search

awslabs / ssosync

Populate AWS SSO directly with your G Suite users and groups using either a CLI or AWS Lambda
Apache License 2.0
512 stars 175 forks source link

Hyphens aren't allowed in GoogleGroupsMatch and similar fields by the CloudFormation template #162

Closed tim-hutchinson closed 7 months ago

tim-hutchinson commented 7 months ago

Describe the bug When setting patterns that include a - character and deploying with CloudFormation/ from the Serverless Application Repository, CloudFormation will reject the request, due to failing the regex

To Reproduce Steps to reproduce the behavior:

  1. Deploy from the Serverless Application Repository version
  2. Ran with args GoogleGroupMatch = "email:aws-sso-*"
BadRequestException: Parameter 'GoogleGroupMatch' must match pattern (?!.*\s)|(name|Name|NAME)(:([a-zA-Z0-9]{1,64})\*)|(name|Name|NAME)(=([a-zA-Z0-9 ]{1,64}))|(email|Email|EMAIL)(:([a-zA-Z0-9.-_]{1,64})\*)|(email|Email|EMAIL)(=([a-zA-Z0-9.-_]{1,64})@([a-zA-Z0-9.-]{5,260}))

Expected behavior Successfully deploying the stack

Additional context Looking at the regex, it seems that the - character is not escaped from several places, resulting in it being treated as a range operator instead of a hyphen literal.

tim-hutchinson commented 7 months ago

Related, but not the same as this: Exact names appear to allow a ` character, but wildcarded names do not. We were originally going to swap our equivalent name patternName:AWS SSO *`, but noticed it also would fail.