# sso-assignment

Manages IAM Identity Center permission sets and account assignments.

Defines named permission sets with AWS managed policies, customer-managed policies, and optional inline policies, then assigns them to identity store groups or users across specified accounts. All assignments are expressed as a flat list and managed idempotently via `for_each`. Requires the `governance/organization` module to have SSO trusted-access enabled and a pre-existing IAM Identity Center instance.

## Usage

```hcl
module "sso_assignment" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/sso-assignment/aws"
  version = "0.1.0"

  sso_instance_arn = data.aws_ssoadmin_instances.main.arns[0]

  permission_sets = {
    admin = {
      name             = "AdministratorAccess"
      description      = "Full admin access"
      managed_policies = ["arn:aws:iam::aws:policy/AdministratorAccess"]
    }
  }

  assignments = [
    {
      account_id         = "111122223333"
      permission_set_key = "admin"
      principal_id       = "9067abc12345-abcd-1234-efgh-5678ijklmnop"
      principal_type     = "GROUP"
    }
  ]
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->

## Requirements

| Name                                                                     | Version |
| ------------------------------------------------------------------------ | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5  |
| <a name="requirement_aws"></a> [aws](#requirement_aws)                   | ~> 6.50 |

## Providers

| Name                                             | Version |
| ------------------------------------------------ | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0  |

## Resources

| Name                                                                                                                                                                            | Type     |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_ssoadmin_account_assignment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_account_assignment)                                 | resource |
| [aws_ssoadmin_customer_managed_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_customer_managed_policy_attachment) | resource |
| [aws_ssoadmin_managed_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_managed_policy_attachment)                   | resource |
| [aws_ssoadmin_permission_set.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_permission_set)                                         | resource |
| [aws_ssoadmin_permission_set_inline_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssoadmin_permission_set_inline_policy)             | resource |

## Inputs

| Name                                                                              | Description                                                                                                                                 | Type                                                                                                                                                                                                                                                                                                                                                                                               | Default | Required |
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | :------: |
| <a name="input_sso_instance_arn"></a> [sso_instance_arn](#input_sso_instance_arn) | ARN of the IAM Identity Center (SSO) instance                                                                                               | `string`                                                                                                                                                                                                                                                                                                                                                                                           | n/a     |   yes    |
| <a name="input_assignments"></a> [assignments](#input_assignments)                | List of principal-to-account assignments. permission_set_key references a<br/>key in var.permission_sets. principal_type is USER or GROUP.  | <pre>list(object({<br/> account_id = string<br/> permission_set_key = string<br/> principal_id = string<br/> principal_type = string<br/> }))</pre>                                                                                                                                                                                                                                                | `[]`    |    no    |
| <a name="input_permission_sets"></a> [permission_sets](#input_permission_sets)    | Map of permission set definitions. Inline policies and managed policy ARNs<br/>are optional. session_duration follows ISO 8601 (e.g. PT8H). | <pre>map(object({<br/> name = string<br/> description = string<br/> session_duration = optional(string, "PT8H")<br/> managed_policies = optional(list(string), [])<br/> inline_policy = optional(string, null)<br/> customer_managed_policies = optional(list(object({<br/> name = string<br/> path = optional(string, "/")<br/> })), [])<br/> relay_state = optional(string, null)<br/> }))</pre> | `{}`    |    no    |
| <a name="input_tags"></a> [tags](#input_tags)                                     | Resource tags to apply to all resources                                                                                                     | `map(string)`                                                                                                                                                                                                                                                                                                                                                                                      | `{}`    |    no    |

## Outputs

| Name                                                                                         | Description                                      |
| -------------------------------------------------------------------------------------------- | ------------------------------------------------ |
| <a name="output_assignment_ids"></a> [assignment_ids](#output_assignment_ids)                | Map of assignment composite key to assignment ID |
| <a name="output_permission_set_arns"></a> [permission_set_arns](#output_permission_set_arns) | Map of permission set logical key to ARN         |
| <a name="output_permission_set_ids"></a> [permission_set_ids](#output_permission_set_ids)    | Map of permission set logical key to ID          |

<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->