add sso sync script

Makefile

@@ -1,8 +1,9 @@
 OUTPUT = main # Referenced as Handler in template.yaml
 RELEASER = goreleaser
 PACKAGED_TEMPLATE = packaged.yaml
-STACK_NAME := $(STACK_NAME)
-S3_BUCKET := $(S3_BUCKET)
+# Labmda resides in `creditninja` account
+STACK_NAME = serverlessrepo-ssosync-redeploy
+S3_BUCKET = ssosync-sam-package-bucket
 TEMPLATE = template.yaml
 APP_NAME 	 ?= ssosync
 

sso_sync.sh

@@ -0,0 +1,37 @@
+#!/bin/bash +x
+
+WORKDIR="."
+SSOSYNC="$WORKDIR/ssosync"
+GoogleCredentials="$WORKDIR/credentials.json"
+DOMAIN="creditninja.com"
+
+echo "Check script requirements.."
+if [ $(which aws) ] && [ $(which jq) ]; then
+  echo -n "OK" && echo
+else 
+  echo " Install jq and aws-cli"
+  exit 1
+fi
+
+echo "Getting credentials.."
+SCIMEndpointAccessToken=$(aws secretsmanager get-secret-value --secret-id SSOSyncSCIMAccessToken | jq -r '.SecretString')
+SCIMEndpointUrl=$(aws secretsmanager get-secret-value --secret-id SSOSyncSCIMEndpointUrl | jq -r '.SecretString')
+GoogleAdminEmail=$(aws secretsmanager get-secret-value --secret-id  SSOSyncGoogleAdminEmail | jq -r '.SecretString')
+aws secretsmanager get-secret-value --secret-id SSOSyncGoogleCredentials | jq -r '.SecretString' | jq > $GoogleCredentials
+
+echo "Syncing.."
+$SSOSYNC \
+  --access-token       "$SCIMEndpointAccessToken" \
+  --endpoint           "$SCIMEndpointUrl" \
+  --google-admin       "$GoogleAdminEmail" \
+  --google-credentials "$GoogleCredentials" \
+  --sync-method         "users_groups" \
+  --include-groups      "sso_database_admin@$DOMAIN" \
+  --include-groups      "sso_developer@$DOMAIN" \
+  --include-groups      "sso_developer_lead@$DOMAIN" \
+  --include-groups      "sso_devops@$DOMAIN" \
+  --include-groups      "sso_finance@$DOMAIN" \
+  --include-groups      "sso_qa@$DOMAIN" \
+  --include-groups      "sso_risk_analyst@$DOMAIN" \
+  --include-groups      "sso_risk_developer@$DOMAIN" \
+  --debug

template.yaml

@@ -15,17 +15,18 @@ Metadata:
           default: "Advanced Configuration"
         Parameters:
           - SyncMethod
-          - GoogleUserMatch
-          - GoogleGroupMatch
           - LogLevel
           - LogFormat
           - ScheduleExpression
-          - IgnoreUsers
-          - IgnoreGroups
           - IncludeGroups
+          # Commented out variables we are not using
+          # - GoogleUserMatch
+          # - GoogleGroupMatch
+          # - IgnoreUsers
+          # - IgnoreGroups
 
   AWS::ServerlessRepo::Application:
-    Name: ssosync
+    Name: ssosync-redeploy
     Description: Helping you populate AWS SSO directly with your Google Apps users.
     Author: Sebastian Doell
     SpdxLicenseId: Apache-2.0
@@ -35,9 +36,9 @@ Metadata:
     Labels: [serverless, sso, lambda, scim]
     HomePageUrl: https://github.com/awslabs/ssosync
     # Update the semantic version and run sam publish to publish a new version of your app
-    SemanticVersion: 1.0.0-rc.10
+    SemanticVersion: 1.0.0-rc.10-cn.3
     # best practice is to use git tags for each release and link to the version tag as your source code URL
-    SourceCodeUrl: https://github.com/awslabs/ssosync/tree/1.0.0-rc.10
+    SourceCodeUrl: https://github.com/KMDPartners/ssosync/tree/sso-sync-cn
 
 Parameters:
   ScheduleExpression:
@@ -47,7 +48,7 @@ Parameters:
   LogLevel:
     Type: String
     Description: Log level for Lambda function logging
-    Default: warn
+    Default: info
     AllowedValues:
       - panic
       - fatal
@@ -79,30 +80,31 @@ Parameters:
     Type: String
     Description: AWS SSO SCIM AccessToken
     NoEcho: true
-  GoogleUserMatch:
-    Type: String
-    Description: |
-      Google Workspace user filter query parameter, example: 'name:John* email:admin*', see: https://developers.google.com/admin-sdk/directory/v1/guides/search-users
-  GoogleGroupMatch:
-    Type: String
-    Description: |
-      Google Workspace group filter query parameter, example: 'name:Admin* email:aws-*', see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups
-  IgnoreGroups:
-    Type: String
-    Description: |
-      Ignore these Google Workspace groups
-  IgnoreUsers:
-    Type: String
-    Description: |
-      Ignore these Google Workspace users
+    # Commented out variables that we are not using
+  # GoogleUserMatch:
+  #   Type: String
+  #   Description: |
+  #     Google Workspace user filter query parameter, example: 'name:John* email:admin*', see: https://developers.google.com/admin-sdk/directory/v1/guides/search-users
+  # GoogleGroupMatch:
+  #   Type: String
+  #   Description: |
+  #     Google Workspace group filter query parameter, example: 'name:Admin* email:aws-*', see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups
+  # IgnoreGroups:
+  #   Type: String
+  #   Description: |
+  #     Ignore these Google Workspace groups
+  # IgnoreUsers:
+  #   Type: String
+  #   Description: |
+  #     Ignore these Google Workspace users
   IncludeGroups:
     Type: String
     Description: | 
       Include only these Google Workspace groups. (Only applicable for SyncMethod user_groups)
   SyncMethod:
     Type: String
     Description: Sync method to use
-    Default: groups
+    Default: users_groups
     AllowedValues:
       - groups
       - users_groups
@@ -116,7 +118,7 @@ Resources:
     Properties:
       Runtime: go1.x
       Handler: dist/ssosync_linux_amd64/ssosync
-      Timeout: 300
+      Timeout: 850
       Environment:
         Variables:
           SSOSYNC_LOG_LEVEL: !Ref LogLevel
@@ -125,12 +127,13 @@ Resources:
           SSOSYNC_GOOGLE_ADMIN: !Ref AWSGoogleAdminEamil
           SSOSYNC_SCIM_ENDPOINT: !Ref AWSSCIMEndpointSecret
           SSOSYNC_SCIM_ACCESS_TOKEN: !Ref AWSSCIMAccessTokenSecret
-          SSOSYNC_USER_MATCH: !Ref GoogleUserMatch
-          SSOSYNC_GROUP_MATCH: !Ref GoogleGroupMatch
           SSOSYNC_SYNC_METHOD: !Ref SyncMethod
-          SSOSYNC_IGNORE_GROUPS: !Ref IgnoreGroups
-          SSOSYNC_IGNORE_USERS: !Ref IgnoreUsers
           SSOSYNC_INCLUDE_GROUPS: !Ref IncludeGroups
+          # Commented out variables that we are not using
+          # SSOSYNC_IGNORE_GROUPS: !Ref IgnoreGroups
+          # SSOSYNC_IGNORE_USERS: !Ref IgnoreUsers
+          # SSOSYNC_USER_MATCH: !Ref GoogleUserMatch
+          # SSOSYNC_GROUP_MATCH: !Ref GoogleGroupMatch
       Policies:
         - Statement:
             - Sid: SSMGetParameterPolicy