SSO User Creation Terraform

sso.tf

########## Data Soure ##########

data "aws_ssoadmin_instances" "my_dev_application" {}
data "aws_caller_identity" "current" {}

########## Locals ##########

locals {
  account_id     = data.aws_caller_identity.current.account_id
  sso_user_email = "[email protected]"
  aws_region     = "us-east-1"
  aws_profile    = "your-profile"
}

########## Provider ##########

provider "aws" {
  region  = local.aws_region
  profile = local.aws_profile
}

########## User ##########

resource "aws_identitystore_user" "my_dev_application" {
  identity_store_id = tolist(data.aws_ssoadmin_instances.my_dev_application.identity_store_ids)[0]

  display_name = "My Application Dev User"
  user_name    = "MyApplicationDevUser"

  name {
    given_name  = "User"
    family_name = "Dev"
  }

  emails {
    primary = true
    value   = local.sso_user_email
  }
}

########## Group ##########

resource "aws_identitystore_group" "my_dev_application" {
  identity_store_id = tolist(data.aws_ssoadmin_instances.my_dev_application.identity_store_ids)[0]
  display_name      = "MyApplicationDevGroup"
  description       = "My application dev group"
}

resource "aws_identitystore_group_membership" "my_dev_application" {
  identity_store_id = tolist(data.aws_ssoadmin_instances.my_dev_application.identity_store_ids)[0]
  group_id          = aws_identitystore_group.my_dev_application.group_id
  member_id         = aws_identitystore_user.my_dev_application.user_id
}

########## Permission Set ##########

resource "aws_ssoadmin_permission_set" "my_dev_application" {
  name         = "MyApplicationDevPermissions"
  description  = "My application dev permission"
  instance_arn = tolist(data.aws_ssoadmin_instances.my_dev_application.arns)[0]
}

resource "aws_iam_policy" "assume-dev-role-policy" {
  name        = "my-application-assume-dev-role-policy"
  description = "My application assume dev role policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "sts:AssumeRole",
        ]
        Effect   = "Allow"
        Resource = "${aws_iam_role.my_dev_application.arn}"
      },
    ]
  })
}

resource "aws_ssoadmin_customer_managed_policy_attachment" "my_dev_application" {
  instance_arn       = aws_ssoadmin_permission_set.my_dev_application.instance_arn
  permission_set_arn = aws_ssoadmin_permission_set.my_dev_application.arn
  customer_managed_policy_reference {
    name = aws_iam_policy.assume-dev-role-policy.name
    path = "/"
  }
}

########## Account Assignment ##########

resource "aws_ssoadmin_account_assignment" "my_dev_application" {
  instance_arn       = tolist(data.aws_ssoadmin_instances.my_dev_application.arns)[0]
  permission_set_arn = aws_ssoadmin_permission_set.my_dev_application.arn

  principal_id   = aws_identitystore_group.my_dev_application.group_id
  principal_type = "GROUP"

  target_id   = local.account_id
  target_type = "AWS_ACCOUNT"
}

########## Role ##########

resource "aws_iam_role" "my_dev_application" {
  name = "my-application-dev-role"
  assume_role_policy = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Effect" : "Allow",
        "Principal" : {
          "Service" : "ec2.amazonaws.com"
        },
        "Action" : "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_policy" "my_dev_application" {
  name        = "my-application-dev-policies"
  description = "My application dev policies"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        "Action" : [
          "ssm:GetParameter"
        ],
        "Resource" : "arn:aws:ssm:us-east-1:${local.account_id}:parameter/MY-APPLICATION/*",
        "Effect" : "Allow"
      },
      {
        "Action" : [
          "dynamodb:BatchGetItem",
          "dynamodb:GetRecords",
          "dynamodb:GetShardIterator",
          "dynamodb:Query",
          "dynamodb:GetItem",
          "dynamodb:Scan",
          "dynamodb:BatchWriteItem",
          "dynamodb:PutItem",
          "dynamodb:UpdateItem",
          "dynamodb:TransactGetItems",
          "dynamodb:TransactWriteItems"          
        ],
        "Resource" : [
          "arn:aws:dynamodb:us-east-1:${local.account_id}:table/my_application_*"
        ],
        "Effect" : "Allow"
      }
    ]
  })
}

resource "aws_iam_policy_attachment" "my_dev_application_attachment" {
  name       = "MyApplicationDevRolePolicyAttachment"
  roles      = [aws_iam_role.my_dev_application.name]
  policy_arn = aws_iam_policy.my_dev_application.arn
}