-
Notifications
You must be signed in to change notification settings - Fork 73
/
example-template.yaml
63 lines (56 loc) · 1.49 KB
/
example-template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS-SSO-Util-2020-11-08
Metadata:
SSO:
NumChildStacks: 10
Parameters:
AccountParameter:
Type: String
Resources:
SomePSResource:
Type: AWS::SSO::PermissionSet
Properties:
# InstanceArn: arn:aws:sso:::instance/ssoins-69e2ecd0b249f0cd
Name: Foo
InlinePolicy:
Version: 2012-10-17
Statement:
- Sid: DenyEverything
Effect: Deny
Action: "*:*"
Resource: "*"
SimpleAssignmentGroup:
Type: SSOUtil::SSO::AssignmentGroup
Properties:
Principal:
PrincipalType: USER
PrincipalId: c843295c-d41f-4f23-9832-1521dbaf36f7
PermissionSet:
- !GetAtt SomePSResource.PermissionSetArn
Target:
- Type: AWS_ACCOUNT
TargetIds:
- "123456789012"
- "112233445566"
ComplexAssignmentGroup:
Type: SSOUtil::SSO::AssignmentGroup
Properties:
Name: Complex
Principal:
- Type: GROUP
Id:
- 6c1645fc-37b5-40ba-8c3d-5216b9055505
- 67d02fc7-ef1e-463f-b572-ba9b2fe710ba
- Type: USER
Id: c843295c-d41f-4f23-9832-1521dbaf36f7
PermissionSet:
- arn:aws:sso:::permissionSet/ssoins-69e2ecd0b249f0cd/ps-45b2cb9e8a6aee12
- ps-b5b9375180ceaaac
- !GetAtt SomePSResource.PermissionSetArn
Target:
- Type: AWS_ACCOUNT
Id: {"Ref": "AccountParameter"}
- Type: AWS_ACCOUNT
Id:
- "123456789012"
- "112233445566"