op-scim-bridge.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Deploys 1Password SCIM Bridge on AWS Fargate in an Amazon ECS cluster. Includes ALB, ACM certificate, AWS secret,
  security groups, and IAM role resources. Optionally creates Route 53 records and a VPC with 2 public subnets,
  internet gateway, and route table.
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Parameters:
          - VPCID
          - VPCCIDR
          - PublicSubnets
          - Route53HostedZoneID
          - ProvisioningVolume
          - DomainName
          - SCIMBridgeVersion
          - scimsession
      - Label:
          default: Workspace configuration (only for customers integrating with Google Workspace)
        Parameters:
          - WorkspaceCredentials
          - WorkspaceActor
    ParameterLabels:
      VPCID:
        default: VPC ID
      VPCCIDR:
        default: VPC CIDR
      PublicSubnets:
        default: Public subnets
      Route53HostedZoneID:
        default: Route 53 hosted zone
      ProvisioningVolume:
        default: Provisioning volume
      DomainName:
        default: 1Password SCIM Bridge domain name
      SCIMBridgeVersion:
        default: 1Password SCIM Bridge version
      WorkspaceCredentials:
        default: Service account key
      WorkspaceActor:
        default: Actor
Parameters:
  VPCID:
    Type: String
    Description: >-
      (Optional) ID of an existing VPC to use for your SCIM bridge. If empty, a new VPC and two public subnets will be
      created.
  VPCCIDR:
    Type: String
    Default: 10.0.0.0/16
    Description: A CIDR block for the VPC. Required if VPCID is empty; ignored if specifying a VPCID.
  PublicSubnets:
    Type: CommaDelimitedList
    Description: (Optional) A comma-separated list of two or more public subnets in the specified VPC.
    ConstraintDescription: >-
      must be a list of at least two existing subnets associated a unique availability zone in the specified VPC
  Route53HostedZoneID:
    Type: String
    Description: >-
      (Optional) The Route 53 hosted zone in which to create DNS records for ACM validation and the ALB endpoint. If
      empty, these records must be created in your DNS provider.
  ProvisioningVolume:
    Type: String
    Description: >-
      The expected volume of provisioning activity. Use base for provisioning less than 1,000 users, high for up to
      5,000 users, or very-high for more than 5,000 users.
    Default: base
    AllowedValues:
      - base
      - high
      - very-high
    ConstraintDescription: must be base, high, or very-high
  DomainName:
    Type: String
    Default: scim.example.com
    Description: >-
      A fully qualified domain name for your SCIM bridge.
  scimsession:
    Type: String
    Description: >-
      The plain text contents of the scimsession file created during the automated user provisioning setup in your
      1Password account.
    MinLength: 1
    ConstraintDescription: must not be empty
    NoEcho: true
  SCIMBridgeVersion:
    Type: String
    Default: v2.9.9
    Description: >-
      The tag of the 1Password SCIM Bridge image to pull from Docker Hub.
  WorkspaceCredentials:
    Type: String
    Default: ""
    Description: >-
      The plain text contents of the key file associated with the service account for Google Workspace.
    NoEcho: true
  WorkspaceActor:
    Type: String
    Default: ""
    Description: >-
      The email address of the Google Workspace administrator that the service account is acting on behalf of.
Rules:
  ValidateWorkspaceConfig:
    RuleCondition: !Not
      - Fn::EachMemberEquals:
          - - !Ref WorkspaceCredentials
            - !Ref WorkspaceActor
          - ""
    Assertions:
      - Assert: !Not [!Equals [!Ref WorkspaceCredentials, ""]]
        AssertDescription: >-
          The service account key is required to connect to Google Workspace.
      - Assert: !Not [!Equals [!Ref WorkspaceActor, ""]]
        AssertDescription: >-
          The actor email is required to connect to Google Workspace.
Mappings:
  CpuScale:
    base:
      SCIMBridge: 128
      Redis: 128
      Task: 256
    high:
      SCIMBridge: 512
      Redis: 128
      Task: 1024
    very-high:
      SCIMBridge: 1024
      Redis: 128
      Task: 2048
  MemoryScale:
    base:
      SCIMBridge: 512
      Redis: 512
      Task: 1024
    high:
      SCIMBridge: 1024
      Redis: 512
      Task: 2048
    very-high:
      SCIMBridge: 1024
      Redis: 512
      Task: 4096
Conditions:
  CreateVPC: !Equals [!Ref VPCID, ""]
  CreateRoute53Records: !Not [!Equals [!Ref Route53HostedZoneID, ""]]
  OutputDNSRecordContent: !Not [Condition: CreateRoute53Records]
  UsingGoogleWorkspace: !Not
    - !Or
      - !Equals [!Ref WorkspaceCredentials, ""]
      - !Equals [!Ref WorkspaceActor, ""]
Resources:
  scimsessionSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      SecretString: !Ref scimsession
  WorkspaceCredentialsSecret:
    Type: AWS::SecretsManager::Secret
    Condition: UsingGoogleWorkspace
    Properties:
      SecretString: !Ref WorkspaceCredentials
  WorkspaceSettingsSecret:
    Type: AWS::SecretsManager::Secret
    Condition: UsingGoogleWorkspace
    Properties:
      SecretString: !Sub |-
        {
          "actor":"${WorkspaceActor}",
          "bridgeAddress":"https://${DomainName}"
        }
  ECSCluster:
    Type: AWS::ECS::Cluster
    DependsOn: ExecutionRole
    Properties:
      CapacityProviders:
        - FARGATE
      DefaultCapacityProviderStrategy:
        - CapacityProvider: FARGATE
          Weight: 1
  ECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: op-scim-bridge
      RequiresCompatibilities:
        - FARGATE
      NetworkMode: awsvpc
      Cpu: !FindInMap
        - CpuScale
        - !Ref ProvisioningVolume
        - Task
      Memory: !FindInMap
        - MemoryScale
        - !Ref ProvisioningVolume
        - Task
      ExecutionRoleArn: !GetAtt ExecutionRole.Arn
      TaskRoleArn: !Ref TaskRole
      RuntimePlatform:
        CpuArchitecture: ARM64
        OperatingSystemFamily: LINUX
      Volumes:
        - Name: secrets
      ContainerDefinitions:
        - Name: mount-secrets
          Essential: false
          Image: amazon/aws-cli
          MountPoints:
            - ContainerPath: /aws
              SourceVolume: secrets
          Environment:
            - Name: SCIMSESSION_ARN
              Value: !Ref scimsessionSecret
            - !If
              - UsingGoogleWorkspace
              - Name: WORKSPACE_CREDENTIALS_ARN
                Value: !Ref WorkspaceCredentialsSecret
              - !Ref AWS::NoValue
            - !If
              - UsingGoogleWorkspace
              - Name: WORKSPACE_SETTINGS_ARN
                Value: !Ref WorkspaceSettingsSecret
              - !Ref AWS::NoValue
          EntryPoint:
            - /bin/bash
            - -c
          Command:
            - !Join
              - " "
              - - >-
                  aws secretsmanager get-secret-value
                  --secret-id $SCIMSESSION_ARN --query SecretString --output text
                  > scimsession
                - !If
                  - UsingGoogleWorkspace
                  - >-
                    && aws secretsmanager get-secret-value
                    --secret-id $WORKSPACE_CREDENTIALS_ARN --query SecretString --output text
                    > workspace-credentials.json
                    && aws secretsmanager get-secret-value
                    --secret-id $WORKSPACE_SETTINGS_ARN --query SecretString --output text
                    > workspace-settings.json
                  - !Ref AWS::NoValue
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroup
              awslogs-stream-prefix: !Ref LogStream
        - Name: op-scim-bridge
          Cpu: !FindInMap
            - CpuScale
            - !Ref ProvisioningVolume
            - SCIMBridge
          Memory: !FindInMap
            - MemoryScale
            - !Ref ProvisioningVolume
            - SCIMBridge
          Image: !Sub 1password/scim:${SCIMBridgeVersion}
          User: opuser:opuser
          PortMappings: [ContainerPort: 3002]
          DependsOn:
            - ContainerName: mount-secrets
              Condition: SUCCESS
            - ContainerName: redis
              Condition: HEALTHY
          MountPoints:
            - ContainerPath: /home/opuser/.op
              SourceVolume: secrets
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroup
              awslogs-stream-prefix: !Ref LogStream
        - Name: redis
          Cpu: !FindInMap
            - CpuScale
            - !Ref ProvisioningVolume
            - Redis
          Memory: !FindInMap
            - MemoryScale
            - !Ref ProvisioningVolume
            - Redis
          Image: redis
          User: redis:redis
          Command:
            - --maxmemory 256mb
            - --maxmemory-policy volatile-lru
            - --save ""
          PortMappings: [ContainerPort: 6379]
          HealthCheck:
            Command:
              - CMD-SHELL
              - redis-cli ping | grep PONG
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-region: !Ref AWS::Region
              awslogs-group: !Ref LogGroup
              awslogs-stream-prefix: !Ref LogStream
  LogGroup:
    Type: AWS::Logs::LogGroup
  LogStream:
    Type: AWS::Logs::LogStream
    Properties:
      LogGroupName: !Ref LogGroup
  ECSService:
    Type: AWS::ECS::Service
    DependsOn: HTTPSListener
    Properties:
      Cluster: !Ref ECSCluster
      TaskDefinition: !Ref ECSTaskDefinition
      DesiredCount: 1
      HealthCheckGracePeriodSeconds: 60
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets: !If
            - CreateVPC
            - [!Ref PublicSubnet1, !Ref PublicSubnet2]
            - !Ref PublicSubnets
          SecurityGroups:
            - !Ref ServiceSecurityGroup
      LoadBalancers:
        - ContainerName: op-scim-bridge
          ContainerPort: 3002
          TargetGroupArn: !Ref TargetGroup
  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /ping
      Matcher:
        HttpCode: 200,301,302
      HealthCheckTimeoutSeconds: 5
      UnhealthyThresholdCount: 2
      HealthyThresholdCount: 2
      Port: 3002
      Protocol: HTTP
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 60
      TargetType: ip
      VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets: !If
        - CreateVPC
        - [!Ref PublicSubnet1, !Ref PublicSubnet2]
        - !Ref PublicSubnets
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroup
  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: >-
        Allow public HTTPS ingress to the load balancer from the identity
        provider, restrict egress to the VPC for 1Password SCIM Bridge
      VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 3002
          ToPort: 3002
          CidrIp: !If
            - CreateVPC
            - !GetAtt VPC.CidrBlock
            - 0.0.0.0/0
  ServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: >-
        Restrict ingress to ECS Service from load balancer, allow egress to
        1Password.com for 1Password SCIM Bridge.
      VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 3002
          ToPort: 3002
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
  HTTPSListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup
      LoadBalancerArn: !Ref LoadBalancer
      Port: 443
      Protocol: HTTPS
      Certificates:
        - CertificateArn: !Ref TLSCertificate
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ""
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: inlined_managed_policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource:
                  - arn:aws:logs:*:*:*
  DNSRecord:
    Condition: CreateRoute53Records
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref Route53HostedZoneID
      Comment: DNS record pointing to load balancer for 1Password SCIM Bridge
      Name: !Ref DomainName
      Type: A
      AliasTarget:
        DNSName: !GetAtt LoadBalancer.DNSName
        HostedZoneId: !GetAtt LoadBalancer.CanonicalHostedZoneID
  TLSCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: !Ref DomainName
      ValidationMethod: DNS
      DomainValidationOptions: !If
        - CreateRoute53Records
        - - DomainName: !Ref DomainName
            HostedZoneId: !Ref Route53HostedZoneID
        - !Ref AWS::NoValue
  TaskRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: cloudwatch_logging
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: "*"
        - PolicyName: vpc_access
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - ec2:CreateNetworkInterface
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DeleteNetworkInterface
                Resource: "*"
        - PolicyName: secrets_manager_policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource:
                  - !Ref scimsessionSecret
                  - !If
                    - UsingGoogleWorkspace
                    - !Ref WorkspaceCredentialsSecret
                    - !Ref AWS::NoValue
                  - !If
                    - UsingGoogleWorkspace
                    - !Ref WorkspaceSettingsSecret
                    - !Ref AWS::NoValue
  VPC:
    Condition: CreateVPC
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VPCCIDR
      EnableDnsHostnames: true
      EnableDnsSupport: true
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Condition: CreateVPC
    Properties:
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: !Ref AWS::Region
      VpcId: !Ref VPC
      CidrBlock:
        Fn::Select:
          - 0
          - Fn::Cidr:
              - !GetAtt VPC.CidrBlock
              - 16
              - 12
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Condition: CreateVPC
    Properties:
      AvailabilityZone:
        Fn::Select:
          - 1
          - Fn::GetAZs: !Ref AWS::Region
      VpcId: !Ref VPC
      CidrBlock:
        Fn::Select:
          - 1
          - Fn::Cidr:
              - !GetAtt VPC.CidrBlock
              - 16
              - 12
  InternetGateway:
    Condition: CreateVPC
    Type: AWS::EC2::InternetGateway
  GatewayAttachment:
    Condition: CreateVPC
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  RouteTable:
    Condition: CreateVPC
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  Route:
    Condition: CreateVPC
    Type: AWS::EC2::Route
    DependsOn: GatewayAttachment
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnet1RouteTableAssociation:
    Condition: CreateVPC
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref RouteTable
  PublicSubnet2RouteTableAssociation:
    Condition: CreateVPC
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref RouteTable
Outputs:
  CNAMEName:
    Condition: OutputDNSRecordContent
    Description: >-
      Name of a DNS record to point to the load balancer. Use with CNAMEValue to create a CNAME record in your DNS
      provider.
    Value: !Sub ${DomainName}.
  CNAMEValue:
    Condition: OutputDNSRecordContent
    Description: >-
      Value of a DNS record to point to the load balancer. Use with CNAMEName to create a public CNAME record in your
      DNS provider.
    Value: !Sub ${LoadBalancer.DNSName}.
  SCIMBridgeURL:
    Description: >-
      The URL for your SCIM bridge. Use this and your bearer token to connect
      your identity provider to 1Password.
    Value: !Sub https://${DomainName}