{"id":18535688,"url":"https://github.com/fivexl/terraform-aws-sso-elevator","last_synced_at":"2025-04-09T15:32:45.719Z","repository":{"id":153356437,"uuid":"614284140","full_name":"fivexl/terraform-aws-sso-elevator","owner":"fivexl","description":"Slack bot to temporary assign AWS SSO Permission set to a user","archived":false,"fork":false,"pushed_at":"2025-04-08T14:15:47.000Z","size":917,"stargazers_count":43,"open_issues_count":24,"forks_count":5,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-04-08T14:40:20.416Z","etag":null,"topics":["aws","aws-lambda","iam-identity-center","just-in-time-access","python","security","slack","sso","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/fivexl/sso-elevator/aws/latest","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fivexl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-15T09:24:21.000Z","updated_at":"2025-04-08T14:15:51.000Z","dependencies_parsed_at":null,"dependency_job_id":"a1511274-7532-4304-a87e-7f5b08f93f1c","html_url":"https://github.com/fivexl/terraform-aws-sso-elevator","commit_stats":null,"previous_names":[],"tags_count":32,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-sso-elevator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-sso-elevator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-sso-elevator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fivexl%2Fterraform-aws-sso-elevator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fivexl","download_url":"https://codeload.github.com/fivexl/terraform-aws-sso-elevator/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248058183,"owners_count":21040713,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-lambda","iam-identity-center","just-in-time-access","python","security","slack","sso","terraform","terraform-module"],"created_at":"2024-11-06T19:26:39.130Z","updated_at":"2025-04-09T15:32:45.707Z","avatar_url":"https://github.com/fivexl.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![FivexL](https://releases.fivexl.io/fivexlbannergit.jpg)](https://fivexl.io/)\n\n# Terraform module for implementing temporary elevated access via AWS IAM Identity Center (Successor to AWS Single Sign-On) and Slack\n\n- [Terraform module for implementing temporary elevated access via AWS IAM Identity Center (Successor to AWS Single Sign-On) and Slack](#terraform-module-for-implementing-temporary-elevated-access-via-aws-iam-identity-center-successor-to-aws-single-sign-on-and-slack)\n- [Introduction](#introduction)\n- [Functionality](#functionality)\n - [Group Assignments Mode](#group-assignments-mode)\n- [Important Considerations and Assumptions](#important-considerations-and-assumptions)\n- [Module configuration, and features](#module-configuration-and-features)\n - [Configuration structure](#configuration-structure)\n - [Explicit Deny](#explicit-deny)\n - [Automatic Approval](#automatic-approval)\n - [Aggregation of Rules](#aggregation-of-rules)\n - [Single Approver](#single-approver)\n - [Diagram of processing a request:](#diagram-of-processing-a-request)\n - [Secondary Subdomain Fallback Feature:](#secondary-subdomain-fallback-feature)\n - [Sending direct messages to users feature](#sending-direct-messages-to-users-feature)\n - [API gateway feature](#api-gateway-feature)\n- [Deployment and Usage](#deployment-and-usage)\n - [SSO Delegation](#sso-delegation)\n - [Build Process](#build-process)\n - [Terraform deployment example](#terraform-deployment-example)\n - [Slack App creation](#slack-app-creation)\n- [Terraform docs](#terraform-docs)\n - [Requirements](#requirements)\n - [Providers](#providers)\n - [Modules](#modules)\n - [Resources](#resources)\n - [Inputs](#inputs)\n - [Outputs](#outputs)\n - [More info](#more-info)\n- [Development](#development)\n - [Post review](#post-review)\n\n\n# Introduction\nCurrently, AWS IAM Identity Center does not support the temporary assignment of permission sets to users. As a result, teams using AWS IAM Identity Center are forced to either create highly restricted permission sets or rely on AWS IAM role chaining. Both approaches have significant drawbacks and result in an overly complex security model. The desired solution is one where AWS operators are granted access only when necessary and for the exact duration needed, with a default state of no access or read-only access.\n\nThe terraform-aws-sso-elevator module addresses this issue by allowing the implementation of temporary elevated access to AWS accounts while avoiding permanently assigned permission sets, thereby achieving the principle of least privilege access.\n\nFor more information on temporary elevated access for AWS and the AWS-provided solution, visit [Managing temporary elevated access to your AWS environment](https://aws.amazon.com/blogs/security/managing-temporary-elevated-access-to-your-aws-environment/).\n\nThe key difference between the terraform-aws-sso-elevator module and the option described in the blog post above is that the module enables requesting access elevation via a Slack form. We hope that this implementation may inspire AWS to incorporate native support for temporary access elevation in AWS IAM Identity Center.\n\nAWS announced that [Customers of AWS IAM Identity Center (successor to AWS Single Sign-On) can use CyberArk Secure Cloud Access, Ermetic, and Okta Access Requests for temporary elevated access](https://aws.amazon.com/about-aws/whats-new/2023/05/aws-partners-temporary-elevated-access-capabilities-iam-identity-center/). So if you are already using one of those vendors we recommend checking their offering first.\n\nWatch demo\n[![Demo](https://img.youtube.com/vi/iR3Rdjd7QMU/maxresdefault.jpg)](https://youtu.be/iR3Rdjd7QMU)\n\n# Functionality\n\n```mermaid\nsequenceDiagram\n Requester-\u003e\u003eSlack: submits form in Slack - CMD+K, search access or /access command\n Slack-\u003e\u003eAWS Lambda - Access Requester: sends request to access-requester\n AWS Lambda - Access Requester-\u003e\u003eSlack: sends a message to Slack channel with approve/deny buttons and tags approvers\n Approver-\u003e\u003eSlack: pressed approve button in Slack message\n Slack-\u003e\u003eAWS Lambda - Access Requester: Send approved request to access-requester\n AWS Lambda - Access Requester-\u003e\u003eAWS IAM Identity Center(SSO): creates user-level permission set assignment based on approved request\n AWS Lambda - Access Requester-\u003e\u003eAWS EventBridge: creates revocation schedule\n AWS Lambda - Access Requester-\u003e\u003eAWS S3: logs audit record\n AWS EventBridge-\u003e\u003eAWS Lambda - Access Revoker: sends revocation event when times come\n AWS Lambda - Access Revoker-\u003e\u003eAWS IAM Identity Center(SSO): revokes user-level permission set assignment\n AWS Lambda - Access Revoker-\u003e\u003eAWS S3: logs audit record\n AWS Lambda - Access Revoker-\u003e\u003eSlack: send notification about revocation\n```\n\nThe module deploys two AWS Lambda functions: access-requester and access-revoker. The access-requester handles requests from Slack, creating user-level permission set assignments and an Amazon EventBridge trigger that activates the access-revoker Lambda when it is time to revoke access. The access-revoker revokes user access when triggered by EventBridge and also runs daily to revoke any user-level permission set assignments without an associated EventBridge trigger. Group-level permission sets are not affected.\n\nFor auditing purposes, information about all access grants and revocations is stored in S3. See [documentation here](athena_query/) to find out how to configure AWS Athena to query audit logs.\n\nAdditionally, the Access-Revoker continuously reconciles the revocation schedule with all user-level permission set assignments and issues warnings if it detects assignments without a revocation schedule (presumably created by someone manually). By default, the Access-Revoker will automatically revoke all unknown user-level permission set assignments daily. However, you can configure it to operate more or less frequently.\n\n## Group Assignments Mode\nStarting from version 2.0, Terraform AWS SSO Elevator introduces support for group access. SSO elevator now can add users to a groups, to do so, you will need to use /group-access command, which, instead of showing the form for account assignments, will present a Slack form where the user can select a group they want access to, specify a reason, and define the duration for which access is required.\n\nThe basic logic for access, configuration, and Slack integration remains the same as before. To enable the new Group Assignments Mode, you need to provide the module with a new group_config Terraform variable:\n```hcl\ngroup_config = [\n { \n \"Resource\" : [\"99999999-8888-7777-6666-555555555555\"], #ManagementAccountAdmins\n \"Approvers\" : [\n \"email@gmail.com\"\n ]\n \"ApprovalIsNotRequired\": true\n },\n { \n \"Resource\" : [\"11111111-2222-3333-4444-555555555555\"], #prod read only\n \"Approvers\" : [\n \"email@gmail.com\"\n ]\n \"AllowSelfApproval\" : true,\n },\n {\n \"Resource\" : [\"44445555-3333-2222-1111-555557777777\"], #ProdAdminAccess\n \"Approvers\" : [\n \"email@gmail.com\"\n ]\n },\n]\n```\nThere are two key differences compared to the standard Elevator configuration:\n- ResourceType is not required for group access configurations.\n- In the Resource field, you must provide group IDs instead of account IDs.\n\nThe Elevator will only work with groups specified in the configuration.\n\nIf you were using Terraform AWS SSO Elevator before version 2.0.0, you need to update your Slack app manifest by adding a new shortcut to enable this functionality:\n{\n \"name\": \"group-access\",\n \"type\": \"global\",\n \"callback_id\": \"request_for_group_membership\",\n \"description\": \"Request access to SSO Group\"\n}\nTo disable this functionality, simply remove the shortcut from the manifest.\n\n\n# Important Considerations and Assumptions\n\nSSO elevator assumes that your Slack user email will match SSO user id otherwise it won't be able to match Slack user sending request to an AWS SSO user.\n\nWhen onboarding your organization, be aware that the access-revoker will revoke all user-level Permission Set assignments in the AWS accounts you specified in the module configuration. If you specify Accounts: '*' in any of rules, it will remove user-level assignments from all accounts. Therefore, if you want to maintain some permanent SSO assignments (e.g., read-only in production and admin in development or test accounts), you should use group-level assignments. It is advisable to ensure your AWS admin has the necessary access level to your AWS SSO management account through group-level assignments so that you can experiment with the module's configuration.\n\nThe same behavior applies to group-level assignments: if you specify a group in the `group_configuration`, SSO Elevator will remove any users from that group if they were not added by SSO Elevator.\n\n\n\n# Module configuration, and features\n\n## Configuration structure\n\nThe configuration is a list of dictionaries, where each dictionary represents a single configuration rule.\n\nEach configuration rule specifies which resource(s) the rule applies to, which permission set(s) are being requested, who the approvers are, and any additional options for approving the request.\n\nThe fields in the configuration dictionary are:\n\n- **ResourceType**: This field specifies the type of resource being requested, such as \"Account.\" As of now, the only supported value is \"Account.\"\n- **Resource**: This field defines the specific resource(s) being requested. It accepts either a single string or a list of strings. Setting this field to \"*\" allows the rule to match all resources associated with the specified `ResourceType`.\n- **PermissionSet**: Here, you indicate the permission set(s) being requested. This can be either a single string or a list of strings. If set to \"*\", the rule matches all permission sets available for the defined `Resource` and `ResourceType`.\n- **Approvers**: This field lists the potential approvers for the request. It accepts either a single string or a list of strings representing different approvers.\n- **AllowSelfApproval**: This field can be a boolean, indicating whether the requester, if present in the `Approvers` list, is permitted to approve their own request. It defaults to `None`.\n- **ApprovalIsNotRequired**: This field can also be a boolean, signifying whether the approval can be granted automatically, bypassing the approvers entirely. The default value is `None`.\n- \n### Explicit Deny\nIn the system, an explicit denial in any statement overrides any approvals. For instance, if one statement designates an individual as an approver for all accounts, but another statement specifies that the same individual is not allowed to self-approve or to bypass the approval process for a particular account and permission set (by setting \"allow_self_approval\" and \"approval_is_not_required\" to `False`), then that individual will not be able to approve requests for that specific account, thereby enforcing a stricter control.\n\n### Automatic Approval\nRequests will be approved automatically if either of the following conditions are met:\n\n- AllowSelfApproval is set to true and the requester is in the Approvers list.\n- ApprovalIsNotRequired is set to true.\n\n### Aggregation of Rules\nThe approval decision and final list of reviewers will be calculated dynamically based on the aggregate of all rules. If you have a rule that specifies that someone is an approver for all accounts, then that person will be automatically added to all requests, even if there are more detailed rules for specific accounts or permission sets.\n\n### Single Approver\nIf there is only one approver and AllowSelfApproval is not set to true, nobody will be able to approve the request.\n\n### Diagram of processing a request:\n![Diagram of processing a request](docs/Diagram_of_processing_a_request.png)\n\n## Secondary Subdomain Fallback Feature:\nWARNING: \nThis feature is STRONGLY DISCOURAGED because it can introduce security risks.\n\nSSO Elevator uses Slack email addresses to find users in AWS SSO. In some cases, the domain of a Slack user's email \n(e.g., \"john.doe@old.domain\") differs from the domain defined in AWS SSO (e.g., \"john.doe@new.domain\"). By setting \nthese fallback domains, SSO Elevator will attempt to replace the original domain from Slack with each secondary domain \nin order to locate a matching AWS SSO user. \n \n- This mechanism should only be used in rare or critical situations where you cannot align Slack and AWS SSO domains.\n\nExample:\n- Slack email: john.doe@old.domain\n- AWS SSO email: john.doe@new.domain\n\nWithout fallback domains, SSO Elevator cannot find the SSO user due to the domain mismatch. By setting \nsecondary_fallback_email_domains = [\"@new.domain\"], SSO Elevator will try to swap out \"@old.domain\" for \"@new.domain\"\n(and any other domain in the list) and attempt to locate \"john.doe@new.domain\" in AWS SSO.\n\nSecurity Risks \u0026 Recommendations:\n- If multiple SSO users share the same local-part (before the \"@\") across different domains, SSO Elevator may \n grant permissions to the wrong user.\n- Disable or remove entries in this variable as soon as you no longer need domain fallback functionality \n to restore a more secure configuration.\n\nIN SUMMARY:\nUse \"secondary_fallback_email_domains\" ONLY if absolutely necessary. It is best practice to maintain \nconsistent, verified email domains in Slack and AWS SSO. Remove these fallback entries as soon as you \nresolve the underlying domain mismatch to minimize security exposure.\n\nSSO Elevator will update request message in channel with Warning, if fallback domains are in use.\n\nNotes:\n- SSO Elevator always prioritizes the primary domain from Slack (the Slack user's email) when searching for a user in AWS SSO.\n- SSO Elevator adds a large warning message in Slack if it uses a secondary fallback domain to find a user in AWS SSO.\n- The secondary domain feature works **ONLY** for the requester, approvers in the configuration must have the same email domain as in Slack.\n\n## Sending direct messages to users feature\nSSO Elevator uses slack channels to communicate with users. But there is a use case of SSO Elevator where only approvers are members of a channel, so no one except them can see who has access where. And when this is the case, requesters don't get any feedback about their requests. To solve this problem, SSO Elevator can send direct messages to users if they are not in the channel. To enable this feature, your SSO Elevator slack app should have the following permissions: (\"channels:read\", \"groups:read\", \"im:write\"). And `send_dm_if_user_not_in_channel` variable should be set to true. If you are updating from the previous version but for a time being you can't update slack app permissions, you can use `send_dm_if_user_not_in_channel` variable to disable this feature so it won't break your current setup.\n\n## API gateway feature\nTo address the [lambda-1](https://docs.aws.amazon.com/securityhub/latest/userguide/lambda-controls.html#lambda-1) SecurityHub control alert triggered by the default creation of a FunctionURLAllowPublicAccess resource-based policy for lambda, in 1.4.0 release module will eventually migrate to the usage of API Gateway by default. You still can use lambda URL to seamlessly migrate to the API Gateway url, but it is deprecated and will be removed in future releases. You can use the following variables to control the behavior:\n\n```hcl\ncreate_api_gateway = true # This will create an API Gateway for the requester lambda\ncreate_lambda_url = false # This will delete lambda url\n```\n\nTo fix the Security Hub issue when migrating to API Gateway, manually delete the FunctionURLAllowPublicAccess policy statement in the AWS Console.\n**After updating the module, you can find the API URL in the output of the module. Please don't forget to update the Slack App manifest with the new URL.**\n\n# Deployment and Usage\n\nThe deployment process is divided into two main parts: deploying the Terraform module, which sets up the necessary infrastructure and resources for the Lambdas to function, and creating a Slack App, which will be the interface through which users can interact with the Lambdas. Detailed instructions on how to perform both of these steps, along with the Slack App manifest, can be found below.\n\n## SSO Delegation\nAWS recommends delegating SSO administration to a separate “delegated SSO administrator account.” We also recommend creating a dedicated “sso-tooling” account to manage access across your entire organization. You can learn more about how to use SSO Elevator in the delegated SSO administrator account here: [SSO delegation](/docs/docs.md#sso-delegation)\n\n## Build Process\nThere are three ways to build an SSO elevator:\n\nUsing pre-created images pulled from ECR (Default)\nUsing Docker build to build images locally (provide the variable use_pre_created_image = false)\nThere is also an option to host ECR yourself by providing the following variables:\n```hcl\necr_repo_name = \"example_repo_name\"\necr_owner_account_id = \"\u003cexample_account_id\u003e\"\n```\n\nGitHub CI of this repository pre-builds the requester and revoker lambda Docker images on every release and push them to FivexL's private ECR. Users can use these pre-built Docker images to build lambdas.\n\nECR is private for the following reasons:\n\n- AWS Lambda can't use any other source of images except ECR.\n- AWS Lambda can't use public ECR.\n- AWS Lambda doesn't support pulling container images from Amazon ECR using a pull-through cache rule (so we can't create a private repo from the user's side to pull images from the GHCR, for example).\n\nImages and repositories are replicated in every region that AWS SSO supports except these:\n```\n- ap_east_1\n- eu_south_1\n- ap_southeast_3\n- af_south_1\n- me_south_1\n- il_central_1\n- me_central_1\n- eu_south_2\n- ap_south_2\n- eu_central_2\n- ap_southeast_4\n- ca_west_1\n- us_gov_east_1\n- us_gov_west_1\n```\nThose regions are not enabled by default. If you need to use a region that is not supported by the module, please let us know by creating an issue, and we will add support for it. \n\n## Terraform deployment example\n\n```terraform\n\ndata \"aws_ssoadmin_instances\" \"this\" {}\n\n# You will have to create /sso-elevator/slack-signing-secret AWS SSM Parameter\n# and store Slack app signing secret there, if you have not created app yet then\n# you can leave a dummy value there and update it after Slack app is ready\ndata \"aws_ssm_parameter\" \"sso_elevator_slack_signing_secret\" {\n name = \"/sso-elevator/slack-signing-secret\"\n}\n\n# You will have to create /sso-elevator/slack-bot-token AWS SSM Parameter\n# and store Slack bot token there, if you have not created app yet then\n# you can leave a dummy value there and update it after Slack app is ready\ndata \"aws_ssm_parameter\" \"sso_elevator_slack_bot_token\" {\n name = \"/sso-elevator/slack-bot-token\"\n}\n\nmodule \"aws_sso_elevator\" {\n source = \"github.com/fivexl/terraform-aws-sso-elevator.git\"\n source = \"fivexl/sso-elevator/aws\"\n version = \"2.0.2\"\n slack_signing_secret = data.aws_ssm_parameter.sso_elevator_slack_signing_secret.value\n slack_bot_token = data.aws_ssm_parameter.sso_elevator_slack_bot_token.value\n slack_channel_id = local.slack_channel_id\n\n s3_logging = {\n target_bucket = module.naming_conventions.s3_access_logs_bucket_name\n target_prefix = \"sso-elevator-logs/\"\n }\n\n s3_bucket_partition_prefix = \"sso-elevator-logs\"\n\n s3_object_lock = true\n s3_object_lock_configuration = {\n rule = {\n default_retention = {\n mode = \"GOVERNANCE\"\n years = 3\n }\n }\n }\n # The default object lock configuration is as follows:\n # {\n # rule = {\n # default_retention = {\n # mode = \"GOVERNANCE\"\n # years = 2\n # }\n # }\n #}\n # You can specify a different configuration here:\n s3_object_lock_configuration = {\n rule = {\n default_retention = {\n mode = \"GOVERNANCE\"\n years = 1\n }\n }\n }\n\n # s3_name_of_the_existing_bucket = \"sso_elevator_audit_logs_bucket-\u003csome_sha\u003e\"\n # If you want to use your own bucket for storing SSO Elevator audit logs (logs about access requests), use the `s3_name_of_the_existing_bucket` variable.\n # If `s3_name_of_the_existing_bucket` is left empty, the module creates a new bucket name based on `s3_bucket_name_for_audit_entry`.\n # In that case, remember to specify `s3_logging` with at least the `target_bucket` key to enable access logging, otherwise, module deployment will fail.\n s3_logging = {\n target_bucket = \"some_access_logging_bucket\"\n target_prefix = \"some_prefix_for_access_logs\"\n }\n\n config = [\n # This could be a config for dev/stage account where developers can self-serve\n # permissions\n # Allows Bob and Alice to approve requests for all\n # PermissionSets in accounts dev_account_id and stage_account_id as\n # well as approve its own requests\n # You have to specify at AllowSelfApproval: true or specify two approvers\n # so you do not lock out approver\n {\n \"ResourceType\" : \"Account\",\n \"Resource\" : [\"dev_account_id\", \"stage_account_id\"],\n \"PermissionSet\" : \"*\",\n \"Approvers\" : [\"bob@corp.com\", \"alice@corp.com\"],\n \"AllowSelfApproval\" : true,\n },\n # This could be an option for a financial person\n # allows self approval for Billing PermissionSet\n # for account_id for user finances@corp.com\n {\n \"ResourceType\" : \"Account\",\n \"Resource\" : \"account_id\",\n \"PermissionSet\" : \"Billing\",\n \"Approvers\" : \"finances@corp.com\",\n \"AllowSelfApproval\" : true,\n },\n # Your typical CTO - can approve all accounts and all permissions\n # as well as his/hers own requests to avoid lock out\n # Careful withi Resource * since it will cause revocation of all\n # non-module-created user-level permission set assignments in all\n # accounts, add this one later when you are done with single account\n # testing\n {\n \"ResourceType\" : \"Account\",\n \"Resource\" : \"*\",\n \"PermissionSet\" : \"*\",\n \"Approvers\" : \"cto@corp.com\",\n \"AllowSelfApproval\" : true,\n },\n # Read only config for production accounts so developers\n # can check prod when needed\n {\n \"ResourceType\" : \"Account\",\n \"Resource\" : [\"prod_account_id\", \"prod_account_id2\"],\n \"PermissionSet\" : \"ReadOnly\",\n \"AllowSelfApproval\" : true,\n },\n # Prod access\n {\n \"ResourceType\" : \"Account\",\n \"Resource\" : [\"prod_account_id\", \"prod_account_id2\"],\n \"PermissionSet\" : \"AdministratorAccess\",\n \"Approvers\" : [\"manager@corp.com\", \"ciso@corp.com\"],\n \"ApprovalIsNotRequired\" : false,\n \"AllowSelfApproval\" : false,\n },\n # example of list being used for permissions sets\n {\n \"ResourceType\" : \"Account\",\n \"Resource\" : \"account_id\",\n \"PermissionSet\" : [\"ReadOnlyPlus\", \"AdministratorAccess\"],\n \"Approvers\" : [\"ciso@corp.com\"], \n \"AllowSelfApproval\" : true,\n },\n\n ]\ngroup_config = [\n { \n \"Resource\" : [\"99999999-8888-7777-6666-555555555555\"], #ManagementAccountAdmins\n \"Approvers\" : [\n \"email@gmail.com\"\n ]\n \"ApprovalIsNotRequired\": true\n },\n { \n \"Resource\" : [\"11111111-2222-3333-4444-555555555555\"], #prod read only\n \"Approvers\" : [\n \"email@gmail.com\"\n ]\n \"AllowSelfApproval\" : true,\n },\n {\n \"Resource\" : [\"44445555-3333-2222-1111-555557777777\"], #ProdAdminAccess\n \"Approvers\" : [\n \"email@gmail.com\"\n ]\n },\n]\n}\n\noutput \"aws_sso_elevator_lambda_function_url\" {\n value = module.aws_sso_elevator.lambda_function_url\n}\n```\n\n## Slack App creation\n1. Go to https://api.slack.com/\n2. Click `create an app`\n3. Click `From an app manifest`\n4. Select workspace, click `next`\n5. Choose `yaml` for app manifest format\n6. Update lambda url (from output `aws_sso_elevator_lambda_function_url`) to `request_url` field and paste the following into the text box: \n```yaml\ndisplay_information:\n name: AWS SSO Access Elevator\n description: Slack bot to temporary assign AWS SSO Permission set to a user\nfeatures:\n bot_user:\n display_name: AWS SSO Access Elevator\n always_online: false\n shortcuts:\n - name: access\n type: global\n callback_id: request_for_access\n description: Request access to Permission Set in AWS Account\n - name: group-access # Delete this shortcut if you want to prohibit access to the Group Assignments Mode\n type: global\n callback_id: request_for_group_membership\n description: Request access to SSO Group\noauth_config:\n scopes:\n bot:\n # 'commands': This permission adds shortcuts and/or slash commands that people can use.\n - commands\n # 'chat:write': This permission is required for the app to post messages to Slack.\n - chat:write\n # 'users:read' and 'users:read.email': These permissions are required for the app to find the user's email address, which is necessary for creating AWS account assignments and including user mentions in requests.\n - users:read.email\n - users:read\n # 'channels:history': This permission is needed for the app to find old messages in order to handle \"discard button\" events.\n - channels:history\n # Permissions below are required if you want to use the feature of sending direct messages to users if they are not in the channel\n - \"channels:read\", # View basic information about public channels in a workspace. It allows app to determine if requester is in the channel.\n - \"groups:read\", # View basic information about private channels that slack app has been added to. Same as above but for private channels\n - \"im:write\" # Allows the app to send direct messages to members of a workspace. It is used to send messages to the user if they are not in the channel.\nsettings:\n interactivity:\n is_enabled: true\n request_url: \u003cLAMBDA URL GOES HERE - CHECK LAMBDA CONFIGURATION IN AWS CONSOLE OR GET IT FORM TERRAFORM OUTPUT\u003e \n org_deploy_enabled: false\n socket_mode_enabled: false\n token_rotation_enabled: false\n```\n7. Check permissions and click `create`\n8. Click `install to workspace`\n9. Copy `Signing Secret` # for `slack_signing_secret` module input\n10. Copy `Bot User OAuth Token` # for `slack_bot_token` module input\n\n# Terraform docs \n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Requirements\n\n| Name | Version |\n| ------------------------------------------------------------------------- | ------- |\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | ~\u003e 1.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 4.64 |\n| \u003ca name=\"requirement_external\"\u003e\u003c/a\u003e [external](#requirement\\_external) | \u003e= 1.0 |\n| \u003ca name=\"requirement_local\"\u003e\u003c/a\u003e [local](#requirement\\_local) | \u003e= 1.0 |\n| \u003ca name=\"requirement_null\"\u003e\u003c/a\u003e [null](#requirement\\_null) | \u003e= 2.0 |\n| \u003ca name=\"requirement_random\"\u003e\u003c/a\u003e [random](#requirement\\_random) | \u003e= 3.0 |\n\n## Providers\n\n| Name | Version |\n| ---------------------------------------------------------- | ------- |\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | 5.65.0 |\n| \u003ca name=\"provider_random\"\u003e\u003c/a\u003e [random](#provider\\_random) | 3.6.2 |\n\n## Modules\n\n| Name | Source | Version |\n| ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------ | ------- |\n| \u003ca name=\"module_access_requester_slack_handler\"\u003e\u003c/a\u003e [access\\_requester\\_slack\\_handler](#module\\_access\\_requester\\_slack\\_handler) | terraform-aws-modules/lambda/aws | 7.19.0 |\n| \u003ca name=\"module_access_revoker\"\u003e\u003c/a\u003e [access\\_revoker](#module\\_access\\_revoker) | terraform-aws-modules/lambda/aws | 7.19.0 |\n| \u003ca name=\"module_audit_bucket\"\u003e\u003c/a\u003e [audit\\_bucket](#module\\_audit\\_bucket) | fivexl/account-baseline/aws//modules/s3_baseline | 1.5.0 |\n| \u003ca name=\"module_http_api\"\u003e\u003c/a\u003e [http\\_api](#module\\_http\\_api) | terraform-aws-modules/apigateway-v2/aws | 5.0.0 |\n| \u003ca name=\"module_sso_elevator_dependencies\"\u003e\u003c/a\u003e [sso\\_elevator\\_dependencies](#module\\_sso\\_elevator\\_dependencies) | terraform-aws-modules/lambda/aws | 7.19.0 |\n\n## Resources\n\n| Name | Type |\n| -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |\n| [aws_cloudwatch_event_rule.sso_elevator_check_on_inconsistency](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |\n| [aws_cloudwatch_event_rule.sso_elevator_scheduled_revocation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |\n| [aws_cloudwatch_event_target.check_inconsistency](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |\n| [aws_cloudwatch_event_target.sso_elevator_scheduled_revocation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |\n| [aws_iam_role.eventbridge_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy.eventbridge_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |\n| [aws_lambda_permission.eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |\n| [aws_lambda_permission.url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |\n| [aws_scheduler_schedule_group.one_time_schedule_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/scheduler_schedule_group) | resource |\n| [aws_sns_topic.dlq](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |\n| [aws_sns_topic_subscription.dlq](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |\n| [random_string.random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |\n| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_iam_policy_document.revoker](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_iam_policy_document.slack_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n| [aws_ssoadmin_instances.all](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssoadmin_instances) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------- | :------: |\n| \u003ca name=\"input_api_gateway_throttling_burst_limit\"\u003e\u003c/a\u003e [api\\_gateway\\_throttling\\_burst\\_limit](#input\\_api\\_gateway\\_throttling\\_burst\\_limit) | The maximum number of requests that API Gateway allows in a burst. | `number` | `5` | no |\n| \u003ca name=\"input_api_gateway_throttling_rate_limit\"\u003e\u003c/a\u003e [api\\_gateway\\_throttling\\_rate\\_limit](#input\\_api\\_gateway\\_throttling\\_rate\\_limit) | The maximum number of requests that API Gateway allows per second. | `number` | `1` | no |\n| \u003ca name=\"input_approver_renotification_backoff_multiplier\"\u003e\u003c/a\u003e [approver\\_renotification\\_backoff\\_multiplier](#input\\_approver\\_renotification\\_backoff\\_multiplier) | The multiplier applied to the wait time for each subsequent notification sent to the approver. Default is 2, which means the wait time will double for each attempt. | `number` | `2` | no |\n| \u003ca name=\"input_approver_renotification_initial_wait_time\"\u003e\u003c/a\u003e [approver\\_renotification\\_initial\\_wait\\_time](#input\\_approver\\_renotification\\_initial\\_wait\\_time) | The initial wait time before the first re-notification to the approver is sent. This is measured in minutes. If set to 0, no re-notifications will be sent. | `number` | `15` | no |\n| \u003ca name=\"input_aws_sns_topic_subscription_email\"\u003e\u003c/a\u003e [aws\\_sns\\_topic\\_subscription\\_email](#input\\_aws\\_sns\\_topic\\_subscription\\_email) | value for the email address to subscribe to the SNS topic | `string` | `\"\"` | no |\n| \u003ca name=\"input_config\"\u003e\u003c/a\u003e [config](#input\\_config) | value for the SSO Elevator config | `any` | `[]` | no |\n| \u003ca name=\"input_create_api_gateway\"\u003e\u003c/a\u003e [create\\_api\\_gateway](#input\\_create\\_api\\_gateway) | If true, module will create \u0026 configure API Gateway for the Lambda function | `bool` | `true` | no |\n| \u003ca name=\"input_create_lambda_url\"\u003e\u003c/a\u003e [create\\_lambda\\_url](#input\\_create\\_lambda\\_url) | If true, the Lambda function will continue to use the Lambda URL, which will be deprecated in the future\u003cbr\u003eIf false, Lambda url will be deleted. | `bool` | `true` | no |\n| \u003ca name=\"input_ecr_owner_account_id\"\u003e\u003c/a\u003e [ecr\\_owner\\_account\\_id](#input\\_ecr\\_owner\\_account\\_id) | In what account is the ECR repository located. | `string` | `\"222341826240\"` | no |\n| \u003ca name=\"input_ecr_repo_name\"\u003e\u003c/a\u003e [ecr\\_repo\\_name](#input\\_ecr\\_repo\\_name) | The name of the ECR repository. | `string` | `\"aws-sso-elevator\"` | no |\n| \u003ca name=\"input_event_brige_check_on_inconsistency_rule_name\"\u003e\u003c/a\u003e [event\\_brige\\_check\\_on\\_inconsistency\\_rule\\_name](#input\\_event\\_brige\\_check\\_on\\_inconsistency\\_rule\\_name) | value for the event bridge check on inconsistency rule name | `string` | `\"sso-elevator-check-on-inconsistency\"` | no |\n| \u003ca name=\"input_event_brige_scheduled_revocation_rule_name\"\u003e\u003c/a\u003e [event\\_brige\\_scheduled\\_revocation\\_rule\\_name](#input\\_event\\_brige\\_scheduled\\_revocation\\_rule\\_name) | value for the event bridge scheduled revocation rule name | `string` | `\"sso-elevator-scheduled-revocation\"` | no |\n| \u003ca name=\"input_group_config\"\u003e\u003c/a\u003e [group\\_config](#input\\_group\\_config) | value for the SSO Elevator group config | `any` | `[]` | no |\n| \u003ca name=\"input_log_level\"\u003e\u003c/a\u003e [log\\_level](#input\\_log\\_level) | value for the log level | `string` | `\"INFO\"` | no |\n| \u003ca name=\"input_logs_retention_in_days\"\u003e\u003c/a\u003e [logs\\_retention\\_in\\_days](#input\\_logs\\_retention\\_in\\_days) | The number of days you want to retain log events in the log group for both Lambda functions and API Gateway. | `number` | `365` | no |\n| \u003ca name=\"input_max_permissions_duration_time\"\u003e\u003c/a\u003e [max\\_permissions\\_duration\\_time](#input\\_max\\_permissions\\_duration\\_time) | Maximum duration of the permissions granted by the Elevator in hours. | `number` | `24` | no |\n| \u003ca name=\"input_request_expiration_hours\"\u003e\u003c/a\u003e [request\\_expiration\\_hours](#input\\_request\\_expiration\\_hours) | After how many hours should the request expire? If set to 0, the request will never expire. | `number` | `8` | no |\n| \u003ca name=\"input_requester_lambda_name\"\u003e\u003c/a\u003e [requester\\_lambda\\_name](#input\\_requester\\_lambda\\_name) | value for the requester lambda name | `string` | `\"access-requester\"` | no |\n| \u003ca name=\"input_revoker_lambda_name\"\u003e\u003c/a\u003e [revoker\\_lambda\\_name](#input\\_revoker\\_lambda\\_name) | value for the revoker lambda name | `string` | `\"access-revoker\"` | no |\n| \u003ca name=\"input_revoker_post_update_to_slack\"\u003e\u003c/a\u003e [revoker\\_post\\_update\\_to\\_slack](#input\\_revoker\\_post\\_update\\_to\\_slack) | Should revoker send a confirmation of the revocation to Slack? | `bool` | `true` | no |\n| \u003ca name=\"input_s3_bucket_name_for_audit_entry\"\u003e\u003c/a\u003e [s3\\_bucket\\_name\\_for\\_audit\\_entry](#input\\_s3\\_bucket\\_name\\_for\\_audit\\_entry) | Unique name of the S3 bucket | `string` | `\"sso-elevator-audit-entry\"` | no |\n| \u003ca name=\"input_s3_bucket_partition_prefix\"\u003e\u003c/a\u003e [s3\\_bucket\\_partition\\_prefix](#input\\_s3\\_bucket\\_partition\\_prefix) | The prefix for the S3 audit bucket object partitions.\u003cbr\u003e Don't use slashes (/) in the prefix, as it will be added automatically, e.g. \"logs\" will be transformed to \"logs/\".\u003cbr\u003e If you want to use the root of the bucket, leave this empty. | `string` | `\"logs\"` | no |\n| \u003ca name=\"input_s3_logging\"\u003e\u003c/a\u003e [s3\\_logging](#input\\_s3\\_logging) | Map containing access bucket logging configuration. | `map(string)` | `{}` | no |\n| \u003ca name=\"input_s3_mfa_delete\"\u003e\u003c/a\u003e [s3\\_mfa\\_delete](#input\\_s3\\_mfa\\_delete) | Whether to enable MFA delete for the S3 bucket | `bool` | `false` | no |\n| \u003ca name=\"input_s3_name_of_the_existing_bucket\"\u003e\u003c/a\u003e [s3\\_name\\_of\\_the\\_existing\\_bucket](#input\\_s3\\_name\\_of\\_the\\_existing\\_bucket) | Specify the name of an existing S3 bucket to use. If not provided, a new bucket will be created. | `string` | `\"\"` | no |\n| \u003ca name=\"input_s3_object_lock\"\u003e\u003c/a\u003e [s3\\_object\\_lock](#input\\_s3\\_object\\_lock) | Enable object lock | `bool` | `false` | no |\n| \u003ca name=\"input_s3_object_lock_configuration\"\u003e\u003c/a\u003e [s3\\_object\\_lock\\_configuration](#input\\_s3\\_object\\_lock\\_configuration) | Object lock configuration | `any` | \u003cpre\u003e{\u003cbr\u003e \"rule\": {\u003cbr\u003e \"default_retention\": {\u003cbr\u003e \"mode\": \"GOVERNANCE\",\u003cbr\u003e \"years\": 2\u003cbr\u003e }\u003cbr\u003e }\u003cbr\u003e}\u003c/pre\u003e | no |\n| \u003ca name=\"input_schedule_expression\"\u003e\u003c/a\u003e [schedule\\_expression](#input\\_schedule\\_expression) | recovation schedule expression (will revoke all user-level assignments unknown to the Elevator) | `string` | `\"cron(0 23 * * ? *)\"` | no |\n| \u003ca name=\"input_schedule_expression_for_check_on_inconsistency\"\u003e\u003c/a\u003e [schedule\\_expression\\_for\\_check\\_on\\_inconsistency](#input\\_schedule\\_expression\\_for\\_check\\_on\\_inconsistency) | how often revoker should check for inconsistency (warn if found unknown user-level assignments) ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffivexl%2Fterraform-aws-sso-elevator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffivexl%2Fterraform-aws-sso-elevator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffivexl%2Fterraform-aws-sso-elevator/lists"}