Okta CloudFormation Resource Types

This collection of AWS CloudFormation resource types allow Okta to be controlled using AWS CloudFormation.

Resource	Description	Documentation
Okta::Application::Application	This resource type manages an Okta Application	/Okta-Application
Okta::Group::Group	This resource type manages an Okta Group	/Okta-Group
Okta::Group::GroupApplicationAssociation	This resource type manages an Okta Group Application Association	/Okta-Group-Application-Association
Okta::Group::Membership	This resource type manages an Okta Group Membership	/Okta-Group-Membership
Okta::Policy::Policy	This resource type manages an Okta Policy	/Okta-Policy

Prerequisites

• AWS Account
• AWS CLI
• Okta account and Okta API Key

AWS Management Console

To get started:

1. Sign in to the AWS Management Console with your account and navigate to CloudFormation.

2. Select "Public extensions" from the left hand pane and filter Publisher by "Third Party".

3. Use the search bar to filter by the "Okta" prefix.

Note: All official Okta resources begin with Okta:: and specify that they are Published by Okta.

4. Select the desired resource name to view more information about its schema, and click Activate.

5. On the Extension details page, specify:

• Extension name
• Execution role ARN
• Automatic updates for minor version releases
• Configuration

6. In your terminal, specify the configuration data for the registered Okta CloudFormation resource type, in the given account and region by using the SetTypeConfiguration operation:

For example:

$ aws cloudformation set-type-configuration \
--region us-west-2 --type RESOURCE \
--type-name Okta::Application::Application \
--configuration-alias default \
--configuration "{ \"OktaAccess\":{\"Url\":\"YOUROKTAURL\", \"ApiKey\":\"YOUROKTAAPIKEY\"}}"

Note: All Okta resources requires a type configuration to be set.

7. After you have your resource configured, create your AWS stack that includes any of the activated Okta resources.

For more information about available commands and workflows, see the official AWS documentation.

Supported regions

The Okta CloudFormation resources are available on the CloudFormation Public Registry in the following regions:

Code	Name
us-east-1	US East (N. Virginia)
us-east-2	US East (Ohio)
us-west-1	US West (N. California)
us-west-2	US West (Oregon)
ap-south-1	Asia Pacific (Mumbai)
ap-northeast-1	Asia Pacific (Tokyo)
ap-northeast-2	Asia Pacific (Seoul)
ap-southeast-1	Asia Pacific (Singapore)
ap-southeast-2	Asia Pacific (Sydney)
ca-central-1	Canada (Central)
eu-central-1	Europe (Frankfurt)
eu-west-1	Europe (Ireland)
eu-west-2	Europe (London)
eu-west-3	Europe (Paris)
eu-north-1	Europe (Stockholm)
sa-east-1	South America (São Paulo)

Note: To privately register a resource in any other region, use the provided packages.

Examples

Shows how to create an Application in Okta

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Shows how to create an Application in Okta
Resources:
  NewOktaApp:
    Type: Okta::Application::Application
    Properties:
      Name: "template_basic_auth"
      Label: "CFN Sample Application"
      SignOnMode: "BASIC_AUTH"
      Settings:
        App:
          Url: "https://example.com/login.html"
          AuthURL: "https://example.com/auth.html"

Shows how to create a Group in Okta

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Shows how to create a Group in Okta
Resources:
  NewOktaGroup:
    Type: Okta::Group::Group
    Properties:
      Profile:
        Name: CFN Sample Group
        Description: Description of the CFN Sample Group

Shows how to create a Group Application Association in Okta

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Shows how to create a Group Application Association in Okta
Resources:
  NewGroupAssociation:
    Type: Okta::Group::GroupApplicationAssociation
    Properties:
      ApplicationId: MyApplicationId
      GroupId: MyGroupId

Shows how to create a Group Membership in Okta

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Shows how to create a Group Membership in Okta
Resources:
  NewGroupUserMembership:
    Type: Okta::Group::Membership
    Properties:
      GroupId: !GetAtt NewOktaGroup.Id
      UserLogin: EMAIL_FOR_EXISTING_USER

Shows how to create a Policy in Okta

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Shows how to create a Policy in Okta
Resources:
  NewGroupPolicy:
    Type: Okta::Policy::Policy
    Properties:
      Type: OKTA_SIGN_ON
      Name: My Policy
      Description: My Policy Description
      Conditions:
        People:
          Groups:
            Include:
              - MyGroupId