API for creating permission sets in Identity store

There is indeed an API available for creating permission sets in AWS IAM Identity Center (formerly known as AWS Single Sign-On). The API operation you're looking for is called "CreatePermissionSet".

To use this API, you'll need to provide the ARN (Amazon Resource Name) of the IAM Identity Center instance where you want to create the permission set. The API accepts various parameters in JSON format, including the description, name, relay state, session duration, and tags for the permission set.

When using the AWS CLI to create permission sets, you first need to get the ARN of your IAM Identity Center instance. You can do this by running the following command:

aws sso-admin list-instances

Once you have the instance ARN, you can use it to create permission sets using the CreatePermissionSet API.

It's worth noting that while you can use this API to create and manage permission sets programmatically, you cannot enable IAM Identity Center itself using CloudFormation or other infrastructure-as-code tools. However, you can use CloudFormation to create permission sets and assign them to accounts once IAM Identity Center is enabled.

For more complex scenarios, you might consider setting up a CI/CD pipeline using services like AWS CodePipeline and AWS CodeBuild to manage your IAM Identity Center permission sets and assignments as code. This approach allows you to version control your permission sets and automate their deployment across your AWS organization.
Sources
CreatePermissionSet - IAM Identity Center
Create an SSO and Identity Store using Cloudformation | AWS re:Post
Use new account assignment APIs for AWS SSO to automate multi-account access | AWS Security Blog
Manage AWS IAM Identity Center permission sets as code by using AWS CodePipeline - AWS Prescriptive Guidance