Skip to content

Commit 220c90d

Browse files
IevIeievgeniia ieromenko
IevIe
and
ievgeniia ieromenko
authored
Updated Detective Organization solution to make AWS Control Tower optional (#180)
* Updated Detective Organization solution to make AWS Control Tower optional * Updated documentation * linting fixes --------- Co-authored-by: ievgeniia ieromenko <ieviero@amazon.com>
1 parent 95a3fe8 commit 220c90d

File tree

5 files changed

+26
-30
lines changed

5 files changed

+26
-30
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2023-09-22](#2023-09-22)
67
- [2023-08-07](#2023-08-07)
78
- [2023-07-07](#2023-07-07)
89
- [2023-07-01](#2023-07-07)
@@ -44,6 +45,10 @@ All notable changes to this project will be documented in this file.
4445

4546
---
4647

48+
## 2023-09-22
49+
50+
- Updated [Detective Organization](aws_sra_examples/solutions/detective/detective_org) solution to make AWS Control Tower optional.
51+
4752
## 2023-08-07
4853

4954
- Updated [Common Prerequisites](https://github.com/aws-samples/aws-security-reference-architecture-examples/tree/main/aws_sra_examples/solutions/common/common_prerequisites) solution to make AWS Control Tower optional.

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ Follow the instructions within the [Quick Setup](aws_sra_examples/quick_setup) t
133133
| [S3 Block Account Public Access](aws_sra_examples/solutions/s3/s3_block_account_public_access) | Configures the account-level S3 BPA settings for all accounts within the organization. | Configures S3 BPA settings on buckets created by Control Tower only. | <ul><li>AWS Control Tower</li></ul> |
134134
| [Security Hub](aws_sra_examples/solutions/securityhub/securityhub_org) | Configures Security Hub within a delegated admin account for all accounts and governed regions within the organization. | | <ul><li>AWS Config in all Org Accounts</li><li>[Config Management Account](aws_sra_examples/solutions/config/config_management_account) (*if using AWS Control Tower*)</li></ul> |
135135
| [Inspector](aws_sra_examples/solutions/inspector/inspector_org) | Configure Inspector within a delegated admin account for all accounts and governed regions within the organization. | | |
136-
| [Detective](aws_sra_examples/solutions/detective/detective) | The Detective Organization solution will automate enabling Amazon Detective by delegating administration to an account (e.g. Audit or Security Tooling) and configuring Detective for all the existing and future AWS Organization accounts. **Note:** As of 06/07/2023, this solution is not included in the quick setup (it will be in a future code release) | | <ul><li>AWS Control Tower</li><li>[GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org)</li></ul> |
136+
| [Detective](aws_sra_examples/solutions/detective/detective) | The Detective Organization solution will automate enabling Amazon Detective by delegating administration to an account (e.g. Audit or Security Tooling) and configuring Detective for all the existing and future AWS Organization accounts. | | <ul><li>[GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org)</li></ul> |
137137
## Utils
138138

139139
- packaging_scripts/stage-solution.sh (Package and stage all the AWS SRA example solutions. For more information see [Staging script details](aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md#staging-script-details))

‎aws_sra_examples/solutions/detective/detective_org/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,11 +78,11 @@ The Detective Organization solution will automate enabling Amazon Detective by d
7878

7979
---
8080

81-
### 2.0 Audit Account<!-- omit in toc -->
81+
### 2.0 Audit Account (Security Tooling)<!-- omit in toc -->
8282

8383
The example solutions use `Audit Account` instead of `Security Tooling Account` to align with the default account name used within the AWS Control Tower
8484
setup process for the Security Account. The Account ID for the `Audit Account` SSM parameter is
85-
populated from the `SecurityAccountId` parameter within the `AWSControlTowerBP-BASELINE-CONFIG` StackSet.
85+
populated from the `SecurityAccountId` parameter within the `AWSControlTowerBP-BASELINE-CONFIG` StackSet, but is specified manually in other environments, and then stored in an SSM parameter (this is all done in the common prerequisites solution).
8686

8787
#### 2.1 AWS CloudFormation<!-- omit in toc -->
8888

‎aws_sra_examples/solutions/detective/detective_org/lambda/src/common.py‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@
1616
from botocore.exceptions import ClientError, EndpointConnectionError
1717

1818
if TYPE_CHECKING:
19-
from mypy_boto3_cloudformation import CloudFormationClient
2019
from mypy_boto3_iam.client import IAMClient
2120
from mypy_boto3_organizations import OrganizationsClient
21+
from mypy_boto3_ssm.client import SSMClient
2222
from mypy_boto3_sts.client import STSClient
2323

2424
# Setup Default Logger
@@ -27,15 +27,13 @@
2727
LOGGER.setLevel(log_level)
2828

2929
# Global variables
30-
CLOUDFORMATION_PAGE_SIZE = 20
31-
CLOUDFORMATION_THROTTLE_PERIOD = 0.2
3230
ORGANIZATIONS_PAGE_SIZE = 20
3331
ORGANIZATIONS_THROTTLE_PERIOD = 0.2
3432

3533
try:
3634
MANAGEMENT_ACCOUNT_SESSION = boto3.Session()
37-
CLOUDFORMATION_CLIENT: CloudFormationClient = MANAGEMENT_ACCOUNT_SESSION.client("cloudformation")
3835
ORG_CLIENT: OrganizationsClient = MANAGEMENT_ACCOUNT_SESSION.client("organizations")
36+
SSM_CLIENT: SSMClient = MANAGEMENT_ACCOUNT_SESSION.client("ssm")
3937
except Exception as error:
4038
LOGGER.error({"Unexpected_Error": error})
4139
raise ValueError("Unexpected error executing Lambda function. Review CloudWatch logs for details.") from None
@@ -101,32 +99,13 @@ def get_active_organization_accounts(exclude_accounts: list = None) -> list:
10199

102100

103101
def get_control_tower_regions() -> list: # noqa: CCR001
104-
"""Query 'AWSControlTowerBP-BASELINE-CLOUDWATCH' CloudFormation stack to identify customer regions.
102+
"""Query SSM Parameter Store to identify customer regions.
105103
106104
Returns:
107-
Customer regions chosen in Control Tower
105+
Customer regions
108106
"""
109-
paginator = CLOUDFORMATION_CLIENT.get_paginator("list_stack_instances")
110-
customer_regions = []
111-
aws_account = ""
112-
all_regions_identified = False
113-
for page in paginator.paginate(
114-
StackSetName="AWSControlTowerBP-BASELINE-CLOUDWATCH",
115-
PaginationConfig={"PageSize": CLOUDFORMATION_PAGE_SIZE},
116-
):
117-
for instance in page["Summaries"]:
118-
if not aws_account:
119-
aws_account = instance["Account"]
120-
customer_regions.append(instance["Region"])
121-
continue
122-
if aws_account == instance["Account"]:
123-
customer_regions.append(instance["Region"])
124-
continue
125-
all_regions_identified = True
126-
break
127-
if all_regions_identified:
128-
break
129-
sleep(CLOUDFORMATION_THROTTLE_PERIOD)
107+
ssm_response = SSM_CLIENT.get_parameter(Name="/sra/regions/customer-control-tower-regions")
108+
customer_regions = ssm_response["Parameter"]["Value"].split(",")
130109

131110
return list(customer_regions)
132111

‎aws_sra_examples/solutions/detective/detective_org/templates/sra-detective-org-configuration.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,18 @@ Resources:
281281
- detective:DisableOrganizationAdminAccount
282282
- detective:ListOrganizationAdminAccount
283283
Resource: '*'
284+
285+
- PolicyName: "ssm-access"
286+
PolicyDocument:
287+
Version: "2012-10-17"
288+
Statement:
289+
- Effect: "Allow"
290+
Action:
291+
- ssm:GetParameter
292+
- ssm:GetParameters
293+
Resource:
294+
- !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/sra*"
295+
284296
- PolicyName: sra-detective-org-policy-iam
285297
PolicyDocument:
286298
Version: 2012-10-17

0 commit comments

Comments
 (0)