iam-google.tf

# Setup identity provider to allow Google login
resource "aws_iam_saml_provider" "hhl" {
  name                   = "hhlGoogleWorkspace"
  saml_metadata_document = file("${path.module}/files/hhlGoogleIDPMetadata.xml")
}

data "aws_iam_policy_document" "saml_trust_policy" {
  # Security Account
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::249394787319:root"]
    }
  }

  # Google SSO
  statement {
    actions = ["sts:AssumeRoleWithSAML"]

    principals {
      type        = "Federated"
      identifiers = [aws_iam_saml_provider.hhl.arn]
    }

    condition {
      test     = "StringEquals"
      variable = "SAML:aud"
      values   = ["https://signin.aws.amazon.com/saml"]
    }
  }
}