Building-Blocks.md

Building Blocks

The solution comprises of the following building blocks:

1. DynamoDB tables

Table Name	Contents	Use
Permission Set	All content of permission set JSON files	Staging - to compute delta while triggering permission set create/update/delete API
Permission Set Arn	Permission set name and arn value (generated by SSO on create API call)	Lookup - to map permission set name to arn value and vice versa
Links	All content of links file name split by dot (excluding the file extension)	Lookup - fetch one link entity value based on another entity value Lookup, determine pre-existing account assignment relationships Trigger - create/delete accountAssignment based on data changes
Provisioned Links	Link data abstracted to an individual account	Lookup - used to determine if a link has already been created

2. Lambda Functions

Function Group	Function	Code Path	Purpose	Trigger Source	Downstream Triggers
User Interface Handlers	Account Assignment API handler	lib/lambda-functions/user-interface-handlers/src/linkApi.ts	API proxy lambda for account assignment API operations	Account assignment API gateway	Account assignment topic
User Interface Handlers	Account Assignment S3 create/update handler	lib/lambda-functions/user-interface-handlers/src/linkCu.ts	S3 event handler lambda for account assignment create/update operations	S3 event notifications on link prefix and create object type events	Account assignment topic
User Interface Handlers	Account Assignment S3 delete handler	lib/lambda-functions/user-interface-handlers/src/linkDel.ts	S3 event handler lambda for account assignment delete operations	S3 event notifications on link prefix and remove object type events	Account assignment topic
User Interface Handlers	Permission set API handler	lib/lambda-functions/user-interface-handlers/src/permissionSetApi.ts	API proxy lambda for permission set API operations	Permission set API gateway	Permission set topic
User Interface Handlers	Permission set S3 create/update handler	lib/lambda-functions/user-interface-handlers/src/permissionSetCu.ts	S3 event handler lambda for permission set create/update operations	S3 event notifications on permission set prefix and create object type events	Permission set topic
User Interface Handlers	Permission set S3 delete handler	lib/lambda-functions/user-interface-handlers/src/permissionSetDel.ts	S3 event handler lambda for permission set delete operations	S3 event notifications on permission set prefix and remove object type events	Permission set topic
Application Handlers	AWS IAM Identity Center groups event handler	lib/lambda-functions/application-handlers/src/groupsCud.ts	Handler to process AWS IAM Identity Center group events	AWS IAM Identity Center group events rule (AWS IAM Identity Center event) through cross-account topic	Account assignment queue/ org entities state machine(org account)
Application Handlers	AWS IAM Identity Center users event handler	lib/lambda-functions/application-handlers/src/usersCud.ts	Handler to process AWS IAM Identity Center user events	AWS IAM Identity Center user events rule (AWS IAM Identity Center event) through cross-account topic	Account assignment queue/ org entities state machine(org account)
Application Handlers	Account assignments queue processor	lib/lambda-functions/application-handlers/src/linkManager.ts	Handler to process account assignment API operations from FIFO queue	Account assignment queue	n/a
Application Handlers	Account assignment topic processor	lib/lambda-functions/application-handlers/src/linkTopicProcessor.ts	Handler to determine type of account assignment operation	Account assignment topic	Account assignment queue/ org entities state machine(org account)
Application Handlers	Org events handler	lib/lambda-functions/application-handlers/src/orgEvents.ts	Handler to process org events	Org events rule(Org main account) through cross-account topic	Account assignment queue
Application Handlers	Permission set sync handler	lib/lambda-functions/application-handlers/src/permissionSetSync.ts	Handler to sync any pending account assignments for the permission set	Permission set topic processor	Account assignment queue/ org entities state machine(org account)
Application Handlers	Permission set topic processor	lib/lambda-functions/application-handlers/src/permissionSetTopicProcessor.ts	Handler to determine type of permissions set operation and process permission set API operations	Permission set topic	n/a
Application Handlers	Org entities state machine listener	lib/lambda-functions/application-handlers/src/processTargetAccountSMListener.ts	Handler to process org entities state machine results	Org entities state machine(org account) through cross-accounn topic	Account assignment queue
Current config Handlers	Custom resource handler	lib/lambda-functions/current-config-handlers/src/triggerParentSM.ts	Cloud formation custom resource handler for importing current AWS IAM Identity Center configuration into the solution	Cloud formation	Current configuration state machine(AWS IAM Identity Center account)
Current config Handlers	Custom resource status update handler	lib/lambda-functions/current-config-handlers/src/update-custom-resource.ts	Handler to update cloudformation with status of custom resource creation/update/delete	Cloud formation	n/a
Current config Handlers	Permission set import handler	lib/lambda-functions/current-config-handlers/src/import-permission-sets.ts	Handler to import permission sets into the solution	Import permission set state machine(AWS IAM Identity Center account) through cross-account topic	n/a
Current config Handlers	Account assignment import handler	lib/lambda-functions/current-config-handlers/src/import-account-assignment.ts	Handler to import account assignments into the solution	Import account assignment state machine(AWS IAM Identity Center account) through cross-account topic	n/a

3. SNS Topics

Topic	Account	Publisher	Subscriber
Permission set processing topic	Target	Permission set user interface handlers	Permission set topic processor
Account assignment processing topic	Target	Account assignment user interface handlers	Account assignment topic processor
Permission set sync topic	Target	Permission set topic processor	Permission set sync handler
Error topic	Target	All lambda functions	Email provided in cdk.json
Org entities state machine topic	Org main	Org entities state machine	Org entities state machine listener (target)
Org events topic	Org main	Org events event bridge rule	Org events handler(target)
SSO groups event topic	SSO	SSO groups events event bridge rule	AWS IAM Identity Center groups event handler(target)
SSO users event topic	SSO	SSO users events event bridge rule	AWS IAM Identity Center users event handler(target)
Import permission set topic	SSO	Import permission set state machine	Permission set import handler(target)
Import account assignment topic	SSO	Import account assignment state machine	Account assignment import handler(target)

4. SQS Queues

Queue	isFifo	Producer(s)	Message group ID	Message de-duplication ID	Consumer(s)
Account assignment	true	Account assignment topic processor, Org events handler, Permission set sync handler,AWS SSO groups event handler, AWS IAM Identity Center users event handler, Org entities state machine listener,	accountId-permissionSetID-principalId	action-accountId-permissionSetID-principalId	Account assignments queue processor

5. S3 Object Event Notifications

S3 Bucket	Prefix Filtered on	Suffix filtered on	Lambda invoked
SSO artefacts bucket	permission_sets/	.json	OBJECT_CREATED event type - Permission set create/update handler OBJECT_REMOVED event type - Permission set delete handler
SSO artefacts bucket	links_data/	.ssofile	OBJECT_CREATED event type - link create/update handler OBJECT_REMOVED event type - link delete handler

6. API Gateway end points

API Name	Type	Integration	Authentication	Purpose	Receiver
Links API	Edge	Lambda Rest	IAM with permissions set to links api caller roleArn from cdk.json	Interface for linkAPI handler	linkAPI handler
Permission set API	Edge	Lambda Rest	IAM with permissions set to permission set caller roleArn from cdk.json	Interface for permissionSetAPI handler	permissionSetAPI handler

7. State Machines

Step function Name	Deployed in	Trigger source(s)	Purpose
Org entities list	Org main	AWS IAM Identity Center groups event handler, AWS IAM Identity Center users event handler, Permission set sync handler, Account assignment topic processor	Resolve target accounts by querying org API's
Import current config	SSO	Cloudformation custom resource handler	Trigger parent SM to orchestrate current SSO configuration import
Import permission set	SSO	Import current config SM	Import permission set objects
Import account assignment	SSO	Import permission set SM	Import account assignment objects

8. Lambda Layers

Layer Name	Runtime	Purpose	Referenced by
Node JS layer	NODEJS_20_X	Package AWS-JS SDK V3 modular clients, uuid, ajv and json-diff libs	All Lambda's