Skip to content

Commit 458c348

Browse files
andywick-awsandywick-aws
authored
Merge pull request #46 from aws-samples/feature/iam-access-analyzer
Feature/iam access analyzer
2 parents 9c0e86c + a690c30 commit 458c348

File tree

11 files changed

+470
-0
lines changed

11 files changed

+470
-0
lines changed

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ platform (e.g. AWS Landing Zone, AWS Control Tower, AWS CloudFormation StackSets
2626
* [Organization Firewall Manager](solutions/firewall-manager/firewall-manager-org)
2727
* GuardDuty
2828
* [Organization GuardDuty](solutions/guardduty/guardduty-org)
29+
* IAM
30+
* [Access Analyzer](solutions/iam/access-analyzer)
2931
* Macie
3032
* [Organization Macie](solutions/macie/macie-org)
3133
* SecurityHub

‎solutions/iam/access-analyzer/README.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
2+
3+
# Access Analyzer
4+
5+
The IAM Access Analyzer solution enables AWS IAM Access Analyzer by delegating administration to a member account
6+
within the Organization management account. It then configures Access Analyzer within the delegated administrator account
7+
for all the existing and future AWS Organization accounts.
8+
9+
In addition to the organization deployment, the solution deploys AWS Access Analyzer to all the member accounts
10+
and regions for analyzing account level permissions.
11+
12+
----
13+
14+
# Table of Contents
15+
* [Deployed Resource Details](#deployed-resource-details)
16+
* [Implementation Instructions](#implementation-instructions)
17+
* [References](#references)
18+
19+
----
20+
21+
# Deployed Resource Details
22+
23+
![Architecture](./documentation/Access-Analyzer-Architecture.png "Architecture")
24+
25+
## 1.0 Organization Management Account
26+
27+
### 1.1 AWS CloudFormation
28+
29+
**Description:**
30+
31+
All resources deployed via CloudFormation StackSet and Stacks within member accounts
32+
33+
**Configuration:**
34+
35+
* StackSet Names:
36+
* AccessAnalyzerOrganization
37+
* AccessAnalyzerAccount
38+
39+
### 1.2 AWS Organizations
40+
41+
**Description:**
42+
43+
AWS Organizations is used to delegate an administrator account for AWS Access Analyzer
44+
45+
**Configuration:**
46+
47+
* Delegated Administrator Account - See [Common Register Delegated Administrator](../../common/register-delegated-administrator)
48+
49+
50+
### 1.3 Account AWS IAM Access Analyzer
51+
52+
**Description:**
53+
54+
AWS IAM Access Analyzer is configured to monitor supported resources for the AWS Account zone of trust.
55+
56+
**Configuration:**
57+
58+
* Access Analyzer Name Prefix: Default = account-access-analyzer
59+
* Tag Key = Access Analyzer Tag Key
60+
* Tag Value = Access Analyzer Tag Value
61+
62+
----
63+
64+
## 2.0 Security Tooling Account
65+
66+
### 2.1 AWS CloudFormation
67+
68+
**Description:**
69+
70+
All resources are deployed via CloudFormation Stack created by the Management account StackSet
71+
72+
**Configuration:**
73+
74+
* Stack Names:
75+
* StackSet-...-AccessAnalyzerAccount-...
76+
* StackSet-...-AccessAnalyzerOrganization-...
77+
78+
### 2.2 Account AWS IAM Access Analyzer
79+
80+
**Description:**
81+
82+
AWS IAM Access Analyzer is configured to monitor supported resources for the AWS Account zone of trust.
83+
84+
**Configuration:**
85+
86+
* Access Analyzer Name Prefix: Default = account-access-analyzer
87+
* Tag Key = Access Analyzer Tag Key
88+
* Tag Value = Access Analyzer Tag Value
89+
90+
### 2.3 Organization AWS IAM Access Analyzer
91+
92+
**Description:**
93+
94+
AWS IAM Access Analyzer is configured to monitor supported resources for the AWS Organization zone of trust.
95+
96+
**Configuration:**
97+
98+
* Access Analyzer Name Prefix: Default = organization-access-analyzer
99+
* Tag Key = Access Analyzer Tag Key
100+
* Tag Value = Access Analyzer Tag Value
101+
102+
----
103+
104+
## 3.0 All Existing and Future Organization Member Accounts
105+
106+
### 3.1 AWS CloudFormation
107+
108+
**Description:**
109+
110+
All resources are deployed via CloudFormation Stack created by the Management account StackSet
111+
112+
**Configuration:**
113+
114+
* Stack Names:
115+
* StackSet-...-AccessAnalyzerAccount-...
116+
117+
### 3.2 Account AWS IAM Access Analyzer
118+
119+
**Description:**
120+
121+
AWS IAM Access Analyzer is configured to monitor
122+
[supported resources](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-resources.html) for the
123+
AWS Account zone of trust.
124+
125+
**Configuration:**
126+
127+
* Access Analyzer Name Prefix: Default = account-access-analyzer
128+
* Tag Key = Access Analyzer Tag Key
129+
* Tag Value = Access Analyzer Tag Value
130+
131+
----
132+
133+
# Implementation Instructions
134+
135+
### [AWS Control Tower](./aws-control-tower)
136+
### CloudFormation StackSets
137+
138+
#### Pre-requisites
139+
1. Register a delegated administrator using the
140+
[Common Register Delegated Administrator](../../common/register-delegated-administrator) solution
141+
1. pServicePrincipalList = "access-analyzer.amazonaws.com"
142+
143+
#### Instructions
144+
145+
> **Solution Deployment Order:**
146+
> 1. Security Account (AccessAnalyzerOrganization)
147+
> 2. All Accounts (AccessAnalyzerAccount)
148+
149+
1. Create CloudFormation StackSets using the following templates
150+
151+
| Account | StackSet Name | Template |
152+
| --------------- | ----------------- | ---------- |
153+
| Management | CommonRegisterDelegatedAdmin | templates/common-register-delegated-administrator.yaml |
154+
| Security | AccessAnalyzerOrganization | templates/access-analyzer-org.yaml |
155+
| All Accounts | AccessAnalyzerAccount | templates/access-analyzer-acct.yaml |
156+
157+
----
158+
159+
# References
160+
* [Using AWS IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html)

‎solutions/iam/access-analyzer/aws-control-tower/README.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
2+
3+
----
4+
5+
# Implementation Instructions
6+
7+
1. Make sure the required [prerequisites](../../../../extras/aws-control-tower/prerequisites/README.md) are completed
8+
2. Package and upload the common-register-delegated-administrator Lambda function
9+
```shell
10+
export AWS_ACCESS_KEY_ID=INSERT_AWS_ACCESS_KEY_ID
11+
export AWS_SECRET_ACCESS_KEY=INSERT_AWS_SECRET_ACCESS_KEY
12+
export AWS_SESSION_TOKEN=INSERT_AWS_SESSION_TOKEN
13+
14+
export BUCKET=lambda-zips-CHANGE_ME_ACCOUNT_ID-CHANGE_ME_REGION
15+
sh ~/aws-security-reference-architecture-examples/extras/packaging-scripts/package-lambda.sh \
16+
--file_name common-register-delegated-admin.zip \
17+
--bucket $BUCKET \
18+
--src_dir ~/aws-security-reference-architecture-examples/solutions/common/register-delegated-admninistrator/code/src
19+
```
20+
3. Copy the files to the Customizations for AWS Control Tower configuration
21+
1. customizations-for-control-tower-configuration
22+
1. [manifest.yaml](manifest.yaml) -> manifest.yaml
23+
2. [common/register-delegated-administrator/aws-control-tower/parameters/common-register-delegated-administrator.json](../../../common/register-delegated-administrator/aws-control-tower/parameters/common-register-delegated-administrator.json)
24+
-> parameters/common-register-delegated-administrator.json
25+
3. [parameters/access-analyzer-acct.json](parameters/access-analyzer-acct.json)
26+
-> parameters/access-analyzer-acct.json
27+
4. [parameters/access-analyzer-org.json](parameters/access-analyzer-org.json)
28+
-> parameters/access-analyzer-org.json
29+
5. [common/register-delegated-administrator/templates/common-register-delegated-administrator.yaml](../../../common/register-delegated-administrator/common-register-delegated-administrator.yaml)
30+
-> templates/common-register-delegated-administrator.yaml
31+
6. [templates/access-analyzer-acct.yaml](../templates/access-analyzer-acct.yaml)
32+
-> templates/access-analyzer-acct.yaml
33+
7. [templates/access-analyzer-org.yaml](../templates/access-analyzer-org.yaml)
34+
-> templates/access-analyzer-org.yaml
35+
36+
4. Update the parameter files with any specific values for your environment
37+
5. Add "access-analyzer.amazonaws.com" to the pServicePrincipalList parameter in the parameters/common-register-delegated-administrator.json
38+
6. Add the [common/register-delegated-administrator/aws-control-tower/manifest.yaml](../../../common/register-delegated-administrator/aws-control-tower)
39+
resource configuration to your manifest.yaml file.
40+
```yaml
41+
...
42+
cloudformation_resources:
43+
# -----------------------------------------------------------------------------
44+
# Common Register Delegated Administrator
45+
# -----------------------------------------------------------------------------
46+
- name: CommonRegisterDelegatedAdmin
47+
template_file: templates/common-register-delegated-administrator.yaml
48+
parameter_file: parameters/common-register-delegated-administrator.json
49+
deploy_method: stack_set
50+
deploy_to_account:
51+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME
52+
...
53+
```
54+
7. Update the manifest.yaml file with your account names and SSM parameters
55+
8. Deploy the Customizations for AWS Control Tower configuration
56+
9. How to verify after the pipeline completes?
57+
1. Log into the Audit account and navigate to the IAM Access Analyzer page
58+
1. Verify that there are 2 Access Analyzers (account and organization)
59+
2. Verify all existing accounts/regions have an account Access Analyzer
60+
61+
# Delete Instructions
62+
63+
1. Within the Customizations for AWS Control Tower configuration
64+
1. Remove the Access Analyzer configuration from the manifest.yaml file
65+
2. (Optional) Delete the parameter and template files for the Access Analyzer solution
66+
2. Deploy the Customizations for AWS Control Tower configuration
67+
3. After the pipeline completes, log into the Management account and navigate to the CloudFormation StackSet page
68+
1. Delete the Stack Instances from the CustomControlTower-AccessAnalyzerOrganization CloudFormation StackSet
69+
2. After the Stack Instance deletes, delete the CustomControlTower-AccessAnalyzerOrganization CloudFormation StackSet
70+
3. Delete the Stack Instances from the CustomControlTower-AccessAnalyzerAccount CloudFormation StackSet
71+
4. After the Stack Instance deletes, delete the CustomControlTower-AccessAnalyzerAccount CloudFormation StackSet
72+
5. Remove the access-analyzer.amazonaws.com service principle from the
73+
parameters/common-register-delegated-administrator.json file

‎solutions/iam/access-analyzer/aws-control-tower/manifest-v2.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2021-03-15
5+
6+
# Control Tower Custom Resources (Service Control Policies or CloudFormation)
7+
resources:
8+
# -----------------------------------------------------------------------------
9+
# IAM Access Analyzer Solution
10+
# -----------------------------------------------------------------------------
11+
- name: AccessAnalyzerOrganization
12+
resource_file: templates/access-analyzer-org.yaml
13+
parameters:
14+
- parameter_key: pAccessAnalyzerName
15+
parameter_value: cfct-organization-access-analyzer
16+
- parameter_key: pTagKey1
17+
parameter_value: cfct
18+
- parameter_key: pTagValue1
19+
parameter_value: managed-by-cfct
20+
deploy_method: stack_set
21+
deployment_targets:
22+
accounts:
23+
- Audit
24+
regions:
25+
- ap-southeast-2
26+
- eu-west-1
27+
- us-east-1
28+
- us-east-2
29+
- us-west-2
30+
31+
- name: AccessAnalyzerAccount
32+
resource_file: templates/access-analyzer-acct.yaml
33+
parameters:
34+
- parameter_key: pAccessAnalyzerNamePrefix
35+
parameter_value: cfct-account-access-analyzer
36+
- parameter_key: pTagKey1
37+
parameter_value: cfct
38+
- parameter_key: pTagValue1
39+
parameter_value: managed-by-cfct
40+
deploy_method: stack_set
41+
deployment_targets:
42+
organizational_units:
43+
- Core
44+
- management
45+
- workloads
46+
regions:
47+
- ap-southeast-2
48+
- eu-west-1
49+
- us-east-1
50+
- us-east-2
51+
- us-west-2

‎solutions/iam/access-analyzer/aws-control-tower/manifest.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2020-01-01
5+
6+
# Control Tower Custom Service Control Policies
7+
organization_policies: []
8+
9+
# Control Tower Custom CloudFormation Resources
10+
cloudformation_resources:
11+
# -----------------------------------------------------------------------------
12+
# IAM Access Analyzer Solution
13+
# -----------------------------------------------------------------------------
14+
- name: AccessAnalyzerOrganization
15+
template_file: templates/access-analyzer-org.yaml
16+
parameter_file: parameters/access-analyzer-org.json
17+
deploy_method: stack_set
18+
deploy_to_account:
19+
- Audit
20+
regions:
21+
- ap-southeast-2
22+
- eu-west-1
23+
- us-east-1
24+
- us-east-2
25+
- us-west-2
26+
27+
- name: AccessAnalyzerAccount
28+
template_file: templates/access-analyzer-acct.yaml
29+
parameter_file: parameters/access-analyzer-acct.json
30+
deploy_method: stack_set
31+
deploy_to_ou:
32+
- Core
33+
- management
34+
- workloads
35+
regions:
36+
- ap-southeast-2
37+
- eu-west-1
38+
- us-east-1
39+
- us-east-2
40+
- us-west-2

‎solutions/iam/access-analyzer/aws-control-tower/parameters/access-analyzer-acct.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[
2+
{
3+
"ParameterKey": "pAccessAnalyzerNamePrefix",
4+
"ParameterValue": "cfct-account-access-analyzer"
5+
},
6+
{
7+
"ParameterKey": "pTagKey1",
8+
"ParameterValue": "cfct"
9+
},
10+
{
11+
"ParameterKey": "pTagValue1",
12+
"ParameterValue": "managed-by-cfct"
13+
}
14+
]

‎solutions/iam/access-analyzer/aws-control-tower/parameters/access-analyzer-org.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[
2+
{
3+
"ParameterKey": "pAccessAnalyzerName",
4+
"ParameterValue": "cfct-organization-access-analyzer"
5+
},
6+
{
7+
"ParameterKey": "pTagKey1",
8+
"ParameterValue": "cfct"
9+
},
10+
{
11+
"ParameterKey": "pTagValue1",
12+
"ParameterValue": "managed-by-cfct"
13+
}
14+
]

‎solutions/iam/access-analyzer/documentation/Access-Analyzer-Architecture.png‎

186 KB
Loading

‎solutions/iam/access-analyzer/documentation/Access-Analyzer-Architecture.pptx‎

137 KB
Binary file not shown.

0 commit comments

Comments
 (0)