SSO Admin

Introduction

SSO Admin is a service provided by Amazon Web Services (AWS) that enables you to manage your AWS Single Sign-On (AWS SSO) resources. It allows you to create, update, and delete AWS SSO resources such as directories, groups, and users.

LocalStack provides a mock implementation of the SSO Admin API that allows you to create and manage your AWS SSO resources. The supported APIs are available on our API Coverage section, which provides information on the extent of SSO Admin’s integration with LocalStack.

Getting started

This guide is designed for users new to SSO Admin and assumes basic knowledge of the AWS CLI and our lstk aws command.

Start your LocalStack container using your preferred method. We will demonstrate how to look up your SSO instance, create a permission set, add tags to a permission set, list permission sets, and assign a permission set to an account.

List SSO instances

Every SSO Admin call needs an instance ARN, and account assignments also need the identity store that belongs to that instance. LocalStack creates a matching instance and identity store at startup. Look them up using the ListInstances API, the same way you would on AWS:

lstk aws sso-admin list-instances

Output

{
    "Instances": [
        {
            "CreatedDate": 1790689464.40134,
            "IdentityStoreId": "d-d26mgpezzt",
            "InstanceArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt",
            "OwnerAccountId": "000000000000",
            "Status": "ACTIVE"
        }
    ]
}

Copy the InstanceArn and IdentityStoreId values, you will need them in the following steps.

Note

LocalStack generates these values for each container, so yours will differ from the output shown here. Replace the instance ARN, identity store ID, and the other generated IDs in the following commands with the values from your own output.

Create a permission set

You can create a permission set using the CreatePermissionSet API.

lstk aws sso-admin create-permission-set \
    --name my-permission-set \
    --description "My permission set" \
    --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt \
    --tags Key=Name,Value=my-permission-set

Output

{
    "PermissionSet": {
        "CreatedDate": 1790689470.076944,
        "Description": "My permission set",
        "Name": "my-permission-set",
        "PermissionSetArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx",
        "SessionDuration": 3600
    }
}

Copy the PermissionSetArn value, you will need it in the following steps.

List permission sets

You can list permission sets using the ListPermissionSets API.

lstk aws sso-admin list-permission-sets --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt

Output

{
    "PermissionSets": [
        "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx"
    ]
}

List tags for a permission set

You can list tags for a permission set using the ListTagsForResource API.

lstk aws sso-admin list-tags-for-resource --resource-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt

Output

{
    "Tags": [
        {
            "Key": "Name",
            "Value": "my-permission-set"
        }
    ]
}

Create a group in Identity Store

Account assignments grant a principal, a user or group, access to an AWS account through a permission set. Create a group to use as the principal with the Identity Store CreateGroup API:

lstk aws identitystore create-group --identity-store-id d-d26mgpezzt

Output

{
    "GroupId": "78ba7235-f7f6-4c3b-bd77-7582b98756e9",
    "IdentityStoreId": "d-d26mgpezzt"
}

Copy the GroupId value, you will need it in the next step.

Create an account assignment

You can assign a permission set to a principal for a specific AWS account using the CreateAccountAssignment API.

lstk aws sso-admin create-account-assignment \
    --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt \
    --target-id 000000000000 \
    --target-type AWS_ACCOUNT \
    --permission-set-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx \
    --principal-type GROUP \
    --principal-id 78ba7235-f7f6-4c3b-bd77-7582b98756e9

Output

{
    "AccountAssignmentCreationStatus": {
        "CreatedDate": 1790689494.586188,
        "PermissionSetArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx",
        "PrincipalId": "78ba7235-f7f6-4c3b-bd77-7582b98756e9",
        "PrincipalType": "GROUP",
        "RequestId": "41d2b347-539c-44b4-9898-b10e0c12c2f2",
        "Status": "SUCCEEDED",
        "TargetId": "000000000000",
        "TargetType": "AWS_ACCOUNT"
    }
}

TargetId is the AWS account to grant access to, 000000000000 is LocalStack’s default account.

List account assignments

You can list the account assignments for a permission set using the ListAccountAssignments API.

lstk aws sso-admin list-account-assignments \
    --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt \
    --account-id 000000000000 \
    --permission-set-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx

Output

{
    "AccountAssignments": [
        {
            "AccountId": "000000000000",
            "PermissionSetArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx",
            "PrincipalId": "78ba7235-f7f6-4c3b-bd77-7582b98756e9",
            "PrincipalType": "GROUP"
        }
    ]
}

API Coverage

26 of 79 operations implemented

Available from the Ultimate plan. Licensing details

Formats for tools and AIPage MarkdownCoverage MarkdownCoverage JSONCoverage catalog

Find an API

Search the full operation list, then sort the table to compare current support.

Loading operations…

Search by operation name

Operation ▲	Implemented ▼	Verified on Kubernetes
Loading operations…

PreviousNext

Complete static API list All 79 operations and their current support status

Operation	Status
AddRegion	Not implemented
AttachCustomerManagedPolicyReferenceToPermissionSet	Implemented
AttachManagedPolicyToPermissionSet	Implemented
CreateAccountAssignment	Implemented
CreateApplication	Not implemented
CreateApplicationAssignment	Not implemented
CreateInstance	Not implemented
CreateInstanceAccessControlAttributeConfiguration	Not implemented
CreatePermissionSet	Implemented
CreateTrustedTokenIssuer	Not implemented
DeleteAccountAssignment	Implemented
DeleteApplication	Not implemented
DeleteApplicationAccessScope	Not implemented
DeleteApplicationAssignment	Not implemented
DeleteApplicationAuthenticationMethod	Not implemented
DeleteApplicationGrant	Not implemented
DeleteInlinePolicyFromPermissionSet	Implemented
DeleteInstance	Not implemented
DeleteInstanceAccessControlAttributeConfiguration	Not implemented
DeletePermissionSet	Implemented
DeletePermissionsBoundaryFromPermissionSet	Not implemented
DeleteTrustedTokenIssuer	Not implemented
DescribeAccountAssignmentCreationStatus	Implemented
DescribeAccountAssignmentDeletionStatus	Implemented
DescribeApplication	Not implemented
DescribeApplicationAssignment	Not implemented
DescribeApplicationProvider	Not implemented
DescribeInstance	Not implemented
DescribeInstanceAccessControlAttributeConfiguration	Not implemented
DescribePermissionSet	Implemented
DescribePermissionSetProvisioningStatus	Not implemented
DescribeRegion	Not implemented
DescribeTrustedTokenIssuer	Not implemented
DetachCustomerManagedPolicyReferenceFromPermissionSet	Implemented
DetachManagedPolicyFromPermissionSet	Implemented
GetApplicationAccessScope	Not implemented
GetApplicationAssignmentConfiguration	Not implemented
GetApplicationAuthenticationMethod	Not implemented
GetApplicationGrant	Not implemented
GetApplicationSessionConfiguration	Not implemented
GetInlinePolicyForPermissionSet	Implemented
GetPermissionsBoundaryForPermissionSet	Not implemented
ListAccountAssignmentCreationStatus	Not implemented
ListAccountAssignmentDeletionStatus	Not implemented
ListAccountAssignments	Implemented
ListAccountAssignmentsForPrincipal	Implemented
ListAccountsForProvisionedPermissionSet	Implemented
ListApplicationAccessScopes	Not implemented
ListApplicationAssignments	Not implemented
ListApplicationAssignmentsForPrincipal	Not implemented
ListApplicationAuthenticationMethods	Not implemented
ListApplicationGrants	Not implemented
ListApplicationProviders	Not implemented
ListApplications	Not implemented
ListCustomerManagedPolicyReferencesInPermissionSet	Implemented
ListInstances	Implemented
ListManagedPoliciesInPermissionSet	Implemented
ListPermissionSetProvisioningStatus	Not implemented
ListPermissionSets	Implemented
ListPermissionSetsProvisionedToAccount	Implemented
ListRegions	Not implemented
ListTagsForResource	Implemented
ListTrustedTokenIssuers	Not implemented
ProvisionPermissionSet	Implemented
PutApplicationAccessScope	Not implemented
PutApplicationAssignmentConfiguration	Not implemented
PutApplicationAuthenticationMethod	Not implemented
PutApplicationGrant	Not implemented
PutApplicationSessionConfiguration	Not implemented
PutInlinePolicyToPermissionSet	Implemented
PutPermissionsBoundaryToPermissionSet	Not implemented
RemoveRegion	Not implemented
TagResource	Not implemented
UntagResource	Not implemented
UpdateApplication	Not implemented
UpdateInstance	Implemented
UpdateInstanceAccessControlAttributeConfiguration	Not implemented
UpdatePermissionSet	Implemented
UpdateTrustedTokenIssuer	Not implemented