IAM Identity Center

6 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

PermissionSet # GA

PermissionSet is the Schema for managing IAM Identity Center permission sets.

kubectl get permissionsets · example on GitHub

Example

# PermissionSet — IAM Identity Center
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssoadmin.html#permissionset
apiVersion: aws.konfig.io/v1alpha1
kind: PermissionSet
metadata:
  name: example-permissionset
  namespace: default
spec:
  description: Managed by konfig-konector
  inlinePolicy: example
  instanceArn: arn:aws:iam::123456789012:role/example-role
  managedPolicies:
  - example
  name: example-permissionset
  providerRef:
    name: example-permissionset
    region: us-east-1
  relayState: example
  sessionDuration: example
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Description of the permission set.
`inlinePolicy`	string	—	InlinePolicy is an IAM policy document (JSON) stored inline in the permission set.
`instanceArn`	string	yes	InstanceArn is the ARN of the IAM Identity Center instance under which the permission set is created.
`managedPolicies`	array<string>	—	ManagedPolicies is a list of AWS managed policy ARNs to attach to the permission set.
`name`	string	yes	Name is the name of the permission set.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`relayState`	string	—	RelayState redirects users within the application during federation authentication.
`sessionDuration`	string	—	SessionDuration is the length of time that application user sessions are valid, in ISO-8601 duration format (e.g.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`permissionSetArn`	string	—	PermissionSetArn is the ARN of the permission set.

SSOAdminApplication # CLOUD CONTROL · AWS::SSO::Application

SSOAdminApplication manages AWS::SSO::Application through the AWS Cloud Control API.

kubectl get ssoadminapplications · example on GitHub

Example

# SSOAdminApplication — IAM Identity Center
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssoadmin.html#ssoadminapplication
apiVersion: aws.konfig.io/v1alpha1
kind: SSOAdminApplication
metadata:
  name: example-ssoadminapplication
  namespace: default
spec:
  applicationProviderArn: arn:aws:iam::123456789012:role/example-role
  description: Managed by konfig-konector
  instanceArn: arn:aws:iam::123456789012:role/example-role
  name: example-ssoadminapplication
  portalOptions:
    signInOptions:
      applicationUrl: example
      origin: IDENTITY_CENTER
    visibility: ENABLED
  providerRef:
    name: example-ssoadminapplication
    region: us-east-1
  status: ENABLED
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`applicationProviderArn`	string	yes	The ARN of the application provider under which the operation will run Create-only in AWS: changing it requires replacing the resource.
`description`	string	—	The description information for the Identity Center (SSO) Application
`instanceArn`	string	yes	The ARN of the instance of IAM Identity Center under which the operation will run Create-only in AWS: changing it requires replacing the resource.
`name`	string	yes	The name you want to assign to this Identity Center (SSO) Application
`portalOptions`	object	—	A structure that describes the options for the portal associated with an application
`portalOptions.signInOptions`	object	—	A structure that describes the sign-in options for the access portal
`portalOptions.signInOptions.applicationUrl`	string	—	The URL that accepts authentication requests for an application, this is a required parameter if the Origin parameter is APPLICATION
`portalOptions.signInOptions.origin`	enum	yes	This determines how IAM Identity Center navigates the user to the target application Allowed: `IDENTITY_CENTER, APPLICATION`
`portalOptions.visibility`	enum	—	Indicates whether this application is visible in the access portal Allowed: `ENABLED, DISABLED`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`status`	enum	—	Specifies whether the application is enabled or disabled Allowed: `ENABLED, DISABLED`
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`applicationArn`	string	—	The Application ARN that is returned upon creation of the Identity Center (SSO) Application Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`identityStoreArn`	string	—	The ARN of the identity store associated with the Identity Center instance Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SSOAdminApplicationAssignment # CLOUD CONTROL · AWS::SSO::ApplicationAssignment

SSOAdminApplicationAssignment manages AWS::SSO::ApplicationAssignment through the AWS Cloud Control API.

kubectl get ssoadminapplicationassignments · example on GitHub

Example

# SSOAdminApplicationAssignment — IAM Identity Center
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssoadmin.html#ssoadminapplicationassignment
apiVersion: aws.konfig.io/v1alpha1
kind: SSOAdminApplicationAssignment
metadata:
  name: example-ssoadminapplicationassignment
  namespace: default
spec:
  applicationArn: arn:aws:iam::123456789012:role/example-role
  principalId: example-id
  principalType: USER
  providerRef:
    name: example-ssoadminapplicationassignment
    region: us-east-1

Spec

Field	Type	Required	Description
`applicationArn`	string	yes	The ARN of the application.
`principalId`	string	yes	An identifier for an object in IAM Identity Center, such as a user or group Create-only in AWS: changing it requires replacing the resource.
`principalType`	enum	yes	The entity type for which the assignment will be created. Allowed: `USER, GROUP`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SSOAdminInstance # CLOUD CONTROL · AWS::SSO::Instance ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide IAM Identity Center instance. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. SSOAdminInstance manages AWS::SSO::Instance through the AWS Cloud Control API.

kubectl get ssoadmininstances · example on GitHub

Example

# SSOAdminInstance — IAM Identity Center
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssoadmin.html#ssoadmininstance
apiVersion: aws.konfig.io/v1alpha1
kind: SSOAdminInstance
metadata:
  name: example-ssoadmininstance
  namespace: default
spec:
  name: example-ssoadmininstance
  providerRef:
    name: example-ssoadmininstance
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`name`	string	—	The name you want to assign to this Identity Center (SSO) Instance
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`identityStoreId`	string	—	The ID of the identity store associated with the created Identity Center (SSO) Instance Read-only: reported by AWS after creation.
`instanceArn`	string	—	The SSO Instance ARN that is returned upon creation of the Identity Center (SSO) Instance Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerAccountId`	string	—	The AWS accountId of the owner of the Identity Center (SSO) Instance Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	The status of the Identity Center (SSO) Instance, create_in_progress/delete_in_progress/active Read-only: reported by AWS after creation. Allowed: `CREATE_IN_PROGRESS, DELETE_IN_PROGRESS, ACTIVE`

SSOAdminInstanceAccessControlAttributeConfiguration # CLOUD CONTROL · AWS::SSO::InstanceAccessControlAttributeConfiguration ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide Identity Center attribute configuration. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. SSOAdminInstanceAccessControlAttributeConfiguration manages AWS::SSO::InstanceAccessControlAttributeConfiguration through the AWS Cloud Control API.

kubectl get ssoadmininstanceaccesscontrolattributeconfigurations · example on GitHub

Example

# SSOAdminInstanceAccessControlAttributeConfiguration — IAM Identity Center
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssoadmin.html#ssoadmininstanceaccesscontrolattributeconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: SSOAdminInstanceAccessControlAttributeConfiguration
metadata:
  name: example-ssoadmininstanceaccesscontrolattributeconfiguration
  namespace: default
spec:
  accessControlAttributes:
  - key: example
    value:
      source:
      - example
  instanceAccessControlAttributeConfiguration:
    accessControlAttributes:
    - key: example
      value:
        source:
        - example
  instanceArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ssoadmininstanceaccesscontrolattributeconfiguration
    region: us-east-1

Spec

Field	Type	Required	Description
`accessControlAttributes`	array<object>	—
`accessControlAttributes[].key`	string	yes
`accessControlAttributes[].value`	object	yes	SSOAdminInstanceAccessControlAttributeConfigurationAccessControlAttributeValue is a nested property type of AWS::SSO::InstanceAccessControlAttributeConfiguration.
`accessControlAttributes[].value.source`	array<string>	yes
`instanceAccessControlAttributeConfiguration`	object	—	The InstanceAccessControlAttributeConfiguration property has been deprecated but is still supported for backwards compatibility purposes.
`instanceAccessControlAttributeConfiguration.accessControlAttributes`	array<object>	yes
`instanceAccessControlAttributeConfiguration.accessControlAttributes[].key`	string	yes
`instanceAccessControlAttributeConfiguration.accessControlAttributes[].value`	object	yes	SSOAdminInstanceAccessControlAttributeConfigurationAccessControlAttributeValue is a nested property type of AWS::SSO::InstanceAccessControlAttributeConfiguration.
`instanceAccessControlAttributeConfiguration.accessControlAttributes[].value.source`	array<string>	yes
`instanceArn`	string	yes	The ARN of the AWS SSO instance under which the operation will be executed.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SSOAssignment # GA

SSOAssignment is the Schema for managing IAM Identity Center account assignments.

kubectl get ssoassignments · example on GitHub

Example

# SSOAssignment — IAM Identity Center
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssoadmin.html#ssoassignment
apiVersion: aws.konfig.io/v1alpha1
kind: SSOAssignment
metadata:
  name: example-ssoassignment
  namespace: default
spec:
  instanceArn: arn:aws:iam::123456789012:role/example-role
  permissionSetRef:
    name: example-permissionset
  principalId: example-id
  principalType: USER
  providerRef:
    name: example-ssoassignment
    region: us-east-1
  targetId: example-id-x
  targetType: AWS_ACCOUNT

Spec

Field	Type	Required	Description
`instanceArn`	string	yes	InstanceArn is the ARN of the IAM Identity Center instance.
`permissionSetRef`	object	yes	PermissionSetRef references the permission set to assign.
`permissionSetRef.arn`	string	—	ARN is a direct IAM Identity Center permission set ARN.
`permissionSetRef.name`	string	—	Name of a PermissionSet CR in the same namespace.
`principalId`	string	yes	PrincipalId is the GUID of the Identity Center user or group.
`principalType`	enum	yes	PrincipalType is the type of the Identity Center principal. Allowed: `USER, GROUP`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`targetId`	string	yes	TargetId is the 12-digit AWS account ID the assignment targets.
`targetType`	enum	—	TargetType is the entity type the assignment targets. Allowed: `AWS_ACCOUNT`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`permissionSetArn`	string	—	PermissionSetArn is the resolved permission set ARN that was assigned.
`requestId`	string	—	RequestId tracks the in-flight asynchronous create operation.
`state`	string	—	State is the last observed assignment operation state (IN_PROGRESS, SUCCEEDED, or FAILED).