Module state 

Account-partitioned, serializable state for AWS IAM Identity Center’s SSO Admin (sso-admin) control plane.

Everything the service owns for one account: IAM Identity Center instances (each with its regions), permission sets (with their inline / managed / customer-managed / boundary policies), account assignments and their async operation statuses, permission-set provisioning statuses, applications (with their assignments, access scopes, authentication methods, grants and session/assignment configuration), trusted token issuers, per-instance access-control attribute configuration, and resource tags. Nested config objects are stored as the raw request Value so they echo back verbatim.

Structs

SsoAdminData

Per-account SSO Admin state.

SsoAdminSnapshot

StoredApplication

An application registered on an instance.

StoredAssignment

An account assignment linking a principal to a permission set on an account.

StoredInstance

An IAM Identity Center instance.

StoredManagedPolicy

A managed policy attached to a permission set.

StoredOpStatus

Async status for account-assignment create/delete operations.

StoredPermissionSet

A permission set within an instance.

StoredProvisioningStatus

Async status for permission-set provisioning.

StoredRegion

A region enabled on an IAM Identity Center instance.

StoredTrustedTokenIssuer

A trusted token issuer.

Constants

SSOADMIN_SNAPSHOT_SCHEMA_VERSION

Functions

ensure_default_instance

Seed a default, always-ACTIVE IAM Identity Center instance for account_id when it has none. Real AWS requires enabling IAM Identity Center before instances exist, but seeding one makes the control plane (and the paired Identity Store directory) usable out of the box — and lets tools that first resolve ListInstances (e.g. Terraform’s aws_ssoadmin_instances) proceed. The instance id is derived from the account id so it is stable across restarts. No-op if an instance already exists (e.g. restored from a snapshot).

Type Aliases

SharedSsoAdminState