Support cross-account IAM role assumption for Identity Store APIs#2
Open
Dakad wants to merge 17 commits into
Open
Support cross-account IAM role assumption for Identity Store APIs#2Dakad wants to merge 17 commits into
Dakad wants to merge 17 commits into
Conversation
Dakad
force-pushed
the
fix/gh-295_support-cross-account-IAM-role
branch
2 times, most recently
from
876245c to
381e3e5
Compare
Dakad
changed the title
Dakad
force-pushed
the
fix/gh-295_support-cross-account-IAM-role
branch
from
381e3e5 to
87d6b8d
Compare
Bumps [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.41.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.39.0...v1.41.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel dependency-version: 1.41.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
* Edit the regex for the CloudFormation template for the PRECACHE_ORG_UNITS, to allow for a single OU path other than '/' * Updated handling of this environment variable so, if specified but and empty string or not set it disables precaching. * Updated handling of other optional comma separated string env_variables to have the same way.
* Edit the regex for the CloudFormation template for the PRECACHE_ORG_UNITS, to allow for a single OU path other than '/' * Updated handling of this environment variable so, if specified but and empty string or not set it disables precaching. * Updated handling of other optional comma separated string env_variables to have the same way.
Included in this change: Parameter PrecacheOrgUnits : When left empty will disable the pre-caching of both Groups and Users Parameter LogRetention : Added, config CloudWatch Log Group retention period, previously it defaulted to Indefinitely this default has been retain however, it is strongly recommended a more frugal option is selected. Parameter ScheduleExpression : When left empty will disable scheduling of the SSOSync lambda function. The default for this is unchanged Rate(15 minutes), where the lambda is being triggered by an external event or as part of CICD pipeline (such ac CodePipeline), this prevent concurrency limits being encountered. The Parameters page has also been re-grouped to be more intuitive. Quick Start templates: Added a simple template that can launched directly from CloudFormation, this can simply be launched from the repo. Currently, template creates a deployment in a single account with two nested stacks one for the secrets and the other for the lambda function. To update the deployment, download the latest version of the template and update the stack. * implement disabled schedule * Apply disable PreCache to Groups * Improve logging for precache activity * Remove Explicit RoleName * Added Log Retention Setting. * Tidy Up the Parameters page * Add QuickStart * Add job to update version strings in quickstart on release
This reverts commit 561a1c6.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds first-class support for assuming an IAM role before making IAM Identity Center Identity Store API calls.
Today
ssosyncloads AWS credentials from the standard SDK v2 default credential chain and uses them directly for Identity Store operations. This change keeps that behavior by default, and adds an optionalassume-role-arnconfiguration path sossosynccan run outside the delegated admin or management account while still using the correct target-account permissions.The implementation is intentionally narrow:
--assume-role-arnSSOSYNC_ASSUME_ROLE_ARNAssumeRolewith session namessosyncAssociated ticket number and/or AirBrake error?
Related upstream issue:
awslabs/ssosync#295Same PR on
https://github.com/awslabs/ssosync/pull/308Due Date or Desirable Merge
No hard deadline. This is a focused upstream feature addition to unblock cross-account deployments.
How has this been tested?
Anticipated impact
Low-risk, opt-in behavior change.
When
assume-role-arnis not set, behavior stays the same as today. When it is set, Identity Store API calls use the assumed role credentials instead of the base credential chain.How do you plan to monitor the change in prod to make sure it's working?
ssosynclogs for the initial Identity Store connectivity checkChecklist