Allocate AWS SSO Permission Set to Groups in Accounts

Question

Working to fully code the aws sso set up

So far coded via Terraform I have all permission-sets and using scim to pull in groups. Allocation of the permission sets to groups in accounts (I have over 100 accounts) is done by hand. I want to allocate permission sets to groups in selected accounts via IaC (Terraform) but I cant for the life of me find working code.

Ive tried using

aws_sso_permission_set_group_assignment, aws_sso_permission_set_group_attachment, aws_sso_group_permission_set_assignment, aws_sso_group_permission_set_attachment, aws_sso_permission_set_attachment, aws_sso_permission_set_assignment,

These i found in some old docs but they dont work :( giving The provider hashicorp/aws does not support resource type

Does anyone have any advice they can offer of how to remedy this or how they managed to surmount this issue

Here is example of code tried

resource "aws_sso_group_permission_set_attachment" "example" {
     group_id          = "93sd433ee-cd43e4b-cfww-434e-re33-707a0987eb"
     permission_set_id = "arn:aws:sso:::permissionSet/ssoins-63456a11we432d8/ps-1231ded3d42fcrr2"
     account_id = "8765322052550"
}

resource "aws_sso_group_permission_set_attachment" "example" {
     permission_set_arn = "arn:aws:sso:::permissionSet/ssoins-63456a11we432d8/ps-1231ded3d42fcrr2"
     group_name = "93sd433ee-cd43e4b-cfww-434e-re33-707a0987eb"
     account_id = "8765322052550"
}

Answer 1

ssoadmin_account_assignment resource is something which you might be looking for, please go through all the available attributes in the resource to match your needs.

resource "aws_ssoadmin_account_assignment" "example" {
  instance_arn       = tolist(data.aws_ssoadmin_instances.example.arns)[0]
  permission_set_arn = "arn_of_the_permission_set" # replace this with actually permission set arn 

  principal_id   = "group_id" # replace this with groupID 
  principal_type = "GROUP"

  target_id   = "012347678910" # replace with account ID 
  target_type = "AWS_ACCOUNT" 
}