sso component

PR 830

Version 1.240.1, PR 740

v1.227.0