main.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Creates a SAML Identity Provider.
Parameters:
  idpName:
    Description: Name of the identity provider to create.
    Type: String
    Default: NMDGoogle
  samlMetadata:
    Description: The contents of an XML IdP MetaData Document.
    Type: String
  custNameAbbreviation:
    Description: Label for customer name. 2-32 characters, numbers, underscores or dashes. Does not affect functionality.
    Type: String
    AllowedPattern: '^[a-zA-Z0-9_-]{2,32}$' 
  accessPolicy:
    Description: "Policy to assign to New Math Data Engineers in your account. Policy descriptions are here: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html"
    Type: String
    Default: AdministratorAccess
    AllowedValues:
      - AdministratorAccess
      - PowerUserAccess
      - SecurityAudit
      - ReadOnlyAccess
      - SystemAdministrator
      - Billing
Resources:
  samlIdentityProvider:
    Type: AWS::IAM::SAMLProvider
    Properties: 
      Name: !Ref idpName
      SamlMetadataDocument: !Ref samlMetadata
  adminRole:
    Type: AWS::IAM::Role
    Properties: 
      MaxSessionDuration: 43200
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: 
              Federated: !Sub "arn:aws:iam::${AWS::AccountId}:saml-provider/${idpName}"
            Action:
              - "sts:AssumeRoleWithSAML"
            Condition:
              StringEquals:
                "SAML:aud": "https://signin.aws.amazon.com/saml"
      Description: "NMD Admin Role for service."
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      RoleName: !Sub "NMD-Admin-${custNameAbbreviation}"
    DependsOn: samlIdentityProvider

Outputs:
  NewMathDataSsoRole:
    Value: !GetAtt adminRole.Arn
  NewMathDataIdentityProvider:
    Value: !GetAtt samlIdentityProvider.Arn