template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Which pattern are we deploying? The app with secrets, the app but using existing secrets, or just the secrets.
        Parameters:
          - DeployPattern
      - Label:
          default: AWS IAM Identity Center (Successor to AWS Single Sign-On)
        Parameters:
          - SCIMEndpointUrl
          - SCIMEndpointAccessToken
          - Region
          - IdentityStoreID
      - Label:
          default: Google Workspace Credentials 
        Parameters:
          - GoogleAdminEmail
          - GoogleCredentials
      - Label:
          default: Sync Configuration
        Parameters:
          - SyncMethod
          - GoogleUserMatch
          - GoogleGroupMatch
          - IgnoreUsers
          - IgnoreGroups
      - Label:
          default: "Configuration options for users_groups Mode only"
        Parameters:
          - IncludeGroups
      - Label:
          default: "Lambda Configuration"
        Parameters:
          - FunctionName
          - LogLevel
          - LogFormat
          - TimeOut
          - ScheduleExpression

  AWS::ServerlessRepo::Application:
    Name: ssosync
    Description: Helping you populate AWS SSO directly with your Google Apps users.
    Author: Sebastian Doell
    SpdxLicenseId: Apache-2.0
    # paths are relative to .aws-sam/build directory
    LicenseUrl: LICENSE
    ReadmeUrl: SAR.md
    Labels: [serverless, sso, lambda, scim]
    HomePageUrl: https://github.com/awslabs/ssosync
    # Update the semantic version and run sam publish to publish a new version of your app
    SemanticVersion: 1.0.0-rc.10
    # best practice is to use git tags for each release and link to the version tag as your source code URL
    SourceCodeUrl: https://github.com/awslabs/ssosync

Parameters:
  DeployPattern:
    Type: String
    Description: |
      App + secrets (default); you provide the values for the secrets and the everything is setup.
      App only; Deploys the app and to use the secrets you provide the arn for, that exist in this account.
      App for cross-account; Deploys the app and to use the secrets you provide the arn for, also requires details of the KMS key used to encrypt them.
      Secrets only; Just creates the secrets.
      Secrets for cross-account; Just creates the secrets, and encrypts them with a KMS key and share them with the target account.
    Default: App + secrets
    AllowedValues:
      - App + secrets
      - App only
      - App for cross-account
      - Secrets only
      - Secrets for cross-account

  CrossStackConfig:
    Type: String
    Description: |
      [App for cross-account] this is the AppConfig from the ouputs of the Secrets for cross-account stack.
      [Secrets for cross-account] this is the AWS account id into which you will be deplying the SSOSync app?
    Default: ""
    AllowedPattern: '(?!.*\s)|(\d{12})|(arn:aws:secretsmanager:((us(-gov)?|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-\d):[0-9]{8,12}:secret:[a-zA-Z0-9/_+=.@-]{1,512})(,arn:aws:secretsmanager:((us(-gov)?|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-\d):[0-9]{8,12}:secret:[a-zA-Z0-9/_+=.@-]{1,512}){5}(,arn:aws:kms:((us(-gov)?|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-\d):[0-9]{12}:key/[a-zA-Z0-9/_+=.@-]{1,512})?'

  FunctionName:
    Type: String
    Description: |
      [optional] Specify the name you want to us for this deployment, if you want to trigger SSOSync as part of a pipeline or other automation this will ensure a consistent arn to call. leave empty for default behaviour.
    Default: ""
    AllowedPattern: '(?!.*\s)|[a-zA-Z0-9-_]{1,140}'

  ScheduleExpression:
    Type: String
    Description: |
      [optional] Schedule for trigger the execution of ssosync (see CloudWatch schedule expressions), leave empty if you want to trigger execution by another method such as AWS CodePipeline.
    Default: rate(15 minutes)
    AllowedPattern: '(?!.*\s)|rate\(\d{1,3} (minutes|hours|days)\)|(cron\((([0-9]|[1-5][0-9]|60)|\d\/([0-9]|[1-5][0-9]|60)|\*) (([0-9]|[1][0-9]|[2][0-3])|(\d\/([0-9]|[1][0-9]|[2][0-3]))|(([0-9]|[1][0-9]|[2][0-3])-([0-9]|[1][0-9]|[2][0-3]))|\*) (([1-9]|[1-2][0-9]|[3][0-1])|\d\/([1-9]|[1-2][0-9]|[3][0-1])|[1-5]W|L|\*|\?) (([1-9]|[1][1-2])|(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)|((JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV)-(FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC))|(JAN|FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV)(,(FEB|MAR|APR|MAY|JUN|JUL|AUG|SEP|OCT|NOV|DEC)){0,11}|\d\/([0-9]|[1][0-2])|\?|\*) ((MON|TUE|WED|THU|FRI|SAT|SUN)|(MON|TUE|WED|THU|FRI|SAT)-(TUE|WED|THU|FRI|SAT|SUN)|(MON|TUE|WED|THU|FRI|SAT)(,(TUE|WED|THU|FRI|SAT|SUN)){0,6}|[1-7]L|[1-7]#[1-5]|\?|\*) ((19[7-9][0-9]|2[0-1]\d\d)|(19[7-9][0-9]|2[0-1]\d\d)-(19[7-9][0-9]|2[0-1]\d\d)|(19[7-9][0-9]|2[0-1]\d\d)(,(19[7-9][0-9]|2[0-1]\d\d))*|\*)\))'

  LogLevel:
    Type: String
    Description: |
      [required] Log level for Lambda function logging
    Default: warn
    AllowedValues:
      - panic
      - fatal
      - error
      - warn
      - info
      - debug
      - trace

  LogFormat:
    Type: String
    Description: |
      [required] Log format for Lambda function logging
    Default: json
    AllowedValues:
      - json
      - text
        
  TimeOut:
    Type: Number
    Description: |
      [required] Timeout for the Lambda function
    Default: 300
    MinValue: 1
    MaxValue: 900

# Secrets
  GoogleCredentials:
    Type: String
    Description: |
      Credentials to log into Google (content of credentials.json)
    Default: ""
    AllowedPattern: '(?!.*\s)|(\{(\s)*(".*")(\s)*:(\s)*(".*")(\s)*\})'
    NoEcho: true

  GoogleAdminEmail:
    Type: String
    Description: |
      Google Admin email
    Default: ""
    AllowedPattern: '(?!.*\s)|(([a-zA-Z0-9.+=_-]{0,61})@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*)'
    NoEcho: true

  SCIMEndpointUrl:
    Type: String
    Description: |
      AWS IAM Identity Center - SCIM Endpoint Url
    Default: ""
    AllowedPattern: '(?!.*\s)|(https://scim.(us(-gov)?|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-([0-9]{1}).amazonaws.com/([A-Za-z0-9]{11})-([A-Za-z0-9]{4})-([A-Za-z0-9]{4})-([A-Za-z0-9]{4})-([A-Za-z0-9]{12})/scim/v2/?)'

  SCIMEndpointAccessToken:
    Type: String
    Description: |
      AWS IAM Identity Center - SCIM AccessToken
    Default: ""
    AllowedPattern: '(?!.*\s)|([0-9a-zA-Z/=+-\\]{500,620})'
    NoEcho: true

  Region:
    Type: String
    Description: |
      AWS Region where AWS IAM Identity Center is enabled
    Default: ""
    AllowedPattern: '(?!.*\s)|(us(-gov)?|ap|ca|cn|eu|sa)-(central|(north|south)?(east|west)?)-\d'

  IdentityStoreID:
    Type: String
    Description: |
      Identifier of Identity Store in AWS IAM Identity Center
    Default: ""
    AllowedPattern: '(?!.*\s)|d-[1-z0-9]{10}'

  GoogleUserMatch:
    Type: String
    Description: |
      [optional] Google Workspace Users filter query parameter, a simple '*' denotes sync all users in the directory. example: 'name:John*,email:admin*', '*' or name=John Doe,email:admin*' see: https://developers.google.com/admin-sdk/directory/v1/guides/search-users, if left empty no users will be selected but if a pattern has been set for GroupMatch users that are members of the groups it matches will still be selected.
    Default: ""
    AllowedPattern: '(?!.*\s)|(\*)|((((name|Name|NAME)((:[a-zA-Z0-9\- ]{1,64}\*)|(=[a-zA-Z0-9\- ]{1,64})))|((email|Email|EMAIL)((:[a-zA-Z0-9.\-_]{1,64}\*)|(=([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260})))))(,(((name|Name|NAME)((:[a-zA-Z0-9\- ]{1,64}\*)|(=[a-zA-Z0-9\- ]{1,64})))|((email|Email|EMAIL)((:[a-zA-Z0-9.\-_]{1,64}\*)|(=([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260}))))))*)'

  GoogleGroupMatch:
    Type: String
    Description: |
      [optional] Google Workspace Groups filter query parameter, a simple '*' denotes sync all groups (and any users that are members of those groups). example: 'name:Admin*,email:aws-*', 'name=Admins' or '*' see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups, if left empty no groups will be selected.
    Default: "*"
    AllowedPattern: '(?!.*\s)|(\*)|((((name|Name|NAME)((:[a-zA-Z0-9\- ]{1,64}\*)|(=[a-zA-Z0-9\- ]{1,64})))|((email|Email|EMAIL)((:[a-zA-Z0-9.\-_]{1,64}\*)|(=([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260})))))(,(((name|Name|NAME)((:[a-zA-Z0-9\- ]{1,64}\*)|(=[a-zA-Z0-9\- ]{1,64})))|((email|Email|EMAIL)((:[a-zA-Z0-9.\-_]{1,64}\*)|(=([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260}))))))*)'

  IgnoreGroups:
    Type: String
    Description: |
      [optional] Ignore these Google Workspace groups, leave empty if not required
    Default: ""
    AllowedPattern: '(?!.*\s)|((([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260}))(,(([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260})))*)'

  IgnoreUsers:
    Type: String
    Description: |
      [optional] Ignore these Google Workspace users, leave empty if not required
    Default: ""
    AllowedPattern: '(?!.*\s)|((([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260}))(,(([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260})))*)'

  IncludeGroups:
    Type: String
    Description: |
      [optional] Include only these Google Workspace groups, leave empty if not required. (Only applicable for SyncMethod user_groups)
    Default: ""
    AllowedPattern: '(?!.*\s)|((([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260}))(,(([a-zA-Z0-9.\-_]{1,64})@([a-zA-Z0-9.\-]{5,260})))*)'

  SyncMethod:
    Type: String
    Description: Sync method to use 
    Default: groups
    AllowedValues:
      - groups
      - users_groups

Conditions:
  SetFunctionName: !Not 
    - !Equals
        - !Ref FunctionName
        - ""
  SetGoogleUserMatch: !And
    - !Not
        - !Equals
            - !Ref GoogleUserMatch
            - ""
    - !Equals
        - !Ref SyncMethod
        - "groups"
  SetGoogleGroupMatch: !And 
    - !Not
        - !Equals
            - !Ref GoogleGroupMatch
            - ""
    - !Equals
        - !Ref SyncMethod
        - "groups"
  SetIgnoreGroups: !Not 
    - !Equals
        - !Ref IgnoreGroups
        - ""
  SetIgnoreUsers: !Not
    - !Equals
        - !Ref IgnoreUsers
        - ""
  SetIncludeGroups: !And
    - !Not
        - !Equals
            - !Ref IncludeGroups
            - ""
    - !Equals
        - !Ref SyncMethod
        - "users_groups"
  OnSchedule: !Not
    - !Equals
        - !Ref ScheduleExpression
        - ""
  CreateFunction: !Or
    - !Equals
        - !Ref DeployPattern
        - "App for cross-account"
    - !Equals
        - !Ref DeployPattern
        - "App + secrets"
    - !Equals
        - !Ref DeployPattern
        - "App only"
  CreateSecrets: !Or
    - !Equals
        - !Ref DeployPattern
        - "App + secrets"
    - !Equals
        - !Ref DeployPattern
        - "Secrets only"
    - !Equals
        - !Ref DeployPattern
        - "Secrets for cross-account"
  CreateKey: !Equals
    - !Ref DeployPattern
    - "Secrets for cross-account"
  RemoteSecrets: !Equals
    - !Ref DeployPattern
    - "App for cross-account"
  LocalSecrets: !Or
    - !Equals
        - !Ref DeployPattern
        - "App + secrets"
    - !Equals
        - !Ref DeployPattern
        - "App only"
  OutputFunction: !Or
    - !Equals
        - !Ref DeployPattern
        - "App + secrets"
    - !Equals
        - !Ref DeployPattern
        - "App only"
    - !Equals
        - !Ref DeployPattern
        - "App for cross-account"
  OutputSecrets: !Equals
    - !Ref DeployPattern
    - "Secrets only"

Rules:
  SecretValues:
    RuleCondition: !Or
      - !Equals
          - !Ref DeployPattern
          - "App + secrets"
      - !Equals
          - !Ref DeployPattern
          - "Secrets only"
      - !Equals
          - !Ref DeployPattern
          - "Secrets for cross-account"
    Assertions:
      - Assert: !Not
          - !Equals
              - !Ref GoogleCredentials
              - ""
        AssertDescription: 'The contents of the Credentials.json is required for this deployment type.'
      - Assert: !Not
          - !Equals
              - !Ref GoogleAdminEmail
              - ""
        AssertDescription: 'The email address of a directory admin is required for this deployment type.'
      - Assert: !Not
          - !Equals
              - !Ref SCIMEndpointUrl
              - ""
        AssertDescription: 'The SCIM url from IAM Identity Center is required for this deployment type.'
      - Assert: !Not
          - !Equals
              - !Ref SCIMEndpointAccessToken
              - ""
        AssertDescription: 'The SCIM Access Token is required for this deployment type.'
      - Assert: !Not
          - !Equals
              - !Ref Region
              - ""
        AssertDescription: 'The Region in which IAM Identity Center is deployed is required for this deployment type.'
      - Assert: !Not
          - !Equals
              - !Ref IdentityStoreID
              - ""
        AssertDescription: 'The Identity Store Id for IAM Identity Center is required for this deployment type.'

  LocalSecrets:
    RuleCondition:  !Or
      - !Equals
          - !Ref DeployPattern
          - "App + secrets"
      - !Equals
          - !Ref DeployPattern
          - "Secrets only"
    Assertions:
      - Assert: !Equals
          - !Ref CrossStackConfig
          - ""
        AssertDescription: 'Do not provide a Cross Stack Configuration for this deployment type.'

  CrossSecrets:
    RuleCondition: !Equals
      - !Ref DeployPattern
      - "Secrets for cross-account"
    Assertions:
      - Assert: !Not
          - !Equals
              - !Ref CrossStackConfig
              - ""
        AssertDescription: 'The AWS account id, of the account where you intend to deploy the app.'

  CrossApp:
    RuleCondition: !Or
      - !Equals
          - !Ref DeployPattern
          - "App"
      - !Equals
          - !Ref DeployPattern
          - "App for cross-account"
    Assertions:
      - Assert: !Equals
          - !Ref GoogleCredentials
          - ""
        AssertDescription: 'A value for GoogleCredentials is not required for this deployment type.'
      - Assert: !Equals
          - !Ref GoogleAdminEmail
          - ""
        AssertDescription: 'A value for GoogleAdminEmail is not required for this deployment type.'
      - Assert: !Equals
          - !Ref SCIMEndpointUrl
          - ""
        AssertDescription: 'A value for SCIMEndpointUrl is not required for this deployment type.'
      - Assert: !Equals
          - !Ref SCIMEndpointAccessToken
          - ""
        AssertDescription: 'A value for SCIMEndpointAccessToken is not required for this deployment type.'
      - Assert: !Equals
          - !Ref Region
          - ""
        AssertDescription: 'A value for Region is not required for this deployment type.'
      - Assert: !Equals
          - !Ref IdentityStoreID
          - ""
        AssertDescription: 'A value for IdentityStoreID is not required for this deployment type.'
      - Assert: !Not
          - !Equals
              - !Ref CrossStackConfig
              - ""
        AssertDescription: 'AppConfig copied from the outputs of the secrets stack is required for this deployment type.'

Resources:

  SSOSyncRoleLocal:
    Type: AWS::IAM::Role
    Condition: LocalSecrets
    Properties:
      RoleName: SSOSyncAppRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
            - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
      Policies:
        - PolicyName: SSOSyncAppPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: SSMGetParameterPolicy
                Effect: Allow
                Action:
                  - "secretsmanager:Get*"
                Resource:
                  - !If [CreateSecrets, !Ref SecretGoogleCredentials, !Select [0, !Split [',', !Ref CrossStackConfig]]]
                  - !If [CreateSecrets, !Ref SecretGoogleAdminEmail, !Select [1, !Split [',', !Ref CrossStackConfig]]]
                  - !If [CreateSecrets, !Ref SecretSCIMEndpoint, !Select [2, !Split [',', !Ref CrossStackConfig]]]
                  - !If [CreateSecrets, !Ref SecretSCIMAccessToken, !Select [3, !Split [',', !Ref CrossStackConfig]]]
                  - !If [CreateSecrets, !Ref SecretRegion, !Select [4, !Split [',', !Ref CrossStackConfig]]]
                  - !If [CreateSecrets, !Ref SecretIdentityStoreID, !Select [5, !Split [',', !Ref CrossStackConfig]]]
              - Sid: IdentityStoreAccesPolicy
                Effect: Allow
                Action:
                  - "identitystore:DeleteUser"
                  - "identitystore:CreateGroup"
                  - "identitystore:CreateGroupMembership"
                  - "identitystore:ListGroups"
                  - "identitystore:ListUsers"
                  - "identitystore:ListGroupMemberships"
                  - "identitystore:IsMemberInGroups"
                  - "identitystore:GetGroupMembershipId"
                  - "identitystore:DeleteGroupMembership"
                  - "identitystore:DeleteGroup"
                Resource:
                  - "*"
              - Sid: CodePipelinePolicy
                Effect: Allow
                Action:
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:PutJobFailureResult
                Resource: "*"

  SSOSyncRoleRemote:
    Type: AWS::IAM::Role
    Condition: RemoteSecrets
    Properties:
      RoleName: SSOSyncAppRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action:
            - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
      Policies:
        - PolicyName: SSOSyncAppPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Sid: SSMGetParameterPolicy
                Effect: Allow
                Action:
                  - "secretsmanager:Get*"
                Resource:
                  - !Select [0, !Split [',', !Ref CrossStackConfig]] # GoogleCredentials
                  - !Select [1, !Split [',', !Ref CrossStackConfig]] # GoogleAdminEmail
                  - !Select [2, !Split [',', !Ref CrossStackConfig]] # SCIMEndpointUrl
                  - !Select [3, !Split [',', !Ref CrossStackConfig]] # SCIMEndpointAccessToken
                  - !Select [4, !Split [',', !Ref CrossStackConfig]] # Region
                  - !Select [5, !Split [',', !Ref CrossStackConfig]] # IdentityStoreID
              - Sid: KMSDecryptPolicy
                Effect: Allow
                Action:
                  - kms:Decrypt
                Resource:
                  -  !Select [6, !Split [',', !Ref CrossStackConfig]] # KMSSecret
              - Sid: IdentityStoreAccesPolicy
                Effect: Allow
                Action:
                  - "identitystore:DeleteUser"
                  - "identitystore:CreateGroup"
                  - "identitystore:CreateGroupMembership"
                  - "identitystore:ListGroups"
                  - "identitystore:ListUsers"
                  - "identitystore:ListGroupMemberships"
                  - "identitystore:IsMemberInGroups"
                  - "identitystore:GetGroupMembershipId"
                  - "identitystore:DeleteGroupMembership"
                  - "identitystore:DeleteGroup"
                Resource:
                  - "*"
              - Sid: CodePipelinePolicy
                Effect: Allow
                Action:
                  - codepipeline:PutJobSuccessResult
                  - codepipeline:PutJobFailureResult
                Resource: "*"

  SSOSyncFunction:
    Type: AWS::Serverless::Function
    Condition: CreateFunction
    Properties:
      FunctionName: !If [SetFunctionName, !Ref FunctionName, !Ref AWS::NoValue]
      Description: "An instance of ssosync deplyed from the Serverless Application Repository, for details see http://https://github.com/awslabs/ssosync"
      Role: !If [RemoteSecrets, !GetAtt SSOSyncRoleRemote.Arn, !GetAtt SSOSyncRoleLocal.Arn]
      Runtime: provided.al2
      Handler: bootstrap
      Architectures:
        - arm64
      Timeout: !Ref TimeOut
      ReservedConcurrentExecutions: 1
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          LOG_FORMAT: !Ref LogFormat
          GOOGLE_CREDENTIALS: !If [CreateSecrets, !Ref SecretGoogleCredentials, !Select [0, !Split [',', !Ref CrossStackConfig]]]
          GOOGLE_ADMIN: !If [CreateSecrets, !Ref SecretGoogleAdminEmail, !Select [1, !Split [',', !Ref CrossStackConfig]]]
          SCIM_ENDPOINT: !If [CreateSecrets, !Ref SecretSCIMEndpoint, !Select [2, !Split [',', !Ref CrossStackConfig]]]
          SCIM_ACCESS_TOKEN: !If [CreateSecrets, !Ref SecretSCIMAccessToken, !Select [3, !Split [',', !Ref CrossStackConfig]]]
          REGION: !If [CreateSecrets, !Ref SecretRegion, !Select [4, !Split [',', !Ref CrossStackConfig]]]
          IDENTITY_STORE_ID: !If [CreateSecrets, !Ref SecretIdentityStoreID, !Select [5, !Split [',', !Ref CrossStackConfig]]]
          USER_MATCH: !If [SetGoogleUserMatch, !Ref GoogleUserMatch, !Ref AWS::NoValue]
          GROUP_MATCH: !If [SetGoogleGroupMatch, !Ref GoogleGroupMatch, !Ref AWS::NoValue]
          SYNC_METHOD: !Ref SyncMethod
          IGNORE_GROUPS: !If [SetIgnoreGroups, !Ref IgnoreGroups, !Ref AWS::NoValue]
          IGNORE_USERS: !If [SetIgnoreUsers, !Ref IgnoreUsers, !Ref AWS::NoValue]
          INCLUDE_GROUPS: !If [SetIncludeGroups, !Ref IncludeGroups, !Ref AWS::NoValue]
      Events:
        SyncScheduledEvent:
          Type: Schedule
          Name: AWSSyncSchedule
          Properties:
            Enabled: !If [OnSchedule, false, true]
            Schedule: !If [OnSchedule, !Ref ScheduleExpression, "rate(15 minutes)"]


  KeyAlias:
    Type: AWS::KMS::Alias
    Condition: CreateKey
    Properties:
      AliasName: alias/SSOSync
      TargetKeyId: !Ref KeyForSecrets

  KeyForSecrets:
    Type: AWS::KMS::Key
    Condition: CreateKey
    Properties:
      Description: Key for protecting SSOSync Secrets in cross-account deployment
      Enabled: true
      KeySpec: SYMMETRIC_DEFAULT
      KeyUsage: ENCRYPT_DECRYPT
      MultiRegion: false
      PendingWindowInDays: 7
      KeyPolicy:
        Version: 2012-10-17
        Id: key-default-1
        Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
          Action: 'kms:*'
          Resource: '*'
        - Sid: AppRole in Other account
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${CrossStackConfig}:root
          Action:
            - kms:Decrypt
            - kms:DescribeKey
          Resource: '*'

  SecretGoogleCredentials:
    Type: "AWS::SecretsManager::Secret"
    Condition: CreateSecrets
    Properties:
      Name: SSOSyncGoogleCredentials
      SecretString: !Ref GoogleCredentials
      KmsKeyId: !If [CreateKey, !Ref KeyAlias, alias/aws/secretsmanager]

  SecretGoogleCredentialsPolicy:
    Type: AWS::SecretsManager::ResourcePolicy
    Condition: CreateKey
    Properties:
      SecretId: !Ref SecretGoogleCredentials
      ResourcePolicy:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${CrossStackConfig}:root
          Action:
            - secretsmanager:GetSecretValue
          Resource: '*'

  SecretGoogleAdminEmail:
    Type: "AWS::SecretsManager::Secret"
    Condition: CreateSecrets
    Properties:
      Name: SSOSyncGoogleAdminEmail
      SecretString: !Ref GoogleAdminEmail
      KmsKeyId: !If [CreateKey, !Ref KeyAlias, alias/aws/secretsmanager]

  SecretGoogleAdminEmailPolicy:
    Type: AWS::SecretsManager::ResourcePolicy
    Condition: CreateKey
    Properties:
      SecretId: !Ref SecretGoogleAdminEmail
      ResourcePolicy:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${CrossStackConfig}:root
          Action:
            - secretsmanager:GetSecretValue
          Resource: '*'

  SecretSCIMEndpoint: # This can be moved to custom provider
    Type: "AWS::SecretsManager::Secret"
    Condition: CreateSecrets
    Properties:
      Name: SSOSyncSCIMEndpointUrl
      SecretString: !Ref SCIMEndpointUrl
      KmsKeyId: !If [CreateKey, !Ref KeyAlias, alias/aws/secretsmanager]

  SecretSCIMEndpointPolicy:
    Type: AWS::SecretsManager::ResourcePolicy
    Condition: CreateKey
    Properties:
      SecretId: !Ref SecretSCIMEndpoint
      ResourcePolicy:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${CrossStackConfig}:root
          Action:
            - secretsmanager:GetSecretValue
          Resource: '*'
        
  SecretSCIMAccessToken: # This can be moved to custom provider
    Type: "AWS::SecretsManager::Secret"
    Condition: CreateSecrets
    Properties:
      Name: SSOSyncSCIMAccessToken
      SecretString: !Ref SCIMEndpointAccessToken
      KmsKeyId: !If [CreateKey, !Ref KeyAlias, alias/aws/secretsmanager]

  SecretSCIMAccessTokenPolicy:
    Type: AWS::SecretsManager::ResourcePolicy
    Condition: CreateKey
    Properties:
      SecretId: !Ref SecretSCIMAccessToken
      ResourcePolicy:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${CrossStackConfig}:root
          Action:
            - secretsmanager:GetSecretValue
          Resource: '*'
        
  SecretRegion:
    Type: "AWS::SecretsManager::Secret"
    Condition: CreateSecrets
    Properties:
      Name: SSOSyncRegion
      SecretString: !Ref Region
      KmsKeyId: !If [CreateKey, !Ref KeyAlias, alias/aws/secretsmanager]

  SecretRegionPolicy:
    Type: AWS::SecretsManager::ResourcePolicy
    Condition: CreateKey
    Properties:
      SecretId: !Ref SecretRegion
      ResourcePolicy:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${CrossStackConfig}:root
          Action:
            - secretsmanager:GetSecretValue
          Resource: '*'
                
  SecretIdentityStoreID:
    Type: "AWS::SecretsManager::Secret"
    Condition: CreateSecrets
    Properties:
      Name: SSOSyncIdentityStoreID
      SecretString: !Ref IdentityStoreID
      KmsKeyId: !If [CreateKey, !Ref KeyAlias, alias/aws/secretsmanager]

  SecretIdentityStoreIDPolicy:
    Type: AWS::SecretsManager::ResourcePolicy
    Condition: CreateKey
    Properties:
      SecretId: !Ref SecretIdentityStoreID
      ResourcePolicy:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${CrossStackConfig}:root
          Action:
            - secretsmanager:GetSecretValue
          Resource: '*'

Outputs:
  FunctionArn:
    Condition: OutputFunction
    Description: "The Arn of the deployed lambda function"
    Value: !GetAtt SSOSyncFunction.Arn
    Export:
      Name: FunctionARN

  AppConfigLocal:
    Condition: OutputSecrets
    Description: "The Comma Separated list of secrets ARNs to copy and paste into the CrossStackConfig field of the App only stack."
    Value: !Sub ${SecretGoogleCredentials},${SecretGoogleAdminEmail},${SecretSCIMEndpoint},${SecretSCIMAccessToken},${SecretRegion},${SecretIdentityStoreID}
    Export:
      Name: AppConfig

  AppConfigRemote:
    Condition: CreateKey
    Description: "The Comma Separated list of Secrets and KMS Key ARNs to copy and paste into the CrossStackConfig field of the app for cross-account stack."
    Value: !Sub ${SecretGoogleCredentials},${SecretGoogleAdminEmail},${SecretSCIMEndpoint},${SecretSCIMAccessToken},${SecretRegion},${SecretIdentityStoreID},arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/${KeyForSecrets}
    Export:
      Name: AppConfig