Package: aws-sso-cfn-helper
aws-sso-cfn-helperWork around current capabilities of AWS SSO CloudFormation resourcesAWS SSO's CloudFormation support currently only includesAWS::SSO::Assignment, which means for every combination of principal (group or user), permission set, and target (AWS account), you need a separate CloudFormation resource. Additionally, AWS SSO does not support OUs as targets, so you need to specify every account separately.Obviously, this gets verbose.aws-sso-cfn-helperwill generate the assignment combinations according to your specifications.I am against client-side generation of CloudFormation templates, and look forward to discarding this tool once there are two prerequisites:OUs as targets for assignmentsAnAWS::SSO::AssignmentSetresource that allows specifications of multiple principals, permission sets, and targets, and performs the combinatorics directly.InstallI recommend you installaws-sso-cfn-helperwithpipx, which installs the tool in an isolated virtualenv while linking the script you need.# with pipxpipxinstallaws-sso-cfn-helper# without pipxpython-mpipinstall--useraws-sso-cfn-helperUsageAll of the identifiers required below can be looked up using the includedaws-sso-lookuputility, documented below. On both utilities the credentials used can be controlled with the--profileparamater.AWS SSO instance idYou can provide the AWS SSO instance id directly using the--instanceor-iparameter, or you can omit it andaws-sso-cfn-helperwill query your account for the instance id. The instance id will be used to fill out permission set ARNs, if that information is missing.PrincipalsYou can specify principal ids using either or both of--groupsand--users, abbreviated-gand-u, respectively.Permission setsPermission sets can be provided either as ARNs (which include the SSO instance id), as the ARN suffix ($INSTANCE_ID/$PERMISSION_SET_ID) or simply as the permission set id, in which case the ARN will be constructed using the instance id as obtained above.TargetsYou can specify targets using either or both of--ousand--accounts, abbreviated-oand-a, respectively. Because AWS SSO does not support OUs as targets currently, specifying an OU will cause a lookup through the Organizations API to find all the accounts in that OU (and any child OUs). Note that this only happens once, so you would need to run this again after adding another account to the OU.Output templateBy default,aws-sso-cfn-helperwill produce a template file calledtemplate.yaml. This can be changed with the--template-fileparameter. If your inputs cause more assignment resources to be generated than can be held in one template, multiple files will be generated, with numbers inserted before the file suffix (e.g.,template01.yaml,template02.yaml, etc.). You can adjust the number of resources per template (for example, if you plan to add additional resources to each template yourself) with--max-resources-per-template.CloudFormation referencesCloudFormation resources can reference other resources or template parameters. To enable this when generating a template, use the syntax!Ref=ReferenceName, without spaces, for any of the inputs, and the generated resources will have the appropriate references (note that whatever they are referencing will not be present in the template, that is on you to add).Input fileAs all of this is in service of infrastructure as code, you may want to define the inputs as a file checked into source control. This file can be specified with the--input-fileparameter, and takes the form of an INI file with the following section headers (corresponding to the command line parameters):instancegroupsuserspermission-setsousaccountsYou can use the same!Ref=ReferenceNamesyntax in the file, though you can include spaces around the equals.Check out the example file.aws-sso-lookupThe AWS SSO APIs and CloudFormation resources require the use of identifiers that are not displayed in the console, and that the APIs do not make easy to look up by name.aws-sso-lookupis provided to make this a little easier.ItemSyntaxAWS SSO instanceaws-sso-lookup instanceAWS SSO identity storeaws-sso-lookup identity-storeGroupsaws-sso-lookup groups GROUP_NAME [GROUP_NAME...]Usersaws-sso-lookup users USER_NAME [USER_NAME...]Permission setsaws-sso-lookup permission-sets NAME [NAME...]For instance and identity store, it just prints out the id. For the others, it displays the instance/identity store id being used, and then a CSV with columns for the name and identifier. By default, any names not found will haveNOT_FOUNDas their identifier, but with--error-if-not-found/-eit will exit with an error at the first name not found.For group/user/permission set lookups, the instance/identity store will be automatically retrieved if you do not provide--instance-arn(for permission sets) or--instance-store-id(for groups and users).