search

awslabs / ssosync

Populate AWS SSO directly with your G Suite users and groups using either a CLI or AWS Lambda
Apache License 2.0
528 stars 182 forks source link

Allow specifying secret ARNs #92

Closed KyleKotowick closed 11 months ago

KyleKotowick commented 2 years ago

Is your feature request related to a problem? Please describe. My secrets (SSOSyncGoogleAdminEmail, SSOSyncSCIMAccessToken, SSOSyncSCIMEndpointUrl, SSOSyncGoogleCredentials) are stored in a separate AWS account (in the same Organization). Cross-account sharing is correctly set up.

However, since the secret names are hardcoded in this application, there's no way to configure it to load secrets from a different account.

Describe the solution you'd like As command line parameters and/or environment variables, allow specifying full ARNs for the secrets that should be used.

pecigonzalo commented 9 months ago

I don't know if I should open a new issue or we should re-open this one, but I believe that while the CF stack takes an ARN, the code is still hardcoded, and does not respect the ARN. This means the secret names themselves must be exactly set or they fail.