Q4 — --group-match filter and Control Tower group safety

[ChrisPates]

We plan to use an aws-* prefix on all Google Groups we want synced, and set --group-match accordingly. If ssosync only matches Google Groups with that prefix, will it completely ignore AWS Identity Center groups that don't match the filter (e.g. Control Tower groups like AWSControlTowerAdmins)? Or does ssosync still evaluate and potentially delete unmatched AWS groups?

[ChrisPates]

In a uni-directional sync, the target system is made to match the source. There anything that exists in IAM Identity Store that doesn't exist in (the selected scope) Google Workspace Directory, they will be removed.

This how uni-directional replication is supposed to work.

Also, the best practice for AWS Control Tower is to disabled the IAM Identity Center integration when an external identity provider is being used. The reason being is in Identity Management one source should be authoritative.

[ChrisPates]

There is a PFR to implement configurable behavior for the treatment of unmatched user/groups but that has yet to be progressed, principally because of being an anti-pattern to the best practice.

[ChrisPates]

As of v2.8.0, there is an option to retain unmatched users and groups.

[ChrisPates]

Also worth noting that since you are migrating from Okta, and the preferred pattern for group syncing is by prefix/suffix, ssosync supports this as you describe but not the syntax of the query (this is the directory query syntax of the Google Workspace Directory). name:aws-*

However, other query patterns are supported that allow you to name your groups however you like.

• Create a group:

  • name = Any group with this as a member will be synced to IAM Identity Center
  • Description = Any group with this as a member will be synced to IAM Identity Center
  • email = aws-ssosync@domain

• Now add this group as a member of any group you want to sync to IAM Identity Store

• Set the --group-match to memberkey=aws-ssosync@domain