saml-roles.yaml

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  FederatedDBARole:
    DependsOn:
    - IdentityProvider
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          Action: sts:AssumeRoleWithSAML
          Condition:
            StringEquals:
              SAML:aud: https://signin.aws.amazon.com/saml
          Effect: Allow
          Principal:
            Federated:
              Fn::Join:
              - ''
              - - 'arn:aws:iam::'
                - Ref: AWS::AccountId
                - :saml-provider/AzureAD
        Version: '2012-10-17'
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/job-function/DatabaseAdministrator
      Path: /
      RoleName: FederatedDBARole
    Type: AWS::IAM::Role
  FederatedObserverRole:
    DependsOn:
    - IdentityProvider
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          Action: sts:AssumeRoleWithSAML
          Condition:
            StringEquals:
              SAML:aud: https://signin.aws.amazon.com/saml
          Effect: Allow
          Principal:
            Federated:
              Fn::Join:
              - ''
              - - 'arn:aws:iam::'
                - Ref: AWS::AccountId
                - :saml-provider/AzureAD
        Version: '2012-10-17'
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/ReadOnlyAccess
      Path: /
      RoleName: FederatedObserverRole
    Type: AWS::IAM::Role
  FederatedPowerUserRole:
    DependsOn:
    - IdentityProvider
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          Action: sts:AssumeRoleWithSAML
          Condition:
            StringEquals:
              SAML:aud: https://signin.aws.amazon.com/saml
          Effect: Allow
          Principal:
            Federated:
              Fn::Join:
              - ''
              - - 'arn:aws:iam::'
                - Ref: AWS::AccountId
                - :saml-provider/AzureAD
        Version: '2012-10-17'
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/PowerUserAccess
      Path: /
      RoleName: FederatedPowerUserRole
    Type: AWS::IAM::Role
  IdPLambda:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.7
      Handler: index.lambda_handler
      MemorySize: 128
      Role: !GetAtt IdPLambdaExecutionRole.Arn
      Timeout: 30
      Code:
        ZipFile: !Sub |
          import boto3
          from botocore.exceptions import ClientError
          import cfnresponse

          iam = boto3.client("iam")

          def create_idp(name, saml_metadata):
              try:
                  resp = iam.create_saml_provider(SAMLMetadataDocument=saml_metadata, Name=name)
                  return True, resp['SAMLProviderArn']
              except Exception as e:
                  return False, f"Could not create SAML IdP due to: {str(e)}"

          def delete_idp(arn):
              try:
                  iam.delete_saml_provider(SAMLProviderArn=arn)
                  return True, f"SAML provider with ARN {arn} deleted"
              except ClientError as e:
                  if e.response['Error']['Code'] == "NoSuchEntity":
                      return True, f"SAML provider with ARN {arn} already deleted."
                  else:
                      return False, f"Could not delete SAML IdP with ARN {arn}: {str(e)}"
              except Exception as e:
                  return False, f"Could not delete SAML IdP with ARN {arn}: {str(e)}"

          def update_idp(arn, saml_metadata):
              try:
                  resp = iam.update_saml_provider(SAMLMetadataDocument=saml_metadata, SAMLProviderArn=arn)
                  return True, f"SAML provider {arn} updated"
              except Exception as e:
                  return False, f"Cannot update SAML provider {arn}: {str(e)}"

          def lambda_handler(event, context):
              saml_metadata = event['ResourceProperties']['Metadata']
              idp_name = event['ResourceProperties']['Name']
              if event['RequestType'] == 'Create':
                  res, idp_arn = create_idp(idp_name, saml_metadata)
                  reason = "Creation succeeded"
              else:
                  idp_arn = "arn:aws:iam::${AWS::AccountId}:saml-provider/{}".format(idp_name)
                  if event['RequestType'] == 'Update':
                      res, reason = update_idp(idp_arn, saml_metadata)
                  elif event['RequestType'] == 'Delete':
                      res, reason = delete_idp(idp_arn)
                  else:
                      res = False
                      reason = "Unknown operation: " + event['RequestType']
              response_data = dict()
              response_data['Reason'] = reason
              if res:
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data, idp_arn)
              else:
                  cfnresponse.send(event, context, cfnresponse.FAILED, response_data, idp_arn)

  IdPLambdaExecutionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
        Version: '2012-10-17'
      Path: /
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - iam:*SamlProvider
            Effect: Allow
            Resource: '*'
          - Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Effect: Allow
            Resource: '*'
          Version: '2012-10-17'
        PolicyName: root
    Type: AWS::IAM::Role

  IdentityProvider:
    Type: Custom::IdentityProvider
    Properties:
      Metadata: |
        <MetadataDocument>
      Name: AzureAD
      Region:
        Ref: AWS::Region
      ServiceToken:
        Fn::GetAtt:
        - IdPLambda
        - Arn