template.yaml

---
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31

Description: |
  This is used to keep your AWS IAM Identity Center (Successor to AWS Single Sign-On) groups and users in sync with your
  Google Workspace directory using and AWS Lambda function.

  Project URL: https://github.com/slashdevops/idp-scim-sync

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Lambda Function - Configuration"
        Parameters:
          - SyncMethod
          - GWSGroupsFilter
          - LogLevel
          - LogFormat
          - ScheduleExpression
          - MemorySize
          - Timeout
          - LogGroupName
          - LogGroupRetentionDays
          - RoleNameSuffix
      - Label:
          default: "State File - Configuration"
        Parameters:
          - BucketNamePrefix
          - BucketKey
      - Label:
          default: "Google Workspace - Credentials"
        Parameters:
          - GWSServiceAccountFile
          - GWSServiceAccountFileSecretName
          - GWSUserEmail
          - GWSUserEmailSecretName
      - Label:
          default: "AWS Single Sign-On SCIM - Credentials"
        Parameters:
          - SCIMEndpoint
          - SCIMEndpointSecretName
          - SCIMAccessToken
          - SCIMAccessTokenSecretName

  AWS::ServerlessRepo::Application:
    Name: idp-scim-sync
    Description: |
      keep your AWS Single Sign-On (SSO) groups and users in sync with your
      Google Workspace directory using and AWS Lambda function.
    Author: slashdevops idp-scim-sync Team
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels: # only 10 allowed
      - Serverless
      - SSO
      - Lambda
      - SCIM
      - AWS
      - Go
      - Google-Workspace
      - idp-scim-sync
      - Groups
      - Users
    HomePageUrl: https://github.com/slashdevops/idp-scim-sync
    SemanticVersion: 0.0.1 # will be overwritten by the CI/CD pipeline
    SourceCodeUrl: https://github.com/slashdevops/idp-scim-sync

Parameters:
  ScheduleExpression:
    Type: String
    Description: |
      Schedule for trigger the execution of idp-scim-sync (see EventBridge rule schedule expressions)
      Reference: https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-create-rule-schedule.html
    Default: rate(15 minutes)

  LogLevel:
    Type: String
    Description: Log level for Lambda function logging
    Default: info
    AllowedValues:
      - panic
      - fatal
      - error
      - warn
      - info
      - debug
      - trace

  LogFormat:
    Type: String
    Description: Log format for Lambda function logging
    Default: json
    AllowedValues:
      - json
      - text

  BucketNamePrefix:
    Type: String
    Description: |
      Prefix used in the bucket name where the state data will be stored.
      NOTE: This template will use the 'AWS Region' and 'AWS Account ID' as a suffix to the 'bucket name' to avoid conflicts.
      Example: 'BucketNamePrefix-AWS::AccountId-AWS::Region'
    Default: idp-scim-sync-state

  BucketKey:
    Type: String
    Description: |
      The key "file" where the state data will be stored
    Default: data/state.json

  GWSServiceAccountFile:
    Type: String
    Description: |
      The Google Workspace credentials file content (content of credentials.json after creates the service account: https://cloud.google.com/iam/docs/creating-managing-service-account-keys)
    NoEcho: true

  GWSServiceAccountFileSecretName:
    Type: String
    Description: |
      The Google Workspace credentials file secret name
    Default: IDPSCIM_GWSServiceAccountFile

  GWSUserEmail:
    Type: String
    Description: |
      The Google Workspace user email authorized on the creation creation of the service account
    NoEcho: true

  GWSUserEmailSecretName:
    Type: String
    Description: |
      The Google Workspace user email secret name
    Default: IDPSCIM_GWSUserEmail

  SCIMEndpoint:
    Type: String
    Description: |
      The AWS SSO SCIM Endpoint Url
      Reference: https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html
    NoEcho: true

  SCIMEndpointSecretName:
    Type: String
    Description: |
      The AWS SSO SCIM Endpoint Url secret name
    Default: IDPSCIM_SCIMEndpoint

  SCIMAccessToken:
    Type: String
    Description: |
      The AWS SSO SCIM AccessToken
      Reference: https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html
    NoEcho: true

  SCIMAccessTokenSecretName:
    Type: String
    Description: |
      The AWS SSO SCIM AccessToken secret name
    Default: IDPSCIM_SCIMAccessToken

  GWSGroupsFilter:
    Type: String
    Description: |
      The Google Workspace group filter query parameter, example: 'name:AWS* email:aws-*', see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups
    Default: ""

  SyncMethod:
    Type: String
    Description: |
      The sync method to use
    Default: groups
    AllowedValues:
      - groups

  MemorySize:
    Type: Number
    Description: |
      The amount of memory to allocate to the Lambda function.
      The value must be a multiple of 64 MB.
      NOTE: Your function is allocated CPU proportional to the memory configured.
    Default: 256
    MaxValue: 10240
    MinValue: 128

  Timeout:
    Type: Number
    Description: |
      The amount of time that AWS Lambda service allows a function to run before terminating it.
      The value must be greater than or equal to 60 seconds.
    Default: 300
    MaxValue: 900
    MinValue: 3

  LogGroupName:
    Type: String
    Description: The name of the CloudWatch log group
    Default: "/aws/lambda/idp-scim-sync"

  LogGroupRetentionDays:
    Type: Number
    Description: The number of days you want to keep logs for the created lambda function
    Default: 7
    AllowedValues:
      - 1
      - 3
      - 5
      - 7
      - 14
      - 30
      - 60
      - 90
      - 120
      - 150
      - 180
      - 365
      - 400
      - 545
      - 731
      - 1827
      - 3653

  Runtime:
    Type: String
    Description: |
      The Lambda function runtime

      Reference: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html
    Default: provided.al2
    AllowedValues:
      - provided.al2

  Architecture:
    Type: String
    Description: |
      The Lambda function architecture

      Reference: https://docs.aws.amazon.com/lambda/latest/dg/foundation-arch.html#foundation-arch-adv
    Default: arm64
    AllowedValues:
      - arm64

  LambdaFunctionHandler:
    Type: String
    Description: |
      The Lambda function handler

      Reference: https://docs.aws.amazon.com/lambda/latest/dg/configuration-console.html
    Default: bootstrap

  RoleNameSuffix:
    Type: String
    Description: Suffix to apply to IAM to avoid conflicts when multiple stacks are running in the same account
    Default: ""

  LambdaFunctionName:
    Type: String
    Description: Name of the created Lambda function
    Default: "idp-scim-sync"

Resources:
  LambdaFunction:
    Type: AWS::Serverless::Function
    DependsOn:
      - LambdaFunctionLogGroup
    Properties:
      FunctionName: !Ref LambdaFunctionName
      Description: |
        This Lambda function will sync the AWS SSO groups and users with the Google Workspace directory and it will be triggered by an EventBridge rule.
        Project: https://github.com/slashdevops/idp-scim-sync
      Runtime: !Ref Runtime
      Architectures:
        - !Ref Architecture
      MemorySize: !Ref MemorySize
      Handler: !Ref LambdaFunctionHandler # depends on the path inside .aws-sam/build/LambdaFunction/ during the build process using sam build
      Timeout: !Ref Timeout
      CodeUri: "."
      Tracing: Active
      Environment:
        Variables:
          IDPSCIM_LOG_LEVEL: !Ref LogLevel
          IDPSCIM_LOG_FORMAT: !Ref LogFormat
          IDPSCIM_SYNC_METHOD: !Ref SyncMethod
          IDPSCIM_AWS_S3_BUCKET_NAME: !Sub "${BucketNamePrefix}-${AWS::AccountId}-${AWS::Region}"
          IDPSCIM_AWS_S3_BUCKET_KEY: !Ref BucketKey
          IDPSCIM_GWS_GROUPS_FILTER: !Ref GWSGroupsFilter
          IDPSCIM_GWS_USER_EMAIL_SECRET_NAME: !Ref AWSGWSUserEmailSecret
          IDPSCIM_GWS_SERVICE_ACCOUNT_FILE_SECRET_NAME: !Ref AWSGWSServiceAccountFileSecret
          IDPSCIM_AWS_SCIM_ENDPOINT_SECRET_NAME: !Ref AWSSCIMEndpointSecret
          IDPSCIM_AWS_SCIM_ACCESS_TOKEN_SECRET_NAME: !Ref AWSSCIMAccessTokenSecret
      Role: !GetAtt LambdaFunctionRole.Arn
      Events:
        SyncScheduledEvent:
          Type: Schedule
          Name: AWSSyncSchedule
          Properties:
            Enabled: true
            Schedule: !Ref ScheduleExpression
    Metadata: # https://jiangsc.me/2021/01/24/Lessons-Learnt-On-Deploying-GO-Lambda-Application-on-AWS/ and https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/building-custom-runtimes.html
      BuildMethod: makefile

  LambdaFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      Description: !Sub "This role is used by the Lambda function ${AWS::StackName}"
      RoleName: !Sub "serverless-idp-scim-sync-${AWS::AccountId}-${AWS::Region}${RoleNameSuffix}"
      Path: /
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: "lambda.amazonaws.com"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
      Policies:
        - PolicyName: CustomLambdaPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Sid: SSMGetParameterPolicy
                Effect: Allow
                Action:
                  - secretsmanager:GetResourcePolicy
                  - secretsmanager:GetSecretValue
                Resource:
                  - !Ref AWSGWSServiceAccountFileSecret
                  - !Ref AWSGWSUserEmailSecret
                  - !Ref AWSSCIMEndpointSecret
                  - !Ref AWSSCIMAccessTokenSecret
              - Sid: S3Policy
                Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:GetObjectAcl
                  - s3:GetObjectVersion
                  - s3:PutObject
                  - s3:PutObjectAcl
                  - s3:ListBucket
                Resource:
                  - !Sub "arn:aws:s3:::${BucketNamePrefix}-${AWS::AccountId}-${AWS::Region}"
                  - !Sub "arn:aws:s3:::${BucketNamePrefix}-${AWS::AccountId}-${AWS::Region}/*"
              - Sid: KMSGetDataPolicy
                Effect: Allow
                Action:
                  - kms:GenerateDataKeyPair
                Resource:
                  - !GetAtt KMSKey.Arn
              - Sid: KMSDecryptPolicy
                Effect: Allow
                Action:
                  - kms:Decrypt
                  - kms:Encrypt
                  - kms:GenerateDataKey
                Resource:
                  - !GetAtt KMSKey.Arn

  AWSGWSServiceAccountFileSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Ref GWSServiceAccountFileSecretName
      SecretString: !Ref GWSServiceAccountFile

  AWSGWSUserEmailSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Ref GWSUserEmailSecretName
      SecretString: !Ref GWSUserEmail

  AWSSCIMEndpointSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Ref SCIMEndpointSecretName
      SecretString: !Ref SCIMEndpoint

  AWSSCIMAccessTokenSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Ref SCIMAccessTokenSecretName
      SecretString: !Ref SCIMAccessToken

  KMSKey:
    Type: AWS::KMS::Key
    Properties:
      Description: ipd-scim-sync state bucket kms key.
      KeyPolicy:
        Version: 2012-10-17
        Id: ipd-scim-sync-state-bucket-key-policy
        Statement:
          - Sid: AllowIAMThisAccount
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "kms:*"
            Resource: "*"
          - Sid: AllowAWSLambdaToRetrieveKMSKey
            Effect: Allow
            Principal:
              Service: "lambda.amazonaws.com"
              #AWS: !GetAtt LambdaFunctionRole.Arn # Fails because circular reference
              #AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/serverless-idp-scim-sync-${AWS::AccountId}-${AWS::Region}" # Fails in runtime because the roles is not created yet
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:ReEncrypt*
              - kms:GenerateDataKey*
              - kms:DescribeKey
            Resource: "*"
            Condition:
              StringEquals:
                kms:CallerAccount: !Ref "AWS::AccountId"

  KMSKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub "alias/${BucketNamePrefix}-${AWS::AccountId}-${AWS::Region}"
      TargetKeyId:
        Ref: KMSKey

  Bucket:
    DeletionPolicy: Delete
    UpdateReplacePolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${BucketNamePrefix}-${AWS::AccountId}-${AWS::Region}"
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              KMSMasterKeyID: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:${KMSKeyAlias}"
              SSEAlgorithm: "aws:kms"
            BucketKeyEnabled: true # https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AllowAWSLambdaFunction
            Principal:
              AWS:
                - !Sub "arn:aws:iam::${AWS::AccountId}:role/serverless-idp-scim-sync-${AWS::AccountId}-${AWS::Region}${RoleNameSuffix}"
            Effect: Allow
            Action:
              - s3:GetObject
              - s3:GetObjectAcl
              - s3:PutObject
              - s3:PutObjectAcl
              - s3:GetObjectVersion
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${Bucket}/*"
          - Sid: AllowSSLRequestsOnly
            Principal: "*"
            Action:
              - s3:*
            Effect: Deny
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${Bucket}"
              - !Sub "arn:${AWS::Partition}:s3:::${Bucket}/*"
            Condition:
              Bool:
                "aws:SecureTransport": false
          # NOTE: To implement the following policies is necessary to send the objet encrypted to the bucket
          #       and the bucket is already implementing "BucketKeyEnabled", so looks like it is not necessary
          #       but the problem is the AWS Config rule that want these enabled.  Let's see in the future if
          #       I will implement these policies.
          # - Sid: DenyPublishingUnencryptedResources
          #   Effect: Deny
          #   Principal: "*"
          #   Action:
          #     - s3:PutObject
          #   Resource: !Sub "arn:${AWS::Partition}:s3:::${Bucket}/*"
          #   Condition:
          #     "Null":
          #       "s3:x-amz-server-side-encryption": true
          # - Sid: DenyUnEncryptedObjectUploads
          #   Principal: "*"
          #   Action: s3:PutObject
          #   Effect: Deny
          #   Resource: !Sub "arn:${AWS::Partition}:s3:::${Bucket}/*"
          #   Condition:
          #     "StringNotEquals":
          #       "s3:x-amz-server-side-encryption": "aws:kms"

  LambdaFunctionLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Ref LogGroupName
      RetentionInDays: !Ref LogGroupRetentionDays

Outputs:
  LambdaFunctionArn:
    Value: !GetAtt LambdaFunction.Arn
    Description: >
      The ARN of the Lambda function

  LambdaFunctionName:
    Value: !Ref LambdaFunction
    Description: >
      The name of the Lambda function

  LambdaFunctionHandler:
    Value: !Ref LambdaFunctionHandler
    Description: >
      The handler of the Lambda function

  BucketName:
    Value: !Ref Bucket
    Description: >
      The name of the S3 bucket

  BucketArn:
    Value: !GetAtt Bucket.Arn
    Description: >
      The ARN of the S3 bucket

  KMSKeyId:
    Value: !Ref KMSKey
    Description: >
      The ID of the KMS key

  KMSKeyArn:
    Value: !GetAtt KMSKey.Arn
    Description: >
      The ARN of the KMS key

  Architecture:
    Value: !Ref Architecture
    Description: >
      The Lambda function architecture