[New Resource]: Request for application assignment module in IAM Identity Center

[kusumamurri]

Description

There is no resource to create application in IAM Identity Center (successor to AWS Single sign-on).
Please provide a resource module to integrate an AWS application with SSO .

Requested Resource(s) and/or Data Source(s)

aws_ssoadmin_application_assignment

Potential Terraform Configuration

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[Fennerr]

Any update on this resource? It would help integrate IAM Identity Center with an Amazon Cognito user pool.

[steve-todorov]

We are also interested in this feature and would like to automate the provisioning of custom SAML applications.

[mtavaresmedeiros]

+1

[duenzo]

+1

[ugurcancaykara]

+1

[jclRatepay]

+1

[jclRatepay]

Wanted to share the following, latest finding regarding this topic:
We were thinking about getting around the missing Terraform "application assignment module" by setting up a CloudFormation template for handling this application assignment and execute this template via Terraform instead. But after checking the CloudFormation Template Reference and finding no entry regarding the Identicy Center Application Assignment here as well, I dived a bit deeper and revealed that the blocker for implementing the requested Terraform module is not on the AWS Provider side, but on the AWS side, as in the API reference e.g. the "CreateApplicationInstance" (which is the proper Action Name according to the IAM documentation) is not even listed. So I would guess, that no matter which workaround one might comes up with, automating the Identity Center Application Assignment is jsut not possible atm :(

Edit: Even just found an AWS re:post entry confirming this assumption

[peterbev]

AWS have finally provided APIs for application assignments - https://aws.amazon.com/about-aws/whats-new/2023/11/aws-iam-identity-center-apis-automate-access-applications/

Hopefully that unblocks this, and we get an aws_ssoadmin_application_assignment resource 😄

[jclRatepay]

This actually are really great news, thanks a lot for sharing it :)

[deepakbshetty]

AWS API Ref:
https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateApplicationAssignment.html

AWS CLI ref: https://docs.aws.amazon.com/cli/latest/reference/sso-admin/create-application-assignment.html

Another use case around this is AWS Sagemaker domain in SSO mode which currently lacks ability to assign users/groups via IaC

This now possible via create_application_assignment:
applicationArn = sagemaker_client.describe_domain(domainId = "d-xxx")["SingleSignOnApplicationArn"] idc_client.create_application_assignment(applicationArn = applicationArn, principalId="userId/groupId", principalType="USER/GROUP")

Ref: https://aws.amazon.com/blogs/machine-learning/onboard-users-to-amazon-sagemaker-studio-with-active-directory-group-specific-iam-roles/

[oleksandrsv]

I just got reply from AWS Support that it is not possible to assign to AWS SSO Application users or groups, sounds urgent to implement, wdyt?

[github-actions]

This functionality has been released in v5.30.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.