# SSO Admin

Source: /aws/services/sso-admin/

## Introduction

SSO Admin is a service provided by Amazon Web Services (AWS) that enables you to manage your AWS Single Sign-On (AWS SSO) resources.
It allows you to create, update, and delete AWS SSO resources such as directories, groups, and users.

LocalStack provides a mock implementation of the SSO Admin API that allows you to create and manage your AWS SSO resources.
The supported APIs are available on our [API Coverage section](#api-coverage), which provides information on the extent of SSO Admin's integration with LocalStack.

## Getting started

This guide is designed for users new to SSO Admin and assumes basic knowledge of the AWS CLI and our [`lstk aws`](/aws/developer-tools/running-localstack/lstk/cloud-and-iac-commands/#aws) command.

Start your LocalStack container using your preferred method.
We will demonstrate how to look up your SSO instance, create a permission set, add tags to a permission set, list permission sets, and assign a permission set to an account.

### List SSO instances

Every SSO Admin call needs an instance ARN, and account assignments also need the identity store that belongs to that instance.
LocalStack creates a matching instance and identity store at startup.
Look them up using the [`ListInstances`](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListInstances.html) API, the same way you would on AWS:

```bash
lstk aws sso-admin list-instances
```

```bash title="Output"
{
    "Instances": [
        {
            "CreatedDate": 1790689464.40134,
            "IdentityStoreId": "d-d26mgpezzt",
            "InstanceArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt",
            "OwnerAccountId": "000000000000",
            "Status": "ACTIVE"
        }
    ]
}
```

Copy the `InstanceArn` and `IdentityStoreId` values, you will need them in the following steps.

:::note
LocalStack generates these values for each container, so yours will differ from the output shown here.
Replace the instance ARN, identity store ID, and the other generated IDs in the following commands with the values from your own output.
:::

### Create a permission set

You can create a permission set using the [`CreatePermissionSet`](https://docs.aws.amazon.com/sso-admin/latest/APIReference/API_CreatePermissionSet.html) API.

```bash
lstk aws sso-admin create-permission-set \
    --name my-permission-set \
    --description "My permission set" \
    --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt \
    --tags Key=Name,Value=my-permission-set
```

```bash title="Output"
{
    "PermissionSet": {
        "CreatedDate": 1790689470.076944,
        "Description": "My permission set",
        "Name": "my-permission-set",
        "PermissionSetArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx",
        "SessionDuration": 3600
    }
}
```

Copy the `PermissionSetArn` value, you will need it in the following steps.

### List permission sets

You can list permission sets using the [`ListPermissionSets`](https://docs.aws.amazon.com/sso-admin/latest/APIReference/API_ListPermissionSets.html) API.

```bash
lstk aws sso-admin list-permission-sets --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt
```

```bash title="Output"
{
    "PermissionSets": [
        "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx"
    ]
}
```

### List tags for a permission set

You can list tags for a permission set using the [`ListTagsForResource`](https://docs.aws.amazon.com/sso-admin/latest/APIReference/API_ListTagsForResource.html) API.

```bash
lstk aws sso-admin list-tags-for-resource --resource-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt
```

```bash title="Output"
{
    "Tags": [
        {
            "Key": "Name",
            "Value": "my-permission-set"
        }
    ]
}
```

### Create a group in Identity Store

Account assignments grant a principal, a user or group, access to an AWS account through a permission set.
Create a group to use as the principal with the [Identity Store](/aws/services/identitystore/) [`CreateGroup`](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_CreateGroup.html) API:

```bash
lstk aws identitystore create-group --identity-store-id d-d26mgpezzt
```

```bash title="Output"
{
    "GroupId": "78ba7235-f7f6-4c3b-bd77-7582b98756e9",
    "IdentityStoreId": "d-d26mgpezzt"
}
```

Copy the `GroupId` value, you will need it in the next step.

### Create an account assignment

You can assign a permission set to a principal for a specific AWS account using the [`CreateAccountAssignment`](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_CreateAccountAssignment.html) API.

```bash
lstk aws sso-admin create-account-assignment \
    --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt \
    --target-id 000000000000 \
    --target-type AWS_ACCOUNT \
    --permission-set-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx \
    --principal-type GROUP \
    --principal-id 78ba7235-f7f6-4c3b-bd77-7582b98756e9
```

```bash title="Output"
{
    "AccountAssignmentCreationStatus": {
        "CreatedDate": 1790689494.586188,
        "PermissionSetArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx",
        "PrincipalId": "78ba7235-f7f6-4c3b-bd77-7582b98756e9",
        "PrincipalType": "GROUP",
        "RequestId": "41d2b347-539c-44b4-9898-b10e0c12c2f2",
        "Status": "SUCCEEDED",
        "TargetId": "000000000000",
        "TargetType": "AWS_ACCOUNT"
    }
}
```

`TargetId` is the AWS account to grant access to, `000000000000` is LocalStack's default account.

### List account assignments

You can list the account assignments for a permission set using the [`ListAccountAssignments`](https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignments.html) API.

```bash
lstk aws sso-admin list-account-assignments \
    --instance-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt \
    --account-id 000000000000 \
    --permission-set-arn arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx
```

```bash title="Output"
{
    "AccountAssignments": [
        {
            "AccountId": "000000000000",
            "PermissionSetArn": "arn:aws:sso:::instance/ssoins-todqd0e816rij0jt/ps-z8z9arrlhosgsmlx",
            "PrincipalId": "78ba7235-f7f6-4c3b-bd77-7582b98756e9",
            "PrincipalType": "GROUP"
        }
    ]
}
```

## API Coverage


### IAM Identity Center (successor to Single Sign-On) API coverage

Source service: `sso-admin`. 26 of 79 tracked operations are implemented.

Service documentation: /aws/services/sso-admin/
License availability: available starting with the Ultimate plan. See /aws/licensing/ for current plan details.

| Operation | Status |
| --- | --- |
| AddRegion | Not implemented |
| AttachCustomerManagedPolicyReferenceToPermissionSet | Implemented |
| AttachManagedPolicyToPermissionSet | Implemented |
| CreateAccountAssignment | Implemented |
| CreateApplication | Not implemented |
| CreateApplicationAssignment | Not implemented |
| CreateInstance | Not implemented |
| CreateInstanceAccessControlAttributeConfiguration | Not implemented |
| CreatePermissionSet | Implemented |
| CreateTrustedTokenIssuer | Not implemented |
| DeleteAccountAssignment | Implemented |
| DeleteApplication | Not implemented |
| DeleteApplicationAccessScope | Not implemented |
| DeleteApplicationAssignment | Not implemented |
| DeleteApplicationAuthenticationMethod | Not implemented |
| DeleteApplicationGrant | Not implemented |
| DeleteInlinePolicyFromPermissionSet | Implemented |
| DeleteInstance | Not implemented |
| DeleteInstanceAccessControlAttributeConfiguration | Not implemented |
| DeletePermissionSet | Implemented |
| DeletePermissionsBoundaryFromPermissionSet | Not implemented |
| DeleteTrustedTokenIssuer | Not implemented |
| DescribeAccountAssignmentCreationStatus | Implemented |
| DescribeAccountAssignmentDeletionStatus | Implemented |
| DescribeApplication | Not implemented |
| DescribeApplicationAssignment | Not implemented |
| DescribeApplicationProvider | Not implemented |
| DescribeInstance | Not implemented |
| DescribeInstanceAccessControlAttributeConfiguration | Not implemented |
| DescribePermissionSet | Implemented |
| DescribePermissionSetProvisioningStatus | Not implemented |
| DescribeRegion | Not implemented |
| DescribeTrustedTokenIssuer | Not implemented |
| DetachCustomerManagedPolicyReferenceFromPermissionSet | Implemented |
| DetachManagedPolicyFromPermissionSet | Implemented |
| GetApplicationAccessScope | Not implemented |
| GetApplicationAssignmentConfiguration | Not implemented |
| GetApplicationAuthenticationMethod | Not implemented |
| GetApplicationGrant | Not implemented |
| GetApplicationSessionConfiguration | Not implemented |
| GetInlinePolicyForPermissionSet | Implemented |
| GetPermissionsBoundaryForPermissionSet | Not implemented |
| ListAccountAssignmentCreationStatus | Not implemented |
| ListAccountAssignmentDeletionStatus | Not implemented |
| ListAccountAssignments | Implemented |
| ListAccountAssignmentsForPrincipal | Implemented |
| ListAccountsForProvisionedPermissionSet | Implemented |
| ListApplicationAccessScopes | Not implemented |
| ListApplicationAssignments | Not implemented |
| ListApplicationAssignmentsForPrincipal | Not implemented |
| ListApplicationAuthenticationMethods | Not implemented |
| ListApplicationGrants | Not implemented |
| ListApplicationProviders | Not implemented |
| ListApplications | Not implemented |
| ListCustomerManagedPolicyReferencesInPermissionSet | Implemented |
| ListInstances | Implemented |
| ListManagedPoliciesInPermissionSet | Implemented |
| ListPermissionSetProvisioningStatus | Not implemented |
| ListPermissionSets | Implemented |
| ListPermissionSetsProvisionedToAccount | Implemented |
| ListRegions | Not implemented |
| ListTagsForResource | Implemented |
| ListTrustedTokenIssuers | Not implemented |
| ProvisionPermissionSet | Implemented |
| PutApplicationAccessScope | Not implemented |
| PutApplicationAssignmentConfiguration | Not implemented |
| PutApplicationAuthenticationMethod | Not implemented |
| PutApplicationGrant | Not implemented |
| PutApplicationSessionConfiguration | Not implemented |
| PutInlinePolicyToPermissionSet | Implemented |
| PutPermissionsBoundaryToPermissionSet | Not implemented |
| RemoveRegion | Not implemented |
| TagResource | Not implemented |
| UntagResource | Not implemented |
| UpdateApplication | Not implemented |
| UpdateInstance | Implemented |
| UpdateInstanceAccessControlAttributeConfiguration | Not implemented |
| UpdatePermissionSet | Implemented |
| UpdateTrustedTokenIssuer | Not implemented |