Add user attributes mapper (#178)

README.md

@@ -128,6 +128,18 @@ Additionally, authenticate your AWS credentials. Follow this  [section](https://
 
 To obtain your `Identity store ID`, go to the AWS Identity Center console and select settings. Under the `Identity Source` section, copy the `Identity store ID`.
 
+You can customize how Google user's attributes are mapped to AWS users by providing the name of an AWS Parameter containing a custom JSON template;
+the engine that parses the template supports GoTemplate sintax with:
+
+- [sprig](https://github.com/Masterminds/sprig) functions
+- custom template functions:
+
+  - `listFindFirst $list $dictConditions`
+
+    returns the first element of the list matching the given conditions:
+
+    For example `listFindFirst $list (dict "primary" true)` returns the first element of the list whose `primary` value is `true`.
+
 ## Local Usage
 
 ```bash
@@ -149,23 +161,24 @@ Usage:
   ssosync [flags]
 
 Flags:
-  -t, --access-token string         AWS SSO SCIM API Access Token
-  -d, --debug                       enable verbose / debug logging
-  -e, --endpoint string             AWS SSO SCIM API Endpoint
-  -u, --google-admin string         Google Workspace admin user email
-  -c, --google-credentials string   path to Google Workspace credentials file (default "credentials.json")
-  -g, --group-match string          Google Workspace Groups filter query parameter, a simple '*' denotes sync all groups (and any users that are members of those groups). example: 'name:Admin*,email:aws-*', 'name=Admins' or '*' see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups, if left empty no groups will be selected.
-  -h, --help                        help for ssosync
-      --ignore-groups strings       ignores these Google Workspace groups
-      --ignore-users strings        ignores these Google Workspace users
-      --include-groups strings      include only these Google Workspace groups, NOTE: only works when --sync-method 'users_groups'
-      --log-format string           log format (default "text")
-      --log-level string            log level (default "info")
-  -s, --sync-method string          Sync method to use (users_groups|groups) (default "groups")
-  -m, --user-match string           Google Workspace Users filter query parameter, a simple '*' denotes sync all users in the directory. example: 'name:John*,email:admin*', '*' or name=John Doe,email:admin*' see: https://developers.google.com/admin-sdk/directory/v1/guides/search-users, if left empty no users will be selected but if a pattern has been set for GroupMatch users that are members of the groups it matches will still be selected
-  -v, --version                     version for ssosync
-  -r, --region                      AWS region where identity store exists
-  -i, --identity-store-id           AWS Identity Store ID
+  -t, --access-token string            AWS SSO SCIM API Access Token
+  -d, --debug                          enable verbose / debug logging
+  -e, --endpoint string                AWS SSO SCIM API Endpoint
+  -u, --google-admin string            Google Workspace admin user email
+  -c, --google-credentials string      path to Google Workspace credentials file (default "credentials.json")
+  -g, --group-match string             Google Workspace Groups filter query parameter, a simple '*' denotes sync all groups (and any users that are members of those groups). example: 'name:Admin*,email:aws-*', 'name=Admins' or '*' see: https://developers.google.com/admin-sdk/directory/v1/guides/search-groups, if left empty no groups will be selected.
+  -h, --help                           help for ssosync
+      --ignore-groups strings          ignores these Google Workspace groups
+      --ignore-users strings           ignores these Google Workspace users
+      --include-groups strings         include only these Google Workspace groups, NOTE: only works when --sync-method 'users_groups'
+      --log-format string              log format (default "text")
+      --log-level string               log level (default "info")
+  -s, --sync-method string             Sync method to use (users_groups|groups) (default "groups")
+      --user-mapping-template string   Template for mapping users from Google Workspace to AWS
+  -m, --user-match string              Google Workspace Users filter query parameter, a simple '*' denotes sync all users in the directory. example: 'name:John*,email:admin*', '*' or name=John Doe,email:admin*' see: https://developers.google.com/admin-sdk/directory/v1/guides/search-users, if left empty no users will be selected but if a pattern has been set for GroupMatch users that are members of the groups it matches will still be selected
+  -v, --version                        version for ssosync
+  -r, --region                         AWS region where identity store exists
+  -i, --identity-store-id              AWS Identity Store ID
 ```
 
 The function has `two behaviour` and these are controlled by the `--sync-method` flag, this behavior could be

cicd/build/build/buildspec.yml

@@ -16,7 +16,7 @@ phases:
       - apt -qq --yes upgrade
 
       # Install go.lang
-      - GoVersion=${GOLANG_20_VERSION}
+      - GoVersion=${GOLANG_21_VERSION}
 
       # Install golint - now deprecated
       - go install golang.org/x/lint/golint@latest

cmd/root.go

@@ -27,6 +27,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/session"
         "github.com/aws/aws-sdk-go/service/codepipeline"
 	"github.com/aws/aws-sdk-go/service/secretsmanager"
+	"github.com/aws/aws-sdk-go/service/ssm"
 	"github.com/awslabs/ssosync/internal"
 	"github.com/awslabs/ssosync/internal/config"
 	"github.com/pkg/errors"
@@ -172,6 +173,7 @@ func initConfig() {
 		"sync_method",
 		"region",
 		"identity_store_id",
+		"user_mapping_template",
 	}
 
 	for _, e := range appEnvVars {
@@ -197,6 +199,7 @@ func configLambda() {
         s := session.Must(session.NewSession())
 	svc := secretsmanager.New(s)
 	secrets := config.NewSecrets(svc)
+	parameters := config.NewParameters(ssm.New(s))
 
 	unwrap, err := secrets.GoogleAdminEmail(os.Getenv("GOOGLE_ADMIN"))
 	if err != nil {
@@ -234,6 +237,15 @@ func configLambda() {
 	}
 	cfg.IdentityStoreID = unwrap
 
+	unwrap = os.Getenv("USER_MAPPING_TEMPLATE")
+	if len([]rune(unwrap)) != 0 {
+		unwrap, err = parameters.UserMappingTemplate(unwrap)
+		if err != nil {
+			log.Fatal(errors.Wrap(err, "cannot read config: USER_MAPPING_TEMPLATE").Error())
+		}
+		cfg.UserMappingTemplate = unwrap
+	}
+
         unwrap = os.Getenv("LOG_LEVEL")
         if len([]rune(unwrap)) != 0 {
            cfg.LogLevel = unwrap
@@ -301,6 +313,7 @@ func addFlags(cmd *cobra.Command, cfg *config.Config) {
 	rootCmd.Flags().StringVarP(&cfg.SyncMethod, "sync-method", "s", config.DefaultSyncMethod, "Sync method to use (users_groups|groups)")
 	rootCmd.Flags().StringVarP(&cfg.Region, "region", "r", "", "AWS Region where AWS SSO is enabled")
 	rootCmd.Flags().StringVarP(&cfg.IdentityStoreID, "identity-store-id", "i", "", "Identifier of Identity Store in AWS SSO")
+	rootCmd.Flags().StringVar(&cfg.UserMappingTemplate, "user-mapping-template", "", "Template for mapping users from Google Workspace to AWS")
 }
 
 func logConfig(cfg *config.Config) {

go.mod

@@ -1,26 +1,61 @@
 module github.com/awslabs/ssosync
 
-go 1.16
+go 1.21
 
 require (
 	github.com/BurntSushi/toml v1.0.0
+	github.com/Masterminds/sprig/v3 v3.3.0
 	github.com/aws/aws-lambda-go v1.23.0
 	github.com/aws/aws-sdk-go v1.44.102
-	github.com/fsnotify/fsnotify v1.4.9 // indirect
 	github.com/golang/mock v1.5.0
 	github.com/hashicorp/go-retryablehttp v0.7.7
-	github.com/magiconair/properties v1.8.5 // indirect
-	github.com/mitchellh/mapstructure v1.4.1 // indirect
-	github.com/pelletier/go-toml v1.9.0 // indirect
 	github.com/pkg/errors v0.9.1
 	github.com/sirupsen/logrus v1.8.1
-	github.com/spf13/afero v1.6.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
 	github.com/spf13/cobra v1.1.3
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/viper v1.7.1
 	github.com/stretchr/testify v1.7.2
 	golang.org/x/oauth2 v0.0.0-20210427180440-81ed05c6b58c
 	google.golang.org/api v0.46.0
+)
+
+require (
+	cloud.google.com/go v0.81.0 // indirect
+	dario.cat/mergo v1.0.1 // indirect
+	github.com/Masterminds/goutils v1.1.1 // indirect
+	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fsnotify/fsnotify v1.4.9 // indirect
+	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.0.5 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/magiconair/properties v1.8.5 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/mapstructure v1.4.1 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/pelletier/go-toml v1.9.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/spf13/afero v1.6.0 // indirect
+	github.com/spf13/cast v1.7.0 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/subosito/gotenv v1.2.0 // indirect
+	go.opencensus.io v0.23.0 // indirect
+	golang.org/x/crypto v0.26.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
+	golang.org/x/text v0.17.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20210429181445-86c259c2b4ab // indirect
+	google.golang.org/grpc v1.37.0 // indirect
+	google.golang.org/protobuf v1.26.0 // indirect
 	gopkg.in/ini.v1 v1.62.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )