Skip to content

Commit c7a2d8d

Browse files
tekdj7tekdj7
committed
config_management_account solution, and small updates to common_prerequisites solution
1 parent c6520d7 commit c7a2d8d

29 files changed

+1647
-79
lines changed

‎CHANGELOG.md

+21-4
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2021-12-13](#2021-12-13)
67
- [2021-12-10](#2021-12-10)
78
- [2021-11-22](#2021-11-22)
89
- [2021-11-20](#2021-11-20)
@@ -18,11 +19,27 @@ All notable changes to this project will be documented in this file.
1819

1920
---
2021

22+
## 2021-12-13
23+
24+
### Added<!-- omit in toc -->
25+
26+
- [Config Management Account](aws_sra_examples/config/config_management_account) solution
27+
28+
### Changed<!-- omit in toc -->
29+
30+
- In [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution:
31+
- Removed `TAG_KEY/TAG_VALUE` as environment variables and only kept them as Custom Resource Properties, since CloudWatch event is no longer needed in this solution.
32+
- Removed `pManagementAccountId` from multiple templates, and instead used as needed `AWS::AccountId`.
33+
34+
### Fixed<!-- omit in toc -->
35+
36+
- Nothing Fixed
37+
2138
## 2021-12-10
2239

2340
### Added<!-- omit in toc -->
2441

25-
- [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites/) solution
42+
- [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution
2643
- [Deployment Methods](aws_sra_examples/docs/DEPLOYMENT-METHODS.md) documentation
2744
- [Staging Script](aws_sra_examples/utils/packaging_scripts/) - `stage_solution.sh`
2845

@@ -93,9 +110,9 @@ All notable changes to this project will be documented in this file.
93110

94111
### Added<!-- omit in toc -->
95112

96-
- [AWS IAM Access Analyzer](aws_sra_examples/solutions/iam/iam_access_analyzer/) solution
97-
- [Organization AWS Config Aggregator](aws_sra_examples/solutions/config/config_aggregator_org/) solution
98-
- [Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator/) solution
113+
- [AWS IAM Access Analyzer](aws_sra_examples/solutions/iam/iam_access_analyzer) solution
114+
- [Organization AWS Config Aggregator](aws_sra_examples/solutions/config/config_aggregator_org) solution
115+
- [Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator) solution
99116

100117
### Changed<!-- omit in toc -->
101118

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ The examples within this repository have been deployed and tested using the corr
3131
- [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites)
3232
- [Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator)
3333
- Config
34+
- [Config Management Account](aws_sra_examples/solutions/config/config_management_account)
3435
- [Organization Aggregator](aws_sra_examples/solutions/config/config_aggregator_org)
3536
- [Organization Conformance Pack](aws_sra_examples/solutions/config/config_conformance_pack_org)
3637
- EC2

‎aws_sra_examples/docs/DEPLOYMENT-METHODS.md

+5-4
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,12 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
5252
1. Copy the files to the Customizations for AWS Control Tower configuration `custom-control-tower-configuration`
5353
- parameters [**required for manifest version 2020-01-01**]
5454
- Copy the parameter files from the `parameters` folder
55-
- Only one of the main parameter files is required. We recommend using the main-ssm file.
55+
- Only one of the main parameter files is required. We recommend using the `main-ssm` file.
5656
- policies [optional]
5757
- service control policies files (\*.json)
5858
- templates [**required**]
59-
- Copy the template files from the `templates` folder
60-
- Only one of the main template files is required. We recommend using the main-ssm file.
59+
- Copy the template files from the `templates` folder that are referenced in the `manifest.yaml`
60+
- Only one of the main template files is required. We recommend using the `main-ssm` file.
6161
- `manifest.yaml` [**required**]
6262
2. Verify and update the parameters within each of the parameter json files to match the target environment
6363
3. Update the manifest.yaml file with the `organizational unit names`, `account names` and `SSM parameters` for the target environment
@@ -69,7 +69,8 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
6969
- policies [optional]
7070
- service control policies files (\*.json)
7171
- templates [**required**]
72-
- Copy the template files from the `templates` folder
72+
- Copy the template files from the `templates` folder that are referenced in the `manifest-v2.yaml`
73+
- Only one of the main template files is required. We recommend using the `main-ssm` file.
7374
- `manifest-v2.yaml` [**required**]
7475
2. Rename the `manifest-v2.yaml` to `manifest.yaml`
7576
3. Update the manifest.yaml file with the `parameters`, `organizational unit names`, `account names` and `SSM parameters` for the target environment

‎aws_sra_examples/solutions/common/common_prerequisites/README.md

+10-4
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,12 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
1111

1212
## Introduction
1313

14-
The `SRA Prerequisites Solution` creates the resources (`Staging S3 Buckets` and `Execution IAM Role`) and configuration (`SSM Parameters`) for simplifying the deployment of SRA solutions within an AWS Control Tower environment. All resources that support tags are provided a tag keypair of `sra-solution: sra-common-prerequisites`.
14+
The `SRA Prerequisites Solution` creates the resources (`Staging S3 Buckets` and `Execution IAM Role`) and configuration AWS Systems Manager Parameters (`SSM Parameters`) for simplifying the deployment of SRA solutions within an AWS Control Tower
15+
environment. All resources that support tags are provided a tag keypair of `sra-solution: sra-common-prerequisites`.
16+
17+
[AWS Systems Manager](https://aws.amazon.com/systems-manager/) (SSM) has a [Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) capability that provides secure, hierarchical storage for
18+
configuration data management and secrets management. You can store data such as passwords, database strings, Amazon Machine Image (AMI) IDs, and license codes as parameter values. You can store values as plain text or encrypted data. You can
19+
reference Systems Manager parameters in your scripts, commands, SSM documents, and configuration and automation workflows by using the unique name that you specified when you created the parameter.
1520

1621
## Deployed Resource Details
1722

@@ -31,7 +36,7 @@ The `SRA Prerequisites Solution` creates the resources (`Staging S3 Buckets` and
3136

3237
#### 1.3 Org ID AWS Lambda Function<!-- omit in toc -->
3338

34-
- An external deployment package is used in the AWS Lambda Function in the [sra-common-prerequisites-staging-s3-bucket.yaml](templates/sra-common-prerequisites-staging-s3-bucket.yaml) that contains the logic to determine the AWS Organization ID
39+
- An inline AWS Lambda Function in the [sra-common-prerequisites-staging-s3-bucket.yaml](templates/sra-common-prerequisites-staging-s3-bucket.yaml) template contains the logic to determine the AWS Organization ID
3540
- The function is triggered by CloudFormation Create, Update, and Delete events.
3641

3742
#### 1.4 AWS Lambda CloudWatch Log Group<!-- omit in toc -->
@@ -61,8 +66,8 @@ The `SRA Prerequisites Solution` creates the resources (`Staging S3 Buckets` and
6166

6267
#### 1.8 Parameter AWS Lambda Function<!-- omit in toc -->
6368

64-
- An inline AWS Lambda Function in the [sra-common-prerequisites-management-account-parameters.yaml](templates/sra-common-prerequisites-management-account-parameters.yaml) contains the logic for discovering common values in your Control Tower landing
65-
zone. (e.g., Root Organizational Unit ID, Control Tower Home Region, Audit Account ID)
69+
- An external deployment package is used in the AWS Lambda Function in the [sra-common-prerequisites-management-account-parameters.yaml](templates/sra-common-prerequisites-management-account-parameters.yaml) template contains the logic for
70+
discovering common values in your Control Tower landing zone. (e.g., Root Organizational Unit ID, Control Tower Home Region, Audit Account ID)
6671
- The function is triggered by CloudFormation Create, Update, and Delete events.
6772

6873
#### 1.9 AWS Lambda CloudWatch Log Group<!-- omit in toc -->
@@ -155,3 +160,4 @@ The `SRA Prerequisites Solution` creates the resources (`Staging S3 Buckets` and
155160
- [How AWS Control Tower works with roles to create and manage accounts](https://docs.aws.amazon.com/controltower/latest/userguide/roles-how.html)
156161
- [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html)
157162
- [Working with AWS CloudFormation StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html)
163+
- [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/)

‎aws_sra_examples/solutions/common/common_prerequisites/customizations_for_aws_control_tower/manifest-v2.yaml

+1-3
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ resources:
2020
- parameter_key: pLambdaLogLevel
2121
parameter_value: INFO
2222
- parameter_key: pSRAStagingS3BucketName
23-
parameter_value:
23+
parameter_value: '' # Leave blank to use SSM parameter
2424
deploy_method: stack_set
2525
deployment_targets:
2626
accounts:
@@ -79,8 +79,6 @@ resources:
7979
# parameter_value: INFO
8080
# - parameter_key: pLogArchiveAccountId
8181
# parameter_value: ''
82-
# - parameter_key: pManagementAccountId
83-
# parameter_value: ''
8482
# - parameter_key: pOrganizationId
8583
# parameter_value: ''
8684
# - parameter_key: pRootOrganizationalUnitId

‎aws_sra_examples/solutions/common/common_prerequisites/customizations_for_aws_control_tower/parameters/sra-common-prerequisites-main.json

-4
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,6 @@
5555
"ParameterKey": "pLogArchiveAccountId",
5656
"ParameterValue": ""
5757
},
58-
{
59-
"ParameterKey": "pManagementAccountId",
60-
"ParameterValue": ""
61-
},
6258
{
6359
"ParameterKey": "pOrganizationId",
6460
"ParameterValue": ""

‎aws_sra_examples/solutions/common/common_prerequisites/lambda/src/app.py

+10-8
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
"""Custom Resource to gather data and create SSM paramters in the Control Tower management account.
2+
23
Version: 1.0
34
45
'common_prerequisites' solution in the repo, https://github.com/aws-samples/aws-security-reference-architecture-examples
@@ -354,19 +355,20 @@ def parameter_pattern_validator(parameter_name: str, parameter_value: Union[str,
354355
raise ValueError(f"'{parameter_name}' parameter with value of '{parameter_value}' does not follow the allowed pattern: {pattern}.")
355356

356357

357-
def get_validated_parameters() -> dict:
358+
def get_validated_parameters(event: CloudFormationCustomResourceEvent) -> dict:
358359
"""Validate AWS CloudFormation parameters.
359360
361+
Args:
362+
event: event data
363+
360364
Returns:
361365
Validated parameters
362366
"""
363-
tag_key = os.getenv("TAG_KEY", "sra-solution")
364-
tag_value = os.getenv("TAG_VALUE", "sra-common-prerequisites")
365-
366-
parameter_pattern_validator("TAG_KEY", tag_key, pattern=r"^.{1,128}$")
367-
parameter_pattern_validator("TAG_VALUE", tag_value, pattern=r"^.{1,256}$")
367+
params = event["ResourceProperties"].copy()
368+
parameter_pattern_validator("TAG_KEY", params["TAG_KEY"], pattern=r"^.{1,128}$")
369+
parameter_pattern_validator("TAG_VALUE", params["TAG_VALUE"], pattern=r"^.{1,256}$")
368370

369-
return {"TAG_KEY": tag_key, "TAG_VALUE": tag_value}
371+
return params
370372

371373

372374
@helper.create
@@ -384,7 +386,7 @@ def create_update_event(event: CloudFormationCustomResourceEvent, context: Conte
384386
event_info = {"Event": event}
385387
LOGGER.info(event_info)
386388

387-
params = get_validated_parameters()
389+
params = get_validated_parameters(event)
388390
tags: Sequence[TagTypeDef] = [{"Key": params["TAG_KEY"], "Value": params["TAG_VALUE"]}]
389391

390392
ssm_data1 = get_org_ssm_parameter_info(path=SRA_CONTROL_TOWER_SSM_PATH)

‎aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-control-tower-execution-role.yaml

+3-12
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,15 @@ Description:
88
https://github.com/aws-samples/aws-security-reference-architecture-examples
99
Metadata:
1010
SRA:
11-
Version: '1.0'
12-
Order: '1'
13-
11+
Version: 1.0
12+
Order: 2
1413
AWS::CloudFormation::Interface:
1514
ParameterGroups:
1615
- Label:
1716
default: General Properties
1817
Parameters:
1918
- pSRASolutionTagKey
2019
- pSRASolutionName
21-
- pManagementAccountId
2220
- Label:
2321
default: Control Tower Role Attributes
2422
Parameters:
@@ -29,8 +27,6 @@ Metadata:
2927
default: AWS Control Tower Execution Role Name
3028
pCreateAWSControlTowerExecutionRole:
3129
default: Create AWS Control Tower Execution Role
32-
pManagementAccountId:
33-
default: Management Account ID
3430
pSRASolutionName:
3531
default: SRA Solution Name
3632
pSRASolutionTagKey:
@@ -47,11 +43,6 @@ Parameters:
4743
Default: 'true'
4844
Description: Indicates whether the AWS Control Tower Execution role should be created.
4945
Type: String
50-
pManagementAccountId:
51-
AllowedPattern: '^\d{12}$'
52-
ConstraintDescription: Must be 12 digits.
53-
Description: AWS Account ID of the Control Tower Management account.
54-
Type: String
5546
pSRASolutionName:
5647
AllowedValues: [sra-common-prerequisites]
5748
Default: sra-common-prerequisites
@@ -88,7 +79,7 @@ Resources:
8879
Effect: Allow
8980
Principal:
9081
AWS:
91-
- !Sub arn:${AWS::Partition}:iam::${pManagementAccountId}:root
82+
- !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
9283
ManagedPolicyArns:
9384
- !Sub arn:${AWS::Partition}:iam::aws:policy/AdministratorAccess
9485
Tags:

‎aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-main-ssm.yaml

+4-15
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ Description:
88
repo, https://github.com/aws-samples/aws-security-reference-architecture-examples
99
Metadata:
1010
SRA:
11-
Version: '1.0'
12-
Order: '1'
13-
11+
Version: 1.0
12+
Entry: Parameters for deploying solution resolving SSM parameters
13+
Order: 1
1414
AWS::CloudFormation::Interface:
1515
ParameterGroups:
1616
- Label:
@@ -25,7 +25,6 @@ Metadata:
2525
Parameters:
2626
- pAuditAccountId
2727
- pLogArchiveAccountId
28-
- pManagementAccountId
2928
- pRootOrganizationalUnitId
3029
- pOrganizationId
3130
- pHomeRegion
@@ -77,8 +76,6 @@ Metadata:
7776
default: Lambda Log Level
7877
pLogArchiveAccountId:
7978
default: Log Archive Account ID
80-
pManagementAccountId:
81-
default: Management Account ID
8279
pOrganizationId:
8380
default: Organization ID
8481
pRootOrganizationalUnitId:
@@ -177,13 +174,6 @@ Parameters:
177174
Default: /sra/control-tower/log-archive-account-id
178175
Description: SSM Parameter for AWS Account ID of the Control Tower Log Archive account.
179176
Type: AWS::SSM::Parameter::Value<String>
180-
pManagementAccountId:
181-
AllowedPattern: '^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$'
182-
ConstraintDescription:
183-
Must be alphanumeric or special characters [., _, -]. In addition, the slash character ( / ) used to delineate hierarchies in parameter names.
184-
Default: /sra/control-tower/management-account-id
185-
Description: SSM Parameter for AWS Account ID of the Control Tower Management account.
186-
Type: AWS::SSM::Parameter::Value<String>
187177
pOrganizationId:
188178
AllowedPattern: '^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$'
189179
ConstraintDescription:
@@ -227,7 +217,6 @@ Resources:
227217
Value: !Ref pSRASolutionName
228218
Parameters:
229219
pCreateAWSControlTowerExecutionRole: !Ref pCreateAWSControlTowerExecutionRole
230-
pManagementAccountId: !Ref pManagementAccountId
231220

232221
rSSMParametersMemberAccountsStackSet:
233222
Condition: cCreateSSMParametersInMemberAccounts
@@ -272,7 +261,7 @@ Resources:
272261
- ParameterKey: pLogArchiveAccountId
273262
ParameterValue: !Ref pLogArchiveAccountId
274263
- ParameterKey: pManagementAccountId
275-
ParameterValue: !Ref pManagementAccountId
264+
ParameterValue: !Ref AWS::AccountId
276265
- ParameterKey: pOrganizationId
277266
ParameterValue: !Ref pOrganizationId
278267
- ParameterKey: pRootOrganizationalUnitId

‎aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-main.yaml

+4-13
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ Description:
88
https://github.com/aws-samples/aws-security-reference-architecture-examples
99
Metadata:
1010
SRA:
11-
Version: '1.0'
12-
Order: '1'
13-
11+
Version: 1.0
12+
Entry: Parameters for deploying solution without resolving SSM parameters
13+
Order: 1
1414
AWS::CloudFormation::Interface:
1515
ParameterGroups:
1616
- Label:
@@ -25,7 +25,6 @@ Metadata:
2525
Parameters:
2626
- pAuditAccountId
2727
- pLogArchiveAccountId
28-
- pManagementAccountId
2928
- pRootOrganizationalUnitId
3029
- pOrganizationId
3130
- pHomeRegion
@@ -77,8 +76,6 @@ Metadata:
7776
default: Lambda Log Level
7877
pLogArchiveAccountId:
7978
default: Log Archive Account ID
80-
pManagementAccountId:
81-
default: Management Account ID
8279
pOrganizationId:
8380
default: Organization ID
8481
pRootOrganizationalUnitId:
@@ -171,11 +168,6 @@ Parameters:
171168
ConstraintDescription: Must be 12 digits.
172169
Description: AWS Account ID of the Control Tower Log Archive account.
173170
Type: String
174-
pManagementAccountId:
175-
AllowedPattern: '^\d{12}$'
176-
ConstraintDescription: Must be 12 digits.
177-
Description: AWS Account ID of the Control Tower Management account.
178-
Type: String
179171
pOrganizationId:
180172
AllowedPattern: '^o-[a-z0-9]{10,32}$'
181173
ConstraintDescription: Must start with 'o-' followed by from 10 to 32 lowercase letters or digits. (e.g. o-abc1234567)
@@ -215,7 +207,6 @@ Resources:
215207
Value: !Ref pSRASolutionName
216208
Parameters:
217209
pCreateAWSControlTowerExecutionRole: !Ref pCreateAWSControlTowerExecutionRole
218-
pManagementAccountId: !Ref pManagementAccountId
219210

220211
rSSMParametersMemberAccountsStackSet:
221212
Condition: cCreateSSMParametersInMemberAccounts
@@ -260,7 +251,7 @@ Resources:
260251
- ParameterKey: pLogArchiveAccountId
261252
ParameterValue: !Ref pLogArchiveAccountId
262253
- ParameterKey: pManagementAccountId
263-
ParameterValue: !Ref pManagementAccountId
254+
ParameterValue: !Ref AWS::AccountId
264255
- ParameterKey: pOrganizationId
265256
ParameterValue: !Ref pOrganizationId
266257
- ParameterKey: pRootOrganizationalUnitId

‎aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-management-account-parameters.yaml

+2-5
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,8 @@ Description:
88
https://github.com/aws-samples/aws-security-reference-architecture-examples
99
Metadata:
1010
SRA:
11-
Version: '1.0'
12-
Order: '1'
13-
11+
Version: 1.0
12+
Order: 4
1413
AWS::CloudFormation::Interface:
1514
ParameterGroups:
1615
- Label:
@@ -152,8 +151,6 @@ Resources:
152151
Environment:
153152
Variables:
154153
LOG_LEVEL: !Ref pLambdaLogLevel
155-
TAG_KEY: !Ref pSRASolutionTagKey
156-
TAG_VALUE: !Ref pSRASolutionName
157154
Tags:
158155
- Key: !Ref pSRASolutionTagKey
159156
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-member-account-parameters.yaml

+2-3
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,8 @@ Description:
99
https://github.com/aws-samples/aws-security-reference-architecture-examples
1010
Metadata:
1111
SRA:
12-
Version: '1.0'
13-
Order: '2'
14-
12+
Version: 1.0
13+
Order: 5
1514
AWS::CloudFormation::Interface:
1615
ParameterGroups:
1716
- Label:

0 commit comments

Comments
 (0)