Keep your AWS IAM Identity Center (formerly AWS SSO) in sync with your Google Workspace directory using an AWS Lambda function. 🚀

• ✅ Extended Attribute Support: Syncs extended AWS SSO SCIM API fields as described in the official documentation.
• ✅ Configurable User Fields: Choose which optional user attributes (phone numbers, addresses, enterprise data, etc.) to sync. See Configurable User Fields for details.
• ✅ Efficient Data Retrieval: Uses partial responses from the Google Workspace API to fetch only the data you need.
• ✅ Nested Groups Support: Supports nested groups in Google Workspace thanks to the includeDerivedMembership API query parameter.
• ✅ Multiple Deployment Options: Can be deployed via the AWS Serverless Application Repository, as a Container Image, or as a CLI.
• ✅ Incremental Sync: Drastically reduces the number of requests to the AWS SSO SCIM API by using a state file to track changes.

For a detailed list of new features, improvements, and bug fixes in each release, see the What's New page.

This project is compatible with the latest AWS Lambda runtimes. Since version v0.0.19, it uses the provided.al2 runtime and arm64 architecture.

The AWS Lambda function is triggered by a CloudWatch event rule (every 15 minutes by default). It syncs your AWS IAM Identity Center with your Google Workspace directory using their respective APIs.

During the first sync, the data of your Groups and Users is stored in an AWS S3 bucket as a state file. This state file is a custom implementation to save time and requests to the AWS SSO SCIM API, and to mitigate some of its limitations.

This project is developed using the Go language and AWS SAM.

For more details on the resources created by the CloudFormation template, please check the AWS SAM Template documentation.

Note: If this is your first time implementing AWS IAM Identity Center, please read Using SSO.

This repository builds two binaries from the cmd/ directory:

After make build, the binaries are available in build/:

./build/idpscim --help
./build/idpscimcli --help

The repository documentation is organized as follows:

The easiest way to deploy and use this project is through the AWS Serverless Application Repository.

You will need to configure credentials for both Google Workspace and AWS.

• Google Workspace API Credentials

  • Follow the Google Workspace documentation to create credentials.
  • You will need to create a Service Account and delegate domain-wide authority to it with the following scopes:
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.user.readonly
    • https://www.googleapis.com/auth/admin.directory.group.member.readonly

• AWS SSO SCIM API Credentials

  • Configure these credentials in the AWS IAM Identity Center service by following the Automatic provisioning guide.

You have several options to use this project:

• AWS Serverless Application Repository (Recommended)

  • Deploy the application directly from the AWS Serverless Application Repository.
  • To update an existing deployment to a newer published version, reuse the same original application name that you entered when you first deployed it. Do not use the generated serverlessrepo-... stack name. See docs/AWS-SAM.md for the full update flow.

• AWS SAM

  • Build and deploy the Lambda function from your local machine.
  • Quick start:

export AWS_PROFILE=<profile_name>
export AWS_REGION=<region>
GIT_VERSION=dev sam build
sam deploy --guided --stack-name idp-scim-sync --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM

• For full validation, source deployment, publish, and update guidance, see docs/AWS-SAM.md and docs/AWS-SAM-Template.md.

• Build from Source
  • Quick start:

make
./build/idpscim --help
./build/idpscimcli --help

• Run the programs

  • idpscim runs the actual synchronization logic.
  • idpscimcli helps you validate your AWS SCIM and Google Workspace configuration before enabling automated sync.
  • See docs/idpscim.md, docs/idpscimcli.md, docs/Configuration.md, and docs/Development.md for examples, flags, and the full local workflow.

• Pre-built Binaries

  • Download the binaries from the GitHub Releases.

• Container Image

  • Pull the image from the GitHub Container Registry.
  • Container build and execution details are documented in docs/idpscim.md, docs/idpscimcli.md, and docs/Development.md.

By default, all optional user attributes are synced from Google Workspace to AWS SSO SCIM. You can control which optional fields are included using the sync_user_fields configuration option.

Supported optional fields include phoneNumbers, addresses, title, preferredLanguage, locale, timezone, nickName, profileURL, userType, and enterpriseData.

Required fields are always synchronized: name, userName, displayName, emails, and active.

For config file examples, environment variable usage, CLI flags, SAM parameter usage, and behavior notes, see docs/Configuration.md and docs/idpscim.md.

• 📦 AWS Serverless Application Repository
• 📦 GitHub Container Registry

• Group Page Size: The AWS IAM Identity Center SCIM ListGroups endpoint returns at most 100 groups per page. Since v0.45.0 this project walks every page via cursor-based pagination, so a larger directory no longer requires manual configuration.
• Throttling: With a very large number of users and groups, you may still encounter a ThrottlingException from the AWS IAM Identity Center SCIM API. The new member-resolution algorithm (one members.value query per user, see docs/Whats-New.md) is roughly two orders of magnitude lighter than the old brute-force path, but the underlying SCIM endpoint is still rate-limited. This project uses the httpx library with automatic retry and jitter backoff to mitigate this.
• User Status: The Google Workspace API doesn't differentiate between normal and guest users except for their status. This project only syncs ACTIVE users.

If you are coming from the awslabs/ssosync project, please note the following:

• This project only implements the --sync-method groups.
• This project only implements filtering for Google Workspace Groups, not Users.
• This project supports selecting which optional user attributes to sync via --sync-user-fields (e.g., phone numbers, addresses, enterprise data).
• The flag names are different.

This project is released under the Apache License 2.0. See the LICENSE file for more details.