cartography 0.104.0rc2__py3-none-any.whl → 0.123.0__py3-none-any.whl

cartography/intel/aws/identitycenter.py

@@ -1,12 +1,13 @@
 import logging
 from typing import Any
-from typing import Dict
-from typing import List
 
 import boto3
+import botocore.exceptions
 import neo4j
 
 from cartography.client.core.tx import load
+from cartography.client.core.tx import load_matchlinks
+from cartography.client.core.tx import read_list_of_dicts_tx
 from cartography.graph.job import GraphJob
 from cartography.models.aws.identitycenter.awsidentitycenter import (
     AWSIdentityCenterInstanceSchema,
@@ -14,20 +15,38 @@ from cartography.models.aws.identitycenter.awsidentitycenter import (
 from cartography.models.aws.identitycenter.awspermissionset import (
     AWSPermissionSetSchema,
 )
+from cartography.models.aws.identitycenter.awspermissionset import (
+    AWSRoleToSSOGroupMatchLink,
+)
+from cartography.models.aws.identitycenter.awspermissionset import (
+    AWSRoleToSSOUserMatchLink,
+)
+from cartography.models.aws.identitycenter.awssogroup import AWSSSOGroupSchema
 from cartography.models.aws.identitycenter.awsssouser import AWSSSOUserSchema
 from cartography.util import aws_handle_regions
-from cartography.util import run_cleanup_job
 from cartography.util import timeit
 
 logger = logging.getLogger(__name__)
 
 
+def _is_permission_set_sync_unsupported_error(
+    error: botocore.exceptions.ClientError,
+) -> bool:
+    """Return True when the Identity Center instance does not support permission sets."""
+    error_info = error.response.get("Error", {})
+    if error_info.get("Code") != "ValidationException":
+        return False
+
+    message = error_info.get("Message", "").lower()
+    return "not supported for this identity center instance" in message
+
+
 @timeit
 @aws_handle_regions
 def get_identity_center_instances(
     boto3_session: boto3.session.Session,
     region: str,
-) -> List[Dict]:
+) -> list[dict[str, Any]]:
     """
     Get all AWS IAM Identity Center instances in the current region
     """
@@ -44,7 +63,7 @@ def get_identity_center_instances(
 @timeit
 def load_identity_center_instances(
     neo4j_session: neo4j.Session,
-    instance_data: List[Dict],
+    instance_data: list[dict[str, Any]],
     region: str,
     current_aws_account_id: str,
     aws_update_tag: int,
@@ -71,7 +90,7 @@ def get_permission_sets(
     boto3_session: boto3.session.Session,
     instance_arn: str,
     region: str,
-) -> List[Dict]:
+) -> list[dict[str, Any]]:
     """
     Get all permission sets for a given Identity Center instance
     """
@@ -88,18 +107,37 @@ def get_permission_sets(
             )
             permission_set = details.get("PermissionSet", {})
             if permission_set:
-                permission_set["RoleHint"] = (
-                    f":role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_{permission_set.get('Name')}"
-                )
                 permission_sets.append(permission_set)
 
     return permission_sets
 
 
+def transform_permission_sets(
+    permission_sets: list[dict[str, Any]],
+    region: str,
+) -> list[dict[str, Any]]:
+    """
+    Transform permission sets by adding the RoleHint based on region.
+
+    AWS SSO roles in us-east-1 don't include region in the ARN path,
+    but roles in other regions do: /aws-reserved/sso.amazonaws.com/{region}/AWSReservedSSO_*
+    """
+    for permission_set in permission_sets:
+        if region == "us-east-1":
+            permission_set["RoleHint"] = (
+                f":role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_{permission_set.get('Name')}"
+            )
+        else:
+            permission_set["RoleHint"] = (
+                f":role/aws-reserved/sso.amazonaws.com/{region}/AWSReservedSSO_{permission_set.get('Name')}"
+            )
+    return permission_sets
+
+
 @timeit
 def load_permission_sets(
     neo4j_session: neo4j.Session,
-    permission_sets: List[Dict],
+    permission_sets: list[dict[str, Any]],
     instance_arn: str,
     region: str,
     aws_account_id: str,
@@ -120,6 +158,8 @@ def load_permission_sets(
         InstanceArn=instance_arn,
         Region=region,
         AWS_ID=aws_account_id,
+        _sub_resource_label="AWSAccount",
+        _sub_resource_id=aws_account_id,
     )
 
 
@@ -129,7 +169,7 @@ def get_sso_users(
     boto3_session: boto3.session.Session,
     identity_store_id: str,
     region: str,
-) -> List[Dict]:
+) -> list[dict[str, Any]]:
     """
     Get all SSO users for a given Identity Store
     """
@@ -140,17 +180,117 @@ def get_sso_users(
     for page in paginator.paginate(IdentityStoreId=identity_store_id):
         user_page = page.get("Users", [])
         for user in user_page:
-            if user.get("ExternalIds", None):
-                user["ExternalId"] = user.get("ExternalIds")[0].get("Id")
             users.append(user)
 
     return users
 
 
+@timeit
+@aws_handle_regions
+def get_sso_groups(
+    boto3_session: boto3.session.Session,
+    identity_store_id: str,
+    region: str,
+) -> list[dict[str, Any]]:
+    """
+    Get all SSO groups for a given Identity Store
+    """
+    client = boto3_session.client("identitystore", region_name=region)
+    groups: list[dict[str, Any]] = []
+
+    paginator = client.get_paginator("list_groups")
+    for page in paginator.paginate(IdentityStoreId=identity_store_id):
+        group_page = page.get("Groups", [])
+        for group in group_page:
+            groups.append(group)
+
+    return groups
+
+
+def transform_sso_users(
+    users: list[dict[str, Any]],
+    user_group_memberships: dict[str, list[str]] | None = None,
+    user_permissionsets: list[dict[str, Any]] | None = None,
+) -> list[dict[str, Any]]:
+    """
+    Transform SSO users to match the expected schema, optionally including group memberships
+    and permission set assignments.
+
+    Args:
+        users: List of SSO users from AWS API
+        user_group_memberships: Optional mapping of UserId -> [GroupIds]
+        user_permissionsets: Optional list of permission set assignments with shape:
+            [{UserId: str, PermissionSetArn: str, AccountId: str}, ...]
+
+    Returns:
+        Transformed users with MemberOfGroups and AssignedPermissionSets fields added
+    """
+    # Build mapping from UserId to list of PermissionSetArns
+    user_permission_sets: dict[str, list[str]] = {}
+    if user_permissionsets:
+        for assignment in user_permissionsets:
+            user_id = assignment["UserId"]
+            perm_set = assignment["PermissionSetArn"]
+            user_permission_sets.setdefault(user_id, []).append(perm_set)
+
+    # Transform users
+    transformed_users = []
+    for user in users:
+        if user.get("ExternalIds"):
+            user["ExternalId"] = user["ExternalIds"][0].get("Id")
+        # Add group memberships if provided
+        if user_group_memberships:
+            user["MemberOfGroups"] = user_group_memberships.get(user["UserId"], [])
+        # Add direct permission set assignments if available
+        if user_permission_sets:
+            user["AssignedPermissionSets"] = user_permission_sets.get(
+                user["UserId"], []
+            )
+        transformed_users.append(user)
+    return transformed_users
+
+
+def transform_sso_groups(
+    groups: list[dict[str, Any]],
+    group_role_assignments: list[dict[str, Any]] | None = None,
+) -> list[dict[str, Any]]:
+    """
+    Transform SSO groups to match the expected schema, optionally including permission set assignments.
+
+    Args:
+        groups: List of SSO groups from AWS API
+        group_role_assignments: Optional list of role assignments with shape:
+            [{GroupId: str, PermissionSetArn: str, AccountId: str}, ...]
+
+    Returns:
+        Transformed groups with AssignedPermissionSets field added
+    """
+    # Build mapping from GroupId to list of PermissionSetArns
+    group_permission_sets: dict[str, list[str]] = {}
+    if group_role_assignments:
+        for assignment in group_role_assignments:
+            group_id = assignment["GroupId"]
+            perm_set = assignment["PermissionSetArn"]
+            group_permission_sets.setdefault(group_id, []).append(perm_set)
+
+    # Transform groups
+    transformed_groups: list[dict[str, Any]] = []
+    for group in groups:
+        if group.get("ExternalIds"):
+            group["ExternalId"] = group["ExternalIds"][0].get("Id")
+        # Add permission set assignments if available
+        if group_permission_sets:
+            group["AssignedPermissionSets"] = group_permission_sets.get(
+                group["GroupId"], []
+            )
+        transformed_groups.append(group)
+    return transformed_groups
+
+
 @timeit
 def load_sso_users(
     neo4j_session: neo4j.Session,
-    users: List[Dict],
+    users: list[dict[str, Any]],
     identity_store_id: str,
     region: str,
     aws_account_id: str,
@@ -174,21 +314,49 @@ def load_sso_users(
     )
 
 
+@timeit
+def load_sso_groups(
+    neo4j_session: neo4j.Session,
+    groups: list[dict[str, Any]],
+    identity_store_id: str,
+    region: str,
+    aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    """
+    Load SSO groups into the graph
+    """
+    logger.info(
+        f"Loading {len(groups)} SSO groups for identity store {identity_store_id} in region {region}",
+    )
+
+    load(
+        neo4j_session,
+        AWSSSOGroupSchema(),
+        groups,
+        lastupdated=aws_update_tag,
+        IdentityStoreId=identity_store_id,
+        AWS_ID=aws_account_id,
+        Region=region,
+    )
+
+
 @timeit
 @aws_handle_regions
-def get_role_assignments(
+def get_user_permissionsets(
     boto3_session: boto3.session.Session,
-    users: List[Dict],
+    users: list[dict[str, Any]],
     instance_arn: str,
     region: str,
-) -> List[Dict]:
+) -> list[dict[str, Any]]:
     """
-    Get role assignments for SSO users
+    Get permissionsets for SSO users, taking into account which accounts the user is assigned to.
+    Although a permissionset can be assigned to multiple accounts, it is possible for the user
+    to be assigned to just a subset of those!
     """
-
-    logger.info(f"Getting role assignments for {len(users)} users")
+    logger.info(f"Getting permissionsets for {len(users)} users")
     client = boto3_session.client("sso-admin", region_name=region)
-    role_assignments = []
+    user_permissionsets = []
 
     for user in users:
         user_id = user["UserId"]
@@ -199,7 +367,7 @@ def get_role_assignments(
             PrincipalType="USER",
         ):
             for assignment in page.get("AccountAssignments", []):
-                role_assignments.append(
+                user_permissionsets.append(
                     {
                         "UserId": user_id,
                         "PermissionSetArn": assignment.get("PermissionSetArn"),
@@ -207,40 +375,198 @@ def get_role_assignments(
                     },
                 )
 
-    return role_assignments
+    return user_permissionsets
+
+
+@timeit
+@aws_handle_regions
+def get_group_permissionsets(
+    boto3_session: boto3.session.Session,
+    groups: list[dict[str, Any]],
+    instance_arn: str,
+    region: str,
+) -> list[dict[str, Any]]:
+    """
+    Get permissionsets for SSO groups, taking into account which accounts the group is assigned to.
+    """
+    logger.info(f"Getting permissionsets for {len(groups)} groups")
+    client = boto3_session.client("sso-admin", region_name=region)
+    group_permissionsets: list[dict[str, Any]] = []
+
+    for group in groups:
+        group_id = group["GroupId"]
+        paginator = client.get_paginator("list_account_assignments_for_principal")
+        for page in paginator.paginate(
+            InstanceArn=instance_arn,
+            PrincipalId=group_id,
+            PrincipalType="GROUP",
+        ):
+            for assignment in page.get("AccountAssignments", []):
+                group_permissionsets.append(
+                    {
+                        "GroupId": group_id,
+                        "PermissionSetArn": assignment.get("PermissionSetArn"),
+                        "AccountId": assignment.get("AccountId"),
+                    }
+                )
+
+    return group_permissionsets
+
+
+@timeit
+@aws_handle_regions
+def get_user_group_memberships(
+    boto3_session: boto3.session.Session,
+    identity_store_id: str,
+    groups: list[dict[str, Any]],
+    region: str,
+) -> dict[str, list[str]]:
+    """
+    Return a mapping of UserId -> [GroupIds] for all group memberships in the identity store.
+    """
+    client = boto3_session.client("identitystore", region_name=region)
+    user_groups: dict[str, list[str]] = {}
+
+    for group in groups:
+        group_id = group["GroupId"]
+        paginator = client.get_paginator("list_group_memberships")
+        for page in paginator.paginate(
+            IdentityStoreId=identity_store_id, GroupId=group_id
+        ):
+            for membership in page.get("GroupMemberships", []):
+                member = membership.get("MemberId", {})
+                user_id = member.get("UserId")
+                if user_id:
+                    user_groups.setdefault(user_id, []).append(group_id)
+
+    return user_groups
 
 
 @timeit
-def load_role_assignments(
+def _get_permset_roles(
     neo4j_session: neo4j.Session,
-    role_assignments: List[Dict],
-    aws_update_tag: int,
-) -> None:
+    permset_ids: list[str],
+) -> dict[tuple[str, str], str]:
+    """
+    Given a list of permission set ARNs, return a mapping of (permission set ARN, account ID) to role ARN
+    based on the ASSIGNED_TO_ROLE relationship in the graph.
     """
-    Load role assignments into the graph
-    """
-    logger.info(f"Loading {len(role_assignments)} role assignments")
-    if role_assignments:
-        neo4j_session.run(
-            """
-            UNWIND $role_assignments AS ra
-            MATCH (acc:AWSAccount{id:ra.AccountId}) -[:RESOURCE]->
-            (role:AWSRole)<-[:ASSIGNED_TO_ROLE]-
-            (permset:AWSPermissionSet {id: ra.PermissionSetArn})
-            MATCH (sso:AWSSSOUser {id: ra.UserId})
-            MERGE (role)-[r:ALLOWED_BY]->(sso)
-            SET r.lastupdated = $aws_update_tag,
-            r.permission_set_arn = ra.PermissionSetArn
-            """,
-            role_assignments=role_assignments,
-            aws_update_tag=aws_update_tag,
+    query = """
+    MATCH (role:AWSRole)<-[:ASSIGNED_TO_ROLE]-(permset:AWSPermissionSet)
+    MATCH (account:AWSAccount)-[:RESOURCE]->(role)
+    WHERE permset.arn IN $PermSetIds
+    RETURN permset.arn AS PermissionSetArn, role.arn AS RoleArn, account.id AS AccountId
+    """
+    permset_to_role = neo4j_session.execute_read(
+        read_list_of_dicts_tx,
+        query,
+        PermSetIds=permset_ids,
+    )
+    return {
+        (entry["PermissionSetArn"], entry["AccountId"]): entry["RoleArn"]
+        for entry in permset_to_role
+    }
+
+
+@timeit
+def get_principal_roles(
+    neo4j_session: neo4j.Session,
+    principal_assignments: list[dict[str, Any]],
+) -> list[dict[str, Any]]:
+    """
+    At this point we've established that the principal has access to a given account
+    via a given permission set, and now we need to find the exact role in the account
+    it has access to.
+    :param neo4j_session: neo4j.Session
+    :param principal_assignments: either a list of {
+                "UserId": str
+                "AccountId": str,
+                "PermissionSetArn": str,
+            }, or a list of {
+                "GroupId": str,
+                "AccountId": str,
+                "PermissionSetArn": str,
+            }
+    :return: either a list of {
+        "UserId": str,
+        "AccountId": str,
+        "PermissionSetArn": str,
+        "RoleArn": str
+    } or,
+    a list of  {
+        "GroupId": str,
+        "AccountId": str,
+        "PermissionSetArn": str,
+        "RoleArn": str
+    }
+    """
+    # Get unique permission set ARNs from role assignments
+    permset_ids = list({pa["PermissionSetArn"] for pa in principal_assignments})
+    permset_to_role = _get_permset_roles(neo4j_session, permset_ids)
+
+    unmatched = 0
+    # Use the lookup table to enrich assignments with exact role ARNs
+    principal_roles = []
+    for assignment in principal_assignments:
+        lookup_key = (assignment["PermissionSetArn"], assignment["AccountId"])
+        role_arn = permset_to_role.get(lookup_key)
+        if not role_arn:
+            unmatched += 1
+        principal_roles.append(
+            {
+                **assignment,
+                "RoleArn": role_arn,
+            }
         )
+    if unmatched > 0:
+        logger.info(
+            f"Identity Center: {unmatched} of {len(principal_assignments)} principal assignments "
+            "did not match a role. This usually means IAM roles for some permission sets/accounts "
+            "have not been ingested yet. Re-run the IAM sync, and then the Identity Center sync to fix."
+        )
+    return principal_roles
+
+
+@timeit
+def load_user_roles(
+    neo4j_session: neo4j.Session,
+    user_roles: list[dict[str, Any]],
+    aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    logger.info(f"Loading {len(user_roles)} user roles")
+    load_matchlinks(
+        neo4j_session,
+        AWSRoleToSSOUserMatchLink(),
+        user_roles,
+        lastupdated=aws_update_tag,
+        _sub_resource_label="AWSAccount",
+        _sub_resource_id=aws_account_id,
+    )
+
+
+@timeit
+def load_group_roles(
+    neo4j_session: neo4j.Session,
+    group_roles: list[dict[str, Any]],
+    aws_account_id: str,
+    aws_update_tag: int,
+) -> None:
+    logger.info(f"Loading {len(group_roles)} group roles")
+    load_matchlinks(
+        neo4j_session,
+        AWSRoleToSSOGroupMatchLink(),
+        group_roles,
+        lastupdated=aws_update_tag,
+        _sub_resource_label="AWSAccount",
+        _sub_resource_id=aws_account_id,
+    )
 
 
 @timeit
 def cleanup(
     neo4j_session: neo4j.Session,
-    common_job_parameters: Dict[str, Any],
+    common_job_parameters: dict[str, Any],
 ) -> None:
     GraphJob.from_node_schema(
         AWSIdentityCenterInstanceSchema(),
@@ -252,24 +578,249 @@ def cleanup(
     GraphJob.from_node_schema(AWSSSOUserSchema(), common_job_parameters).run(
         neo4j_session,
     )
-    run_cleanup_job(
-        "aws_import_identity_center_cleanup.json",
+    GraphJob.from_node_schema(AWSSSOGroupSchema(), common_job_parameters).run(
         neo4j_session,
-        common_job_parameters,
     )
 
+    # Clean up role assignment MatchLinks
+    GraphJob.from_matchlink(
+        AWSRoleToSSOUserMatchLink(),
+        "AWSAccount",
+        common_job_parameters["AWS_ID"],
+        common_job_parameters["UPDATE_TAG"],
+    ).run(neo4j_session)
+    GraphJob.from_matchlink(
+        AWSRoleToSSOGroupMatchLink(),
+        "AWSAccount",
+        common_job_parameters["AWS_ID"],
+        common_job_parameters["UPDATE_TAG"],
+    ).run(neo4j_session)
+
+
+def _sync_permission_sets(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    instance_arn: str,
+    region: str,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> bool:
+    """
+    Sync permission sets for an Identity Center instance.
+
+    Returns:
+        True if permission set sync is supported, False for account-scoped instances
+        that don't support permission sets.
+    """
+    try:
+        permission_sets = get_permission_sets(boto3_session, instance_arn, region)
+        # Transform permission sets to add RoleHint for fuzzy matching to IAM roles
+        permission_sets = transform_permission_sets(permission_sets, region)
+        load_permission_sets(
+            neo4j_session,
+            permission_sets,
+            instance_arn,
+            region,
+            current_aws_account_id,
+            update_tag,
+        )
+        return True
+    except botocore.exceptions.ClientError as error:
+        if _is_permission_set_sync_unsupported_error(error):
+            logger.warning(
+                "Skipping permission set sync for Identity Center instance %s in region %s "
+                "because the instance does not support permission sets. "
+                "Will attempt to sync users and groups only.",
+                instance_arn,
+                region,
+            )
+            return False
+        raise
+
+
+def _sync_groups_and_users(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    instance_arn: str,
+    identity_store_id: str,
+    region: str,
+    permission_set_sync_supported: bool,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]:
+    """
+    Sync groups and users for an Identity Center instance.
+
+    Groups are synced first so that user->group membership edges can be created.
+    Permission set assignments are fetched (if supported) and used to enrich
+    the user/group nodes with HAS_PERMISSION_SET relationships, then returned
+    for later role assignment creation.
+
+    Args:
+        permission_set_sync_supported: If True, fetches and enriches permission set assignments
+
+    Returns:
+        (user_permission_set_assignments, group_permission_set_assignments)
+        These are the raw assignment data needed for creating ALLOWED_BY relationships.
+        Will be empty lists if permission_set_sync_supported is False.
+    """
+    # Fetch groups first to avoid interleaving between groups and users
+    groups = get_sso_groups(boto3_session, identity_store_id, region)
+
+    # Get permission set assignments for groups (if permission sets are supported)
+    group_permissionsets_raw: list[dict[str, Any]] = []
+    if permission_set_sync_supported:
+        group_permissionsets_raw = get_group_permissionsets(
+            boto3_session,
+            groups,
+            instance_arn,
+            region,
+        )
+
+    # Transform and load groups with their permission set assignments FIRST
+    # so that user->group membership edges can attach in the same run.
+    transformed_groups = transform_sso_groups(groups, group_permissionsets_raw)
+    load_sso_groups(
+        neo4j_session,
+        transformed_groups,
+        identity_store_id,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+    # Handle users AFTER groups exist
+    users = get_sso_users(boto3_session, identity_store_id, region)
+    user_group_memberships = get_user_group_memberships(
+        boto3_session,
+        identity_store_id,
+        groups,
+        region,
+    )
+
+    # Get direct permission set assignments for users (if permission sets are supported)
+    user_permissionsets_raw: list[dict[str, Any]] = []
+    if permission_set_sync_supported:
+        user_permissionsets_raw = get_user_permissionsets(
+            boto3_session,
+            users,
+            instance_arn,
+            region,
+        )
+
+    # Transform and load users with their group memberships AFTER groups exist
+    transformed_users = transform_sso_users(
+        users,
+        user_group_memberships,
+        user_permissionsets_raw,
+    )
+    load_sso_users(
+        neo4j_session,
+        transformed_users,
+        identity_store_id,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+    # Return the raw assignment data for role assignment creation
+    return user_permissionsets_raw, group_permissionsets_raw
+
+
+def _sync_role_assignments(
+    neo4j_session: neo4j.Session,
+    user_permissionsets_raw: list[dict[str, Any]],
+    group_permissionsets_raw: list[dict[str, Any]],
+    current_aws_account_id: str,
+    update_tag: int,
+) -> None:
+    """
+    Create ALLOWED_BY relationships between IAM roles and SSO principals.
+
+    This enriches the raw permission set assignment data with exact role ARNs
+    from the graph (using the composite key lookup), then creates the MatchLink
+    relationships.
+
+    Note: This must be called AFTER groups and users are loaded so that the
+    MatchLinks can find the existing AWSSSOUser/AWSSSOGroup nodes when creating
+    the ALLOWED_BY edges.
+    """
+    user_roles = get_principal_roles(neo4j_session, user_permissionsets_raw)
+    load_user_roles(neo4j_session, user_roles, current_aws_account_id, update_tag)
+
+    group_roles = get_principal_roles(neo4j_session, group_permissionsets_raw)
+    load_group_roles(neo4j_session, group_roles, current_aws_account_id, update_tag)
+
+
+def _sync_instance(
+    neo4j_session: neo4j.Session,
+    boto3_session: boto3.session.Session,
+    instance: dict[str, Any],
+    region: str,
+    current_aws_account_id: str,
+    update_tag: int,
+) -> None:
+    """
+    Sync a single Identity Center instance.
+
+    This syncs permission sets (if supported), groups, users, and role assignments
+    in the correct order to ensure all relationships can be created.
+    """
+    instance_arn = instance["InstanceArn"]
+    identity_store_id = instance["IdentityStoreId"]
+
+    # Sync permission sets (may not be supported for account-scoped instances)
+    permission_set_sync_supported = _sync_permission_sets(
+        neo4j_session,
+        boto3_session,
+        instance_arn,
+        region,
+        current_aws_account_id,
+        update_tag,
+    )
+
+    # Sync groups and users (always happens, but enriched with permission sets if available)
+    user_assignments, group_assignments = _sync_groups_and_users(
+        neo4j_session,
+        boto3_session,
+        instance_arn,
+        identity_store_id,
+        region,
+        permission_set_sync_supported,
+        current_aws_account_id,
+        update_tag,
+    )
+
+    # Create role assignment relationships (only if permission sets are supported)
+    if permission_set_sync_supported:
+        _sync_role_assignments(
+            neo4j_session,
+            user_assignments,
+            group_assignments,
+            current_aws_account_id,
+            update_tag,
+        )
+
 
 @timeit
 def sync_identity_center_instances(
     neo4j_session: neo4j.Session,
     boto3_session: boto3.session.Session,
-    regions: List[str],
+    regions: list[str],
     current_aws_account_id: str,
     update_tag: int,
-    common_job_parameters: Dict,
+    common_job_parameters: dict[str, Any],
 ) -> None:
     """
-    Sync Identity Center instances, their permission sets, and SSO users
+    Sync Identity Center instances across all specified regions.
+
+    For each instance, syncs:
+    1. Permission sets (if supported by the instance type)
+    2. Groups and users (with permission set assignments if available)
+    3. Role assignment relationships (ALLOWED_BY edges from roles to principals)
+
+    Account-scoped Identity Center instances don't support permission sets and will
+    skip step 1 and 3, but still sync users and groups.
     """
     logger.info(f"Syncing Identity Center instances for regions {regions}")
     for region in regions:
@@ -283,42 +834,13 @@ def sync_identity_center_instances(
             update_tag,
         )
 
-        # For each instance, get and load its permission sets and SSO users
         for instance in instances:
-            instance_arn = instance["InstanceArn"]
-            identity_store_id = instance["IdentityStoreId"]
-
-            permission_sets = get_permission_sets(boto3_session, instance_arn, region)
-
-            load_permission_sets(
-                neo4j_session,
-                permission_sets,
-                instance_arn,
-                region,
-                current_aws_account_id,
-                update_tag,
-            )
-
-            users = get_sso_users(boto3_session, identity_store_id, region)
-            load_sso_users(
+            _sync_instance(
                 neo4j_session,
-                users,
-                identity_store_id,
-                region,
-                current_aws_account_id,
-                update_tag,
-            )
-
-            # Get and load role assignments
-            role_assignments = get_role_assignments(
                 boto3_session,
-                users,
-                instance_arn,
+                instance,
                 region,
-            )
-            load_role_assignments(
-                neo4j_session,
-                role_assignments,
+                current_aws_account_id,
                 update_tag,
             )