identity.yaml

# Identity Layer Workflows
#
# These workflows are used for the quickstart setup of the identity layer.
# They automate the deployment of IAM Identity Center (AWS SSO), GitHub OIDC
# providers, and IAM roles for Terraform execution across all accounts.
#
# Documentation: https://docs.cloudposse.com/layers/identity/
#
# For Google Workspace IdP setup, see AWS documentation:
#   - Enable IAM Identity Center: https://docs.aws.amazon.com/singlesignon/latest/userguide/gs-gwp.html#gs-gwp-step1
#   - Configure Google Workspace: https://docs.aws.amazon.com/singlesignon/latest/userguide/gs-gwp.html#gs-gwp-step3
#
# Usage:
#   atmos workflow all -f quickstart/foundation/identity
#   atmos workflow deploy/sso -f quickstart/foundation/identity
#   atmos workflow deploy/github-oidc-provider -f quickstart/foundation/identity
#
# Available workflows:
#   - all: Deploy complete identity layer
#   - vendor: Pull required components
#   - deploy/all: Deploy all identity components
#   - deploy/sso: Configure IAM Identity Center
#   - deploy/iam-role: Deploy Terraform execution roles
#   - deploy/github-oidc-provider: Deploy GitHub OIDC Provider to all accounts
#
workflows:
  check-setup:
    description: Verify that the environment is setup correctly to run these workflows.
    steps:
    - name: check-setup
      type: shell
      command : |-
        if [[ "$GEODESIC_SHELL" != "true" ]]; then
          echo "This workflow must be run from a Geodesic shell." >&2
          exit 1
        elif [[ -z $ATMOS_BASE_PATH ]] || [[ ! -d "$ATMOS_BASE_PATH/.git" ]]; then
          echo "ATMOS_BASE_PATH must be set to the root of the git repository." >&2
          echo "This is usually set automatically by Geodesic." >&2
          echo "To fix: run the Geodesic shell from the root of the git repository." >&2
          echo "  ATMOS_BASE_PATH: \"$ATMOS_BASE_PATH\"" >&2
          echo "  Current directory: \"$(pwd -P)\"" >&2
          exit 1
        elif [[ ! -d "$ATMOS_BASE_PATH/rootfs/usr/local/bin" ]]; then
          printf "No such directory: %s\n" "$ATMOS_BASE_PATH/rootfs/usr/local/bin" >&2
          exit 2
        fi

  all:
    description: Run all workflows
    steps:
      - command: workflow check-setup -f quickstart/foundation/identity
      - command: workflow vendor -f quickstart/foundation/identity
      - command: workflow deploy/all -f quickstart/foundation/identity

  vendor:
    description: Vendor identity layer components.
    steps:
      - command: vendor pull --component aws-sso
      - command: vendor pull --component iam-role
      - command: vendor pull --component github-oidc-provider

  deploy/all:
    description: Deploy all identity components.
    steps:
      - command: workflow deploy/sso -f quickstart/foundation/identity
      - command: workflow deploy/iam-role -f quickstart/foundation/identity
      - command: workflow deploy/github-oidc-provider -f quickstart/foundation/identity

  deploy/sso:
    description: Update aws-sso configuration.
    steps:
      - command: terraform deploy aws-sso -s core-gbl-root

  deploy/iam-role:
    description: |
      Deploy iam-role/terraform and iam-role/planner roles.
      These roles are used by GitHub Actions for CI/CD.
    steps:
      # Only deploy the planner role in the root account
      - command: terraform deploy iam-role/planner -s core-gbl-root
      # Core accounts
      - command: terraform deploy iam-role/terraform -s core-gbl-artifacts
      - command: terraform deploy iam-role/planner -s core-gbl-artifacts
      - command: terraform deploy iam-role/terraform -s core-gbl-audit
      - command: terraform deploy iam-role/planner -s core-gbl-audit
      - command: terraform deploy iam-role/terraform -s core-gbl-auto
      - command: terraform deploy iam-role/planner -s core-gbl-auto
      - command: terraform deploy iam-role/terraform -s core-gbl-dns
      - command: terraform deploy iam-role/planner -s core-gbl-dns
      - command: terraform deploy iam-role/terraform -s core-gbl-network
      - command: terraform deploy iam-role/planner -s core-gbl-network
      - command: terraform deploy iam-role/terraform -s core-gbl-security
      - command: terraform deploy iam-role/planner -s core-gbl-security
      # Platform accounts
      - command: terraform deploy iam-role/terraform -s plat-gbl-dev
      - command: terraform deploy iam-role/planner -s plat-gbl-dev
      - command: terraform deploy iam-role/terraform -s plat-gbl-staging
      - command: terraform deploy iam-role/planner -s plat-gbl-staging
      - command: terraform deploy iam-role/terraform -s plat-gbl-prod
      - command: terraform deploy iam-role/planner -s plat-gbl-prod
      - command: terraform deploy iam-role/terraform -s plat-gbl-sandbox
      - command: terraform deploy iam-role/planner -s plat-gbl-sandbox

  deploy/github-oidc-provider:
    description: |
      Deploy GitHub OIDC Provider to all accounts.
      This enables GitHub Actions to authenticate to AWS using OIDC.
    steps:
      # Core accounts
      - command: terraform deploy github-oidc-provider -s core-gbl-root
      - command: terraform deploy github-oidc-provider -s core-gbl-artifacts
      - command: terraform deploy github-oidc-provider -s core-gbl-audit
      - command: terraform deploy github-oidc-provider -s core-gbl-auto
      - command: terraform deploy github-oidc-provider -s core-gbl-dns
      - command: terraform deploy github-oidc-provider -s core-gbl-network
      - command: terraform deploy github-oidc-provider -s core-gbl-security
      # Platform accounts
      - command: terraform deploy github-oidc-provider -s plat-gbl-dev
      - command: terraform deploy github-oidc-provider -s plat-gbl-staging
      - command: terraform deploy github-oidc-provider -s plat-gbl-prod
      - command: terraform deploy github-oidc-provider -s plat-gbl-sandbox