AWS SSO: Add support for user and group creation

[andrejmaya]

Is your feature request related to a problem? Please describe.
Currently it's not possible to create users/groups with the sso-admin service.

Describe the solution you'd like
It would be great to have commands for the creation of SSO users and groups covered by the AWS CLI

Describe alternatives you've considered
Current alternative is to create both manually in the web console

[kdaily]

Thanks for the feature request. This would be a new service feature, and I'll pass this on to the SSO team.

[kdaily]

Hi @andrejmaya, since this is a feature request for the service team, I'm going to transfer this issue to our centralized AWS SDK repository aws/aws-sdk. An implementation of this feature may be of interest to those of other SDKs as well.

[kdaily]

V276091312

[milan-milo]

Any updates on this?

[nhammond101]

This would be a good feature to have, currently i can automate account creation, assigning root user to SSO, etc but manual creation/assigning of users is preventing a fully automated solution being rolled out across my company

[al-lac]

We would also like to fully automate the account creation. Please give this some priority.

[AmirAvram]

We also require a feature for SSO user creation trough CLI, any estimation for availability?

[kdaily]

Hi all, I requested a status update from the service team and will update when I hear back.

[maxmanders]

I've raised this feature request with our TAM (wasn't aware of this issue thread beforehand). Our IdP groupings are not as granular as those needed for our AWS organisations. We'd like to create our own automation around creating SSO Users and managing the SSO Groups that they belong to, and the Permission Sets associated with those groups. Any sort of update or indicative timeline would be very much appreciated, to help us plan a way forward.

[dtphuc]

I've also raised this feature request with our TAM. I hope it will be coming soon.

[barakharyati]

we created a manual Groups lists in TF, as a patch but it really required.

[project0]

I have actually another use case, i want to be able to delete a group via SDK so i can easily revoke access for the whole group.

[rpuserh]

Any update on this ?

[hbastosc]

Any updates? :)

[kdaily]

@rpuserh and @hbastosc, sorry to say I have no updates to report. I'm checking in with the SSO team again.

[technorbi]

@kdaily are you planning to do it at all? this one is the only thing missing from our auto CT acc creation, would be awesome to have this feature

[g-dx]

@kdaily - do you have any updates to share after checking in with the SSO team?

[kdaily]

Hi all, this is the latest update I have from the SSO team, dated from last week:

"Thank you for reaching out to us with the feature request to create AWS SSO users and groups programmatically, via AWS SSO CLI. This feature is on our roadmap and planned for launch in the 4-12 month timeframe."

[mtb-xt]

This feature is really needed, @kdaily - is there any way to influence the roadmap and increase the 'severity' of this issue, so it's faster than 4-12 months?

[PierreKiwi]

It is pretty ridiculous, especially considering that you can do it in the console today... so the API methods probably already exist privately!

[al-lac]

We decided to use the API / SCIM API and Ansible for provisioning our users and groups in the meantime. Works pretty nicely.

Source Code:
https://github.com/runtastic/ansible-iam/blob/main/roles/aws_user
https://github.com/runtastic/ansible-iam/tree/main/roles/aws_group

[mtb-xt]

@al-lac but that only works if you use external IdP, is that right? This issue is about using built in identity store.

[al-lac]

@mtb-xt yeah you are right. We are also using external IdP for that solution.

[kdaily]

Hi @mtb-xt,

Thanks for your post. Unfortunately that's not within my powers! I will continue to relay the feedback received here, and provide an update when I hear further. As of today, I don't have any further updates on when this feature would be released. Thanks for your patience.

[StackRef]

@mtb-xt @al-lac Actually, those Ansible scripts will work just fine with AWS SSO directly, so long as you enable auto-provisioning of users. Once you do that, you will be given an SCIM URL and a token -- that's what you feed to the Ansible script. I've tested it out and it does just what I want, and I believe it would be trivial to add the functionality to your own custom scripts and even Terraform as a custom provider.

Do note, though, that once you enable SCIM auto provisioning, you cannot add/remove/edit users within the AWS Console anymore! You will have to do it all through the SCIM endpoint. Also note that enabling this does not mean your external provider, if you're using one, will automatically be able to provision users for you; to do that, you would need to set up that SCIM URL and token. We actually did not want our external provider to be able to auto-provision users, so this works out well for us in that we can provision through a script instead.

[mtb-xt]

@StackRef but how can we enable SCIM auto provisioning for AWS SSO? I thought this setting is only available when you have external IdP enabled.

[DarkhanMeirman]

very much needed feature!

[1inh]

@mtb-xt for this to work, you would still need to switch to an external IdP but you will be using ansible to call SCIM API for provisioning

[phelian]

Another voice for saying this is a very much needed feature, please
@kdaily Any more updates to share with the community?

[gudlyf]

@mtb-xt Yes, what @1inh said. You can turn on IdP so Ansible will work and do not need to actually use an external IdP. However, it removes the ability to do changes through the Console anymore. The calls to the AWS SSO API are quite simple, though, so it's not a big leap.

[tim-finnigan]

Hi all, thanks for your patience. I reached out to the SSO team for an update and they responded:

We are currently working on launching an updated version of the AWS SSO User and Group Management APIs...Please reach out to AWS Support or your account team to track the AWS SSO Product Feature Request for more details on timelines.

[tim-finnigan]

The IdentityStore service models were updated in the last 24 hours. As referenced in the documentation there is now a create-group and create-user command available. I'm going to close this issue because the request has been implemented. If anyone runs into any problems related to this please let us know here or create a new issue. Thanks!

[github-actions]

This issue is now closed.

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[gudlyf]

Awesome @tim-finnigan! Awaiting its addition to v2 of the CLI next 😆