Skip to content

Commit fa92477

Browse files
committed
Correct typos and align instructions with other solutions
1 parent cc219cb commit fa92477

File tree

3 files changed

+21
-37
lines changed

3 files changed

+21
-37
lines changed

solutions/common/register-delegated-administrator/aws-control-tower/manifest-v2.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ resources:
99
# Common Register Delegated Administrator Solution
1010
# -----------------------------------------------------------------------------
1111
- name: CommonRegisterDelegatedAdmin
12-
resource_file: templates/common-register-delegated-admin.yaml
12+
resource_file: templates/common-register-delegated-administrator.yaml
1313
parameters:
1414
- parameter_key: pDelegatedAdminAccountId
1515
parameter_value: $[alfred_ssm_/org/member/Audit/account_id]

solutions/config/conformance-pack-org/README.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -213,9 +213,10 @@ get started and to evaluate your AWS environment, use one of the sample conforma
213213
#### Pre-requisites
214214
1. Create AWS Config Conformance Pack Templates S3 Bucket in the Security Tooling Account
215215
* Create an SSM parameter in the Organization Management Account (Optional)
216-
* CloudFormation template to create the S3 bucket - documentation/setup/create-conformance-pack-templates-bucket.yaml
217-
2. Upload documentation/setup/conformance-pack-templates/aws-control-tower-detective-guardrails.yaml to the AWS Config
218-
Conformance Pack Templates S3 Bucket
216+
* [CloudFormation template](./documentation/setup/create-conformance-pack-templates-bucket.yaml) to create the S3 bucket
217+
2. Upload [aws-control-tower-detective-guardrails.yaml](./documentation/setup/conformance-pack-templates/aws-control-tower-detective-guardrails.yaml)
218+
or [Operational-Best-Practices-for-Encryption-and-Keys.yaml](./documentation/setup/conformance-pack-templates/Operational-Best-Practices-for-Encryption-and-Keys.yaml)
219+
to the AWS Config Conformance Pack Templates S3 Bucket
219220

220221
#### Instructions
221222

solutions/firewall-manager/firewall-manager-org/README.md

Lines changed: 16 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -290,41 +290,24 @@ the account when the custom resource is deleted via CloudFormation.
290290

291291
### Instructions
292292

293-
1. Following [AWS Lambda Best Practices](https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html) -
294-
Use the provided packaging script to locally build and package the Lambda function used by the CloudFormation
295-
Custom Resource. Start the process by executing the **package-lambda.sh** in the **/extras/packaging-scripts**
296-
directory. - [Packaging script](../../../extras/packaging-scripts/package-lambda.sh)
297-
298-
```bash
299-
./package-lambda.sh \
300-
--file_name firewall-manager-org.zip \
301-
--bucket lambda-src-s3-bucket \
302-
--src_dir ~/aws-security-reference-architecture-examples/solutions/firewall-manager/firewall-manager-org/code/src
293+
1. Package the Lambda code into a zip file and upload it to the S3 bucket
294+
* Package and Upload the Lambda zip file to S3 - [Packaging script](../../../extras/packaging-scripts/package-lambda.sh)
295+
```shell
296+
export BUCKET=lambda-zips-CHANGE_ME_ACCOUNT_ID-CHANGE_ME_REGION
297+
sh ~/aws-security-reference-architecture-examples/extras/packaging-scripts/package-lambda.sh \
298+
--file_name firewall-manager-org-delegate-admin.zip \
299+
--bucket $BUCKET \
300+
--src_dir ~/aws-security-reference-architecture-examples/solutions/firewall-manager/firewall-manager-org/code/src
303301
```
302+
2. Create a CloudFormation StackSet or Stack within the AWS account using the following templates
303+
304+
| Account | StackSet Name | Template |
305+
| --------------- | ----------------- | ---------- |
306+
| Management | FirewallManagerOrgDelegateAdmin | templates/firewall-manager-org-delegated-admin.yaml |
307+
| Security | FirewallManagerOrgSGPolicy | templates/firewall-manager-org-sg-policy.yaml |
308+
| Security | FirewallManagerOrgWAFPolicy | templates/firewall-manager-org-waf-policy.yaml |
309+
| Security | FirewallManagerOrgDisassociateRole | templates/firewall-manager-org-disassociate-iam-role.yaml |
304310

305-
2. In your Organizational Management Account - deploy the fw-manager-delegated-admin.template. The Template
306-
requires a single parameter: **pDelegatedAdministrationAccountNumber**. Specify the AWS Account Number of the
307-
account that you wish to delegate administration of Firewall Manager to for the parameter.
308-
IMPORTANT - replace the parameter values with the Account Number you wish to delegate FW manager administration to,
309-
the S3 Bucket you uploaded the Lambda Package to, and the name of the lambda package (s3 key) in that bucket.
310-
311-
```bash
312-
aws cloudformation create-stack \
313-
--stack-name firewall-manager-org-delegate-admin \
314-
--capabilities CAPABILITY_IAM \
315-
--template-body file://firewall-manager-org-delegate-admin.yaml
316-
--parameters \
317-
ParameterKey=pDelegatedAdminAccountId,ParameterValue=REPLACE-ME-WITH-YOUR-DELEGATED-ACCOUNT-NUMBER \
318-
ParameterKey=pLambdaS3BucketName,ParameterValue=REPLACE-ME-WITH-YOUR-LAMBDA-UPLOAD-BUCKET \
319-
ParameterKey=pLambdaZipFileName,ParameterValue=REPLACE-ME-WITH-THE-NAME-OF-THE-LAMBDA-ZIP-FILE \
320-
ParameterKey=pRoleToAssume,ParameterValue=REPLACE-ME-WITH-THE-ROLE-TO-ASSUME \
321-
ParameterKey=pTagKey1,ParameterValue=REPLACE-ME-WITH-THE-TAG-KEY \
322-
ParameterKey=pTagValue1,ParameterValue=REPLACE-ME-WITH-THE-TAG-VALUE
323-
```
324-
325-
3. Next deploy both the **firewall-manager-org-waf-policy.yaml** and **firewall-manager-org-sg-policy.yaml** in the
326-
AWS Account that you delegated Firewall Manager Administration to in the previous step. Review the templates for
327-
specifics on parameter requirements.
328311

329312
----
330313

0 commit comments

Comments
 (0)