sso-assignment

Manages IAM Identity Center permission sets and account assignments.

Defines named permission sets with AWS managed policies, customer-managed policies, and optional inline policies, then assigns them to identity store groups or users across specified accounts. All assignments are expressed as a flat list and managed idempotently via for_each. Requires the governance/organization module to have SSO trusted-access enabled and a pre-existing IAM Identity Center instance.

Usage

module "sso_assignment" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/sso-assignment/aws"
  version = "0.1.0"

  sso_instance_arn = data.aws_ssoadmin_instances.main.arns[0]

  permission_sets = {
    admin = {
      name             = "AdministratorAccess"
      description      = "Full admin access"
      managed_policies = ["arn:aws:iam::aws:policy/AdministratorAccess"]
    }
  }

  assignments = [
    {
      account_id         = "111122223333"
      permission_set_key = "admin"
      principal_id       = "9067abc12345-abcd-1234-efgh-5678ijklmnop"
      principal_type     = "GROUP"
    }
  ]
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_ssoadmin_account_assignment.this	resource
aws_ssoadmin_customer_managed_policy_attachment.this	resource
aws_ssoadmin_managed_policy_attachment.this	resource
aws_ssoadmin_permission_set.this	resource
aws_ssoadmin_permission_set_inline_policy.this	resource

Inputs

Name	Description	Type	Default	Required
sso_instance_arn	ARN of the IAM Identity Center (SSO) instance	string	n/a	yes
assignments	List of principal-to-account assignments. permission_set_key references akey in var.permission_sets. principal_type is USER or GROUP.	list(object({ account_id = string permission_set_key = string principal_id = string principal_type = string }))	[]	no
permission_sets	Map of permission set definitions. Inline policies and managed policy ARNsare optional. session_duration follows ISO 8601 (e.g. PT8H).	map(object({ name = string description = string session_duration = optional(string, "PT8H") managed_policies = optional(list(string), []) inline_policy = optional(string, null) customer_managed_policies = optional(list(object({ name = string path = optional(string, "/") })), []) relay_state = optional(string, null) }))	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
assignment_ids	Map of assignment composite key to assignment ID
permission_set_arns	Map of permission set logical key to ARN
permission_set_ids	Map of permission set logical key to ID