Skip to content

Commit 853ec32

Browse files
andywick-awsandywick-aws
authored
Merge pull request #41 from aws-samples/feature/macie-refactor
Feature/macie refactor
2 parents 1993873 + 247133d commit 853ec32

21 files changed

+684
-406
lines changed

‎solutions/macie/macie-org/README.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ All resources are deployed via CloudFormation StackSet and Stack
4242
**Description:**
4343

4444
The custom CloudFormation Lambda resource is required to delegate an administrator account because this capability
45-
is not supported by CloudFormation (December 2020)
45+
is not supported by CloudFormation (August 2021)
4646

4747
**Configuration:**
4848

@@ -54,6 +54,8 @@ is not supported by CloudFormation (December 2020)
5454
* DELEGATED_ADMIN_ACCOUNT_ID - Organization Member Account ID which is typically the Security account
5555
* DISABLE_MACIE_ROLE_NAME - Role within each member account used to disable Macie
5656
* ENABLED_REGIONS - Comma delimited list of regions to enable Macie in. Leave blank for all supported regions.
57+
* FINDING_PUBLISHING_FREQUENCY - Specifies how often to publish updates to policy findings for the account.
58+
Default = 'FIFTEEN_MINUTES', Valid values = 'FIFTEEN_MINUTES', 'ONE_HOUR', 'SIX_HOURS'
5759
* KMS_KEY_ARN - KMS Key ARN to encrypt the Macie classifications sent to S3
5860
* S3_BUCKET_NAME - S3 bucket ARN to send the Macie classifications
5961

@@ -69,7 +71,6 @@ Contains Lambda function execution logs
6971

7072
**Configuration:**
7173

72-
* Retention = Default 2 weeks (14 days)
7374
* Log group name = /aws/lambda/[Lambda Function Name]
7475

7576
### 1.4 Lambda Execution IAM Role
@@ -114,7 +115,7 @@ to configure Macie with the below configurations.
114115

115116
**Description:**
116117

117-
All resources are deployed via CloudFormation Stack created by the management account StackSet
118+
All resources are deployed via CloudFormation Stack created by the Management account StackSet
118119

119120
**Configuration:**
120121

@@ -155,7 +156,7 @@ Macie is enabled for existing accounts within each member account and region dur
155156

156157
**Description:**
157158

158-
All resources are deployed via CloudFormation Stack created by the management account StackSet
159+
All resources are deployed via CloudFormation Stack created by the Management account StackSet
159160

160161
**Configuration:**
161162

@@ -171,7 +172,7 @@ Customer managed KMS key used for encrypting exported Macie findings
171172
**Configuration:**
172173

173174
* Key alias
174-
* Organization Primary Account ID
175+
* Organization Management Account ID
175176
* Logging Account ID
176177
* KMS Key Tag
177178

‎solutions/macie/macie-org/aws-control-tower/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
2222
4. Update the manifest.yaml file with your account names
2323
5. Deploy the Customizations for AWS Control Tower configuration
2424
6. How to verify after the pipeline completes?
25-
1. Log into the Primary account and navigate to the Macie page
25+
1. Log into the Management account and navigate to the Macie page
2626
1. Validate that the delegated admin account is set for each region
2727
2. Log into the Audit account and navigate to the Macie page
2828
1. Verify the correct Macie configurations have been applied to each region
@@ -40,7 +40,7 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
4040
1. Remove the Macie configurations from the manifest.yaml file
4141
2. (Optional) Delete the parameter and template files for the Macie solution
4242
3. Deploy the Customizations for AWS Control Tower configuration
43-
4. After the pipeline completes, log into the Primary account and navigate to the CloudFormation page
43+
4. After the pipeline completes, log into the Management account and navigate to the CloudFormation page
4444
1. Delete the CustomControlTower-MacieOrgDeliveryS3Bucket CloudFormation StackSet
4545
2. Log into the Log Archive account and delete the Macie S3 bucket
4646
3. Delete the Stack Instance from the CustomControlTower-MacieOrgDeliveryS3Bucket CloudFormation StackSet
@@ -49,6 +49,7 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
4949
6. After the Stack Instance deletes, delete the CustomControlTower-MacieOrgDeliveryKMSKey CloudFormation StackSet
5050
7. Delete the Stack Instances from the CustomControlTower-MacieOrgMemberDisableRole CloudFormation StackSet
5151
8. After the Stack Instance deletes, delete the CustomControlTower-MacieOrgMemberDisableRole CloudFormation StackSet
52+
9. Delete the Lambda CloudWatch Log Group within the Management account
5253

5354

5455

‎solutions/macie/macie-org/aws-control-tower/manifest-v2.yaml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2021-03-15
5+
6+
# Control Tower Custom Resources (Service Control Policies or CloudFormation)
7+
resources:
8+
# -----------------------------------------------------------------------------
9+
# Amazon Macie
10+
# -----------------------------------------------------------------------------
11+
- name: MacieOrgConfigurationRole
12+
resource_file: templates/macie-org-configuration-role.yaml
13+
parameters:
14+
- parameter_key: pConfigurationRoleName
15+
parameter_value: "cfct-macie-configuration"
16+
- parameter_key: pOrgManagementAccountId
17+
parameter_value: $[alfred_ssm_/org/member/Control-Tower-Management/account_id]
18+
- parameter_key: pOrgPrimaryLambdaRoleName
19+
parameter_value: "cfct-macie-org-lambda"
20+
- parameter_key: pTagKey1
21+
parameter_value: "cfct"
22+
- parameter_key: pTagValue1
23+
parameter_value: "managed-by-cfct"
24+
deploy_method: stack_set
25+
deployment_targets:
26+
accounts:
27+
- Audit
28+
29+
- name: MacieOrgDeliveryKMSKey
30+
resource_file: templates/macie-org-kms-key.yaml
31+
parameters:
32+
- parameter_key: pMacieDeliveryKeyAlias
33+
parameter_value: "MacieDeliveryKMSKey"
34+
- parameter_key: pLoggingAccountId
35+
parameter_value: $[alfred_ssm_/org/member/Log-archive/account_id]
36+
- parameter_key: pOrgManagementAccountId
37+
parameter_value: $[alfred_ssm_/org/member/Control-Tower-Management/account_id]
38+
- parameter_key: pTagKey1
39+
parameter_value: "cfct"
40+
- parameter_key: pTagValue1
41+
parameter_value: "managed-by-cfct"
42+
deploy_method: stack_set
43+
export_outputs:
44+
- name: /org/macie/kms_key_arn
45+
value: $[output_oMacieDeliveryKeyArn]
46+
deployment_targets:
47+
accounts:
48+
- Audit
49+
50+
- name: MacieOrgDeliveryS3Bucket
51+
resource_file: templates/macie-org-s3-bucket.yaml
52+
parameters:
53+
- parameter_key: pDelegatedAdminAccountId
54+
parameter_value: $[alfred_ssm_/org/member/Audit/account_id]
55+
- parameter_key: pMacieDeliveryBucketPrefix
56+
parameter_value: "macie-delivery"
57+
- parameter_key: pMacieDeliveryKMSKeyArn
58+
parameter_value: $[alfred_ssm_/org/macie/kms_key_arn]
59+
- parameter_key: pOrganizationId
60+
parameter_value: $[alfred_ssm_/org/primary/organization_id]
61+
- parameter_key: pTagKey1
62+
parameter_value: "cfct"
63+
- parameter_key: pTagValue1
64+
parameter_value: "managed-by-cfct"
65+
deploy_method: stack_set
66+
export_outputs:
67+
- name: /org/macie/s3_bucket
68+
value: $[output_oMacieDeliveryS3Bucket]
69+
deployment_targets:
70+
accounts:
71+
- Log archive
72+
73+
- name: MacieOrgConfiguration
74+
resource_file: templates/macie-org-configuration.yaml
75+
parameters:
76+
- parameter_key: pConfigurationRoleName
77+
parameter_value: "cfct-macie-configuration"
78+
- parameter_key: pControlTowerRegionsOnly
79+
parameter_value: "true"
80+
- parameter_key: pDelegatedAdminAccountId
81+
parameter_value: $[alfred_ssm_/org/member/Audit/account_id]
82+
- parameter_key: pDisableMacieRoleName
83+
parameter_value: "cfct-disable-macie"
84+
- parameter_key: pEnabledRegions
85+
parameter_value: ""
86+
- parameter_key: pFindingPublishingFrequency
87+
parameter_value: "FIFTEEN_MINUTES"
88+
- parameter_key: pKMSKeyArn
89+
parameter_value: "$[alfred_ssm_/org/macie/kms_key_arn]"
90+
- parameter_key: pLambdaExecutionRoleName
91+
parameter_value: "cfct-macie-org-lambda"
92+
- parameter_key: pLambdaFunctionName
93+
parameter_value: "cfct-macie-org-configuration"
94+
- parameter_key: pLambdaS3BucketName
95+
parameter_value: $[alfred_ssm_/org/primary/lambda_zips_bucket/us-east-1]
96+
- parameter_key: pLambdaZipFileName
97+
parameter_value: "macie-org-configuration.zip"
98+
- parameter_key: pLogLevel
99+
parameter_value: "debug"
100+
- parameter_key: pOrganizationId
101+
parameter_value: $[alfred_ssm_/org/primary/organization_id]
102+
- parameter_key: pPublishingDestinationBucketName
103+
parameter_value: "$[alfred_ssm_/org/macie/s3_bucket]"
104+
- parameter_key: pTagKey1
105+
parameter_value: "cfct"
106+
- parameter_key: pTagValue1
107+
parameter_value: "managed-by-cfct"
108+
deploy_method: stack_set
109+
deployment_targets:
110+
accounts:
111+
- Management
112+
113+
- name: MacieOrgMemberDisableRole
114+
resource_file: templates/macie-org-member-disable-role.yaml
115+
parameters:
116+
- parameter_key: pDisableMacieRoleName
117+
parameter_value: "cfct-disable-macie"
118+
- parameter_key: pOrgManagementAccountId
119+
parameter_value: $[alfred_ssm_/org/member/Control-Tower-Management/account_id]
120+
- parameter_key: pLambdaRoleName
121+
parameter_value: "cfct-macie-org-lambda"
122+
- parameter_key: pTagKey1
123+
parameter_value: "cfct"
124+
- parameter_key: pTagValue1
125+
parameter_value: "managed-by-cfct"
126+
deploy_method: stack_set
127+
deployment_targets:
128+
organizational_units:
129+
# ALL OU s
130+
- Core
131+
- management
132+
- workloads

‎solutions/macie/macie-org/aws-control-tower/manifest.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,13 @@ cloudformation_resources:
4040
parameter_file: parameters/macie-org-configuration.json
4141
deploy_method: stack_set
4242
deploy_to_account:
43-
- Control Tower Primary
43+
- Control Tower Management
4444

4545
- name: MacieOrgMemberDisableRole
4646
template_file: templates/macie-org-member-disable-role.yaml
4747
parameter_file: parameters/macie-org-member-disable-role.json
4848
deploy_method: stack_set
4949
deploy_to_ou:
5050
- Core
51-
- primary
51+
- management
5252
- workloads

‎solutions/macie/macie-org/aws-control-tower/parameters/macie-org-configuration-role.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
"ParameterValue": "cfct-macie-configuration"
55
},
66
{
7-
"ParameterKey": "pOrgPrimaryAccountId",
8-
"ParameterValue": "$[alfred_ssm_/org/member/Control-Tower-Primary/account_id]"
7+
"ParameterKey": "pOrgManagementAccountId",
8+
"ParameterValue": "$[alfred_ssm_/org/member/Control-Tower-Management/account_id]"
99
},
1010
{
11-
"ParameterKey": "pOrgPrimaryLambdaRoleName",
11+
"ParameterKey": "pLambdaRoleName",
1212
"ParameterValue": "cfct-macie-org-lambda"
1313
},
1414
{

‎solutions/macie/macie-org/aws-control-tower/parameters/macie-org-configuration.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,6 @@
77
"ParameterKey": "pControlTowerRegionsOnly",
88
"ParameterValue": "true"
99
},
10-
{
11-
"ParameterKey": "pDefaultLogGroupRetention",
12-
"ParameterValue": "30"
13-
},
1410
{
1511
"ParameterKey": "pDelegatedAdminAccountId",
1612
"ParameterValue": "$[alfred_ssm_/org/member/Audit/account_id]"
@@ -23,6 +19,10 @@
2319
"ParameterKey": "pEnabledRegions",
2420
"ParameterValue": ""
2521
},
22+
{
23+
"ParameterKey": "pFindingPublishingFrequency",
24+
"ParameterValue": "FIFTEEN_MINUTES"
25+
},
2626
{
2727
"ParameterKey": "pKMSKeyArn",
2828
"ParameterValue": "$[alfred_ssm_/org/macie/kms_key_arn]"
@@ -41,7 +41,7 @@
4141
},
4242
{
4343
"ParameterKey": "pLambdaZipFileName",
44-
"ParameterValue": "macie-org-configuration-v1.zip"
44+
"ParameterValue": "macie-org-configuration.zip"
4545
},
4646
{
4747
"ParameterKey": "pLogLevel",

‎solutions/macie/macie-org/aws-control-tower/parameters/macie-org-kms-key.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
[
22
{
3-
"ParameterKey": "pMacieDeliveryKeyAlias",
4-
"ParameterValue": "MacieDeliveryKMSKey"
3+
"ParameterKey": "pLoggingAccountId",
4+
"ParameterValue": "$[alfred_ssm_/org/member/Log-archive/account_id]"
55
},
66
{
7-
"ParameterKey": "pOrgPrimaryAccountId",
8-
"ParameterValue": "$[alfred_ssm_/org/member/Control-Tower-Primary/account_id]"
7+
"ParameterKey": "pMacieDeliveryKeyAlias",
8+
"ParameterValue": "MacieDeliveryKMSKey"
99
},
1010
{
11-
"ParameterKey": "pLoggingAccountId",
12-
"ParameterValue": "$[alfred_ssm_/org/member/Log-archive/account_id]"
11+
"ParameterKey": "pOrgManagementAccountId",
12+
"ParameterValue": "$[alfred_ssm_/org/member/Control-Tower-Management/account_id]"
1313
},
1414
{
1515
"ParameterKey": "pTagKey1",

‎solutions/macie/macie-org/aws-control-tower/parameters/macie-org-member-disable-role.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
"ParameterValue": "cfct-disable-macie"
55
},
66
{
7-
"ParameterKey": "pOrgPrimaryAccountId",
8-
"ParameterValue": "$[alfred_ssm_/org/member/Control-Tower-Primary/account_id]"
7+
"ParameterKey": "pOrgManagementAccountId",
8+
"ParameterValue": "$[alfred_ssm_/org/member/Control-Tower-Management/account_id]"
99
},
1010
{
11-
"ParameterKey": "pOrgPrimaryLambdaRoleName",
11+
"ParameterKey": "pLambdaRoleName",
1212
"ParameterValue": "cfct-macie-org-lambda"
1313
},
1414
{

‎solutions/macie/macie-org/aws-control-tower/parameters/macie-org-s3-bucket.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
[
2+
{
3+
"ParameterKey": "pDelegatedAdminAccountId",
4+
"ParameterValue": "$[alfred_ssm_/org/member/Audit/account_id]"
5+
},
26
{
37
"ParameterKey": "pMacieDeliveryBucketPrefix",
48
"ParameterValue": "macie-delivery"
@@ -7,6 +11,10 @@
711
"ParameterKey": "pMacieDeliveryKMSKeyArn",
812
"ParameterValue": "$[alfred_ssm_/org/macie/kms_key_arn]"
913
},
14+
{
15+
"ParameterKey": "pOrganizationId",
16+
"ParameterValue": "$[alfred_ssm_/org/primary/organization_id]"
17+
},
1018
{
1119
"ParameterKey": "pTagKey1",
1220
"ParameterValue": "cfct"

‎solutions/macie/macie-org/aws-landing-zone/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,4 +69,5 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
6969
2. MacieOrgDeliveryS3Bucket - Manually cleanup the S3 bucket after deleting the StackSet
7070
3. MacieOrgDeliveryKMSKey
7171
4. MacieOrgMemberDisableRole
72-
4. Delete all the Macie StackSets
72+
6. Delete all the Macie StackSets
73+
7. Delete the Lambda CloudWatch log group in the management account

0 commit comments

Comments
 (0)