template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: >
  SSOAutoAssign

  Sample SAM Template for SSOAutoAssign

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 30

Parameters:
  SSOINSTANCEARN:
    Type: String
  DIRECTORYSERVICEID:
    Type: String

Resources:
#  SSOAutoAssign:
#    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
#    Properties:
#      CodeUri: sso_auto_assign/
#      Handler: app.lambda_handler
#      Runtime: python3.9
#      Environment:
#        Variables:
#          DIRECTORY_SERVICE_ID: !Ref DIRECTORYSERVICEID
#          SSO_INSTANCE_ARN: !Ref SSOINSTANCEARN
#      Architectures:
#        - arm64
#      Policies:
#        - Statement:
#            Effect: Allow
#            Action:
#              - sso:*
#            Resource: "*"
#        - Statement:
#            Effect: Allow
#            Action: "identitystore:ListGroups"
#            Resource: "*"
#        - Statement:
#            Effect: Allow
#            Action: "organizations:ListAccounts"
#            Resource: "*"
#      Events:
#        CreateGroupEvent:
#          Type: EventBridgeRule
#          Properties:
#              InputPath: "$.detail"
#              Pattern:
#                "detail-type":
#                  - "AWS API Call via CloudTrail"
#                detail:
#                  eventSource:
#                    - "sso-directory.amazonaws.com"
#                  eventName:
#                      - CreateGroup
  DynamoDBAccountLoadDynamic:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: dynamo_account_load/
      Handler: app.lambda_handler
      Runtime: python3.9
      Architectures:
        - arm64
      Policies:
        - Statement:
            Effect: Allow
            Action: "dynamodb:PutItem"
            Resource: !GetAtt AWSOrgAccounts.Arn
        - Statement:
            Effect: Allow
            Action: "organizations:DescribeAccount"
            Resource: "*"
      Events:
        CreateAccountEvent:
          Type: EventBridgeRule
          Properties:
            InputPath: "$.detail.serviceEventDetails.createManagedAccountStatus.account"
            Pattern:
              "detail-type":
                - "AWS API Call via CloudTrail"
              detail:
                eventSource:
                  - "controltower.amazonaws.com"
                eventName:
                  - CreateManagedAccount
                serviceEventDetails:
                  createManagedAccountStatus:
                    state:
                      - "SUCCEEDED"

  CleanupClosedAccounts:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: closed_accounts_cleanup/
      Handler: app.lambda_handler
      Runtime: python3.9
      Architectures:
        - arm64
      Policies:
        - Statement:
            Effect: Allow
            Action:
            - "dynamodb:DeleteItem"
            - "dynamodb:GetItem"
            Resource: !GetAtt AWSOrgAccounts.Arn
      Events:
        CloseAccountEvent:
          Type: EventBridgeRule
          Properties:
            InputPath: $.detail.requestParameters
            Pattern:
              "detail-type":
                - "AWS API Call via CloudTrail"
              detail:
                eventSource:
                  - "organizations.amazonaws.com"
                eventName:
                  - CloseAccount


  SSOAutoAssignDynamo:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: sso_auto_assign_dynamo/
      Handler: app.lambda_handler
      Runtime: python3.9
      Environment:
        Variables:
          DIRECTORY_SERVICE_ID: !Ref DIRECTORYSERVICEID
          SSO_INSTANCE_ARN: !Ref SSOINSTANCEARN
      Architectures:
        - arm64
      Policies:
      - Statement:
        - Sid: AllowSSO
          Effect: Allow
          Action:
          - sso:*
          Resource: '*'
        - Sid: AllowIdentityStoreList
          Effect: Allow
          Action:
          - identitystore:ListGroups
          Resource: '*'
        - Sid: AllowListAccounts
          Effect: Allow
          Action:
          - organizations:ListAccounts
          Resource: '*'
        - Sid: AllowDynamoDBQuery
          Effect: Allow
          Action:
          - "dynamodb:query"
          - "dynamodb:scan" 
          Resource: 
              - !Sub "${AWSOrgWideGroups.Arn}*"
              - !Sub "${AWSOrgAccounts.Arn}*"
        - Sid: IAMCleanupActions
          Effect: Allow
          Action:
            - "iam:AttachRolePolicy"
            - "iam:CreateRole"
            - "iam:PutRolePolicy"
            - "iam:UpdateRole"
            - "iam:UpdateRoleDescription"
            - "iam:UpdateAssumeRolePolicy"
            - "iam:PutRolePermissionsBoundary"
            - "iam:DeleteRolePermissionsBoundary"
          Resource:
            - "*"
        - Sid: GetRolesAction
          Effect: Allow
          Action:
            - "iam:GetRole"
            - "iam:ListRoles"
          Resource:
            - "*"
        - Sid: DeleteRolesAction
          Effect: Allow
          Action:
            - "iam:DeleteRole"
            - "iam:DeleteRolePolicy"
            - "iam:DetachRolePolicy"
            - "iam:ListRolePolicies"
            - "iam:ListAttachedRolePolicies"
          Resource:
            - "*"
        - Sid: IAMSLRCleanupActions
          Effect: Allow
          Action:
            - "iam:DeleteServiceLinkedRole"
            - "iam:GetServiceLinkedRoleDeletionStatus"
            - "iam:DeleteRole"
            - "iam:GetRole"
          Resource:
            - "*"
        - Sid: IAMSAMLProviderCreationAction
          Effect: Allow
          Action:
            - "iam:CreateSAMLProvider"
          Resource:
            - "arn:aws:iam::*:saml-provider/AWSSSO_*"
        - Sid: IAMSAMLProviderUpdateAction
          Effect: Allow
          Action:
            - "iam:UpdateSAMLProvider"
          Resource:
            - "arn:aws:iam::*:saml-provider/AWSSSO_*"
        - Sid: IAMSAMLProviderCleanupActions
          Effect: Allow
          Action:
            - "iam:DeleteSAMLProvider"
            - "iam:GetSAMLProvider"
          Resource:
            - "arn:aws:iam::*:saml-provider/AWSSSO_*"
        - Sid: OrganizationAccess
          Effect: Allow
          Action:
              - "organizations:DescribeAccount"
              - "organizations:DescribeOrganization"
              - "organizations:ListDelegatedAdministrators"
              - "organizations:ListAWSServiceAccessForOrganization"
          Resource:
            - "*"
        - Sid: AllowUnauthAppForDirectory
          Effect: Allow
          Action:
            - "ds:UnauthorizeApplication"
          Resource:
            - "*"
        - Sid: AllowDescribeForDirectory
          Effect: Allow
          Action:
            - "ds:DescribeDirectories"
            - "ds:DescribeTrusts"
          Resource:
            - "*"
        - Sid: AllowDescribeAndListOperationsOnIdentitySource
          Effect: Allow
          Action:
            - "identitystore:DescribeUser"
            - "identitystore:DescribeGroup"
            - "identitystore:ListGroups"
            - "identitystore:ListUsers"
          Resource:
            - "*"
      Events:
        CreateGroupEvent:
          Type: EventBridgeRule
          Properties:
              InputPath: "$.detail"
              Pattern:
                "detail-type":
                  - "AWS API Call via CloudTrail"
                detail:
                  eventSource:
                    - "sso-directory.amazonaws.com"
                  eventName:
                      - CreateGroup
        CreateAccountEvent:
          Type: EventBridgeRule
          Properties:
            InputPath: "$.detail"
            Pattern:
              "detail-type":
                - "AWS API Call via CloudTrail"
              detail:
                eventSource:
                  - "controltower.amazonaws.com"
                eventName:
                  - CreateManagedAccount
                serviceEventDetails:
                  createManagedAccountStatus:
                    state:
                      - "SUCCEEDED"
  InitialLoad:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: initial_load/
      Handler: app.lambda_handler
      Runtime: python3.9
      Architectures:
        - arm64
      Policies:
        - Statement:
            Effect: Allow
            Action: "organizations:ListAccounts"
            Resource: "*"
        - Statement:
            Effect: Allow
            Action: "dynamodb:PutItem"
            Resource: !GetAtt AWSOrgAccounts.Arn

  OrgWideRoles:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: org_wide_groups/
      Handler: app.lambda_handler
      Runtime: python3.9
      Architectures:
        - arm64
      Policies:
        - Statement:
            Effect: Allow
            Action: "dynamodb:PutItem"
            Resource: !GetAtt AWSOrgWideGroups.Arn
      Events:
        CreateGroupEvent:
          Type: EventBridgeRule
          Properties:
              InputPath: "$.detail"
              Pattern:
                "detail-type":
                  - "AWS API Call via CloudTrail"
                detail:
                  eventSource:
                    - "sso-directory.amazonaws.com"
                  eventName:
                      - CreateGroup


  AWSOrgAccounts:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: AWSOrgAccounts
      BillingMode: PROVISIONED
      AttributeDefinitions:
        -
          AttributeName: Id
          AttributeType: S
        -
          AttributeName: Name
          AttributeType: S
      KeySchema:
        - AttributeName: Id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      GlobalSecondaryIndexes:
        -
          IndexName: AccountNameIndex
          KeySchema:
            -
              AttributeName: Name
              KeyType: HASH
          Projection:
            ProjectionType: ALL
          ProvisionedThroughput:
             ReadCapacityUnits: 5
             WriteCapacityUnits: 5

  AWSOrgWideGroups:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: ORGSSOGroups
      BillingMode: PROVISIONED
      AttributeDefinitions:
        -
          AttributeName: GroupID
          AttributeType: S
      KeySchema:
        - AttributeName: GroupID
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

  AWSSSOAutoAssignments:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: AWSSSOAutoAssignments
      BillingMode: PROVISIONED
      AttributeDefinitions:
        -
          AttributeName: Id
          AttributeType: S
      KeySchema:
        - AttributeName: Id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5

  InitialLoadRun:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt InitialLoad.Arn