Listing Identity center user with their assigned permissions set

You can generate a report of IAM Identity Center users and their assigned permission sets using a Python script. Here's a solution:

import boto3, json

idstoreclient = boto3.client('identitystore')
ssoadminclient = boto3.client('sso-admin')
orgsclient= boto3.client('organizations')

users={}
groups={}
permissionSets={}
Accounts=[]

Instances= (ssoadminclient.list_instances()).get('Instances')
InstanceARN=Instances[0].get('InstanceArn')
IdentityStoreId=Instances[0].get('IdentityStoreId')

#Dictionary mapping User IDs to usernames
def mapUserIDs():
ListUsers=idstoreclient.list_users(IdentityStoreId=IdentityStoreId)
ListOfUsers=ListUsers['Users']
while 'NextToken' in ListUsers.keys():
ListUsers=idstoreclient.list_users(IdentityStoreId=IdentityStoreId,NextToken=ListUsers['NextToken'])
ListOfUsers.extend(ListUsers['Users'])
for eachUser in ListOfUsers:
users.update({eachUser.get('UserId'):eachUser.get('UserName')})
mapUserIDs()

#Dictionary mapping Group IDs to display names
def mapGroupIDs():
ListGroups=idstoreclient.list_groups(IdentityStoreId=IdentityStoreId)
ListOfGroups=ListGroups['Groups']
while 'NextToken' in ListGroups.keys():
ListGroups=idstoreclient.list_groups(IdentityStoreId=IdentityStoreId,NextToken=ListGroups['NextToken'])
ListOfGroups.extend(ListGroups['Groups'])
for eachGroup in ListOfGroups:
groups.update({eachGroup.get('GroupId'):eachGroup.get('DisplayName')})
mapGroupIDs()

#Dictionary mapping permission set ARNs to permission set names
def mapPermissionSetIDs():
ListPermissionSets=ssoadminclient.list_permission_sets(InstanceArn=InstanceARN)
ListOfPermissionSets=ListPermissionSets['PermissionSets']
while 'NextToken' in ListPermissionSets.keys():
ListPermissionSets=ssoadminclient.list_permission_sets(InstanceArn=InstanceARN,NextToken=ListPermissionSets['NextToken'])
ListOfPermissionSets.extend(ListPermissionSets['PermissionSets'])
for eachPermissionSet in ListOfPermissionSets:
permissionSetDescription=ssoadminclient.describe_permission_set(InstanceArn=InstanceARN,PermissionSetArn=eachPermissionSet)
permissionSetDetails=permissionSetDescription.get('PermissionSet')
permissionSets.update({permissionSetDetails.get('PermissionSetArn'):permissionSetDetails.get('Name')})
mapPermissionSetIDs()

#Listing Permissionsets provisioned to an account
def GetPermissionSetsProvisionedToAccount(AccountID):
ListOfPermissionSetsProvisionedToAccount=[]
PermissionSetsProvisionedToAccount=ssoadminclient.list_permission_sets_provisioned_to_account(InstanceArn=InstanceARN,AccountId=AccountID)
try:
ListOfPermissionSetsProvisionedToAccount = PermissionSetsProvisionedToAccount['PermissionSets']
while 'NextToken' in PermissionSetsProvisionedToAccount.keys():
PermissionSetsProvisionedToAccount=ssoadminclient.list_permission_sets_provisioned_to_account(InstanceArn=InstanceARN,AccountId=AccountID,NextToken=PermissionSetsProvisionedToAccount['NextToken'])
ListOfPermissionSetsProvisionedToAccount.extend(PermissionSetsProvisionedToAccount['PermissionSets'])
return(ListOfPermissionSetsProvisionedToAccount)
except:
return(ListOfPermissionSetsProvisionedToAccount)

#To retrieve the assignment of each permissionset/user/group/account assignment
def ListAccountAssignments(AccountID):
PermissionSetsList=GetPermissionSetsProvisionedToAccount(AccountID)
Assignments=[]
for permissionSet in PermissionSetsList:
AccountAssignments=ssoadminclient.list_account_assignments(InstanceArn=InstanceARN,AccountId=AccountID,PermissionSetArn=permissionSet)
Assignments.extend(AccountAssignments['AccountAssignments'])
while 'NextToken' in AccountAssignments.keys():
AccountAssignments=ssoadminclient.list_account_assignments(InstanceArn=InstanceARN,AccountId=AccountID,PermissionSetArn=permissionSet,NextToken=AccountAssignments['NextToken'])
Assignments.extend(AccountAssignments['AccountAssignments'])
return(Assignments)

#To list all the accounts in the organization
def ListAccountsInOrganization():
AccountsList=orgsclient.list_accounts()
ListOfAccounts=AccountsList['Accounts']
while 'NextToken' in AccountsList.keys():
AccountsList=orgsclient.list_accounts(NextToken=AccountsList['NextToken'])
ListOfAccounts.extend(AccountsList['Accounts'])
for eachAccount in ListOfAccounts:
Accounts.append(str(eachAccount.get('Id')))
return(Accounts)

#To translate set datatype to json
class SetEncoder(json.JSONEncoder):
def default(self, obj):
if isinstance(obj, set):
return list(obj)
return json.JSONEncoder.default(self, obj)

def GetListOfAssignmentsForPermissionSets():
ListOfAccountIDs=ListAccountsInOrganization()
entries=[]
PermissionSetListForAssignments={}
for eachAccountID in ListOfAccountIDs:
GetAccountAssignments=ListAccountAssignments(eachAccountID)
for eachAssignment in GetAccountAssignments:
if(permissionSets.get(eachAssignment.get('PermissionSetArn'))) not in PermissionSetListForAssignments.keys():
SetOfUsersandGroups={'Users':set(),'Groups':set()}
PermissionSetListForAssignments[permissionSets.get(eachAssignment.get('PermissionSetArn'))]=SetOfUsersandGroups
SetOfUsersandGroups=PermissionSetListForAssignments.get(permissionSets.get(eachAssignment.get('PermissionSetArn')))
if(eachAssignment.get('PrincipalType')=='GROUP'):
setOfGroups=SetOfUsersandGroups.get('Groups')
setOfGroups.add(groups.get(eachAssignment.get('PrincipalId')))
SetOfUsersandGroups.update({'Groups':setOfGroups})
PermissionSetListForAssignments.update({permissionSets.get(eachAssignment.get('PermissionSetArn')):SetOfUsersandGroups})
else:
setOfUsers=SetOfUsersandGroups.get('Users')
setOfUsers.add(users.get(eachAssignment.get('PrincipalId')))
SetOfUsersandGroups.update({'Users':setOfUsers})
PermissionSetListForAssignments.update({permissionSets.get(eachAssignment.get('PermissionSetArn')):SetOfUsersandGroups})
with open("AssignmentsForPermissionSets.json", "w") as outfile:
json.dump(PermissionSetListForAssignments, outfile, cls=SetEncoder)
print("Done! AssignmentsForPermissionSets.json generated successfully!")
GetListOfAssignmentsForPermissionSets()

This script will generate a JSON report that lists all permission sets and the respective users and groups assigned to each permission set in IAM Identity Center. The report will be saved as "AssignmentsForPermissionSets.json" in the same directory where you run the script.

The script works by:

1. Mapping user IDs to usernames
2. Mapping group IDs to display names
3. Mapping permission set ARNs to permission set names
4. Listing permission sets provisioned to each account
5. Retrieving assignments for each permission set/user/group/account combination
6. Listing all accounts in the organization
7. Generating a JSON report with all the collected information

To run this script, you'll need:

• The AWS SDK for Python (boto3)
• Appropriate IAM permissions to access IAM Identity Center resources
• AWS credentials configured on your system

Alternatively, you can also view this information through the AWS Management Console by navigating to the IAM Identity Center console, selecting Users under Dashboard, selecting the specific user, and then viewing the AWS accounts tab to see their applied permission sets.
Sources
Get a report of IAM Identity Center identities and their assignments | AWS re:Post
View and change a permission set - AWS IAM Identity Center
Export a report of AWS IAM Identity Center identities and their assignments by using PowerShell - AWS Prescriptive Guidance