Manage Group Memberships
Overview
At checkout the broker adds the requesting identity to a Google Workspace group; at checkin it removes them. Scripts are available in both Python and Bash and use the Admin SDK; the Google service account JSON key is stored in AWS Secrets Manager and retrieved at runtime.
Before You Begin
- The Access Broker is deployed and connected
- The Admin SDK API enabled for your organization and a service account with domain-wide delegation
- The service account JSON key stored in AWS Secrets Manager; the broker host able to read it
- Broker host tooling: AWS CLI +
jq(Bash) orboto3+ Google API client (Python)
Environment Variables
| Variable | Notes |
|---|---|
GWS_SECRET_NAME | AWS secret holding the Google service account key |
GWS_IDENTITY | User email to add/remove |
GWS_GROUP | Target group email |
Checkout / Checkin
Full scripts: gws-group-checkout.sh · gws-group-checkin.sh (Python variants alongside).
# retrieve the service account key from Secrets Manager
aws secretsmanager get-secret-value --secret-id "$GWS_SECRET_NAME" \
--query SecretString --output text > /tmp/gws-sa.json
# checkout — add user to group via Admin SDK (Directory API)
# checkin — remove user from groupConfigure in Britive
Create the permission
Resource Manager → Resource Type Permissions → New Permission. Language = Shell or Python. Paste the checkout and checkin routines. Declare GWS_SECRET_NAME, GWS_GROUP (GWS_IDENTITY maps to the requesting user).
Create a profile and policy
Create a profile (e.g. 4h), set GWS_GROUP, add the permission, and add a policy assigning members by tag.
Verify
In the Google Admin console, open the group’s Members — the user appears during checkout and is removed after checkin.
Troubleshoot
| Symptom | Cause | Fix |
|---|---|---|
403 from Admin SDK | Service account lacks delegation / scopes | Grant domain-wide delegation and group-management scopes |
AccessDenied reading secret | Broker IAM can’t read the secret | Grant secretsmanager:GetSecretValue on GWS_SECRET_NAME |
| API rate limits | Bulk operations | Throttle; Admin SDK enforces usage limits |