Get IAM Role ARNs per-Account for SSO Permission Sets/Assignments

Question

For background, I'll give an example set up of resources/accounts so that I can better ask the question.

I have an account `identity` which contains the root IAM Identity Center installation, and other accounts that are granted access via IAM IDC. To make things simple, let's pretend I am creating IdentityStore users/groups, let's not involve SAML or external IdP. I have a permission set `myorg-infra-admin`, and this is assigned to the `infra-admins` group and is assigned to all accounts. We'll use `dev` and `prod` as the example account names.

In Terraform, this resolves to something like the following:

```terraform
resource aws_identitystore_group infra_admins {
  name = "infra-admins"
  # ...
}

resource aws_sso_permission_set infra_admin {
  name = "myorg-infra-admin"
  # ....
}

# assign it to the accounts
resource aws_ssoadmin_account_assignment infra_admin {
  for_each = toset([var.prod_account_id, var.dev_account_id])
  
  permission_set_arn = aws_ssoadmin_permission_set.infra_admin.arn
  principal_id = aws_identitystore_group.infra_admins.group_id
  principal_type = "GROUP"
  target_type = "AWS_ACCOUNT"
  target_id = each.value
  instance_arn = data.aws_ssoadmin_instances.default.identity_store_ids[0]
}
```

This all works great, and if we visit each of these accounts, we will see the following roles created:

1. `arn:aws:iam::${DEV_ACCOUNT_ID}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_myorg-infra-admin_98a0550b39dffd16`
 2. `arn:aws:iam::${PROD_ACCOUNT_ID}:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_myorg-infra-admin_5f0bab926aff8946`

### Problem

One shortcoming I have encountered is that at least within Terraform, there seems to be no way of automatically discovering the ARNs of these "mounted roles" from the `aws_ssoadmin_account_assignment` resource.

Rather, what I have to resort to is fuzzy-finding them on a per-account basis:

```terraform
data aws_iam_role sso_infra_admin {
  name_regex = "^AWSReservedSSO_(?Pmyorg-infra-admin)_(?P[0-9a-f]{16})$$"
  path_prefix = "/aws-reserved/sso.amazonaws.com/"
}
```

It would be much more convenient if there were a way to get each account's IAM role arn from the `aws_ssoadmin_account_assignment` resource so I don't have to fuzzy find them.

Is this currently possible through an AWS API so that the Terraform provider can be extended?

re:Post Agent · Accepted Answer

In AWS IAM Identity Center, when you create permission sets and assign them to accounts, IAM roles are automatically created in each target account. However, there is currently no direct API method to retrieve these role ARNs from the `aws_ssoadmin_account_assignment` resource.

The role names are generated using a specific pattern: `AWSReservedSSO_[permission-set-name]_[unique-id]` and are placed under the path `/aws-reserved/sso.amazonaws.com/`. The unique ID portion is not deterministically derivable from the permission set information alone, which is why you're currently using the regex approach to find these roles.

When IAM Identity Center creates these roles in target accounts, it uses role chaining behind the scenes, but the API doesn't expose a method to directly map from a permission set assignment to the resulting role ARN.

Your current approach of using a name regex pattern to find the roles is the recommended way to handle this situation. While not ideal from an automation perspective, it's the most reliable method available since the unique identifier in the role name is generated by IAM Identity Center and not exposed through the assignment APIs.

If you need to work with these roles programmatically across accounts, you would need to:
1. Continue using the regex pattern matching in each account
2. Or maintain a mapping of permission sets to their corresponding role ARNs in each account

This is a known limitation when working with IAM Identity Center permission sets and their corresponding IAM roles across accounts.  
**Sources**  
[Delegate permission set administration - AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetdelegation.html)  
[API for creating permission sets in Identity store | AWS re:Post](https://repost.aws/questions/QUg820gsvVQraoVymOY_zFQg/api-for-creating-permission-sets-in-identity-store)  
[Export CloudWatch log data to Amazon S3 using the console | AWS re:Post](https://repost.aws/questions/QUR-mgBqqCRsu-U5J4spRwTw/export-cloudwatch-log-data-to-amazon-s3-using-the-console)

Get IAM Role ARNs per-Account for SSO Permission Sets/Assignments

Problem

Add your answer

Relevant content