sra-common-cfct-setup-management-account-ou.yaml

########################################################################
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
########################################################################
AWSTemplateFormatVersion: 2010-09-09
Description:
  This template moves the management account to an OU in AWS Organizations to satisfy a Customizations for Control Tower (CFCT) prerequisite -
  'common_cfct_setup' solution in the repo, https://github.com/aws-samples/aws-security-reference-architecture-examples
Metadata:
  SRA:
    Version: 1.0
    Order: 3
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: General Properties
        Parameters:
          - pSRASolutionTagKey
          - pSRASolutionName
          - pSRAStagingS3BucketName
          - pOrganizationId
          - pRootOrganizationalUnitId
      - Label:
          default: Custom Resource Properties
        Parameters:
          - pMoveManagementAccountToOU
          - pManagementAccountOU
      - Label:
          default: CFCT Org Prerequisites - Lambda Function Properties
        Parameters:
          - pCFCTOrgLambdaRoleName
          - pCFCTOrgLambdaFunctionName
      - Label:
          default: General Lambda Function Properties
        Parameters:
          - pCreateLambdaLogGroup
          - pLambdaLogGroupRetention
          - pLambdaLogGroupKmsKey
          - pLambdaLogLevel
    ParameterLabels:
      pCFCTOrgLambdaFunctionName:
        default: CFCT Org - Lambda Function Name
      pCFCTOrgLambdaRoleName:
        default: CFCT Org - Lambda Role Name
      pCreateLambdaLogGroup:
        default: Create Lambda Log Group
      pLambdaLogGroupKmsKey:
        default: (Optional) Lambda Logs KMS Key
      pLambdaLogGroupRetention:
        default: Lambda Log Group Retention
      pLambdaLogLevel:
        default: Lambda Log Level
      pManagementAccountOU:
        default: Management Account OU Name
      pMoveManagementAccountToOU:
        default: Move Management Account to OU
      pOrganizationId:
        default: Organization ID
      pRootOrganizationalUnitId:
        default: Root Organizational Unit ID
      pSRASolutionName:
        default: SRA Solution Name
      pSRASolutionTagKey:
        default: SRA Solution Tag Key
      pSRAStagingS3BucketName:
        default: SRA Staging S3 Bucket Name

Parameters:
  pCFCTOrgLambdaFunctionName:
    AllowedPattern: '^[\w-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [_, -]
    Default: sra-management-account-ou
    Description:
      Lambda function name for performing the CFCT Organization prerequisites (move management account to OU, enable CloudFormation StackSets trusted
      access)
    Type: String
  pCFCTOrgLambdaRoleName:
    AllowedPattern: '^[\w+=,.@-]{1,64}$'
    ConstraintDescription: Max 64 alphanumeric characters. Also special characters supported [+, =, ., @, -].
    Default: sra-management-account-ou-lambda
    Description: Lambda execution role for performing the CFCT Organization prerequisites
    Type: String
  pCreateLambdaLogGroup:
    AllowedValues: ['true', 'false']
    Default: 'false'
    Description:
      Indicates whether a CloudWatch Log Group should be explicitly created for the Lambda function, to allow for setting a Log Retention and/or KMS
      Key for encryption.
    Type: String
  pLambdaLogGroupKmsKey:
    AllowedPattern: '^$|^arn:(aws[a-zA-Z-]*){1}:kms:[a-z0-9-]+:\d{12}:key\/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$'
    ConstraintDescription: 'Key ARN example:  arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'
    Description:
      (Optional) KMS Key ARN to use for encrypting the Lambda logs data. If empty, encryption is enabled with CloudWatch Logs managing the server-side
      encryption keys.
    Type: String
  pLambdaLogGroupRetention:
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
    Default: 14
    Description: Specifies the number of days you want to retain log events
    Type: String
  pLambdaLogLevel:
    AllowedValues: [INFO, ERROR, DEBUG]
    Default: INFO
    Description: Lambda Function Logging Level
    Type: String
  pManagementAccountOU:
    AllowedValues: [CFCT-Management, CFCT-Management-Optional, ROOT]
    Default: CFCT-Management-Optional
    Description:
      Name of OU under the root to move Management Account to. If 'ROOT', move account to Root OU.  If 'CFCT-Management', move account to
      CFCT-Management OU. If 'CFCT-Management-Optional', move account to CFCT-Management OU only if account not already in an OU.
    Type: String
  pMoveManagementAccountToOU:
    AllowedValues: ['true', 'false']
    Default: 'true'
    Description:
      Indicates whether the Management Account should be moved to the OU referenced in 'Management Account OU Name' parameter. If 'false', management
      account will not be moved and OU's will not be modified.
    Type: String
  pOrganizationId:
    AllowedPattern: '^o-[a-z0-9]{10,32}$'
    ConstraintDescription: Must start with 'o-' followed by from 10 to 32 lowercase letters or digits. (e.g. o-abc1234567)
    Description: AWS Organizations ID.
    Type: String
  pRootOrganizationalUnitId:
    AllowedPattern: '^r-[a-z0-9]{4,32}'
    ConstraintDescription: Must start with 'r-' followed by from 4 to 32 lowercase letters or digits. (e.g. r-abc123)
    Description: Root Organizational Unit ID
    Type: String
  pSRASolutionName:
    AllowedValues: [sra-common-cfct-setup]
    Default: sra-common-cfct-setup
    Description: The SRA solution name. The default value is the folder name of the solution
    Type: String
  pSRASolutionTagKey:
    AllowedValues: [sra-solution]
    Default: sra-solution
    Description: The SRA solution tag key applied to all resources created by the solution that support tagging. The value is the pSRASolutionName.
    Type: String
  pSRAStagingS3BucketName:
    AllowedPattern: '^(?=^.{3,63}$)(?!.*[.-]{2})(?!.*[--]{2})(?!^(?:(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(?!$)|$)){4}$)(^(([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])\.)*([a-z0-9]|[a-z0-9][a-z0-9\-]*[a-z0-9])$)'
    ConstraintDescription:
      SRA Staging S3 bucket name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Description:
      SRA Staging S3 bucket name for the artifacts relevant to solution. (e.g., lambda zips, CloudFormation templates) S3 bucket name can include
      numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
    Type: String

Conditions:
  cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
  cMoveManagementAccountToOU: !Equals [!Ref pMoveManagementAccountToOU, 'true']
  cMoveManagementAccountToOUAndCreateLambdaLogGroup: !And
    - Condition: cMoveManagementAccountToOU
    - Condition: cCreateLambdaLogGroup
  cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]

Resources:
  rCFCTOrgLambdaCustomResource:
    Condition: cMoveManagementAccountToOU
    Type: Custom::LambdaCustomResource
    Version: '1.0'
    Properties:
      ServiceToken: !GetAtt rCFCTOrgLambdaFunction.Arn
      MANAGEMENT_ACCOUNT_OU: !Ref pManagementAccountOU
      TAG_KEY: !Ref pSRASolutionTagKey
      TAG_VALUE: !Ref pSRASolutionName

  rCFCTOrgLambdaFunction:
    Condition: cMoveManagementAccountToOU
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W58
            reason: Lambda role provides access to CloudWatch Logs
          - id: W89
            reason: Lambda does not need to communicate with VPC resources.
          - id: W92
            reason: Lambda does not need reserved concurrent executions.
      checkov:
        - checkov:skip=CKV_AWS_116:DLQ not needed, as Lambda function only triggered by CloudFormation events.
        - checkov:skip=CKV_AWS_173:Environment variables are not sensitive
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Ref pCFCTOrgLambdaFunctionName
      Description: Performs the CFCT Organization prerequisites
      Architectures: [arm64]
      Handler: app.lambda_handler
      Role: !GetAtt rCFCTOrgLambdaRole.Arn
      Runtime: python3.9
      Timeout: 300
      Code:
        S3Bucket: !Ref pSRAStagingS3BucketName
        S3Key: !Sub ${pSRASolutionName}/lambda_code/${pSRASolutionName}.zip
      Environment:
        Variables:
          LOG_LEVEL: !Ref pLambdaLogLevel
      Tags:
        - Key: !Ref pSRASolutionTagKey
          Value: !Ref pSRASolutionName

  rCFCTOrgLambdaLogGroup:
    Condition: cMoveManagementAccountToOUAndCreateLambdaLogGroup
    DeletionPolicy: Retain
    Type: AWS::Logs::LogGroup
    UpdateReplacePolicy: Retain
    Properties:
      LogGroupName: !Sub /aws/lambda/${pCFCTOrgLambdaFunctionName}
      KmsKeyId: !If
        - cUseKmsKey
        - !Ref pLambdaLogGroupKmsKey
        - !Ref AWS::NoValue
      RetentionInDays: !Ref pLambdaLogGroupRetention

  rCFCTOrgLambdaRole:
    Condition: cMoveManagementAccountToOU
    Type: AWS::IAM::Role
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W11
            reason: Allow * in resource when required
          - id: W28
            reason: The role name is defined to identify automation resources
    Properties:
      RoleName: !Ref pCFCTOrgLambdaRoleName
      Description: !Sub Role for '${pCFCTOrgLambdaRoleName}' Lambda function
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
      Tags:
        - Key: !Ref pSRASolutionTagKey
          Value: !Ref pSRASolutionName
      Policies:
        - PolicyName: sra-cfct-org-prerequisites
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: OrganizationRead
                Effect: Allow
                Action:
                  - organizations:DescribeAccount
                  - organizations:DescribeOrganization
                  - organizations:DescribeOrganizationalUnit
                  - organizations:ListRoots
                  - organizations:ListParents
                  - organizations:ListChildren
                Resource: '*'
              - Sid: OrganizationCreateOU
                Effect: Allow
                Action: organizations:CreateOrganizationalUnit
                Resource: !Sub arn:${AWS::Partition}:organizations::${AWS::AccountId}:root/${pOrganizationId}/${pRootOrganizationalUnitId}
              - Sid: OrganizationsTagOU
                Effect: Allow
                Action: organizations:TagResource
                Resource: !Sub arn:${AWS::Partition}:organizations::${AWS::AccountId}:ou/*
              - Sid: OrganizationMoveAccount
                Effect: Allow
                Action: organizations:MoveAccount
                Resource:
                  - !Sub arn:${AWS::Partition}:organizations::${AWS::AccountId}:account/${pOrganizationId}/${AWS::AccountId}
                  - !Sub arn:${AWS::Partition}:organizations::${AWS::AccountId}:root/${pOrganizationId}/${pRootOrganizationalUnitId}
                  - !Sub arn:${AWS::Partition}:organizations::${AWS::AccountId}:ou/${pOrganizationId}/ou-*
        - PolicyName: CloudWatchLogGroup
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Sid: CloudWatchLogs
                Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${pCFCTOrgLambdaFunctionName}:log-stream:*

Outputs:
  oManagementAccountId:
    Condition: cMoveManagementAccountToOU
    Description: Management Account ID
    Value: !GetAtt rCFCTOrgLambdaCustomResource.ManagementAccountId
  oOrganizationId:
    Condition: cMoveManagementAccountToOU
    Description: Organization ID
    Value: !GetAtt rCFCTOrgLambdaCustomResource.OrganizationId
  oRootOrganizationalUnitId:
    Condition: cMoveManagementAccountToOU
    Description: Root Organizational Unit ID
    Value: !GetAtt rCFCTOrgLambdaCustomResource.RootOrganizationalUnitId
  oCFCTOrgLambdaFunctionArn:
    Condition: cMoveManagementAccountToOU
    Description: CFCT Org Lambda Function ARN
    Value: !GetAtt rCFCTOrgLambdaFunction.Arn
  oCFCTOrgLambdaLogGroupArn:
    Condition: cMoveManagementAccountToOUAndCreateLambdaLogGroup
    Description: CFCT Org Lambda Log Group ARN
    Value: !GetAtt rCFCTOrgLambdaLogGroup.Arn
  oCFCTOrgLambdaRoleArn:
    Condition: cMoveManagementAccountToOU
    Description: CFCT Org Lambda Role ARN
    Value: !GetAtt rCFCTOrgLambdaRole.Arn