OktaからIAM Identity CenterにIDを自動でプロビジョニングしてみた - Workflows編

import boto3
import uuid
import os
import json

def lambda_handler(event, context):

    identitystore = boto3.client('identitystore')

    instance_id = os.environ.get('IDENTITY_CENTER_INSTANCE_ID')
    if not instance_id:
        return {
            'statusCode': 400,
            'body': 'Error: IDENTITY_CENTER_INSTANCE_ID environment variable is not set.'
        }

    try:
        user_data = event
        if not user_data:
            return {
                'statusCode': 400,
                'body': 'Error: Request payload is empty.'
            }
    except Exception as e:
        return {
            'statusCode': 400,
            'body': f'Error: Invalid payload format: {e}'
        }

    if not all(key in user_data for key in ['UserName', 'DisplayName', 'GivenName', 'FamilyName', 'Emails']):
        return {
            'statusCode': 400,
            'body': 'Error: Missing required user information in request payload.'
        }

    try:
        response = identitystore.create_user(
            IdentityStoreId=instance_id,
            UserName=user_data['UserName'],
            DisplayName=user_data['DisplayName'],
            Name={
                'GivenName': user_data['GivenName'],
                'FamilyName': user_data['FamilyName']
            },
            Emails=user_data['Emails']
        )

        print(f"User created successfully: {response}")

        user_id = response['UserId']
        print(f"Created user ID: {user_id}")

        user_info = identitystore.describe_user(
            IdentityStoreId=instance_id,
            UserId=user_id
        )
        print(f"User info: {user_info}")

        return {
            'statusCode': 200,
            'body': f'User created successfully. User ID: {user_id}'
        }

    except Exception as e:
        print(f"Error creating user: {e}")
        return {
            'statusCode': 500,
            'body': f'Error creating user: {e}'
        }

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "identitystore:CreateUser"
            ],
            "Resource": "arn:aws:identitystore::{account_id}:identitystore/d_{instance_id}"
        },
        {
            "Effect": "Allow",
            "Action": [
                "identitystore:DescribeUser",
                "identitystore:ListUsers"
            ],
            "Resource": [
		            "arn:aws:identitystore::{account_id}:identitystore/d_{instance_id}",
		            "arn:aws:identitystore:::user/*"
            ]
        }
    ]
}

IDENTITY_CENTER_INSTANCE_ID=d_{instance_id}