Helping you populate AWS SSO directly with your Google Apps users
SSO Sync will run on any platform that Go can build for. It is available in the AWS Serverless Application Repository
⚠️ there are breaking changes for versions>= 0.02
⚠️ >= 1.0.0-rc.5
groups to do not get deleted in AWS SSO when deleted in the Google Directory, and groups are synced by their email address
⚠️ >= 2.0.0
this makes use of the Identity Store API which means:
- if deploying the lambda from the AWS Serverless Application Repository then it needs to be deployed into the IAM Identity Center delegated administration account. Technically you could deploy in the management account but we would recommend against this.
- if you are running the project as a cli tool, then the environment will need to be using credentials of a user in the IAM Identity Center delegated administration account, with appropriate permissions.
As per the AWS SSO Homepage:
AWS Single Sign-On (SSO) makes it easy to centrally manage access to multiple AWS accounts and business applications and provide users with single sign-on access to all their assigned accounts and applications from one place.
Key part further down:
With AWS SSO, you can create and manage user identities in AWS SSO’s identity store, or easily connect to your existing identity source including Microsoft Active Directory and Azure Active Directory (Azure AD).
AWS SSO can use other Identity Providers as well... such as Google Apps for Domains. Although AWS SSO supports a subset of the SCIM protocol for populating users, it currently only has support for Azure AD.
This project provides a CLI tool to pull users and groups from Google and push them into AWS SSO.
ssosync
deals with removing users as well. The heavily commented code provides you with the detail of
what it is going to do.
- SCIM Protocol RFC
- AWS SSO - Connect to Your External Identity Provider
- AWS SSO - Automatic Provisioning
- AWS IAM Identity Center - Identity Store API
The recommended installation is:
- Setup IAM Identity Center, in the management account of your organization
- Created a linked account
Identity
Account from which to manage IAM Identity Center - Delegate administration to the `Identity' account
- Deploy the SSOSync app from the AWS Serverless Application Repository
You can also:
You can go get github.com/awslabs/ssosync
or grab a Release binary from the release page. The binary
can be used from your local computer, or you can deploy to AWS Lambda to run on a CloudWatch Event
for regular synchronization.
You need a few items of configuration. One side from AWS, and the other from Google Cloud to allow for API access to each. You should have configured Google as your Identity Provider for AWS SSO already.
You will need the files produced by these steps for AWS Lambda deployment as well as locally running the ssosync tool.
First, you have to setup your API. In the project you want to use go to the Console and select API & Services > Enable APIs and Services. Search for Admin SDK and Enable the API.
You have to perform this tutorial to create a service account that you use to sync your users. Save the JSON file
you create during the process and rename it to credentials.json
.
you can also use the
--google-credentials
parameter to explicitly specify the file with the service credentials. Please, keep this file safe, or store it in the AWS Secrets Manager
In the domain-wide delegation for the Admin API, you have to specify the following scopes for the user.