template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "General"
        Parameters:
          - GoogleCredentials
          - GoogleAdminEmail
          - SCIMEndpointUrl
          - SCIMEndpointAccessToken
          - Region
          - IdentityStoreID
      - Label:
          default: "Advanced Configuration"
        Parameters:
          - SyncMethod
          - GoogleUserMatch
          - GoogleGroupMatch
          - LogLevel
          - LogFormat
          - ScheduleExpression
          - IgnoreUsers
          - IgnoreGroups
          - IncludeGroups

  AWS::ServerlessRepo::Application:
    Name: ssosync
    Description: Helping you populate AWS SSO directly with your Google Apps users.
    Author: Sebastian Doell
    SpdxLicenseId: Apache-2.0
    # paths are relative to .aws-sam/build directory
    LicenseUrl: LICENSE
    ReadmeUrl: SAR.md
    Labels: [serverless, sso, lambda, scim]
    HomePageUrl: https://github.com/awslabs/ssosync
    # Update the semantic version and run sam publish to publish a new version of your app
    SemanticVersion: 1.0.0-rc.10
    # best practice is to use git tags for each release and link to the version tag as your source code URL
    SourceCodeUrl: https://github.com/awslabs/ssosync/tree/1.0.0-rc.10

Parameters:
  ScheduleExpression:
    Type: String
    Description: Schedule for trigger the execution of ssosync (see CloudWatch schedule expressions)
    Default: rate(15 minutes)
  LogLevel:
    Type: String
    Description: Log level for Lambda function logging
    Default: warn
    AllowedValues:
      - panic
      - fatal
      - error
      - warn
      - info
      - debug
      - trace
  LogFormat:
    Type: String
    Description: Log format for Lambda function logging
    Default: json
    AllowedValues:
      - json
      - text
  GoogleCredentials:
    Type: String
    Description: Credentials to log into Google (content of credentials.json)
    NoEcho: true
  GoogleAdminEmail:
    Type: String
    Description: Google Admin email
    NoEcho: true
  SCIMEndpointUrl:
    Type: String
    Description: AWS SSO SCIM Endpoint Url
    NoEcho: true
  SCIMEndpointAccessToken:
    Type: String
    Description: AWS SSO SCIM AccessToken
    NoEcho: true
  Region:
    Type: String
    Description: AWS Region where AWS SSO is enabled
    NoEcho: true
  IdentityStoreID:
    Type: String
    Description: Identifier of Identity Store in AWS SSO
    NoEcho: true
  GoogleUserMatch:
    Type: String
    Description: |
      Google Workspace user filter query parameter, example: 'name:John* email:admin*', see: https://developers.google.com/admin-sdk/directory/v1/guides/search-users
  GoogleGroupMatch:
    Type: String
    Description: |
      Google Workspace group filter query parameter, example: 'name:Admin* email:aws-*', see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups
  IgnoreGroups:
    Type: String
    Description: |
      Ignore these Google Workspace groups
  IgnoreUsers:
    Type: String
    Description: |
      Ignore these Google Workspace users
  IncludeGroups:
    Type: String
    Description: |
      Include only these Google Workspace groups. (Only applicable for SyncMethod user_groups)
  SyncMethod:
    Type: String
    Description: Sync method to use
    Default: groups
    AllowedValues:
      - groups
      - users_groups




Resources:
  SSOSyncFunction:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: go1.x
      Handler: dist/ssosync_linux_amd64_v1/ssosync
      Timeout: 300
      Environment:
        Variables:
          SSOSYNC_LOG_LEVEL: !Ref LogLevel
          SSOSYNC_LOG_FORMAT: !Ref LogFormat
          SSOSYNC_GOOGLE_CREDENTIALS: !Ref AWSGoogleCredentialsSecret
          SSOSYNC_GOOGLE_ADMIN: !Ref AWSGoogleAdminEmail
          SSOSYNC_SCIM_ENDPOINT: !Ref AWSSCIMEndpointSecret
          SSOSYNC_SCIM_ACCESS_TOKEN: !Ref AWSSCIMAccessTokenSecret
          SSOSYNC_REGION: !Ref AWSRegionSecret
          SSOSYNC_IDENTITY_STORE_ID: !Ref AWSIdentityStoreIDSecret
          SSOSYNC_USER_MATCH: !Ref GoogleUserMatch
          SSOSYNC_GROUP_MATCH: !Ref GoogleGroupMatch
          SSOSYNC_SYNC_METHOD: !Ref SyncMethod
          SSOSYNC_IGNORE_GROUPS: !Ref IgnoreGroups
          SSOSYNC_IGNORE_USERS: !Ref IgnoreUsers
          SSOSYNC_INCLUDE_GROUPS: !Ref IncludeGroups
      Policies:
        - Statement:
            - Sid: SSMGetParameterPolicy
              Effect: Allow
              Action:
                - "secretsmanager:Get*"
              Resource:
                - !Ref AWSGoogleCredentialsSecret
                - !Ref AWSGoogleAdminEmail
                - !Ref AWSSCIMEndpointSecret
                - !Ref AWSSCIMAccessTokenSecret
                - !Ref AWSRegionSecret
                - !Ref AWSIdentityStoreIDSecret
        - Version: '2012-10-17'
          Statement:
            - Sid: IdentityStoreAccesPolicy
              Effect: Allow
              Action:
                - "identitystore:DeleteUser"
                - "identitystore:CreateGroup"
                - "identitystore:CreateGroupMembership"
                - "identitystore:ListGroups"
                - "identitystore:ListUsers"
                - "identitystore:ListGroupMemberships"
                - "identitystore:IsMemberInGroups"
                - "identitystore:GetGroupMembershipId"
                - "identitystore:DeleteGroupMembership"
              Resource:
                - "*"
      Events:
        SyncScheduledEvent:
          Type: Schedule
          Name: AWSSyncSchedule
          Properties:
            Enabled: true
            Schedule: !Ref ScheduleExpression

  AWSGoogleCredentialsSecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncGoogleCredentials
      SecretString: !Ref GoogleCredentials

  AWSGoogleAdminEmail:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncGoogleAdminEmail
      SecretString: !Ref GoogleAdminEmail

  AWSSCIMEndpointSecret: # This can be moved to custom provider
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncSCIMEndpointUrl
      SecretString: !Ref SCIMEndpointUrl

  AWSSCIMAccessTokenSecret: # This can be moved to custom provider
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncSCIMAccessToken
      SecretString: !Ref SCIMEndpointAccessToken

  AWSRegionSecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncRegion
      SecretString: !Ref Region

  AWSIdentityStoreIDSecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncIdentityStoreID
      SecretString: !Ref IdentityStoreID