featureRequest: One-time migration of existing AWS SSO data about aws-iam-identity-center-extensions HOT 2 CLOSED

We've had some time to think through a design approach for implementing this feature, and observed that with the current AWS SSO admin and identity store API's that are available , we won't be able to implement this feature 100% . As we do not want to have an incomplete feature rolled out in the solution, we've decided to park this feature request until AWS SSO updated their API specifications.

Details around the design limitation are described below:

• The current AWS SSO Identity Store's List Users and List Groups do not allow a wild card based call. These API's expect the filters element in the payload to specify an attribute value.
• Additionally, AWS SSO admin API's account assignment operations require the GUID of the user/group the permission set is being assigned to as part of the API's payload.
• In our solution with the current design, we have event bridge rules that listen on SSO group events (for local identity store, SCIM, and Active Directory based sources) that allow us to persist the mapping between friendly names and the GUID's of the user groups. This allowed us to provide enterprise friendly account assignment operations as a solution feature
• However, when we looked at importing existing AWS SSO configuration into the solution to enable customers to use our solution and manage their access entitlements created outside of the solution, we've noticed that there's no programmatic way for us to get hold of existing groups that were created prior to the solution's deployment, which meant that we won't be able to offer a way for you to manage your access entitlements using user groups created prior to the solution deployment.
• Therefore, we've decided to park this feature until AWS SSO Identity store API allows a wild card based search on the List Users and List Groups API operations. Or, alternatively allow a way to discover existing users/groups in the AWS SSO configuration.

from aws-iam-identity-center-extensions.

We've now worked out a mechanism to handle this feature. Instead of persisting user name - user id and group display name - group id mappings, the solution will now dynamically do the lookup for this value and will therefore not need a list API to get this information.

from aws-iam-identity-center-extensions.