PowerShell で IAM Identity Center の権限セットとAWSアカウントの対応表を作りたい

生成AIが吐いた結果を整理しただけ。

# アカウントの情報
$accounts = @{}
Get-ORGAccountList | foreach-object { $accounts.add($_.id], $_) }

# Identity Center インスタンスの情報
$instances = @{}
Get-SSOADMNInstanceList | foreach-object { $instances.add($_.instanceArn, $_) }

# グループの情報
$groups = @{}
$instances.values | foreach-object {
    $Id = $_.IdentityStoreId
    Find-IDSGroupList -IdentityStoreId $Id | foreach-object { $groups.add($_.groupid, $_) }
}

# ユーザーの情報
$users = @{}
$instances.values | foreach-object {
    $Id = $_.IdentityStoreId
    Find-IDSUserList -IdentityStoreId $Id | foreach-object { $users.add($_.userid, $_) }
}

# 権限セットの情報
$permissionSets = @{}
$instances.values | foreach-object {
    $Arn = $_.instanceArn
    Get-SSOADMNPermissionSetList -InstanceArn $Arn | foreach-object {
        Get-SSOADMNPermissionSet -InstanceArn $Arn -PermissionSetArn $_ | foreach-object {
            $permissionsets.add($_.PermissionSetArn, $_)
        }
    }
}

# アカウントと権限セットのアサイン情報
$assignments = $instances.values | foreach-object {
    $arn = $_.instanceArn
    $permissionsets.values | foreach-object {
        $pmset = $_
        $accounts.values | foreach-object {
            Get-SSOADMNAccountAssignmentList `
                -AccountId $_.Id `
                -InstanceArn $Arn `
                -PermissionSetArn $pmset.permissionSetArn
        }
    }
}


# 列名の定義
$AccountName = @{
    Name = "AccountName"
    Expression = {
        $Accounts[$_.AccountId].Name
    }
}
$PermissionSetName = @{
    Name = "PermissionSetName"
    Expression = {
        $PermissionSets[$_.PermissionsetArn].Name
    }
}
$PrincipalName = @{
    Name = "PrincipalName"
    Expression = {
        $assignment = $_
        switch($assignment.PrincipalType){
            "GROUP" {
                $groups[$assignment.principalid].DisplayName
            }
            "USER" {
                $users[$assignment.principalId].DisplayName
            }
        }
    }
}

# 対応表
$Assignments | Select-Object principaltype,$PrincipalName,$permissionsetname, $accountname

結果

PrincipalType PrincipalName PermissionSetName   AccountName
------------- ------------- -----------------   -----------
GROUP         AdminGroup    AdministratorAccess AccountA
GROUP         AdminGroup    AdministratorAccess AccountB
GROUP         AdminGroup    AdministratorAccess AccountC
GROUP         AdminGroup2   AdministratorAccess AccountC
...

権限セットにアタッチされているポリシーを確認する

$instanceArn = $instances.values | select -first 1 -expand instanceArn

$permissionsets.values | foreach-object {
    $pmsetArn = $_.permissionsetArn

    # AWSマネージドポリシー
    $AWSManagedPolicies = Get-SSOADMNManagedPoliciesInPermissionSetList `
        -instanceArn $instanceArn `
        -PermissionSetArn $pmsetArn

    # カスタマーマネージドポリシー
    $CustomerManagedPolicies = Get-SSOADMNCustomerManagedPolicyReferencesInPermissionSetList `
        -instanceArn $instanceArn `
        -PermissionSetArn $pmsetArn

    # インラインポリシー
    $InlinePolicies = Get-SSOADMNInlinePolicyForPermissionSet `
        -instanceArn $instanceArn `
        -PermissionSetArn $pmsetArn

    [PSCustomObject]@{
        PermissionSetName = $_.Name
        AWSManagedPolicies = $AWSManagedPolicies
        CustomerManagedPolicies = $CustomerManagedPolicies
        InlinePolicies = $InlinePolicies
    }
}

グループに権限セットを割り当てる。

New-SSOADMNAccountAssignment `
    -InstanceArn $InstanceArn `
    -PermissionSetArn $PmSetArn `
    -PrincipalType "GROUP" `
    -PrincipalId $GroupId `
    -TargetId $AccountId `
    -TargetType "AWS_ACCOUNT"

グループのメンバーを一覧する。

$groups.values `
    | Foreach-Object {
        Get-IDSGroupMembershipList -IdentityStoreId $_.identitystoreid -GroupId $_.groupid
    } `
    | Foreach-Object {
        $membership = $_
        [pscustomobject]@{
            IdentityStoreId  = $membership.IdentityStoreId
            GroupName        = $groups[$membership.groupid].DisplayName
            GroupDescription = $groups[$membership.groupid].Description
            UserName         = $users[$membership.MemberId.UserId].UserName
            DisplayName      = $users[$membership.MemberId.UserId].DisplayName
        }
    }

AWS CloudFormation のテンプレートにまとまっていれば良かったのに