template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: AWS IAM Identity Center (Successor to AWS Single Sign-On)
        Parameters:
          - SCIMEndpointUrl
          - SCIMEndpointAccessToken
          - Region
          - IdentityStoreID
      - Label:
          default: Google Workspace Credentials 
        Parameters:
          - GoogleAdminEmail
          - GoogleCredentials
      - Label:
          default: Sync Configuration
        Parameters:
          - SyncMethod
          - GoogleUserMatch
          - GoogleGroupMatch
          - IgnoreUsers
          - IgnoreGroups
      - Label:
          default: "Configuration options for users_groups Mode only"
        Parameters:
          - IncludeGroups
      - Label:
          default: "Lambda Configuration"
        Parameters:
          - FunctionName
          - LogLevel
          - LogFormat
          - TimeOut
          - ScheduleExpression

  AWS::ServerlessRepo::Application:
    Name: ssosync
    Description: Helping you populate AWS SSO directly with your Google Apps users.
    Author: Sebastian Doell
    SpdxLicenseId: Apache-2.0
    # paths are relative to .aws-sam/build directory
    LicenseUrl: LICENSE
    ReadmeUrl: SAR.md
    Labels: [serverless, sso, lambda, scim]
    HomePageUrl: https://github.com/awslabs/ssosync
    # Update the semantic version and run sam publish to publish a new version of your app
    SemanticVersion: 1.0.0-rc.10
    # best practice is to use git tags for each release and link to the version tag as your source code URL
    SourceCodeUrl: https://github.com/awslabs/ssosync/

Parameters:
  FunctionName:
    Type: String
    Description: Specify the Function you want to us for this deployment, leave empty for default behaviour.
    AllowedPattern: '(?!.*\s)|[a-zA-Z0-9-_]{1,140}'
  ScheduleExpression:
    Type: String
    Description: Schedule for trigger the execution of ssosync (see CloudWatch schedule expressions)
    Default: rate(15 minutes)
    AllowedPattern: '(?!.*\s)|rate\(\d{1,3} (minutes|hours|days)\)|(cron\((([0-9]|[1-5][0-9]|60)|\d\/([0-9]|[1-5][0-9]|60)|\*) (([0-9]|[1][0-9]|[2][0-3])|(\d\/([0-9]|[1][0-9]|[2][0-3]))|(([0-9]|[1][0-9]|[2][0-3])-([0-9]|[1][0-9]|[2][0-3]))|\*) (([1-9]|[1-2][0-9]|[3][0-1])|\d\/([1-9]|[1-2][0-9]|[3][0-1])|[1-5]W|L|\*|\?) (([1-9]|[1][1-2])|(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)|((JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV)-(FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC))|(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV)(,(FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)){0,11}|\d\/([0-9]|[1][0-2])|\?|\*) ((MON|TUE|WED|THU|FRI|SAT|SUN)|(MON|TUE|WED|THU|FRI|SAT)-(TUE|WED|THU|FRI|SAT|SUN)|(MON|TUE|WED|THU|FRI|SAT)(,(TUE|WED|THU|FRI|SAT|SUN)){0,6}|[1-7]L|[1-7]#[1-5]|\?|\*) ((19[7-9][0-9]|2[0-1]\d\d)|(19[7-9][0-9]|2[0-1]\d\d)-(19[7-9][0-9]|2[0-1]\d\d)|(19[7-9][0-9]|2[0-1]\d\d)(,(19[7-9][0-9]|2[0-1]\d\d))*|\*)\))'
  LogLevel:
    Type: String
    Description: Log level for Lambda function logging
    Default: warn
    AllowedValues:
      - panic
      - fatal
      - error
      - warn
      - info
      - debug
      - trace
  LogFormat:
    Type: String
    Description: Log format for Lambda function logging
    Default: json
    AllowedValues:
      - json
      - text
  LogRetention:
    Type: String
    Description: Number of days to retain Logs for, leave empty to retain them indefinitely
    Default: ""
    AllowedPattern: '(?!.*\s)|/d'
  TimeOut:
    Type: Number
    Description: Timeout for the Lambda function
    Default: 300
    MinValue: 1
    MaxValue: 900


  GoogleCredentials:
    Type: String
    Description: |
      Credentials to log into Google (content of credentials.json)
    ConstraintDescription: |
      You should save this information when following this setup https://developers.google.com/admin-sdk/directory/v1/guides/delegation
    NoEcho: true
  GoogleAdminEmail:
    Type: String
    Description: |
      Google Admin email
    ConstraintDescription: |
      This is a use with admin authority on your Google Directory, you will have used this when following this setup https://developers.google.com/admin-sdk/directory/v1/guides/delegation
    NoEcho: true
  SCIMEndpointUrl:
    Type: String
    Description: |
      AWS IAM Identity Center - SCIM Endpoint Url
    AllowedPattern: "https://scim.(us(-gov)?|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-([0-9]{1}).amazonaws.com/(.*)-([a-z0-9]{4})-([a-z0-9]{4})-([a-z0-9]{12})/scim/v2/"
    ConstraintDescription: |
      You should save this information when following this setup https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html
    NoEcho: true
  SCIMEndpointAccessToken:
    Type: String
    Description: |
      AWS IAM Identity Center - SCIM AccessToken
    ConstraintDescription: |
      You should save this information when following this setup https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html
    NoEcho: true
  Region:
    Type: String
    Description: |
      AWS Region where AWS IAM Identity Center is enabled
    ConstraintDescription: |
      You can find this value on the settings page of the IAM Identity Center console page
    AllowedPattern: '(us(-gov)?|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-\d'
  IdentityStoreID:
    Type: String
    Description: |
      Identifier of Identity Store in AWS IAM Identity Center
    ConstraintDescription: |
      You can find this value on the settings page of the IAM Identity Center console page
    NoEcho: true
    AllowedPattern: 'd-[1-z0-9]{10}'

  GoogleUserMatch:
    Type: String
    Description: |
      Google Workspace user filter query parameter, example: 'name:John* email:admin*', leave empty if you do not wish to pass this parameter 
    ConstraintDescription: |
      The parameter needs to be compliant with the Google admin-sdk api, https://developers.google.com/admin-sdk/directory/v1/guides/search-users
    Default: ""
    AllowedPattern: '(?!.*\s)|(name|Name|NAME)(:([a-zA-Z0-9]{1,64})(\*))|(name|Name|NAME)(=([a-zA-Z0-9 ]{1,64}))|(email|Email|EMAIL)(:([a-zA-Z0-9.-_]{1,64})(\*))|(email|Email|EMAIL)(=([a-zA-Z0-9.-_]{1,64})@([a-zA-Z0-9.-]{5,260}))'
  GoogleGroupMatch:
    Type: String
    Description: |
      Google Workspace group filter query parameter, example: 'name:Admin* email:aws-*', leave empty if you do not wish to pass this parameter
    ConstraintDescription: |
      The parameter needs to be compliant with the Google admin-sdk api, see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups
    Default: 'name:AWS*'
    AllowedPattern: '(?!.*\s)|(name|Name|NAME)(:([a-zA-Z0-9]{1,64})\*)|(name|Name|NAME)(=([a-zA-Z0-9 ]{1,64}))|(email|Email|EMAIL)(:([a-zA-Z0-9.-_]{1,64})\*)|(email|Email|EMAIL)(=([a-zA-Z0-9.-_]{1,64})@([a-zA-Z0-9.-]{5,260}))'
  IgnoreGroups:
    Type: String
    Description: |
      Do NOT sync these Google Workspace groups into IAM Identity Center, leave empty if not required
    ConstraintDescription: |
      This should be a comma separated list of group names
    Default: ""
    AllowedPattern: '(?!.*\s)|(["0-9a-zA-Z-=@. _]*)(,["0-9a-zA-Z-=@. _]*)*'
  IgnoreUsers:
    Type: String
    Description: |
      Ignore these Google Workspace users, leave empty if not required
    ConstraintDescription: |
      This should be a comma separated list of group names
    Default: ""
    AllowedPattern: '(?!.*\s)|([0-9a-zA-Z-= _]*)(,[0-9a-zA-Z-=@. _]*)*'
  IncludeGroups:
    Type: String
    Description: |
      Include only these Google Workspace groups, leave empty if not required. (Only applicable for SyncMethod user_groups)
    ConstraintDescription: |
      This should be a comma separated list of group names
    Default: ""
    AllowedPattern: '(?!.*\s)|([0-9a-zA-Z-= _]*)(,[0-9a-zA-Z-=@. _]*)*'
  SyncMethod:
    Type: String
    Description: |
      Which sync method do you want to use with ssosync?
    Default: groups
    AllowedValues:
      - groups
      - users_groups

Conditions:
  SetFunctionName: !Not [!Equals [!Ref "FunctionName", ""]]
  OnSchedule: !Not [!Equals [!Ref "ScheduleExpression", ""]]
  SetGoogleUserMatch: !Or [!Not [!Equals [!Ref "GoogleUserMatch", ""]], !Equals [!Ref "SyncMethod", users_groups]]
  SetGoogleGroupMatch: !Or [!Not [!Equals [!Ref "GoogleGroupMatch", ""]], !Equals [!Ref "SyncMethod", users_groups]]
  SetIgnoreGroups: !Not [!Equals [!Ref "IgnoreGroups", ""]]
  SetIgnoreUsers: !Not [!Equals [!Ref "IgnoreUsers", ""]]
  SetIncludeGroups: !Or [!Not [!Equals [!Ref "IncludeGroups", ""]], !Equals [!Ref "SyncMethod", groups]]
  NotIndefinite: !Not [!Equals [!Ref "LogRetention", ""]]
    
Resources:
  SSOSyncFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !If [SetFunctionName, !Ref FunctionName, AWS::NoValue]
      Runtime: provided.al2
      Handler: bootstrap
      Architectures:
        - arm64
      Timeout: !Ref TimeOut
      Environment:
        Variables:
          SSOSYNC_LOG_LEVEL: !Ref LogLevel
          SSOSYNC_LOG_FORMAT: !Ref LogFormat
          SSOSYNC_GOOGLE_CREDENTIALS: !Ref AWSGoogleCredentialsSecret
          SSOSYNC_GOOGLE_ADMIN: !Ref AWSGoogleAdminEmail
          SSOSYNC_SCIM_ENDPOINT: !Ref AWSSCIMEndpointSecret
          SSOSYNC_SCIM_ACCESS_TOKEN: !Ref AWSSCIMAccessTokenSecret
          SSOSYNC_REGION: !Ref AWSRegionSecret
          SSOSYNC_IDENTITY_STORE_ID: !Ref AWSIdentityStoreIDSecret
          SSOSYNC_USER_MATCH: !If [SetGoogleUserMatch, !Ref GoogleUserMatch, AWS::NoValue]
          SSOSYNC_GROUP_MATCH: !If [SetGoogleGroupMatch, !Ref GoogleGroupMatch, AWS::NoValue]
          SSOSYNC_SYNC_METHOD: !Ref SyncMethod
          SSOSYNC_IGNORE_GROUPS: !If [SetIgnoreGroups, !Ref IgnoreGroups, AWS::NoValue]
          SSOSYNC_IGNORE_USERS: !If [SetIgnoreUsers, !Ref IgnoreUsers, AWS::NoValue]
          SSOSYNC_INCLUDE_GROUPS: !If [SetIncludeGroups, !Ref IncludeGroups, AWS::NoValue]
      Policies:
        - Version: '2012-10-17'
          Statement:
            - Sid: SSMGetParameterPolicy
              Effect: Allow
              Action:
                - "secretsmanager:Get*"
              Resource:
                - !Ref AWSGoogleCredentialsSecret
                - !Ref AWSGoogleAdminEmail
                - !Ref AWSSCIMEndpointSecret
                - !Ref AWSSCIMAccessTokenSecret
                - !Ref AWSRegionSecret
                - !Ref AWSIdentityStoreIDSecret
            - Sid: IdentityStoreAccesPolicy
              Effect: Allow
              Action:
                - "identitystore:DeleteUser"
                - "identitystore:CreateGroup"
                - "identitystore:CreateGroupMembership"
                - "identitystore:ListGroups"
                - "identitystore:ListUsers"
                - "identitystore:ListGroupMemberships"
                - "identitystore:IsMemberInGroups"
                - "identitystore:GetGroupMembershipId"
                - "identitystore:DeleteGroupMembership"
                - "identitystore:DeleteGroup"
              Resource:
                - "*"
            - Sid: CodePipelinePolicy
              Effect: Allow
              Action:
                - codepipeline:PutJobSuccessResult
                - codepipeline:PutJobFailureResult
              Resource: "*"
      Events:
        SyncScheduledEvent:
          Type: Schedule
          Name: AWSSyncSchedule
          Properties:
            Enabled: !If [OnSchedule, false, true]
            Schedule: !If [OnSchedule, !Ref ScheduleExpression, "rate(15 minutes)"]

  # Explicit log group that refers to the Lambda function
  LogGroup:
    Type: AWS::Logs::LogGroup
    Condition: NotIndefinite
    Properties:
      LogGroupName: !Sub "/aws/lambda/${SSOSyncFunction}"
      # Explicit retention time
      RetentionInDays: !Ref LogRetention

  AWSGoogleCredentialsSecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncGoogleCredentials
      SecretString: !Ref GoogleCredentials

  AWSGoogleAdminEmail:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncGoogleAdminEmail
      SecretString: !Ref GoogleAdminEmail

  AWSSCIMEndpointSecret: # This can be moved to custom provider
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncSCIMEndpointUrl
      SecretString: !Ref SCIMEndpointUrl

  AWSSCIMAccessTokenSecret: # This can be moved to custom provider
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncSCIMAccessToken
      SecretString: !Ref SCIMEndpointAccessToken

  AWSRegionSecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncRegion
      SecretString: !Ref Region

  AWSIdentityStoreIDSecret:
    Type: "AWS::SecretsManager::Secret"
    Properties:
      Name: SSOSyncIdentityStoreID
      SecretString: !Ref IdentityStoreID

Outputs:
  FunctionArn:
    Description: "The Arn of the deployed lambda function"
    Value: !GetAtt SSOSyncFunction.Arn
    Export:
      Name: SSOSyncFunctionARN