Skip to content

Commit e11d584

Browse files
andywick-awsandywick-aws
authoredApr 25, 2022
Merge pull request #96 from tekdj7/alternatecontacts
account_alternate_contacts
·
v3.1.0v2.1.0
2 parents 968160b + 7b6d474 commit e11d584

19 files changed

+3814
-930
lines changed
 

‎CHANGELOG.md

+8
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2022-04-25](#2022-04-25)
67
- [2022-04-14](#2022-04-14)
78
- [2022-04-10](#2022-04-10)
89
- [2022-04-04](#2022-04-04)
@@ -26,6 +27,12 @@ All notable changes to this project will be documented in this file.
2627

2728
---
2829

30+
## 2022-04-25
31+
32+
### Added<!-- omit in toc -->
33+
34+
- Added [Account Alternate Contacts](aws_sra_examples/solutions/account/account_alternate_contacts) solution to set alternate contacts (Billing, Security, Operations) for all existing and future AWS Organization accounts.
35+
2936
## 2022-04-14
3037

3138
### Changed<!-- omit in toc -->
@@ -76,6 +83,7 @@ All notable changes to this project will be documented in this file.
7683
### Removed<!-- omit in toc -->
7784

7885
- Removed the sra-common-cfct-setup-main-ssm.yaml template as it was the same as the other main template.
86+
> > > > > > > 035d75801d00b0f08affe2bf91d7cbfeade1820f
7987
8088
## 2022-03-16
8189

‎README.md

+19-14
Large diffs are not rendered by default.

‎aws_sra_examples/solutions/account/account_alternate_contacts/README.md

+174
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
# Account Alternate Contacts<!-- omit in toc -->
2+
3+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
4+
5+
## Table of Contents
6+
7+
- [Table of Contents](#table-of-contents)
8+
- [Introduction](#introduction)
9+
- [Deployed Resource Details](#deployed-resource-details)
10+
- [Implementation Instructions](#implementation-instructions)
11+
- [References](#references)
12+
13+
---
14+
15+
## Introduction
16+
17+
The Account Alternate Contacts solution sets alternate contacts for all existing and future AWS Organization accounts.
18+
19+
**Key solution features:**
20+
21+
- Sets different alternate contacts for:
22+
- `Billing`: The alternate billing contact will receive billing-related notifications, such as invoice availability notifications.
23+
- `Operations`: The alternate operations contact will receive operations-related notifications.
24+
- `Security`: The alternate security contact will receive security-related notifications, including notifications from the AWS Abuse Team.
25+
- Assumes a role in the management and member accounts to set the alternate contacts.
26+
- Sets alternate contacts for all existing accounts including the `management account` and future accounts.
27+
- Ability to delete alternate contacts via a parameter and CloudFormation update event.
28+
29+
---
30+
31+
## Deployed Resource Details
32+
33+
![Architecture](./documentation/account-alternate-contacts.png)
34+
35+
### 1.0 Organization Management Account<!-- omit in toc -->
36+
37+
#### 1.1 AWS CloudFormation<!-- omit in toc -->
38+
39+
- All resources are deployed via AWS CloudFormation as a `StackSet` and `Stack Instance` within the `management account` or a CloudFormation `Stack` within a specific account.
40+
- The [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/) solution deploys all templates as a CloudFormation `StackSet`.
41+
- For parameter details, review the [AWS CloudFormation templates](templates/).
42+
43+
#### 1.2 IAM Roles<!-- omit in toc -->
44+
45+
- The `Lambda IAM Role` is used by the Lambda function to identify existing and future accounts that need Account Alternate Contacts configured.
46+
- The `Configuration IAM Role` is assumed by the Lambda function to set alternate contacts for the management account and the member accounts.
47+
- The `Event Rule IAM Role` is assumed by EventBridge to forward Global events to the `Home Region` default Event Bus.
48+
49+
#### 1.3 Regional Event Rules<!-- omit in toc -->
50+
51+
- The `AWS Control Tower Lifecycle Event Rule` triggers the `AWS Lambda Function` when a new AWS Account is provisioned through AWS Control Tower.
52+
- The `Organization Compliance Scheduled Event Rule` triggers the `AWS Lambda Function` to capture AWS Account status updates (e.g. suspended to active).
53+
- A parameter is provided to set the schedule frequency.
54+
- See the [Instructions to Manually Run the Lambda Function](#instructions-to-manually-run-the-lambda-function) for triggering the `AWS Lambda Function` before the next scheduled run time.
55+
- The `AWS Organizations Event Rule` triggers the `AWS Lambda Function` when updates are made to accounts within the organization.
56+
- When AWS Accounts are added to the AWS Organization outside of the AWS Control Tower Account Factory. (e.g. account created via AWS Organizations console, account invited from another AWS Organization).
57+
- When tags are added or updated on AWS Accounts.
58+
59+
#### 1.4 Global Event Rules<!-- omit in toc -->
60+
61+
- If the `Home Region` is different from the `Global Region (e.g. us-east-1)`, then global event rules are created within the `Global Region` to forward events to the `Home Region` default Event Bus.
62+
- The `AWS Organizations Event Rule` forwards AWS Organization account update events.
63+
64+
#### 1.5 Dead Letter Queue (DLQ)<!-- omit in toc -->
65+
66+
- SQS dead letter queue used for retaining any failed Lambda events.
67+
68+
#### 1.6 AWS Lambda Function<!-- omit in toc -->
69+
70+
- The Lambda function includes logic to set Account Alternate Contacts.
71+
72+
#### 1.7 Lambda CloudWatch Log Group<!-- omit in toc -->
73+
74+
- All the `AWS Lambda Function` logs are sent to a CloudWatch Log Group `</aws/lambda/<LambdaFunctionName>` to help with debugging and traceability of the actions performed.
75+
- By default the `AWS Lambda Function` will create the CloudWatch Log Group and logs are encrypted with a CloudWatch Logs service managed encryption key.
76+
- Parameters are provided for changing the default log group retention and encryption KMS key.
77+
78+
#### 1.8 Alarm SNS Topic<!-- omit in toc -->
79+
80+
- SNS Topic used to notify subscribers when messages hit the Dead Letter Queue (DLQ).
81+
82+
#### 1.9 SNS Topic<!-- omit in toc -->
83+
84+
- SNS Topic used to fanout the Lambda function for setting the Account Alternate Contact
85+
86+
#### 1.10 Account Alternate Contacts<!-- omit in toc -->
87+
88+
- Account Alternate Contacts (Billing, Operations, Security) are configured for all accounts.
89+
- Account Alternate Contacts can be updated as necessary via CloudFormation parameters.
90+
- Deleting the CloudFormation stack, will not remove the existing Account Alternate Contacts. (see [Solution Delete Instructions](#solution-delete-instructions) for details on deleting alternate contacts)
91+
- **Note:** If a value is provided to the `Exclude Alternate Contact Account Tags` optional CloudFormation parameter, AWS accounts matching those tags will be excluded from account alternate contacts being applied.
92+
93+
---
94+
95+
### 2.0 All Existing and Future Organization Member Accounts<!-- omit in toc -->
96+
97+
#### 2.1 AWS CloudFormation<!-- omit in toc -->
98+
99+
- See [1.1 AWS CloudFormation](#11-aws-cloudformation)
100+
101+
#### 2.2 Configuration IAM Role<!-- omit in toc -->
102+
103+
- See [1.3 Configuration IAM Role](#13-configuration-iam-role)
104+
105+
#### 2.3 Account Alternate Contacts<!-- omit in toc -->
106+
107+
- Account Alternate Contacts (Billing, Operations, Security) are configured for all accounts.
108+
- Account Alternate Contacts can be updated as necessary via CloudFormation parameters.
109+
- Deleting the CloudFormation stack, will not remove the existing Account Alternate Contacts. (see [Solution Delete Instructions](#solution-delete-instructions) for details on deleting alternate contacts)
110+
- **Note:** If a value is provided to the `Exclude Alternate Contact Account Tags` optional CloudFormation parameter, AWS accounts matching those tags will be excluded from account alternate contacts being applied.
111+
112+
---
113+
114+
## Implementation Instructions
115+
116+
### Prerequisites<!-- omit in toc -->
117+
118+
1. [Download and Stage the SRA Solutions](../../../docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md). **Note:** This only needs to be done once for all the solutions.
119+
2. Verify that the [SRA Prerequisites Solution](../../common/common_prerequisites/) has been deployed.
120+
121+
### Solution Deployment<!-- omit in toc -->
122+
123+
Choose a Deployment Method:
124+
125+
- [AWS CloudFormation](#aws-cloudformation)
126+
- [Customizations for AWS Control Tower](../../../docs/CFCT-DEPLOYMENT-INSTRUCTIONS.md)
127+
128+
#### AWS CloudFormation<!-- omit in toc -->
129+
130+
In the `management account (home region)`, launch an AWS CloudFormation **Stack** using one of the options below:
131+
132+
- **Option 1:** (Recommended) Use the [sra-account-alternate-contacts-main-ssm.yaml](templates/sra-account-alternate-contacts-main-ssm.yaml) template. This is a more automated approach where some of the CloudFormation parameters are populated from
133+
SSM parameters created by the [SRA Prerequisites Solution](../../common/common_prerequisites/).
134+
135+
```bash
136+
aws cloudformation deploy --template-file $HOME/aws-sra-examples/aws_sra_examples/solutions/account/account_alternate_contacts/templates/sra-account-alternate-contacts-main-ssm.yaml --stack-name sra-account-alternate-contacts-main-ssm --capabilities CAPABILITY_NAMED_IAM --parameter-overrides pBillingContactAction=add pBillingName=<BILLING_NAME> pBillingTitle=<BILLING_TITLE> pBillingEmail=<BILLING_EMAIL> pBillingPhone=<BILLING_PHONE> pOperationsContactAction=add pOperationsName=<OPERATIONS_NAME> pOperationsTitle=<OPERATIONS_TITLE> pOperationsEmail=<OPERATIONS_EMAIL> pOperationsPhone=<OPERATIONS_PHONE> pSecurityContactAction=add pSecurityName=<SECURITY_NAME> pSecurityTitle=<SECURITY_TITLE> pSecurityEmail=<SECURITY_EMAIL> pSecurityPhone=<SECURITY_PHONE> pSRAAlarmEmail=<SRA_ALARM_EMAIL> pExcludeAlternateContactAccountTags='<EXCLUDE_ALTERNATE_CONTACT_ACCOUNT_TAGS>'
137+
```
138+
139+
- **Option 2:** Use the [sra-account-alternate-contacts-main.yaml](templates/sra-account-alternate-contacts-main.yaml) template. Input is required for the CloudFormation parameters where the default is not set.
140+
141+
```bash
142+
aws cloudformation deploy --template-file $HOME/aws-sra-examples/aws_sra_examples/solutions/account/account_alternate_contacts/templates/sra-account-alternate-contacts-main.yaml --stack-name sra-account-alternate-contacts-main --capabilities CAPABILITY_NAMED_IAM --parameter-overrides pManagementAccountId=<MANAGEMENT_ACCOUNT_ID> pOrganizationId=<ORGANIZATION_ID> pRootOrganizationalUnitId=<ROOT_ORGANIZATIONAL_UNIT_ID> pSRAStagingS3BucketName=<SRA_STAGING_S3_BUCKET_NAME> pBillingContactAction=add pBillingName=<BILLING_NAME> pBillingTitle=<BILLING_TITLE> pBillingEmail=<BILLING_EMAIL> pBillingPhone=<BILLING_PHONE> pOperationsContactAction=add pOperationsName=<OPERATIONS_NAME> pOperationsTitle=<OPERATIONS_TITLE> pOperationsEmail=<OPERATIONS_EMAIL> pOperationsPhone=<OPERATIONS_PHONE> pSecurityContactAction=add pSecurityName=<SECURITY_NAME> pSecurityTitle=<SECURITY_TITLE> pSecurityEmail=<SECURITY_EMAIL> pSecurityPhone=<SECURITY_PHONE> pSRAAlarmEmail=<SRA_ALARM_EMAIL> pExcludeAlternateContactAccountTags='<EXCLUDE_ALTERNATE_CONTACT_ACCOUNT_TAGS>'
143+
```
144+
145+
#### Verify Solution Deployment<!-- omit in toc -->
146+
147+
1. Log into the `management account` and navigate to the Account page
148+
1. Verify that the Alternate Contacts are set correctly.
149+
2. Log into a member account and verify the Alternate Contacts are set correctly.
150+
151+
#### Solution Delete Instructions<!-- omit in toc -->
152+
153+
**Note:** Deleting the solution will not delete the existing Account Alternate Contacts. If needed, update the CloudFormation stack to provide new alternate contacts.
154+
155+
1. (Optional) In the `management account (home region)`, to delete the alternate contacts, change the `Billing Alternate Contact Action`, `Operations Alternate Contact Action`, and `Security Alternate Contact Action` parameters to `delete` and update
156+
the AWS CloudFormation Stack (`sra-account-alternate-contacts-main-ssm` or `sra-account-alternate-contacts-main`).
157+
2. In the `management account (home region)`, delete the AWS CloudFormation **Stack** (`sra-account-alternate-contacts-main-ssm` or `sra-account-alternate-contacts-main`).
158+
3. In the `management account (home region)`, delete the AWS CloudWatch **Log Group** (e.g. /aws/lambda/<solution_name>) for the Lambda function deployed.
159+
160+
#### Instructions to Manually Run the Lambda Function<!-- omit in toc -->
161+
162+
1. In the `management account (home region)`.
163+
2. Navigate to the AWS Lambda Functions page.
164+
3. Select the `checkbox` next to the Lambda Function and select `Test` from the `Actions` menu.
165+
4. Scroll down to view the `Test event`.
166+
5. Click the `Test` button to trigger the Lambda Function with the default values.
167+
6. Verify that the updates were successful within the expected account(s).
168+
169+
---
170+
171+
## References
172+
173+
- [Update the primary and alternate contact information](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html)
174+
- [Adding, changing, or removing alternate contacts](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-account-payment.html#manage-account-payment-alternate-contacts)

‎aws_sra_examples/solutions/account/account_alternate_contacts/customizations_for_aws_control_tower/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Customizations for AWS Control Tower<!-- omit in toc -->
2+
3+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
4+
5+
---
6+
7+
[Customizations for AWS Control Tower Deployment Instructions](../../../../docs/CFCT-DEPLOYMENT-INSTRUCTIONS.md)

‎aws_sra_examples/solutions/account/account_alternate_contacts/customizations_for_aws_control_tower/manifest-v2.yaml

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2021-03-15
5+
6+
# Control Tower Custom Resources (Service Control Policies or CloudFormation)
7+
resources:
8+
# -----------------------------------------------------------------------------
9+
# Account Alternate Contacts
10+
# -----------------------------------------------------------------------------
11+
- name: sra-account-alternate-contacts-main-ssm
12+
resource_file: templates/sra-account-alternate-contacts-main-ssm.yaml
13+
parameters:
14+
- parameter_key: pBillingContactAction
15+
parameter_value: 'add'
16+
- parameter_key: pBillingEmail
17+
parameter_value: ''
18+
- parameter_key: pBillingName
19+
parameter_value: ''
20+
- parameter_key: pBillingPhone
21+
parameter_value: ''
22+
- parameter_key: pBillingTitle
23+
parameter_value: ''
24+
- parameter_key: pComplianceFrequency
25+
parameter_value: 7
26+
- parameter_key: pCreateLambdaLogGroup
27+
parameter_value: 'false'
28+
- parameter_key: pExcludeAlternateContactAccountTags
29+
parameter_value: ''
30+
- parameter_key: pLambdaLogGroupKmsKey
31+
parameter_value: ''
32+
- parameter_key: pLambdaLogLevel
33+
parameter_value: 'INFO'
34+
- parameter_key: pLambdaLogGroupRetention
35+
parameter_value: '14'
36+
- parameter_key: pOperationsContactAction
37+
parameter_value: 'add'
38+
- parameter_key: pOperationsEmail
39+
parameter_value: ''
40+
- parameter_key: pOperationsName
41+
parameter_value: ''
42+
- parameter_key: pOperationsPhone
43+
parameter_value: ''
44+
- parameter_key: pOperationsTitle
45+
parameter_value: ''
46+
- parameter_key: pSecurityContactAction
47+
parameter_value: 'add'
48+
- parameter_key: pSecurityEmail
49+
parameter_value: ''
50+
- parameter_key: pSecurityName
51+
parameter_value: ''
52+
- parameter_key: pSecurityPhone
53+
parameter_value: ''
54+
- parameter_key: pSecurityTitle
55+
parameter_value: ''
56+
- parameter_key: pSRAAlarmEmail
57+
parameter_value: ''
58+
deploy_method: stack_set
59+
deployment_targets:
60+
accounts:
61+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME
62+
63+
# - name: sra-account-alternate-contacts-main
64+
# resource_file: templates/sra-account-alternate-contacts-main-ssm.yaml
65+
# parameters:
66+
# - parameter_key: pBillingContactAction
67+
# parameter_value: 'add'
68+
# - parameter_key: pBillingEmail
69+
# parameter_value: ''
70+
# - parameter_key: pBillingName
71+
# parameter_value: ''
72+
# - parameter_key: pBillingPhone
73+
# parameter_value: ''
74+
# - parameter_key: pBillingTitle
75+
# parameter_value: ''
76+
# - parameter_key: pComplianceFrequency
77+
# parameter_value: 7
78+
# - parameter_key: pCreateLambdaLogGroup
79+
# parameter_value: 'false'
80+
# - parameter_key: pExcludeAlternateContactAccountTags
81+
# parameter_value: ''
82+
# - parameter_key: pLambdaLogGroupKmsKey
83+
# parameter_value: ''
84+
# - parameter_key: pLambdaLogLevel
85+
# parameter_value: 'INFO'
86+
# - parameter_key: pLambdaLogGroupRetention
87+
# parameter_value: '14'
88+
# - parameter_key: pManagementAccountId
89+
# parameter_value: SPECIFY
90+
# - parameter_key: pOperationsContactAction
91+
# parameter_value: 'add'
92+
# - parameter_key: pOperationsEmail
93+
# parameter_value: ''
94+
# - parameter_key: pOperationsName
95+
# parameter_value: ''
96+
# - parameter_key: pOperationsPhone
97+
# parameter_value: ''
98+
# - parameter_key: pOperationsTitle
99+
# parameter_value: ''
100+
# - parameter_key: pOrganizationId
101+
# parameter_value: SPECIFY
102+
# - parameter_key: pRootOrganizationalUnitId
103+
# parameter_value: SPECIFY
104+
# - parameter_key: pSecurityContactAction
105+
# parameter_value: 'add'
106+
# - parameter_key: pSecurityEmail
107+
# parameter_value: ''
108+
# - parameter_key: pSecurityName
109+
# parameter_value: ''
110+
# - parameter_key: pSecurityPhone
111+
# parameter_value: ''
112+
# - parameter_key: pSecurityTitle
113+
# parameter_value: ''
114+
# - parameter_key: pSRAAlarmEmail
115+
# parameter_value: ''
116+
# - parameter_key: pSRAStagingS3BucketName
117+
# parameter_value: SPECIFY
118+
# deploy_method: stack_set
119+
# deployment_targets:
120+
# accounts:
121+
# - REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

‎aws_sra_examples/solutions/account/account_alternate_contacts/customizations_for_aws_control_tower/manifest.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2020-01-01
5+
6+
# Control Tower Custom Service Control Policies
7+
organization_policies: []
8+
9+
# Control Tower Custom CloudFormation Resources
10+
cloudformation_resources:
11+
# -----------------------------------------------------------------------------
12+
# Account Alternate Contacts
13+
# -----------------------------------------------------------------------------
14+
- name: sra-account-alternate-contact-main-ssm
15+
template_file: templates/sra-account-alternate-contacts-main-ssm.yaml
16+
parameter_file: parameters/sra-account-alternate-contacts-main-ssm.json
17+
deploy_method: stack_set
18+
deploy_to_account:
19+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME
20+
21+
# - name: sra-account-alternate-contact-main
22+
# template_file: templates/sra-account-alternate-contact-main.yaml
23+
# parameter_file: parameters/sra-account-alternate-contact-main.json
24+
# deploy_method: stack_set
25+
# deploy_to_account:
26+
# - REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

0 commit comments

Comments
 (0)
Please sign in to comment.