template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Okta AWS SSO SCIM Groups Connector

  This application listens to group membership events from Okta and syncrhonizes
  membership changes to identically named groups in AWS SSO which begin with the
  prefix `AWS_`.

  Changes are effected by interacting with the SCIM 2.0 endpoint provided by AWS SSO
  for automatic provisioning.

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 3

Parameters:
  ScimUrl:
    Type: String
    Description: "The SCIM url provided when setting up AWS SSO."

Metadata:
  AWS::ServerlessRepo::Application:
    Author: Myles Loffler
    Name: "Okta AWS SSO SCIM Groups Connector"
    SemanticVersion: 0.0.1
    Description: >
      This application listens to group membership events from Okta and syncrhonizes
      membership changes to identically named groups in AWS SSO which begin with the
      prefix `AWS_`.

      Changes are effected by interacting with the SCIM 2.0 endpoint provided by AWS SSO
      for automatic provisioning.
    Labels: ['AWS SSO', 'Okta', 'IAM']
    SpdxLicenseId: MIT
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    HomePageUrl: https://github.com/myles2007/okta-aws-sso-scim-groups-connector
    SourceCodeUrl: https://github.com/myles2007/okta-aws-sso-scim-groups-connector

Resources:
  ReadAppSecretsPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      Path: "/app/okta-aws-sso-scim-groups-connector/read-secrets/"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action: "secretsManager:GetSecretValue"
            Resource: !Ref Secrets

  TokenAuthorizerRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/app/okta-aws-sso-scim-groups-connector/token-authorizer/"
      ManagedPolicyArns:
        - !Ref ReadAppSecretsPolicy
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'

  EventProcessorRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/app/okta-aws-sso-scim-groups-connector/event-processor/"
      ManagedPolicyArns:
        - !Ref ReadAppSecretsPolicy
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'

  Secrets:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: "Contains the secrets expected to be provided by Okta and required by AWS SSO."
      Name: app/okta-aws-sso-scim-groups-connector
      GenerateSecretString:
        SecretStringTemplate: "{\"aws_sso_scim_key\": \"<MUST BE PROVIDED>\"}"
        GenerateStringKey: "auth_token_for_okta"
        PasswordLength: 256

  OktaEventsApi:
    Type: "AWS::Serverless::Api"
    Properties:
      StageName: Prod
      Cors:
        AllowOrigin: "'https://britecore.okta.com'"
      Auth:
        DefaultAuthorizer: TokenAuth
        Authorizers:
          TokenAuth:
            FunctionArn: !GetAtt TokenAuthorizer.Arn
            FunctionPayloadType: "REQUEST"
            Identity:
              Headers:
                - Authorization
                - x-api-key
        ApiKeyRequired: true # sets for all methods
        UsagePlan:
          CreateUsagePlan: "PER_API"


  EventHookVerifier:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: app/
      Handler: verify.lambda_handler
      Runtime: python3.8
      Events:
        Verify:
          Type: Api
          Properties:
            RestApiId: !Ref OktaEventsApi
            Path: /
            Method: get

  EventProcessor:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: app/
      Handler: processor.lambda_handler
      Runtime: python3.8
      Events:
        OktaEvent: # Should just be group member added/group member removed, but unfiltered.
          Type: Api
          Properties:
            RestApiId: !Ref OktaEventsApi
            Path: /
            Method: post
      Environment:
        Variables:
          SCIM_URL: !Ref ScimUrl
      Role: !GetAtt EventProcessorRole.Arn

  TokenAuthorizer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: app
      Handler: authorizer.lambda_handler
      Runtime: python3.8
      Role: !GetAtt TokenAuthorizerRole.Arn

Outputs:
  OktaEventsApi:
    Description: "API Gateway endpoint URL for Prod stage for OktaEventsApi"
    Value: !Sub "https://${OktaEventsApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
  EventHookVerifier:
    Description: "Perform initial endpoint verification with Okta"
    Value: !GetAtt EventHookVerifier.Arn
  EventHookVerifierIamRole:
    Description: "Implicit IAM Role created for EventHookVerifier function"
    Value: !GetAtt EventHookVerifierRole.Arn
  EventProcessor:
    Description: "Process events from Okta (specifically interesting group membership changes"
    Value: !GetAtt EventProcessor.Arn