Skip to content

Add SSO group id lookup parameter resolver - #390

Merged
andrewjhumphrey merged 24 commits into
masterfrom
andrewjhumphrey-sso-group-id-parameter-resolverid
Jul 11, 2025
Merged

Add SSO group id lookup parameter resolver#390
andrewjhumphrey merged 24 commits into
masterfrom
andrewjhumphrey-sso-group-id-parameter-resolverid

Conversation

@andrewjhumphrey

@andrewjhumphrey andrewjhumphrey commented Jul 10, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Remove the need to hardcode magic AWS IIC/SSO group IDs that are required when creating AWS::SSO::Assignment resources

Note: This requires adding a new stack_master.yml toplevel attribute: sso_identity_store_id which is required to do the group lookup. Rather than specifying that in each individual parameter lookup, do it once at the top level.

An example of what this looks like:

Before:

Parameters file:

SSOArn:
  stack_output: sso-permission-sets-standard/SSOArn
  role: service-role/rolename
  account: '123456789012'
SecurityAdminPermissionSetArn:
  stack_output: sso-permission-sets-standard/SecurityAdminArn
  role: service-role/rolename
  account: '123456789012'
GroupId: "b12345c6-7890-12e3-45b6-b7f89dded0aa"   <---- Needs to be manually fetched from the console/cli

After:

Parameters file:

SSOArn:
  stack_output: sso-permission-sets-standard/SSOArn
  role: service-role/rolename
  account: '123456789012'
SecurityAdminPermissionSetArn:
  stack_output: sso-permission-sets-standard/SecurityAdminArn
  role: service-role/rolename
  account: '123456789012'
GroupId:
  sso_group_id: 'us-east-1:d-123456df7/Okta-App-AWS-Group-name'
  role: service-role/rolename
  account: '123456789012'

simpson-ross
simpson-ross approved these changes Jul 10, 2025
View reviewed changes

@simpson-ross simpson-ross left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Neat! All seems reasonable, 👍

orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread README.md Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/sso_group_id_finder.rb Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/sso_group_id_finder.rb Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/sso_group_id_finder.rb Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/sso_group_id_finder.rb Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/sso_group_id_finder.rb
@andrewjhumphrey
PR Feedback fixes
d0c6d62 
Remove unused variables and exceptions
Harmonise capitalisation of Sso
@andrewjhumphrey
Add tests for the finder class too
6de910d
@andrewjhumphrey
Make ruby3.0+ compatible
6fd6c5a
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/version.rb Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/sso_group_id_finder.rb Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread spec/stack_master/sso_group_id_finder_spec.rb Outdated
orien
orien reviewed Jul 10, 2025
View reviewed changes
Comment thread lib/stack_master/sso_group_id_finder.rb
orien
orien approved these changes Jul 10, 2025
View reviewed changes

@orien orien left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome!

Thanks for indulging my many suggestions.

Comment thread lib/stack_master/version.rb
runlevel5
runlevel5 approved these changes Jul 10, 2025
View reviewed changes

@runlevel5 runlevel5 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@andrewjhumphrey
andrewjhumphrey merged commit 4a85545 into master Jul 11, 2025
20 checks passed
@orien
orien deleted the andrewjhumphrey-sso-group-id-parameter-resolverid branch December 7, 2025 00:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@orien orien orien approved these changes
@simpson-ross simpson-ross simpson-ross approved these changes
+1 more reviewer
@runlevel5 runlevel5 runlevel5 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@andrewjhumphrey @runlevel5 @orien @simpson-ross