Terraform配置AWS IAM Identity Center同步AD用户组及权限集求助

1. 基础准备 #

• 确保Terraform AWS Provider版本 ≥ 4.0（支持IAM Identity Center最新资源）
• 确认AWS账户已启用IAM Identity Center（未启用则Terraform可自动创建实例）
• 获取已部署的AD目录ID（可通过AWS控制台或aws ds describe-directories命令查询）

2. 配置AWS Provider #

provider "aws" {
  region = "us-east-1" # 替换为你的区域，需与AD目录同区域
}

3. 启用/引用IAM Identity Center实例 #

若账户未启用IAM Identity Center，用以下代码创建实例：

resource "aws_ssoadmin_instance" "main" {
  # 自动关联当前账户的AWS Organization（需确保组织已启用）
}

output "sso_instance_arn" {
  value = aws_ssoadmin_instance.main.arn
}

若已启用实例，直接引用：

data "aws_ssoadmin_instance" "main" {
  # 自动获取当前区域的IAM Identity Center实例
}

4. 关联AD目录作为身份源 #

将AD目录配置为IAM Identity Center的身份源，实现用户/组自动同步：

resource "aws_ssoadmin_instance_access_control_configuration" "ad_identity_source" {
  instance_arn = data.aws_ssoadmin_instance.main.arn # 或aws_ssoadmin_instance.main.arn

  identity_store {
    identity_store_id = "d-9067abcdef" # 替换为你的AD目录ID
    type              = "DIRECTORY_SERVICE"
  }
}

关联后，IAM Identity Center会自动启动首次同步，后续每4小时自动同步一次；手动触发同步可使用CLI命令：aws sso-admin start-synchronization --instance-arn <你的实例ARN>

5. 创建权限集 #

权限集定义用户/组访问AWS账户的权限，示例如下：

示例1：关联AWS托管策略的权限集 #

resource "aws_ssoadmin_permission_set" "admin_access" {
  instance_arn = data.aws_ssoadmin_instance.main.arn
  name         = "AdminAccess"
  description  = "Full administrative access to AWS accounts"
  session_duration = "PT8H" # 会话时长8小时，最大支持12小时（PT12H）
}

resource "aws_ssoadmin_managed_policy_attachment" "admin_policy" {
  instance_arn       = data.aws_ssoadmin_instance.main.arn
  permission_set_arn = aws_ssoadmin_permission_set.admin_access.arn
  managed_policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

示例2：关联自定义IAM策略的权限集 #

resource "aws_ssoadmin_permission_set" "dev_team_access" {
  instance_arn = data.aws_ssoadmin_instance.main.arn
  name         = "DevTeamAccess"
  description  = "Limited access for development team"
  session_duration = "PT4H"
}

resource "aws_ssoadmin_customer_managed_policy_attachment" "dev_policy" {
  instance_arn       = data.aws_ssoadmin_instance.main.arn
  permission_set_arn = aws_ssoadmin_permission_set.dev_team_access.arn
  customer_managed_policy_reference {
    name = "DevTeamCustomPolicy" # 替换为你的自定义IAM策略名称
    path = "/"
  }
}

6. 分配权限集到AD用户/组与AWS账户 #

先通过CLI获取AD用户/组ID：

• 查询用户：aws identity-store list-users --identity-store-id <你的AD目录ID>
• 查询组：aws identity-store list-groups --identity-store-id <你的AD目录ID>

然后配置分配：

# 示例：将AdminAccess权限集分配给AD组DevOps，关联到AWS账户123456789012
resource "aws_ssoadmin_account_assignment" "devops_admin" {
  instance_arn       = data.aws_ssoadmin_instance.main.arn
  permission_set_arn = aws_ssoadmin_permission_set.admin_access.arn
  principal_id       = "g-12345678" # 替换为你的AD组ID
  principal_type     = "GROUP"
  target_id          = "123456789012" # 替换为目标AWS账户ID
  target_type        = "AWS_ACCOUNT"
}

# 示例：将DevTeamAccess权限集分配给AD用户john.doe@example.com
resource "aws_ssoadmin_account_assignment" "john_dev" {
  instance_arn       = data.aws_ssoadmin_instance.main.arn
  permission_set_arn = aws_ssoadmin_permission_set.dev_team_access.arn
  principal_id       = "u-87654321" # 替换为你的AD用户ID
  principal_type     = "USER"
  target_id          = "123456789012"
  target_type        = "AWS_ACCOUNT"
}

关键注意事项 #

• AWS Organization必须已启用，IAM Identity Center依赖组织管理账户
• AD目录与IAM Identity Center实例必须在同一AWS区域
• 权限集分配后需等待1-2分钟生效，用户可通过IAM Identity Center门户登录目标账户
• 若AD用户/组未同步到IAM Identity Center，检查AD与AWS的信任关系，或手动触发同步

内容的提问来源于stack exchange，提问作者Shinigami Sin of Wrath