Skip to content

Commit 9c0e86c

Browse files
andywick-awsandywick-aws
authored
Merge pull request #45 from aws-samples/feature/config-aggregator-org
Feature/config aggregator org
2 parents 8aa13f2 + b783028 commit 9c0e86c

File tree

19 files changed

+1142
-0
lines changed

19 files changed

+1142
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ platform (e.g. AWS Landing Zone, AWS Control Tower, AWS CloudFormation StackSets
2020
* [Organization CloudTrail](solutions/cloudtrail/cloudtrail-org)
2121
* Config
2222
* [Account Aggregator](solutions/config/aggregator-acct)
23+
* [Organization Aggregator](solutions/config/aggregator-org)
2324
* [Organization Conformance Pack](solutions/config/conformance-pack-org)
2425
* Firewall Manager
2526
* [Organization Firewall Manager](solutions/firewall-manager/firewall-manager-org)

‎solutions/common/register-delegated-administrator/README.md‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
2+
3+
# Register Delegated Administrator Account
4+
5+
The register delegated administrator account solution is a common solution to register a delegated administrator
6+
account (e.g. Security Tooling Account) within the AWS Organizations management account using the AWS Organizations
7+
APIs.
8+
9+
----
10+
11+
# Table of Contents
12+
* [Deployed Resource Details](#deployed-resource-details)
13+
* [Implementation Instructions](#implementation-instructions)
14+
* [References](#references)
15+
16+
----
17+
18+
# Deployed Resource Details
19+
20+
![Architecture](./documentation/Register-Delegated-Admin-Architecture.png "Architecture")
21+
22+
## 1.0 Organization Management Account
23+
24+
### 1.1 AWS CloudFormation
25+
26+
**Description:**
27+
28+
All resources are deployed via CloudFormation StackSet and Stacks within member accounts
29+
30+
**Configuration:**
31+
32+
* StackSet Names:
33+
* RegisterDelegatedAdmin
34+
35+
### 1.2 AWS Lambda Function
36+
37+
**Description:**
38+
39+
The custom CloudFormation Lambda resource is required to delegate an administrator account because this capability
40+
is not supported by CloudFormation.
41+
42+
**Configuration:**
43+
44+
* Lambda Function Name = [Prefix]-register-delegated-admin
45+
* Environment Variables and Properties (Configurable and set via CloudFormation)
46+
* AWS_SERVICE_PRINCIPAL_LIST - AWS service principals to delegate administration for
47+
* DELEGATED_ADMIN_ACCOUNT_ID - Organization Member Account ID, e.g. Security Tooling Account
48+
* LOG_LEVEL - Default = info, Valid Values = debug, info, warning, error, critical
49+
50+
**Input Validation**
51+
52+
Validation of environment variables and properties is done to make sure values exist and are the correct type
53+
54+
### 1.3 Lambda CloudWatch Log Group
55+
56+
**Description:**
57+
58+
Contains Lambda function execution logs
59+
60+
**Configuration:**
61+
62+
* Log group name = /aws/lambda/[Lambda Function]
63+
64+
### 1.4 Lambda Execution IAM Role
65+
66+
**Description:**
67+
68+
Used by the custom CloudFormation Lambda function to enable AWS service access for the provided service and register
69+
an AWS account as the delegated administrator.
70+
71+
**Configuration:**
72+
73+
* Role Name: [Prefix]-register-delegated-admin-lambda
74+
* Policy Name: [Prefix]-register-delegated-admin-lambda
75+
* Permissions:
76+
* CloudWatch Logs - Limited: Write on LogGroupName like /aws/lambda/[Lambda Function]
77+
* Organizations - Limited: List, Read, Write
78+
79+
### 1.5 AWS Organizations
80+
81+
**Description:**
82+
83+
AWS Organizations APIs are used to delegate the administrator account
84+
85+
**Configuration:**
86+
87+
* Delegated Admin Account ID
88+
* Service Principal
89+
90+
91+
----
92+
93+
## 2.0 Delegated Administrator Account (Security Tooling)
94+
95+
### 2.1 Services Supported
96+
97+
**Description:**
98+
99+
The services that support a delegated administrator account can be configured and managed within this account.
100+
101+
**Configuration:**
102+
103+
* Service Principal Mapping
104+
105+
| Service | Service Principal |
106+
| ---------------------------- | -------------------------------------- |
107+
| AWS IAM Access Analyzer | access-analyzer.amazonaws.com |
108+
| AWS Audit Manager | auditmanager.amazonaws.com |
109+
| AWS CloudFormation StackSets | stacksets.cloudformation.amazonaws.com |
110+
| AWS Config | config.amazonaws.com |
111+
| AWS Config Conformance Packs | config-multiaccountsetup.amazonaws.com |
112+
| Amazon Macie | macie.amazonaws.com |
113+
| AWS Security Hub | securityhub.amazonaws.com |
114+
| Amazon S3 Storage Lens | storage-lens.s3.amazonaws.com |
115+
116+
117+
----
118+
119+
# Implementation Instructions
120+
121+
### [AWS Control Tower](./aws-control-tower)
122+
### CloudFormation StackSets
123+
124+
1. Create new or use an existing S3 bucket within the deployment region owned by the Organization Management Account
125+
* Example bucket name: lambda-zips-[Management Account ID]-[AWS region]
126+
* [Example CloudFormation Template](../../../extras/lambda-s3-buckets.yaml)
127+
* Each bucket must allow the s3:GetObject action to the AWS Organization using a bucket policy like the one below
128+
to allow the accounts within the Organization to get the Lambda files.
129+
2. Package the Lambda code into a zip file and upload it to the S3 bucket
130+
* Package and Upload the Lambda zip file to S3 - [Packaging script](../../../extras/packaging-scripts/package-lambda.sh)
131+
```shell
132+
export BUCKET=lambda-zips-CHANGE_ME_ACCOUNT_ID-CHANGE_ME_REGION
133+
sh ~/aws-security-reference-architecture-examples/extras/packaging-scripts/package-lambda.sh \
134+
--file_name common-register-delegated-admin.zip \
135+
--bucket $BUCKET \
136+
--src_dir ~/aws-security-reference-architecture-examples/solutions/common/register-delegated-admninistrator/code/src
137+
```
138+
3. Create a CloudFormation StackSet or Stack with the following template
139+
140+
| Account | StackSet Name | Template |
141+
| --------------- | ----------------- | ---------- |
142+
| Management | RegisterDelegatedAdmin | templates/register-delegated-admin.yaml |
143+
4. Verify configuration using the following AWS CLI shell script
144+
```shell
145+
for accountId in $(aws organizations list-delegated-administrators --query 'DelegatedAdministrators[*].Id' \
146+
--output text); do echo -e "$accountId\n Service Principals: " \
147+
$(aws organizations list-delegated-services-for-account --account-id $accountId \
148+
--query 'DelegatedServices[*].ServicePrincipal'); done
149+
```
150+
151+
----
152+
153+
# References
154+
155+
* [AWS services that you can use with AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html)

‎solutions/common/register-delegated-administrator/aws-control-tower/README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0
2+
3+
----
4+
5+
# Implementation Instructions
6+
7+
1. Make sure the required [prerequisites](../../../../extras/aws-control-tower/prerequisites/README.md) are completed
8+
2. Package and upload the common-register-delegated-administrator Lambda function
9+
```shell
10+
export AWS_ACCESS_KEY_ID=INSERT_AWS_ACCESS_KEY_ID
11+
export AWS_SECRET_ACCESS_KEY=INSERT_AWS_SECRET_ACCESS_KEY
12+
export AWS_SESSION_TOKEN=INSERT_AWS_SESSION_TOKEN
13+
14+
export BUCKET=lambda-zips-CHANGE_ME_ACCOUNT_ID-CHANGE_ME_REGION
15+
sh ~/aws-security-reference-architecture-examples/extras/packaging-scripts/package-lambda.sh \
16+
--file_name common-register-delegated-admin.zip \
17+
--bucket $BUCKET \
18+
--src_dir ~/aws-security-reference-architecture-examples/solutions/common/register-delegated-admninistrator/code/src
19+
```
20+
3. Copy the files to the Customizations for AWS Control Tower configuration
21+
1. customizations-for-control-tower-configuration
22+
1. [manifest.yaml](manifest.yaml) -> manifest.yaml
23+
2. [common/register-delegated-administrator/aws-control-tower/parameters/common-register-delegated-administrator.json](../../../common/register-delegated-administrator/aws-control-tower/parameters/common-register-delegated-administrator.json)
24+
-> parameters/common-register-delegated-administrator.json
25+
3. [common/register-delegated-administrator/templates/common-register-delegated-administrator.yaml](../../../common/register-delegated-administrator/templates/common-register-delegated-administrator.yaml)
26+
-> templates/common-register-delegated-administrator.yaml
27+
4. Add service principals to the pServicePrincipalList parameter in the
28+
parameters/common-register-delegated-administrator.json
29+
5. Add the [common/register-delegated-administrator/aws-control-tower/manifest.yaml](../../../common/register-delegated-administrator/aws-control-tower)
30+
resource configuration to your manifest.yaml file.
31+
```yaml
32+
...
33+
cloudformation_resources:
34+
# -----------------------------------------------------------------------------
35+
# Common Register Delegated Administrator
36+
# -----------------------------------------------------------------------------
37+
- name: CommonRegisterDelegatedAdmin
38+
template_file: templates/common-register-delegated-administrator.yaml
39+
parameter_file: parameters/common-register-delegated-administrator.json
40+
deploy_method: stack_set
41+
deploy_to_account:
42+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME
43+
...
44+
```
45+
6. Update the manifest.yaml file with your account names and SSM parameters
46+
7. Deploy the Customizations for AWS Control Tower configuration
47+
8. How to verify after the pipeline completes?
48+
1. Export the management account credentials in your local terminal and run the following script:
49+
```shell
50+
for accountId in $(aws organizations list-delegated-administrators --query 'DelegatedAdministrators[*].Id' \
51+
--output text); do echo -e "$accountId\n Service Principals: " \
52+
$(aws organizations list-delegated-services-for-account --account-id $accountId \
53+
--query 'DelegatedServices[*].ServicePrincipal'); done
54+
```
55+
2. Verify that the service principals are listed for the delegated administrator account
56+
57+
# Delete Instructions
58+
59+
1. Verify that all solutions related to the service principals are removed before deleting the solution
60+
2. Within the Customizations for AWS Control Tower configuration
61+
1. Remove the Common Register Delegated Administrator configuration from the manifest.yaml file
62+
2. (Optional) Delete the parameter and template files for the Common Register Delegated Administrator solution
63+
3. Deploy the Customizations for AWS Control Tower configuration
64+
4. After the pipeline completes, log into the Management account and navigate to the CloudFormation StackSet page
65+
1. Delete the Stack Instance from the CustomControlTower-CommonRegisterDelegatedAdmin CloudFormation StackSet
66+
2. After the Stack Instance deletes, delete the CustomControlTower-CommonRegisterDelegatedAdmin CloudFormation
67+
StackSet
68+

‎solutions/common/register-delegated-administrator/aws-control-tower/manifest-v2.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2021-03-15
5+
6+
# Control Tower Custom Resources (Service Control Policies or CloudFormation)
7+
resources:
8+
# -----------------------------------------------------------------------------
9+
# Common Register Delegated Administrator Solution
10+
# -----------------------------------------------------------------------------
11+
- name: CommonRegisterDelegatedAdmin
12+
resource_file: templates/common-register-delegated-admin.yaml
13+
parameters:
14+
- parameter_key: pDelegatedAdminAccountId
15+
parameter_value: $[alfred_ssm_/org/member/Audit/account_id]
16+
- parameter_key: pLambdaExecutionRoleName
17+
parameter_value: cfct-aggregator-register-delegated-admin-lambda
18+
- parameter_key: pLambdaFunctionName
19+
parameter_value: cfct-aggregator-register-delegated-admin
20+
- parameter_key: pLambdaS3BucketName
21+
parameter_value: $[alfred_ssm_/org/primary/lambda_zips_bucket/us-east-1]
22+
- parameter_key: pLambdaZipFileName
23+
parameter_value: common-register-delegated-administrator.zip
24+
- parameter_key: pLogLevel
25+
parameter_value: debug
26+
- parameter_key: pServicePrincipalList
27+
parameter_value: "CHANGE_ME_SERVICE_PRINCIPAL_LIST"
28+
- parameter_key: pTagKey1
29+
parameter_value: cfct
30+
- parameter_key: pTagValue1
31+
parameter_value: managed-by-cfct
32+
deploy_method: stack_set
33+
deployment_targets:
34+
accounts:
35+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

‎solutions/common/register-delegated-administrator/aws-control-tower/manifest.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2020-01-01
5+
6+
# Control Tower Custom Service Control Policies
7+
organization_policies: []
8+
9+
# Control Tower Custom CloudFormation Resources
10+
cloudformation_resources:
11+
# -----------------------------------------------------------------------------
12+
# Common Register Delegated Administrator
13+
# -----------------------------------------------------------------------------
14+
- name: CommonRegisterDelegatedAdmin
15+
template_file: templates/common-register-delegated-administrator.yaml
16+
parameter_file: parameters/common-register-delegated-administrator.json
17+
deploy_method: stack_set
18+
deploy_to_account:
19+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

‎solutions/common/register-delegated-administrator/aws-control-tower/parameters/common-register-delegated-administrator.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
[
2+
{
3+
"ParameterKey": "pDelegatedAdminAccountId",
4+
"ParameterValue": "$[alfred_ssm_/org/member/Audit/account_id]"
5+
},
6+
{
7+
"ParameterKey": "pLambdaExecutionRoleName",
8+
"ParameterValue": "cfct-common-register-delegated-admin-lambda"
9+
},
10+
{
11+
"ParameterKey": "pLambdaFunctionName",
12+
"ParameterValue": "cfct-common-register-delegated-admin"
13+
},
14+
{
15+
"ParameterKey": "pLambdaS3BucketName",
16+
"ParameterValue": "$[alfred_ssm_/org/primary/lambda_zips_bucket/us-east-1]"
17+
},
18+
{
19+
"ParameterKey": "pLambdaZipFileName",
20+
"ParameterValue": "common-register-delegated-administrator.zip"
21+
},
22+
{
23+
"ParameterKey": "pLogLevel",
24+
"ParameterValue": "debug"
25+
},
26+
{
27+
"ParameterKey": "pServicePrincipalList",
28+
"ParameterValue": "CHANGE_ME_SERVICE_PRINCIPAL_LIST"
29+
},
30+
{
31+
"ParameterKey": "pTagKey1",
32+
"ParameterValue": "cfct"
33+
},
34+
{
35+
"ParameterKey": "pTagValue1",
36+
"ParameterValue": "managed-by-cfct"
37+
}
38+
]

0 commit comments

Comments
 (0)