SSO New User & Group Resource

[ajaychoudhary-bcg]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Related #18739

Description

It would be great if we can provide resource to create new group and add members using terraform.

New or Affected Resource(s)

New

• aws_XXXXX

Potential Terraform Configuration

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.

References

• #0000

[YakDriver]

@ajaychoudhary-bcg This sounds like a good idea. However, can you please provide additional details, such as a possible name for the new resource and what the Terraform configuration would look like?

[ajaychoudhary-bcg]

@YakDriver
When we create group from UI, it requires only name and description.
resource "aws_ssoadmin_group" "example" {
name = "test"
description = "test" # Optional argument
users = [list of users arns] # Optional argument
#other attributes as required for integration
}
similarly we need for user
resource "aws_ssoadmin_user" "example" {
Username= string
EmailAddress= string
firstname = string
lastname = string
#other attributes as required for integration
}
and data source for users will also be required with filter to get existing users and add in group.

[ajaychoudhary-bcg]

do we know by when this will be available?

[bhegazy]

I don't think this is yet possible since it's not yet supported in AWS SDK , maybe we should also edit the this issue title to be SSO New User & Group Resource to match the issue in aws-sdk

[rpuserh]

Any update on this ?

[rwejdling]

I guess the best option for now is to enable an automatic provisioning endpoint on the SSO tenant and use the SCIM API directly. Annoying, but could work.

[Stasmo]

The AWS SCIM API only returns a maximum of 50 users when listing users. There is no way to retrieve the rest of the users. The AWS SCIM endpoint also does not return a user's group information, so there's no way to tell which groups the user is part of. Unfortunately, the AWS SCIM API is not a great option for automated user provisioning.

[mbuotidem]

It appears this is now supported in AWS SDK: https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_CreateUser.html