stack_master 2.16.0 → 2.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b4266652d84c1c02817d9db7dfcdf52dc475d86b24013066362ff9db91ef7703
-  data.tar.gz: 3da40d30397a13adea77a79db06162c6006b7d2d6c77748b01fea17dfc1a50fc
+  metadata.gz: 637daba2dddc707df22584fad412d87df4ee24aab069885231561d847c762496
+  data.tar.gz: 7abcea21ecfbc080886b4181dc66392066a9360255ed2186bf2e7d652f6101e2
 SHA512:
-  metadata.gz: af293fcc93bd620fe8b37e3220b265470ad59fa35cf790fc303d4f070ec9bb1e5b447a7c37e2f4bc10cd60ed637bc4febc98dd6c430f98a2a51e6466edb3abd4
-  data.tar.gz: 55f59fd4ceb3175cf2660e5285058900696d0fadf899f271bdf58a81dc472f5b2660f1efef2b37be0357a9d1c68c61b4c383be88ae8f98b0bc2a8f57b883e191
+  metadata.gz: dba94d8ecf220d837673ef95f68c8d534b979bd31d67b8056e0836355a88f713499ca55420906ffb16855f7c3acb17e320c41ec90cb9c84263c59539f00c4cb2
+  data.tar.gz: 680f31e8fef7a94d387582acdb6c9381844aae4e2c56e6c4088f36d9c1ac2969feb27b9703c90c21416cef96572efc32455d4621951567611a18cb3481f22f56

data/README.md

@@ -416,6 +416,24 @@ ssh_sg:
     - WebAccessSecurityGroup
 ```
 
+### AWS IIC/SSO Group IDs
+
+Looks up AWS Identity Center group name in the configured Identity Store and returns the ID suitable for use in AWS IIC assignments.
+It is likely that account and role will need to be specified to do the lookup, the region specification is optional it defaults to stack region.
+
+```yaml
+GroupId:
+  sso_group_id: '[region:]identity-store-id/SSO Group Name'
+```
+
+e.g.
+```yaml
+GroupIdNotInStackRegion:
+  sso_group_id: 'us-east-1:d-123456df8:Okta-App-AWS-FooBar'
+GroupIdInStackRegion:
+  sso_group_id: 'd-123456df8:Okta-App-AWS-FooBar'
+```
+
 ### SNS Topic
 
 Looks up an SNS topic by name and returns the ARN.

data/lib/stack_master/parameter_resolvers/accounts_by_tags.rb

@@ -0,0 +1,60 @@
+module StackMaster
+  module ParameterResolvers
+    class AccountsByTags < Resolver
+      array_resolver class_name: 'AccountsByTags'
+
+      def initialize(config, stack_definition)
+        @config = config
+        @stack_definition = stack_definition
+      end
+
+      def resolve(team)
+        
+      end
+
+      private
+
+      def fetch_all_aws_accounts()
+        return @aws_accounts if defined(@aws_accounts)
+        @aws_accounts = []
+        next_token = nil
+        client = Aws::Organizations::Client.new(region: @stack_definition.region)
+        loop do
+          resp = client.list_accounts(next_token: next_token)
+          @aws_accounts << resp.accounts
+          next_token = resp.next_token
+          break if next_token.nil?
+        end
+        @aws_accounts.flatten! || @aws_accounts  
+      end
+
+      def_fetch_tags_for_account(account)
+        client = Aws::Organizations::Client.new(region: @stack_definition.region)
+        next_token = nil
+        tags = [] 
+        loop do
+          client.list_tags_for_resource(resource_id: account.id, next_token: next_token)
+          tags << resp.tags
+          next_token = resp.next_token
+          break if next_token.nil?
+        end
+        tags.flatten! || tags
+      end
+
+      def fetch_tags_for_accounts()
+        return @tagged_aws_accounts if defined?(@tagged_aws_accounts )
+        @tagged_aws_accounts = Hash.new()
+        fetch_all_aws_accounts()
+        @aws_accounts.each do |account|
+          @tagged_aws_accounts[account.id.to_sym] = { :account => account.id, :tags => fetch_tags_for_account(account.id) }
+        end
+      end
+
+      def account_in_group?(account, group)
+        fetch_tags_for_accounts if defined?(@tagged_aws_accounts)
+        @tagged_aws_accounts[:account.to_sym][:tags].select {|tag| tag['key'] =='Group' && tag['value']==group}
+      end
+
+    end
+  end
+end

data/lib/stack_master/parameter_resolvers/sso_group_id.rb

@@ -0,0 +1,21 @@
+module StackMaster
+  module ParameterResolvers
+    class SsoGroupId < Resolver
+      InvalidParameter = Class.new(StandardError)
+
+      def initialize(config, stack_definition)
+        @config = config
+        @stack_definition = stack_definition
+      end
+
+      def resolve(value)
+        sso_group_id_finder.find(value)
+      end
+
+    private
+      def sso_group_id_finder
+        StackMaster::SsoGroupIdFinder.new()
+      end
+    end
+  end
+end

data/lib/stack_master/sso_group_id_finder.rb

@@ -0,0 +1,33 @@
+module StackMaster
+  class SsoGroupIdFinder
+    SsoGroupNotFound = Class.new(StandardError)
+
+    def find(reference)
+      output_regex = %r{(?:(?<region>[^:]+):)?(?<identity_store_id>[^:/]+)/(?<group_name>.+)}
+
+      if !reference.is_a?(String) || !(match = output_regex.match(reference))
+          raise ArgumentError, 'Sso group lookup parameter must be in the form of [region:]identity-store-id/group_name'
+      end
+
+      region = match[:region] || StackMaster.cloud_formation_driver.region
+      client = Aws::IdentityStore::Client.new({ region: region })
+
+      begin
+        response = client.get_group_id({
+          identity_store_id: match[:identity_store_id],
+          alternate_identifier: {
+            unique_attribute: {
+              attribute_path: 'displayName',
+              attribute_value: match[:group_name],
+            },
+          },
+        })
+        return response.group_id
+      rescue Aws::IdentityStore::Errors::ServiceError => e
+          puts "Error calling GetGroupId: #{e.message}"
+      end
+
+      raise SsoGroupNotFound, "No group with name #{match[:group_name]} found in identity store #{match[:identity_store_id]} in #{region}"
+    end
+  end
+end

data/lib/stack_master/test_driver/cloud_formation.rb

@@ -1,3 +1,4 @@
+require 'ostruct'
 require 'securerandom'
 
 module StackMaster

data/lib/stack_master/version.rb

@@ -1,3 +1,3 @@
 module StackMaster
-  VERSION = "2.16.0"
+  VERSION = "2.17.0"
 end

data/lib/stack_master.rb

@@ -4,6 +4,7 @@ require 'aws-sdk-acm'
 require 'aws-sdk-cloudformation'
 require 'aws-sdk-ec2'
 require 'aws-sdk-ecr'
+require 'aws-sdk-identitystore'
 require 'aws-sdk-s3'
 require 'aws-sdk-sns'
 require 'aws-sdk-ssm'
@@ -33,6 +34,7 @@ module StackMaster
   autoload :StackStatus, 'stack_master/stack_status'
   autoload :SnsTopicFinder, 'stack_master/sns_topic_finder'
   autoload :SecurityGroupFinder, 'stack_master/security_group_finder'
+  autoload :SsoGroupIdFinder, 'stack_master/sso_group_id_finder'
   autoload :ParameterLoader, 'stack_master/parameter_loader'
   autoload :ParameterResolver, 'stack_master/parameter_resolver'
   autoload :RoleAssumer, 'stack_master/role_assumer'
@@ -84,6 +86,7 @@ module StackMaster
     autoload :Ejson, 'stack_master/parameter_resolvers/ejson'
     autoload :SnsTopicName, 'stack_master/parameter_resolvers/sns_topic_name'
     autoload :SecurityGroup, 'stack_master/parameter_resolvers/security_group'
+    autoload :SsoGroupId, 'stack_master/parameter_resolvers/sso_group_id'
     autoload :LatestAmiByTags, 'stack_master/parameter_resolvers/latest_ami_by_tags'
     autoload :LatestAmi, 'stack_master/parameter_resolvers/latest_ami'
     autoload :Env, 'stack_master/parameter_resolvers/env'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: stack_master
 version: !ruby/object:Gem::Version
-  version: 2.16.0
+  version: 2.17.0
 platform: ruby
 authors:
 - Steve Hodgkiss
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-31 00:00:00.000000000 Z
+date: 2025-07-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -109,6 +109,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: os
   requirement: !ruby/object:Gem::Requirement
@@ -199,6 +213,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-identitystore
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-s3
   requirement: !ruby/object:Gem::Requirement
@@ -514,6 +542,7 @@ files:
 - lib/stack_master/paged_response_accumulator.rb
 - lib/stack_master/parameter_loader.rb
 - lib/stack_master/parameter_resolver.rb
+- lib/stack_master/parameter_resolvers/accounts_by_tags.rb
 - lib/stack_master/parameter_resolvers/acm_certificate.rb
 - lib/stack_master/parameter_resolvers/ami_finder.rb
 - lib/stack_master/parameter_resolvers/ejson.rb
@@ -525,6 +554,7 @@ files:
 - lib/stack_master/parameter_resolvers/parameter_store.rb
 - lib/stack_master/parameter_resolvers/security_group.rb
 - lib/stack_master/parameter_resolvers/sns_topic_name.rb
+- lib/stack_master/parameter_resolvers/sso_group_id.rb
 - lib/stack_master/parameter_resolvers/stack_output.rb
 - lib/stack_master/parameter_validator.rb
 - lib/stack_master/prompter.rb
@@ -548,6 +578,7 @@ files:
 - lib/stack_master/sparkle_formation/compile_time/value_validator.rb
 - lib/stack_master/sparkle_formation/compile_time/value_validator_factory.rb
 - lib/stack_master/sparkle_formation/template_file.rb
+- lib/stack_master/sso_group_id_finder.rb
 - lib/stack_master/stack.rb
 - lib/stack_master/stack_definition.rb
 - lib/stack_master/stack_differ.rb
@@ -579,8 +610,8 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/envato/stack_master/issues
   changelog_uri: https://github.com/envato/stack_master/blob/master/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/stack_master/2.16.0
-  source_code_uri: https://github.com/envato/stack_master/tree/v2.16.0
+  documentation_uri: https://www.rubydoc.info/gems/stack_master/2.17.0
+  source_code_uri: https://github.com/envato/stack_master/tree/v2.17.0
 post_install_message:
 rdoc_options: []
 require_paths:
@@ -596,7 +627,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.0.3.1
 signing_key:
 specification_version: 4
 summary: StackMaster is a sure-footed way of creating, updating and keeping track