authentik-connect-sync¶
Status: Current | Last reviewed: 2026-05-28
JIT user provisioning Lambda. Listens for Authentik events and provisions matching agents in Amazon Connect.
Source¶
Runtime¶
| Aspect | Value |
|---|---|
| Language | Python 3.12 |
| Deployed as | AWS Lambda authentik-connect-sync |
| Trigger | API Gateway c5zujfv7u7 from Authentik webhooks |
| Config | SSM /connect-sync/* parameters |
What it does¶
- Authentik fires a webhook on user create / role change / disable.
- Lambda translates the event to Connect agent CRUD.
- Provisions or updates the agent's queue, routing profile, and security profile.
- Disables the Connect agent on Authentik disable.
Dependencies¶
| Service | Purpose |
|---|---|
| Authentik | Webhook source |
| Amazon Connect | Agent CRUD APIs |
| AWS SSM | Config |
Vanguard¶
Lambdas don't run under Overmind. To exercise the flow locally:
cd apps/authentik-connect-sync
python -m pytest tests/
Use SAM Local for full webhook simulation.
Production¶
Lambda is deployed by sentinel-deploy-gke.yml — same workflow even though it's AWS infra. SSM params:
| Param | Purpose |
|---|---|
/connect-sync/instance-id |
Connect instance to provision in |
/connect-sync/routing-profile |
Default routing profile |
/connect-sync/security-profile |
Default security profile |