AWS SSO Terraform module

This module handles creation of AWS SSO permission sets and assignment to AWS SSO entities and AWS Accounts.

Pre-requisites

Before this module can be used, please ensure that the following pre-requisites are met:

• Enable AWS Organizations and add AWS Accounts you want to be managed by SSO. Documentation
• Enable AWS SSO. Documentation.
• Create AWS SSO entities (Users and Groups) Documentation or use identitystore module.
• Ensure that Terraform is using a role with permissions required for AWS SSO management. Documentation.

Usage

More complex examples can be found in the examples directory. Simple use case:

module "sso" {
  source  = "avlcloudtechnologies/sso/aws"

  permission_sets = {
    AdministratorAccess = {
      description      = "Provides full access to AWS services and resources.",
      session_duration = "PT2H",
      managed_policies = ["arn:aws:iam::aws:policy/AdministratorAccess"]
    },
  }
  account_assignments = [
    {
      principal_name = "management"
      principal_type = "GROUP"
      permission_set = "AdministratorAccess"
      account_ids    = ["123456789", "234567890"]
    },
  ]
}

permission_sets and account_assignments

permission_sets is a map of maps. Key is used as unique value for for_each resources. Inner map has the following keys/value pairs.

account_assignments is a list of maps which have the following keys/value pairs.

Requirements

Providers

Modules

No modules.

Resources

Inputs

list(object({
    principal_name = string,
    principal_type = string,
    permission_set = string,
    account_ids    = list(string)
  }))

{
  "AdministratorAccess": {
    "description": "Provides full access to AWS services and resources.",
    "managed_policies": [
      "arn:aws:iam::aws:policy/AdministratorAccess"
    ],
    "session_duration": "PT2H"
  }
}

Outputs