通过Terraform为AWS IAM Identity Center配置权限集及组分配

核心资源清单 #

• data "aws_ssoadmin_instance"：获取AWS Identity Center实例ARN（所有SSO管理操作的基础依赖）
• data "aws_identitystore_group"：查询已通过SCIM同步到Identity Store的Okta组ID
• aws_ssoadmin_permission_set：创建权限集（定义访问AWS资源的权限集合）
• aws_ssoadmin_managed_policy_attachment / aws_ssoadmin_customer_managed_policy_attachment：给权限集附加托管/自定义IAM策略（可选但必需实现具体权限）
• aws_ssoadmin_account_assignment：将权限集分配给目标Okta组，关联到指定成员账户（每个成员账户需单独配置或用for_each批量处理）

配置执行顺序 #

1. 获取Identity Center实例信息 #

首先获取已启用的Identity Center实例ARN，后续所有SSO资源都依赖这个参数：

data "aws_ssoadmin_instance" "main" {
  provider = aws.management_account # 指向组织管理账户的provider配置
}

2. 查询同步后的Okta组 #

通过Identity Store定位已同步的Okta组（可通过组名、描述等过滤，确保匹配目标组）：

data "aws_identitystore_group" "okta_target_group" {
  identity_store_id = data.aws_ssoadmin_instance.main.identity_store_id
  filter {
    attribute_path  = "DisplayName"
    attribute_value = "Okta-Sync-Dev-Team" # 替换为你的Okta组名称
  }
}

3. 创建权限集 #

定义权限集的基础属性（会话时长、访问类型等）：

resource "aws_ssoadmin_permission_set" "dev_team_access" {
  name         = "Dev-Team-Access"
  instance_arn = data.aws_ssoadmin_instance.main.arn
  session_duration = "PT8H" # 会话有效期8小时
}

4. 为权限集附加权限策略 #

根据需求附加AWS托管策略或自定义策略，比如附加EC2全访问权限：

resource "aws_ssoadmin_managed_policy_attachment" "dev_team_ec2_full_access" {
  instance_arn       = data.aws_ssoadmin_instance.main.arn
  permission_set_arn = aws_ssoadmin_permission_set.dev_team_access.arn
  managed_policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
}

如果使用自定义策略，需先在对应账户创建IAM策略，再用aws_ssoadmin_customer_managed_policy_attachment完成关联。

5. 批量分配权限集到成员账户 #

用for_each遍历成员账户列表，批量完成组-权限集-账户的关联：

variable "member_account_ids" {
  type    = list(string)
  default = ["123456789012", "987654321098"] # 替换为你的成员账户ID列表
}

resource "aws_ssoadmin_account_assignment" "dev_team_account_access" {
  for_each = toset(var.member_account_ids)

  instance_arn       = data.aws_ssoadmin_instance.main.arn
  permission_set_arn = aws_ssoadmin_permission_set.dev_team_access.arn
  principal_id       = data.aws_identitystore_group.okta_target_group.group_id
  principal_type     = "GROUP"
  target_id          = each.value
  target_type        = "AWS_ACCOUNT"
}

关键注意事项 #

• 确保Terraform使用的身份（管理账户或委托管理员账户）拥有ssoadmin:*、identitystore:DescribeGroup等相关权限
• aws_identitystore_group的过滤条件需准确，避免匹配非Okta同步的组
• 若使用委托管理员账户，需在Terraform provider中指定该账户配置，并确认其已被授予SSO管理权限

内容的提问来源于stack exchange，提问作者blackPanther