Cannot Sync groups anymore

[tmylonidis]

Hi,

our Google Workspace - AWS SSO integration was working properly, and now that I had to add a new user in our Google Workspace groups that are imported to AWS SSO, I realized that we are seeing the following errors:

cannot sync groups and their members: error getting groups from the identity provider: idp: error listing groups: googleapi: Error 403: Not Authorized to access this resource/api, forbidden: withStack null

Now, the only things that were changed in our AWS SSO configuration is that we configured the start URL of the portal from the random one to something specific. Also, in order for Security Hub to be centralized, we set the Audit account of our organization as the delegated administrator. Could any of these two affect the connection?

I tried to browse through the lambda settings, but couldn't find any reference to the start URL, what could I be missing?

Thanks,

Theo

[christiangda]

Hi @tmylonidis ,

checking your error identity provider: idp: error listing groups: googleapi: Error 403: Not Authorized to access this resource/api, forbidden: withStack nullis clear that your google credentials suffer a change

I mean, the problem is in the google user and service account you created in google to have access to the google workspace api., try to check what happened with these, I mean maybe somebody remove your API permissions from the service. account and user email you were using.

The problem is there, or maybe you configured these parameters in a bad way in the CloudFormation template or in the Secret Manager.

[tmylonidis]

Hi @christiangda ,

thank you for your response! It seems that this is the issue, the Google API Admin rights were revoked for the email I was using. Do you know if I can change the email address that is used from the idp-scim-sync Lambda configuration, or do I need to redeploy?

Thanks,

Theo

[christiangda]

Hi @tmylonidis , for me the best and easy way is to go to AWS SecretManager and change the value of the email there. The second best option is to go to the CloudFormation template deployed by Serverless Application and redeploy changing the email, and the third is to deploy again the Serverless Application with the same name and new parameters and this is going to redeploy de cloudformation template with the new parameters

[tmylonidis]

Perfect, thank you so much for the quick response and the great tips! Really appreciate it 🙏