Skip to content

Latest commit

 

History

History
93 lines (72 loc) · 4.85 KB

README.md

File metadata and controls

93 lines (72 loc) · 4.85 KB
Raw

Terraform Module for AWS/Google SSO Sync

This module deploys the AWS/Google SSOSync Lambda. You must follow the instructions in the SSOSync project to prepare your Google directory, create your Google credentials and prepare your SCIM endpoint. Before using this module, Google must already be configured as the SAML provider for IAM Identity Center.

It is recommended that you deploy this module in the delegated administrator account for IAM Identity Center.

Usage:

module "sso_sync" {
  source = "github.com/thoughtbot/terraform-aws-google-sso?ref=VERSION"

  google_admin_email         = "[email protected]"
  google_credentials         = local.secrets.GoogleCredentials
  google_group_match         = "email:aws-*"
  name                       = "aws-google-sso-sync"
  scim_endpoint_access_token = local.secrets.SCIMEndpointAccessToken
  scim_endpoint_url          = local.secrets.SCIMEndpointUrl
  semantic_version           = "2.0.2"
}


locals {
  secrets = jsondecode(
    data.aws_secretsmanager_secret_version.sso_sync.secret_string
  )
}

data "aws_secretsmanager_secret_version" "sso_sync" {
  secret_id = "aws-google-sso-sync"
}

Requirements

Name Version
terraform >= 1.0
aws ~> 5.0

Providers

Name Version
aws ~> 5.0

Modules

No modules.

Resources

Name Type
aws_serverlessapplicationrepository_cloudformation_stack.this resource
aws_region.current data source
aws_ssoadmin_instances.this data source

Inputs

Name Description Type Default Required
application_id ID of the serverless application to deploy; defaults to official SSOSync string null no
google_admin_email Email address of the Google admin who created the service account string n/a yes
google_credentials Service account credentials for syncing users and groups string n/a yes
google_group_match Pattern for finding which groups to sync (default all) string "" no
google_ignore_groups Google groups to ignore (default none) string "" no
google_ignore_users Google users to ignore (default none) string "" no
google_user_match Pattern for finding which users to sync (defaults to all in matched groups) string "" no
identity_store_id ID of the identity store to sync; defaults to the first store string null no
name Name of the CloudFormation stack string "aws-google-sso-sync" no
region AWS region in which to deploy the Lambda; defaults to current string null no
scim_endpoint_access_token Access token for AWS SCIM provisioner string n/a yes
scim_endpoint_url URL for AWS SCIM provisioner string n/a yes
semantic_version Version of SSOSync to deploy string n/a yes
tags Tags to apply to created resources map(string) {} no

Outputs

Name Description
stack_id ID of the created CloudFormation stack
stack_outputs Outputs from the CloudFormation stack