Skip to content

Commit 981e715

Browse files
andywick-awsandywick-aws
committed
Adding AWS Config Aggregator Org solution with a common register delegated administrator solution
1 parent bf8e975 commit 981e715

File tree

17 files changed

+997
-0
lines changed

17 files changed

+997
-0
lines changed

‎solutions/common/register-delegated-administrator/README.md‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
2+
3+
# Register Delegated Administrator Account
4+
5+
The register delegated administrator account solution is a common solution to register a delegated administrator
6+
account (e.g. Security Tooling Account) within the AWS Organizations management account using the AWS Organizations
7+
APIs.
8+
9+
----
10+
11+
# Table of Contents
12+
* [Deployed Resource Details](#deployed-resource-details)
13+
* [Implementation Instructions](#implementation-instructions)
14+
* [References](#references)
15+
16+
----
17+
18+
# Deployed Resource Details
19+
20+
![Architecture](./documentation/Register-Delegated-Admin-Architecture.png "Architecture")
21+
22+
## 1.0 Organization Management Account
23+
24+
### 1.1 AWS CloudFormation
25+
26+
**Description:**
27+
28+
All resources are deployed via CloudFormation StackSet and Stacks within member accounts
29+
30+
**Configuration:**
31+
32+
* StackSet Names:
33+
* RegisterDelegatedAdmin
34+
35+
### 1.2 AWS Lambda Function
36+
37+
**Description:**
38+
39+
The custom CloudFormation Lambda resource is required to delegate an administrator account because this capability
40+
is not supported by CloudFormation.
41+
42+
**Configuration:**
43+
44+
* Lambda Function Name = [Prefix]-register-delegated-admin
45+
* Environment Variables and Properties (Configurable and set via CloudFormation)
46+
* AWS_SERVICE_PRINCIPAL_LIST - AWS service principals to delegate administration for
47+
* DELEGATED_ADMIN_ACCOUNT_ID - Organization Member Account ID, e.g. Security Tooling Account
48+
* LOG_LEVEL - Default = info, Valid Values = debug, info, warning, error, critical
49+
50+
**Input Validation**
51+
52+
Validation of environment variables and properties is done to make sure values exist and are the correct type
53+
54+
### 1.3 Lambda CloudWatch Log Group
55+
56+
**Description:**
57+
58+
Contains Lambda function execution logs
59+
60+
**Configuration:**
61+
62+
* Log group name = /aws/lambda/[Lambda Function]
63+
64+
### 1.4 Lambda Execution IAM Role
65+
66+
**Description:**
67+
68+
Used by the custom CloudFormation Lambda function to enable AWS service access for the provided service and register
69+
an AWS account as the delegated administrator.
70+
71+
**Configuration:**
72+
73+
* Role Name: [Prefix]-register-delegated-admin-lambda
74+
* Policy Name: [Prefix]-register-delegated-admin-lambda
75+
* Permissions:
76+
* CloudWatch Logs - Limited: Write on LogGroupName like /aws/lambda/[Lambda Function]
77+
* Organizations - Limited: List, Read, Write
78+
79+
### 1.5 AWS Organizations
80+
81+
**Description:**
82+
83+
AWS Organizations APIs are used to delegate the administrator account
84+
85+
**Configuration:**
86+
87+
* Delegated Admin Account ID
88+
* Service Principal
89+
90+
91+
----
92+
93+
## 2.0 Delegated Administrator Account (Security Tooling)
94+
95+
### 2.1 Services Supported
96+
97+
**Description:**
98+
99+
The services that support a delegated administrator account can be configured and managed within this account.
100+
101+
**Configuration:**
102+
103+
* Service Principal Mapping
104+
105+
| Service | Service Principal |
106+
| ---------------------------- | -------------------------------------- |
107+
| AWS IAM Access Analyzer | access-analyzer.amazonaws.com |
108+
| AWS Audit Manager | auditmanager.amazonaws.com |
109+
| AWS CloudFormation StackSets | stacksets.cloudformation.amazonaws.com |
110+
| AWS Config | config.amazonaws.com |
111+
| AWS Config Conformance Packs | config-multiaccountsetup.amazonaws.com |
112+
| Amazon Macie | macie.amazonaws.com |
113+
| AWS Security Hub | securityhub.amazonaws.com |
114+
| Amazon S3 Storage Lens | storage-lens.s3.amazonaws.com |
115+
116+
117+
----
118+
119+
# Implementation Instructions
120+
121+
1. Create new or use an existing S3 bucket within the deployment region owned by the Organization Management Account
122+
* Example bucket name: lambda-zips-[Management Account ID]-[AWS region]
123+
* [Example CloudFormation Template](../../../extras/lambda-s3-buckets.yaml)
124+
* Each bucket must allow the s3:GetObject action to the AWS Organization using a bucket policy like the one below
125+
to allow the accounts within the Organization to get the Lambda files.
126+
2. Package the Lambda code into a zip file and upload it to the S3 bucket
127+
* Package and Upload the Lambda zip file to S3 - [Packaging script](../../../extras/packaging-scripts/package-lambda.sh)
128+
```shell
129+
export BUCKET=lambda-zips-CHANGE_ME_ACCOUNT_ID-CHANGE_ME_REGION
130+
sh ~/aws-security-reference-architecture-examples/extras/packaging-scripts/package-lambda.sh \
131+
--file_name common-register-delegated-admin.zip \
132+
--bucket $BUCKET \
133+
--src_dir ~/aws-security-reference-architecture-examples/solutions/common/register-delegated-admninistrator/code/src
134+
```
135+
3. Create a CloudFormation StackSet or Stack with the following template
136+
137+
| Account | StackSet Name | Template |
138+
| --------------- | ----------------- | ---------- |
139+
| Management | RegisterDelegatedAdmin | templates/register-delegated-admin.yaml |
140+
4. Verify configuration using the following AWS CLI shell script
141+
```shell
142+
for accountId in $(aws organizations list-delegated-administrators --query 'DelegatedAdministrators[*].Id' \
143+
--output text); do echo -e "$accountId\n Service Principals: " \
144+
$(aws organizations list-delegated-services-for-account --account-id $accountId \
145+
--query 'DelegatedServices[*].ServicePrincipal'); done
146+
```
147+
148+
----
149+
150+
# References
151+
152+
* [AWS services that you can use with AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html)

‎solutions/common/register-delegated-administrator/aws-control-tower/manifest-v2.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2021-03-15
5+
6+
# Control Tower Custom Resources (Service Control Policies or CloudFormation)
7+
resources:
8+
# -----------------------------------------------------------------------------
9+
# Common Register Delegated Administrator Solution
10+
# -----------------------------------------------------------------------------
11+
- name: CommonRegisterDelegatedAdmin
12+
resource_file: templates/common-register-delegated-admin.yaml
13+
parameters:
14+
- parameter_key: pDelegatedAdminAccountId
15+
parameter_value: $[alfred_ssm_/org/member/Audit/account_id]
16+
- parameter_key: pLambdaExecutionRoleName
17+
parameter_value: cfct-aggregator-register-delegated-admin-lambda
18+
- parameter_key: pLambdaFunctionName
19+
parameter_value: cfct-aggregator-register-delegated-admin
20+
- parameter_key: pLambdaS3BucketName
21+
parameter_value: $[alfred_ssm_/org/primary/lambda_zips_bucket/us-east-1]
22+
- parameter_key: pLambdaZipFileName
23+
parameter_value: common-register-delegated-administrator.zip
24+
- parameter_key: pLogLevel
25+
parameter_value: debug
26+
- parameter_key: pServicePrincipalList
27+
parameter_value: "CHANGE_ME_SERVICE_PRINCIPAL_LIST"
28+
- parameter_key: pTagKey1
29+
parameter_value: cfct
30+
- parameter_key: pTagValue1
31+
parameter_value: managed-by-cfct
32+
deploy_method: stack_set
33+
deployment_targets:
34+
accounts:
35+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

‎solutions/common/register-delegated-administrator/aws-control-tower/manifest.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2020-01-01
5+
6+
# Control Tower Custom Service Control Policies
7+
organization_policies: []
8+
9+
# Control Tower Custom CloudFormation Resources
10+
cloudformation_resources:
11+
# -----------------------------------------------------------------------------
12+
# Common Register Delegated Administrator
13+
# -----------------------------------------------------------------------------
14+
- name: CommonRegisterDelegatedAdmin
15+
template_file: templates/common-register-delegated-administrator.yaml
16+
parameter_file: parameters/common-register-delegated-administrator.json
17+
deploy_method: stack_set
18+
deploy_to_account:
19+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

‎solutions/common/register-delegated-administrator/aws-control-tower/parameters/common-register-delegated-administrator.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
[
2+
{
3+
"ParameterKey": "pDelegatedAdminAccountId",
4+
"ParameterValue": "$[alfred_ssm_/org/member/Audit/account_id]"
5+
},
6+
{
7+
"ParameterKey": "pLambdaExecutionRoleName",
8+
"ParameterValue": "cfct-common-register-delegated-admin-lambda"
9+
},
10+
{
11+
"ParameterKey": "pLambdaFunctionName",
12+
"ParameterValue": "cfct-common-register-delegated-admin"
13+
},
14+
{
15+
"ParameterKey": "pLambdaS3BucketName",
16+
"ParameterValue": "$[alfred_ssm_/org/primary/lambda_zips_bucket/us-east-1]"
17+
},
18+
{
19+
"ParameterKey": "pLambdaZipFileName",
20+
"ParameterValue": "common-register-delegated-administrator.zip"
21+
},
22+
{
23+
"ParameterKey": "pLogLevel",
24+
"ParameterValue": "debug"
25+
},
26+
{
27+
"ParameterKey": "pServicePrincipalList",
28+
"ParameterValue": "CHANGE_ME_SERVICE_PRINCIPAL_LIST"
29+
},
30+
{
31+
"ParameterKey": "pTagKey1",
32+
"ParameterValue": "cfct"
33+
},
34+
{
35+
"ParameterKey": "pTagValue1",
36+
"ParameterValue": "managed-by-cfct"
37+
}
38+
]

0 commit comments

Comments
 (0)