Bootstrap/main.yml at main · New-Math-Data/Bootstrap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
AWSTemplateFormatVersion: "2010-09-09"
Description: Creates a SAML Identity Provider.
Parameters:
  idpName:
    Description: Name of the identity provider to create.
    Type: String
    Default: NMDGoogle
  samlMetadata:
    Description: The contents of an XML IdP MetaData Document.
    Type: String
  custNameAbbreviation:
    Description: Label for customer name. 2-32 characters, numbers, underscores or dashes. Does not affect functionality.
    Type: String
    AllowedPattern: '^[a-zA-Z0-9_-]{2,32}$'
  accessPolicy:
    Description: "Policy to assign to New Math Data Engineers in your account. Policy descriptions are here: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html"
    Type: String
    Default: AdministratorAccess
    AllowedValues:
      - AdministratorAccess
      - PowerUserAccess
      - SecurityAudit
      - ReadOnlyAccess
      - SystemAdministrator
      - Billing
Mappings:
  PolicyMap:
    AdministratorAccess:
      Arn: "arn:aws:iam::aws:policy/AdministratorAccess"
    PowerUserAccess:
      Arn: "arn:aws:iam::aws:policy/PowerUserAccess"
    SecurityAudit:
      Arn: "arn:aws:iam::aws:policy/SecurityAudit"
    ReadOnlyAccess:
      Arn: "arn:aws:iam::aws:policy/ReadOnlyAccess"
    SystemAdministrator:
      Arn: "arn:aws:iam::aws:policy/job-function/SystemAdministrator"
    Billing:
      Arn: "arn:aws:iam::aws:policy/job-function/Billing"
Resources:
  samlIdentityProvider:
    Type: AWS::IAM::SAMLProvider
    Properties:
      Name: !Ref idpName
      SamlMetadataDocument: !Ref samlMetadata
  samlChosenRole:
    Type: AWS::IAM::Role
    Properties:
      MaxSessionDuration: 43200
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Federated: !Sub "arn:aws:iam::${AWS::AccountId}:saml-provider/${idpName}"
            Action:
              - "sts:AssumeRoleWithSAML"
            Condition:
              StringEquals:
                "SAML:aud": "https://signin.aws.amazon.com/saml"
      Description: !Sub "NMD ${accessPolicy} Role for service."
      ManagedPolicyArns:
        - !FindInMap [PolicyMap, !Ref accessPolicy, Arn]
      RoleName: !Sub "NMD-${accessPolicy}-${custNameAbbreviation}"
    DependsOn: samlIdentityProvider

Outputs:
  NewMathDataSsoRole:
    Value: !GetAtt samlChosenRole.Arn
  NewMathDataIdentityProvider:
    Value: !GetAtt samlIdentityProvider.Arn