Does SST work with SSO users (I want to use Contro...
# sstk
Kujtim Hoxha
09/02/2021, 3:48 PMDoes SST work with SSO users (I want to use Control Tower and organisations )
a
Adrián Mouly
09/02/2021, 3:49 PMWhat is control tower?
Adrián Mouly
09/02/2021, 3:49 PMI’m using SSO, and SST works fine.
Adrián Mouly
09/02/2021, 3:50 PMWe provide the keys from AWS IAM.
k
Kujtim Hoxha
09/02/2021, 3:50 PMhttps://aws.amazon.com/controltower/?control-blogs.sort-by=item.additionalFields.createdDate&control-blogs.sort-order=desc
^ just an easier way to manage organisations
a
Adrián Mouly
09/02/2021, 3:52 PMOh nice.
Adrián Mouly
09/02/2021, 3:53 PMYeah we use this with SSO also, and SST works fine.
Adrián Mouly
09/02/2021, 3:53 PMI didn’t setup this, was other people.
Adrián Mouly
09/02/2021, 3:53 PMBut my team deployed SST over that.
k
Kujtim Hoxha
09/02/2021, 3:54 PMok sweet so probably we just setup
Copy code
aws configure ssoa
Adrián Mouly
09/02/2021, 3:54 PMSo SST is going to use the profile, is SSO using that?
k
Kujtim Hoxha
09/02/2021, 3:55 PMSo I never used SSO before and was wondering if it is somehow different, I think as you said it will be exactly the same
a
Adrián Mouly
09/02/2021, 3:56 PMYeah I think so, because this uses access key/secret.
k
Kujtim Hoxha
09/02/2021, 3:58 PMYeah I was wondering if we could use SST without key/secret but using SSO (this should be safer)
a
Adrián Mouly
09/02/2021, 3:58 PMYeah I see.
Adrián Mouly
09/02/2021, 3:59 PMThe team who gave me access, they create key/secret for each SSO user.
k
Kujtim Hoxha
09/02/2021, 3:59 PMYeah looking into that maybe it is fine to just use key/secret instead
a
Adrián Mouly
09/02/2021, 4:00 PMAlso those keys are really restricted, to do minimal things.
Adrián Mouly
09/02/2021, 4:00 PMAlso, other good practice is we have 1 account for each env.
Adrián Mouly
09/02/2021, 4:00 PMAnd then each dev deploys with their own stage, to account
developmentk
Kujtim Hoxha
09/02/2021, 4:00 PMYep that is what I am also thinking, if I create a Dev account it does not really matter how much access the devs have
a
Adrián Mouly
09/02/2021, 4:01 PMYeah.
Adrián Mouly
09/02/2021, 4:01 PMIn my case devs doesn’t have permissions to use IAM.
Adrián Mouly
09/02/2021, 4:01 PMBut they can create resources and such, that way we can create a multi-stage workflow.
k
Kujtim Hoxha
09/02/2021, 4:02 PMYep that makes sense
Kujtim Hoxha
09/02/2021, 4:04 PMThanks @Adrián Mouly
f
Frank
09/02/2021, 4:08 PM
Hey guys, wanted to chime in quickly. We have an open issue here https://github.com/serverless-stack/serverless-stack/issues/313
Frank
09/02/2021, 4:09 PM
I’m not too familiar with SSO, but the last time when I looked at it, it seems CDK hasn’t fully supported it yet.
k
Kujtim Hoxha
09/02/2021, 4:12 PM@Frank thanks, I am trying this maybe it works 😅 https://github.com/aws/aws-cdk/issues/5455#issuecomment-713643500
Kujtim Hoxha
09/02/2021, 4:30 PM^ this actually worked 🙌
f
Frank
09/02/2021, 8:53 PM
Oh nice! 👍