SSO Admin

Introduction

SSO Admin is a service provided by Amazon Web Services (AWS) that enables you to manage your AWS Single Sign-On (AWS SSO) resources. It allows you to create, update, and delete AWS SSO resources such as directories, groups, and users.

LocalStack provides a mock implementation of the SSO Admin API that allows you to create and manage your AWS SSO resources. The supported APIs are available on our API Coverage section, which provides information on the extent of SSO Admin’s integration with LocalStack.

Getting started

This guide is designed for users new to SSO Admin and assumes basic knowledge of the AWS CLI and our lstk aws command.

Start your LocalStack container using your preferred method. We will demonstrate how to create a permission set, add tags to a permission set, list permission sets, and assign a permission set to an account.

Create a permission set

You can create a permission set using the CreatePermissionSet API.

lstk aws sso-admin create-permission-set \
    --name my-permission-set \
    --description "My permission set" \
    --instance-arn arn:aws:sso:::instance/d-1234567890 \
    --tags Key=Name,Value=my-permission-set

Output

{
    "PermissionSet": {
        "CreatedDate": "2025-07-02T12:15:33.352631+05:30",
        "Description": "My permission set",
        "Name": "my-permission-set",
        "PermissionSetArn": "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8",
        "SessionDuration": 3600
    }
}

List permission sets

You can list permission sets using the ListPermissionSets API.

lstk aws sso-admin list-permission-sets --instance-arn arn:aws:sso:::instance/d-1234567890

Output

{
    "PermissionSets": [
        "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8"
    ]
}

List tags for a permission set

You can list tags for a permission set using the ListTagsForResource API.

lstk aws sso-admin list-tags-for-resource --resource-arn arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8 --instance-arn arn:aws:sso:::instance/d-1234567890

Output

{
    "Tags": [
        {
            "Key": "Name",
            "Value": "my-permission-set"
        }
    ]
}

Create a group in Identity Store

Account assignments grant a principal, a user or group, access to an AWS account through a permission set. Create a group to use as the principal with the Identity Store CreateGroup API:

lstk aws identitystore create-group --identity-store-id testls

Output

{
    "GroupId": "67c95b67-1445-4499-b6f8-c87b8b355832",
    "IdentityStoreId": "testls"
}

Copy the GroupId value, you will need it in the next step.

Create an account assignment

You can assign a permission set to a principal for a specific AWS account using the CreateAccountAssignment API.

lstk aws sso-admin create-account-assignment \
    --instance-arn arn:aws:sso:::instance/d-1234567890 \
    --target-id 000000000000 \
    --target-type AWS_ACCOUNT \
    --permission-set-arn arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8 \
    --principal-type GROUP \
    --principal-id 67c95b67-1445-4499-b6f8-c87b8b355832

Output

{
    "AccountAssignmentCreationStatus": {
        "CreatedDate": "2026-09-09T21:42:17.819038+02:00",
        "PermissionSetArn": "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8",
        "PrincipalId": "67c95b67-1445-4499-b6f8-c87b8b355832",
        "PrincipalType": "GROUP",
        "RequestId": "dfa5ac6f-e06f-42ff-b3a9-a7f0b8c58fb0",
        "Status": "SUCCEEDED",
        "TargetId": "000000000000",
        "TargetType": "AWS_ACCOUNT"
    }
}

TargetId is the AWS account to grant access to, 000000000000 is LocalStack’s default account.

List account assignments

You can list the account assignments for a permission set using the ListAccountAssignments API.

lstk aws sso-admin list-account-assignments \
    --instance-arn arn:aws:sso:::instance/d-1234567890 \
    --account-id 000000000000 \
    --permission-set-arn arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8

Output

{
    "AccountAssignments": [
        {
            "AccountId": "000000000000",
            "PermissionSetArn": "arn:aws:sso:::instance/d-1234567890/ps-lm0rshcjz3tikab8",
            "PrincipalId": "67c95b67-1445-4499-b6f8-c87b8b355832",
            "PrincipalType": "GROUP"
        }
    ]
}

API Coverage

Operation ▲	Implemented ▼	Verified on Kubernetes

PreviousPage 1 of 0Next