Skip to content

Commit e3adbcd

Browse files
andywick-awsandywick-aws
committed
new staging script, all solutions refactored to use nested stacks, documentation consistency
1 parent 6dbed05 commit e3adbcd

File tree

258 files changed

+18768
-12840
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

258 files changed

+18768
-12840
lines changed

‎.flake8

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
[flake8]
22
max-line-length = 150
3+
max-complexity = 10
4+
max-cognitive-complexity = 10
35
max-parameters-amount = 7
46
min_python_version = 3.9.0
57
copyright-regexp = Copyright Amazon.com, Inc\..*
@@ -13,8 +15,9 @@ select = A,B,B9,C,D,E,F,G,H,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,W,X,Y,Z,0,1,2,3,4,5,6,7,
1315

1416
# disable below checks:
1517
ignore =
16-
FS003 # f-string missing prefix (false positives with raw strings)
17-
T003: # add link on issue into TODO
18+
FS003, # f-string missing prefix (false positives with raw strings)
19+
T003, # add link on issue into TODO
20+
W503 # Line break occurred before binary operator
1821

1922
# disable flake8 checks for Lambda function source code that will be used inline. (max 4096 characters)
2023
per-file-ignores =

‎.github/ISSUE_TEMPLATE/bug.md

+11-5
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,37 @@
11
---
22
name: Bug
33
about: Report a bug
4-
title: "[BUG] "
4+
title: '[BUG] '
55
labels: bug
66
assignees: ''
7-
87
---
98

109
### Describe the bug
10+
1111
A clear and concise description of what the bug is.
1212

1313
### To Reproduce
14+
1415
Steps to reproduce the behavior:
16+
1517
1. Go to '...'
1618
2. Click on '....'
1719
3. Scroll down to '....'
1820
4. See error
1921

2022
### Expected behavior
23+
2124
A clear and concise description of what you expected to happen.
2225

2326
### Screenshots
27+
2428
If applicable, add screenshots to help explain your problem.
2529

26-
### Deployment Environment (please complete the following information):
27-
- Deployment Framework [e.g. Customizations for Control Tower and CloudFormation StackSets]:
28-
- Deployment Framework Version [e.g. 1.0, 2.0]:
30+
### Deployment Environment (please complete the following information)
31+
32+
- Deployment Framework [e.g. Customizations for Control Tower and CloudFormation StackSets]:
33+
- Deployment Framework Version [e.g. 1.0, 2.0]:
2934

3035
### Additional context
36+
3137
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/feature_request.md

+6-3
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,23 @@
11
---
22
name: Feature request
33
about: Suggest an idea for this project
4-
title: "[FEATURE] "
4+
title: '[FEATURE] '
55
labels: feature
66
assignees: ''
7-
87
---
98

10-
### Is your feature request related to a problem? Please describe.
9+
### Is your feature request related to a problem? Please describe
10+
1111
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
1212

1313
### Describe the solution you'd like
14+
1415
A clear and concise description of what you want to happen.
1516

1617
### Describe alternatives you've considered
18+
1719
A clear and concise description of any alternative solutions or features you've considered.
1820

1921
### Additional context
22+
2023
Add any other context or screenshots about the feature request here. e.g. link to a new AWS feature

‎.github/ISSUE_TEMPLATE/guidance.md

+6-5
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
---
22
name: Guidance
33
about: Ask a guidance question
4-
title: "[Guidance]"
4+
title: '[Guidance]'
55
labels: question
66
assignees: ''
7-
87
---
98

109
<!--
@@ -18,6 +17,7 @@ clarification, instead of filing a new issue.
1817
-->
1918

2019
### The Question
20+
2121
<!--
2222
Ask your question here. Include any details relevant. Make sure you are not
2323
falling prey to the [X/Y problem][2]!
@@ -27,8 +27,9 @@ falling prey to the [X/Y problem][2]!
2727

2828
### Environment
2929

30-
- **Example:** <!-- Name of the example in question -->
31-
- **Framework** <!-- [all | Customizations for Control Tower | CloudFormation StackSets | etc... ] -->
30+
- **Example:** <!-- Name of the example in question -->
31+
- **Framework** <!-- [all | Customizations for Control Tower | CloudFormation StackSets | etc... ] -->
32+
33+
### Other information
3234

33-
### Other information
3435
<!-- e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc -->

‎.github/PULL_REQUEST_TEMPLATE.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
1+
<!-- markdownlint-disable MD041 -->
12
<!--
23
Explain what changed and why.
34
4-
Please read the [Contribution guidelines][1], use the [General Contributing Guidance] checklist,
5+
Please read the [Contribution guidelines][1], use the [General Contributing Guidance] checklist,
56
and follow the pull-request checklist.
67
78
[1]: https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/master/CONTRIBUTING.md
@@ -14,4 +15,4 @@ Fixes # <!-- Please create a new issue if none exists yet -->
1415

1516
By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license].
1617

17-
[Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.0
18+
[Apache 2.0 License](https://www.apache.org/licenses/LICENSE-2.0)

‎CHANGELOG.md

+83
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2022-03-14](#2022-03-14)
67
- [2022-01-07](#2022-01-07)
78
- [2021-12-16](#2021-12-16)
89
- [2021-12-10](#2021-12-10)
@@ -20,6 +21,88 @@ All notable changes to this project will be documented in this file.
2021

2122
---
2223

24+
## 2022-03-14
25+
26+
### Added<!-- omit in toc -->
27+
28+
- Added new document [DOWNLOAD-AND-STAGE-SOLUTIONS.md](aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md) to explain the steps for downloading the SRA example code and staging the solutions within the S3 staging bucket.
29+
- Added [Security Hub Organization](aws_sra_examples/solutions/securityhub/securityhub_org) solution to configure Security Hub using AWS Organizations. All existing accounts are added to the central admin account, standards are enabled/disabled per
30+
provided parameters, a region aggregator is created per the provided paramenter, and a parameter is provided for disabling Security Hub within all accounts and regions via SNS fanout.
31+
32+
### Changed<!-- omit in toc -->
33+
34+
- Updated the [CFCT-DEPLOYMENT-INSTRUCTIONS.md](aws_sra_examples/docs/CFCT-DEPLOYMENT-INSTRUCTIONS.md) document to remove references to the common_cfct_setup solution.
35+
- [CloudTrail](https://github.com/aws-samples/aws-security-reference-architecture-examples/tree/main/aws_sra_examples/solutions/cloudtrail/cloudtrail_org) solution
36+
- Added main templates to simplify deployments via nested stacks.
37+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
38+
- Added integration with Secrets Manager to share CloudFormation output values with the management account.
39+
- Updated the bucket policy to use aws:SourceArn to align with the updated documentation
40+
[Organization Trail Bucket Policy](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html#org-trail-bucket-policy).
41+
- Updated the CFCT configuration to use the main templates and parameters.
42+
- [Common CFCT Setup](aws_sra_examples/solutions/common/common_cfct_setup) solution
43+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
44+
- Removed the Lambda function that created a new OU and moved the management account. This is no longer required due to the latest version of the CFCT solution supporting deployments to the management account within the root OU.
45+
- [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution
46+
- Added a template to create a KMS key for sharing CloudFormation outputs via Secrets Manager secrets.
47+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
48+
- Updated the staging bucket policy to fix the reference to the AWSControlTowerExecution role ARN.
49+
- Added SRA version parameter to main templates for triggering updates to StackSets.
50+
- Added logic within the descriptions to reference the rControlTowerExecutionRoleStack resource if the cCreateAWSControlTowerExecutionRole condition is met. This logic avoids creating an empty stack when the condition is false.
51+
- [Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator) solution
52+
- Added main templates to simplify deployments via nested stacks.
53+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
54+
- Updated the CFCT configuration to use the main templates and parameters.
55+
- Added integration with Secrets Manager to share CloudFormation output values with the management account.
56+
- Updated the Lambda function to align with latest coding standards.
57+
- [AWS Config Aggregator](aws_sra_examples/solutions/config/config_aggregator_org) solution
58+
- Added main templates to simplify deployments via nested stacks.
59+
- Updated the CFCT configuration to use the main templates and parameters.
60+
- Added pRegisterDelegatedAdminAccount parameter to determine whether or not to register the delegated administrator account. This allows the ability to register the delegated admin accounts outside of this solution.
61+
- [AWS Config Conformance Pack](aws_sra_examples/solutions/config/config_conformance_pack_org) solution
62+
- Added main templates to simplify deployments via nested stacks.
63+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
64+
- Updated the CFCT configuration to use the main templates and parameters.
65+
- Added pRegisterDelegatedAdminAccount parameter to determine whether or not to register the delegated administrator account.
66+
- Moved the list_config_recorder_status.py script from the utils/aws_control_tower/helper_scripts to the solution scripts folder.
67+
- Updated and moved the Operational-Best-Practices-for-Encryption-and-Keys.yaml conformance pack template to the templates/aws_config_conformance_packs folder.
68+
- [AWS Config Management Account](aws_sra_examples/solutions/config/config_management_account) solution
69+
- Added SRA version parameter to main templates for triggering updates to StackSets.
70+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
71+
- [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) solution
72+
- Added main templates to simplify deployments via nested stacks.
73+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
74+
- [Firewall Manager](aws_sra_examples/solutions/firewall_manager/firewall_manager_org) solution
75+
- Added main templates to simplify deployments via nested stacks.
76+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
77+
- [GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org) solution
78+
- Added main templates to simplify deployments via nested stacks.
79+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
80+
- Added a parameter and logic to disable GuardDuty within all accounts and regions using SNS fanout.
81+
- [IAM Access Analyzer](aws_sra_examples/solutions/iam/iam_access_analyzer) solution
82+
- Added main templates to simplify deployments via nested stacks.
83+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
84+
- [IAM Password Policy](aws_sra_examples/solutions/iam/iam_password_policy) solution
85+
- Renamed solution and files to remove \_acct suffix
86+
- Added main templates to simplify deployments via nested stacks.
87+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
88+
- [Macie](aws_sra_examples/solutions/macie/macie_org) solution
89+
- Added main templates to simplify deployments via nested stacks.
90+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
91+
- Added a parameter and logic to disable Macie within all accounts and regions using SNS fanout.
92+
- [S3 Block Account Public Access](aws_sra_examples/solutions/s3/s3_block_account_public_access) solution
93+
- Added main templates to simplify deployments via nested stacks.
94+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
95+
96+
### Removed<!-- omit in toc -->
97+
98+
- The `Account Security Hub Enabler` solution was replaced with the [Security Hub Organization](aws_sra_examples/solutions/securityhub/securityhub_org) solution.
99+
- The `package-lambda.sh` script was replaced by the stage_solution.sh script.
100+
- The `Prerequisites for AWS Control Tower solutions` files were replaced with the [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution.
101+
102+
### Fixed<!-- omit in toc -->
103+
104+
- Fixed checkov metadata entries to use updated [check suppression via CFN Metadata](https://github.com/bridgecrewio/checkov/pull/2216).
105+
23106
## 2022-01-07
24107

25108
### Added<!-- omit in toc -->

‎README.md

+15-23
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,11 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
1717
## Introduction
1818

1919
This repository contains code to help developers and engineers deploy AWS security-related services in an `AWS Control Tower` multi-account environment following patterns that align with the
20-
[AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). The Amazon Web Services (AWS) Security Reference Architecture (AWS SRA) is a holistic set of guidelines for deploying the full complement of AWS security services in a multi-account environment.
20+
[AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). The Amazon Web Services (AWS) Security Reference Architecture (AWS SRA) is a holistic set of guidelines for deploying
21+
the full complement of AWS security services in a multi-account environment.
2122

22-
The AWS service configurations and resources (e.g. IAM roles and policies) deployed by these templates are deliberately very restrictive. They are intended to illustrate an implementation pattern rather than provide a complete solution. You may need to modify and tailor these solutions to suit your environment and security needs.
23+
The AWS service configurations and resources (e.g. IAM roles and policies) deployed by these templates are deliberately very restrictive. They are intended to illustrate an implementation pattern rather than provide a complete solution. You may need
24+
to modify and tailor these solutions to suit your environment and security needs.
2325

2426
The examples within this repository have been deployed and tested within an `AWS Control Tower` environment using `AWS CloudFormation` as well as the `Customizations for AWS Control Tower (CFCT)` solution.
2527

@@ -30,8 +32,8 @@ The examples within this repository have been deployed and tested within an `AWS
3032
1. Setup the environment to configure [AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html) within a new or existing AWS account.
3133
2. Deploy the [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution.
3234
3. Choose a deployment method:
33-
- [AWS CloudFormation StackSets/Stacks](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html)
34-
- [Customizations for AWS Control Tower (CFCT)](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/)
35+
- AWS CloudFormation StackSets/Stacks - [AWS Documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html)
36+
- Customizations for AWS Control Tower (CFCT) - [Solution Documentation](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/)
3537
4. (Optional) - Deploy the [Customizations for AWS Control Tower (CFCT) Setup](aws_sra_examples/solutions/common/common_cfct_setup) solution. **Note** Only implement if the CFCT deployment method was selected.
3638
5. Per your requirements select one or all of the [Example Solutions](aws_sra_examples/solutions) to implement via the selected deployment method.
3739

@@ -53,26 +55,24 @@ The examples within this repository have been deployed and tested within an `AWS
5355
- [Organization GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org)
5456
- IAM
5557
- [Access Analyzer](aws_sra_examples/solutions/iam/iam_access_analyzer)
56-
- [Account Password Policy](aws_sra_examples/solutions/iam/iam_password_policy_acct)
58+
- [Account Password Policy](aws_sra_examples/solutions/iam/iam_password_policy)
5759
- Macie
5860
- [Organization Macie](aws_sra_examples/solutions/macie/macie_org)
5961
- S3
6062
- [S3 Block Account Public Access](aws_sra_examples/solutions/s3/s3_block_account_public_access)
6163
- SecurityHub
62-
- [Account SecurityHub Enabler](aws_sra_examples/solutions/securityhub/securityhub_enabler_acct)
64+
- [Organization Security Hub](aws_sra_examples/solutions/securityhub/securityhub_org)
6365

6466
## Utils
6567

66-
- [Prerequisites for AWS Control Tower solutions](aws_sra_examples/utils/aws_control_tower/prerequisites)
67-
- packaging_scripts
68-
- package-lambda.sh (Creates the Lambda zip file and uploads to an S3 bucket)
68+
- packaging_scripts/stage-solution.sh (Package and stage all the AWS SRA example solutions. For more information see [Staging script details](aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md#staging-script-details))
6969

7070
## Environment Setup
7171

7272
Based on the deployment method selected these solutions are required to implement SRA solutions.
7373

74-
- [Common Customizations for AWS Control Tower (CFCT) Setup](aws_sra_examples/solutions/common/common_cfct_setup)
7574
- [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites)
75+
- [Common Customizations for AWS Control Tower (CFCT) Setup](aws_sra_examples/solutions/common/common_cfct_setup)
7676

7777
## Repository and Solution Naming Convention
7878

@@ -96,22 +96,14 @@ The repository is organized by AWS service solutions, which include deployment p
9696
│ │ │ ├── app.py
9797
│ │ │ └── requirements.txt
9898
│ │ └── templates
99-
│ │ ├── guardduty-org-configuration-role.yaml
100-
│ │ ├── guardduty-org-configuration.yaml
101-
│ │ ├── guardduty-org-delete-detector-role.yaml
102-
│ │ ├── guardduty-org-delivery-kms-key.yaml
103-
│ │ └── guardduty-org-delivery-s3-bucket.yaml
99+
│ │ ├── sra-guardduty-org-configuration-role.yaml
100+
│ │ ├── sra-guardduty-org-configuration.yaml
101+
│ │ ├── sra-guardduty-org-delete-detector-role.yaml
102+
│ │ ├── sra-guardduty-org-delivery-kms-key.yaml
103+
│ │ └── sra-guardduty-org-delivery-s3-bucket.yaml
104104
│ ├── ...
105105
```
106106

107-
The example solutions within this repository can be managed/deployed to accounts using AWS Organizations or directly within individual accounts. The suffix on the solution name identifies how the solution is managed/deployed.
108-
109-
| Solution Suffix | Description |
110-
| --------------- | ------------------------------------------------------------------- |
111-
| acct | The solution is managed/deployed within each account |
112-
| org | The solution is managed/deployed to accounts via AWS Organizations |
113-
| ou | The solution is managed/deployed to accounts via Organization Units |
114-
115107
## Frequently Asked Questions
116108

117109
Q. How were these particular solutions chosen? A. All the examples in this repository are derived from common patterns that many customers ask us to help them deploy within their environments. We will be adding to the examples over time.

0 commit comments

Comments
 (0)