You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+19-2
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,7 @@
3
3
## Table of Contents<!-- omit in toc -->
4
4
5
5
-[Introduction](#introduction)
6
+
-[2022-01-07](#2022-01-07)
6
7
-[2021-12-16](#2021-12-16)
7
8
-[2021-12-10](#2021-12-10)
8
9
-[2021-11-22](#2021-11-22)
@@ -19,11 +20,27 @@ All notable changes to this project will be documented in this file.
19
20
20
21
---
21
22
23
+
## 2022-01-07
24
+
25
+
### Added<!-- omit in toc -->
26
+
27
+
-[Customizations for AWS Control Tower (CFCT) Setup](aws_sra_examples/solutions/common/common_cfct_setup) solution
28
+
29
+
### Changed<!-- omit in toc -->
30
+
31
+
- Updates to the [stage_solution.sh](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/utils/packaging_scripts/stage_solution.sh) packaging script to support better error logging and include
32
+
packaging of `common` solutions.
33
+
- In [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) and [AWS Config Management Account](aws_sra_examples/solutions/config/config_management_account) solutions:
34
+
- Updates to logging to include tracebacks for when exceptions are raised.
35
+
- In [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution:
36
+
- Set `DeletionPolicy=Retain` and `UpdateReplacePolicy=Retain` for the IAM Role: `AWSControlTowerExecution`
37
+
- Renamed `DEPLOYMENT-METHODS.md` to [CFCT-DEPLOYMENT-INSTRUCTIONS.md](aws_sra_examples/docs/CFCT-DEPLOYMENT-INSTRUCTIONS.md) to provide manual and automated steps for deployment of Customizations for Control Tower (CFCT), including prerequisites.
This repository contains AWS CloudFormation templates to help developers and engineers deploy AWS security-related services in a multi-account environment following patterns that align with the
18
-
[AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). The Amazon Web Services (AWS) Security Reference Architecture (AWS SRA) is a holistic set of guidelines for deploying
19
-
the full complement of AWS security services in a multi-account environment.
19
+
This repository contains code to help developers and engineers deploy AWS security-related services in an `AWS Control Tower` multi-account environment following patterns that align with the
20
+
[AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). The Amazon Web Services (AWS) Security Reference Architecture (AWS SRA) is a holistic set of guidelines for deploying the full complement of AWS security services in a multi-account environment.
20
21
21
-
The AWS service configurations and resources (e.g. IAM roles and policies) deployed by these templates are deliberately very restrictive. They are intended to illustrate an implementation path rather than provide a complete solution. You will need to
22
-
modify and tailor these templates to suit your individual environment and security needs.
22
+
The AWS service configurations and resources (e.g. IAM roles and policies) deployed by these templates are deliberately very restrictive. They are intended to illustrate an implementation pattern rather than provide a complete solution. You may need to modify and tailor these solutions to suit your environment and security needs.
23
23
24
-
The examples within this repository have been deployed and tested using the corresponding deployment platform (e.g. AWS Control Tower and AWS CloudFormation StackSets).
24
+
The examples within this repository have been deployed and tested within an `AWS Control Tower` environment using `AWS CloudFormation` as well as the `Customizations for AWS Control Tower (CfCT)` solution.
25
+
26
+
## Getting Started with SRA
27
+
28
+
29
+
30
+
1. Setup the environment to configure [AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html) within a new or existing AWS account.
31
+
2. Deploy the [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution.
-[Customizations for AWS Control Tower (CFCT)](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/)
35
+
4. (Optional) - Deploy the [Customizations for AWS Control Tower (CFCT) Setup](aws_sra_examples/common/common_cfct_setup) solution. **Note** Only implement if the CFCT deployment method was selected.
36
+
5. Per your requirements select one or all of the [Example Solutions](aws_sra_examples/solutions) to implement via the selected deployment method.
Copy file name to clipboardExpand all lines: aws_sra_examples/docs/CFCT-DEPLOYMENT-INSTRUCTIONS.md
+43-28
Original file line number
Diff line number
Diff line change
@@ -1,27 +1,41 @@
1
-
# Deployment Methods<!-- omit in toc -->
1
+
# Customizations for AWS Control Tower Deployment Instructions<!-- omit in toc -->
2
2
3
3
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
4
4
5
5
---
6
6
7
7
## Table of Contents<!-- omit in toc -->
8
8
9
-
-[Customizations for AWS Control Tower Deployment Instructions](#customizations-for-aws-control-tower-deployment-instructions)
9
+
-[Prerequisites](#prerequisites)
10
10
-[References](#references)
11
11
12
-
## Customizations for AWS Control Tower Deployment Instructions
12
+
## Prerequisites
13
13
14
-
### Prerequisites<!-- omit in toc -->
14
+
### Enable Trusted Access for AWS CloudFormation StackSets<!-- omit in toc -->
15
+
16
+
1. Within the AWS CloudFormation StackSets console page, `Enable trusted access` with AWS Organizations to use service-managed permissions.
17
+
2. See [Enable trusted access with AWS Organizations](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html) for more details.
18
+
3. To verify that the trusted access is enabled:
19
+
1. Within the AWS Organizations console page, select `Services` from the side menu
20
+
2. Verify that `CloudFormation StackSets` has `Trusted access = Access enabled`
21
+
22
+
### Create the AWSControlTowerExecution IAM Role<!-- omit in toc -->
23
+
24
+
- The `AWSControlTowerExecution` Role provides the support needed to deploy solutions to the `management account` across regions as CloudFormation `StackSets` and it is required for the SRA CFCT solution deployments.
25
+
- This role is created as part of the [common_prerequisites](../solutions/common/common_prerequisites) solution deployment.
26
+
27
+
## Deploy Customizations for AWS Control Tower (CFCT)<!-- omit in toc -->
28
+
29
+
The below prerequisites can be accomplished via the [common_cfct_setup](../solutions/common/common_cfct_setup/) automated solution or they can be done manually following the below steps.
15
30
16
31
1. Move the `Organizations Management Account` to an Organizational Unit (OU) (e.g. Management), so that CloudFormation StackSets can be deployed to the `Management Account`
17
32
1. Within the AWS Control Tower console page, select `Organizational units` from the side menu, click the `Add an OU` button, and set the `OU name = Management`
18
33
2. Within the AWS Organizations console page, select `AWS accounts` from the side menu
19
34
1. Select the checkbox next to the `Management Account`
20
35
2. From the `Actions` menu, select `Move` and select the new `Management OU` that was created above
21
36
3. Select `Move AWS account`
22
-
2. Within the AWS CloudFormation StackSets console page, `Enable trusted access` with AWS Organizations to use service-managed permissions. To verify that the trusted access is enabled:
23
-
1. Within the AWS Organizations console page, select `Services` from the side menu
24
-
2. Verify that `CloudFormation StackSets` has `Trusted access = Access enabled`
37
+
2. Create the `AWSControlTowerExecution` IAM role in the `management account (home region)` by launching an AWS CloudFormation **Stack** using the
38
+
[sra-common-prerequisites-control-tower-execution-role.yaml](../solutions/common/common_prerequisites/templates/sra-common-prerequisites-control-tower-execution-role.yaml) template file as the source.
25
39
3. Deploy the [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/) solution following the below instructions.
26
40
1. In the `Management account (home region)`, deploy a new CloudFormation stack with the below recommended settings:
27
41
<!-- markdownlint-disable-next-line MD034 -->
@@ -30,48 +44,49 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
30
44
-`AWS CodePipeline Source` = AWS CodeCommit
31
45
-`Failure Tolerance Percentage` = 0
32
46
- Acknowledge that AWS CloudFormation might create IAM resources with custom names
33
-
2. On the local machine install [git](https://git-scm.com/downloads) and [git-remote-codecommit](https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-connect.html).
34
-
3. Clone the AWS CodeCommit repository via `git clone codecommit::<HOME REGION>://custom-control-tower-configuration custom-control-tower-configuration`
47
+
48
+
### AWS CodeCommit Repo<!-- omit in toc -->
49
+
50
+
1. On the local machine install [git](https://git-scm.com/downloads) and [git-remote-codecommit](https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-connect.html).
51
+
2. Clone the AWS CodeCommit repository via `git clone codecommit::<HOME REGION>://custom-control-tower-configuration custom-control-tower-configuration`
35
52
36
53
### Deployment Instructions<!-- omit in toc -->
37
54
38
55
1. Determine which version of the [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/) solution you have deployed:
39
-
1. Within the `management account (home region)` find the **CloudFormation Stack** for the Customizations for Control Tower (e.g. custom-control-tower-initiation)
56
+
1. Within the `management account (home region)` find the **CloudFormation Stack** for the Customizations for Control Tower (e.g. `custom-control-tower-initiation`, `sra-common-cfct-setup-main-ssm-rCFCTStack`, `sra-common-cfct-setup-main-rCFCTStack`)
40
57
2. Select the `Outputs` tab
41
58
3. The `CustomControlTowerSolutionVersion`**Value** is the version running in the environment
42
59
1. Version 1 = v1.x.x = manifest.yaml version 2020-01-01
43
60
2. Version 2 = v2.x.x = manifest.yaml version 2021-03-15
44
-
2. Create the `AWSControlTowerExecution` IAM role in the `management account (home region)` by launching an AWS CloudFormation **Stack** using the
45
-
[sra-common-prerequisites-control-tower-execution-role.yaml](../solutions/common/common_prerequisites/templates/sra-common-prerequisites-control-tower-execution-role.yaml) template file as the source.
46
-
3. Follow the instructions for the cooresponding version:
61
+
2. Follow the instructions for the cooresponding version:
#### Version 1 Deployment Instructions<!-- omit in toc -->
51
66
52
67
1. Copy the files to the Customizations for AWS Control Tower configuration `custom-control-tower-configuration`
53
-
- parameters [**required for manifest version 2020-01-01**]
54
-
- Copy the parameter files from the `parameters` folder
55
-
- Only one of the main parameter files is required. We recommend using the `main-ssm` file.
56
-
- policies [optional]
57
-
- service control policies files (\*.json)
58
-
- templates [**required**]
59
-
- Copy the template files from the `templates` folder that are referenced in the `manifest.yaml`
60
-
- Only one of the main template files is required. We recommend using the `main-ssm` file.
61
-
-`manifest.yaml`[**required**]
68
+
- parameters [**required for manifest version 2020-01-01**]
69
+
- Copy the parameter files from the `parameters` folder
70
+
- Only one of the main parameter files is required. We recommend using the `main-ssm` file.
71
+
- policies [optional]
72
+
- service control policies files (\*.json)
73
+
- templates [**required**]
74
+
- Copy the template files from the `templates` folder that are referenced in the `manifest.yaml`
75
+
- Only one of the main template files is required. We recommend using the `main-ssm` file.
76
+
-`manifest.yaml`[**required**]
62
77
2. Verify and update the parameters within each of the parameter json files to match the target environment
63
78
3. Update the manifest.yaml file with the `organizational unit names`, `account names` and `SSM parameters` for the target environment
64
79
4. Deploy the Customizations for AWS Control Tower configuration by pushing the code to the `AWS CodeCommit` repository or uploading to the `AWS S3 Bucket`
65
80
66
81
#### Version 2 Deployment Instructions<!-- omit in toc -->
67
82
68
83
1. Copy the files to the Customizations for AWS Control Tower configuration `custom-control-tower-configuration`
69
-
- policies [optional]
70
-
- service control policies files (\*.json)
71
-
- templates [**required**]
72
-
- Copy the template files from the `templates` folder that are referenced in the `manifest-v2.yaml`
73
-
- Only one of the main template files is required. We recommend using the `main-ssm` file.
74
-
-`manifest-v2.yaml`[**required**]
84
+
- policies [optional]
85
+
- service control policies files (\*.json)
86
+
- templates [**required**]
87
+
- Copy the template files from the `templates` folder that are referenced in the `manifest-v2.yaml`
88
+
- Only one of the main template files is required. We recommend using the `main-ssm` file.
89
+
-`manifest-v2.yaml`[**required**]
75
90
2. Rename the `manifest-v2.yaml` to `manifest.yaml`
76
91
3. Update the manifest.yaml file with the `parameters`, `organizational unit names`, `account names` and `SSM parameters` for the target environment
77
92
4. Deploy the Customizations for AWS Control Tower configuration by pushing the code to the `AWS CodeCommit` repository or uploading to the `AWS S3 Bucket`
0 commit comments