Update code and documentation for apg publication (#2)

Update code and documentation for apg publication.

Author: igirardi

README.md

@@ -27,6 +27,7 @@
 
 
 ACCOUNT_ID = "111111111111"
+ROLE_ARN = ""
 AWS_CONTROL_TOWER_REGION = "eu-west-1"
 
 # pylint: disable=duplicate-code

constants.py

@@ -1,8 +1,5 @@
 {
-    "scripts": {
-       "preinstall": "/usr/bin/env gem install cfn-nag"
-    },
-    "dependencies": {
-       "aws-cdk": "^2.84.0"
-    }
- }
+   "dependencies": {
+      "aws-cdk": "^2.84.0"
+   }
+}

img/ctc-architecture.png

@@ -4,41 +4,41 @@
 #
 #    pip-compile requirements/requirements-dev.in
 #
-astroid==2.15.5
+astroid==2.15.6
     # via pylint
 bandit==1.7.5
-    # via -r requirements-dev.in
+    # via -r requirements/requirements-dev.in
 black==22.12.0
-    # via -r requirements-dev.in
+    # via -r requirements/requirements-dev.in
 certifi==2023.7.22
     # via requests
-charset-normalizer==3.1.0
+charset-normalizer==3.2.0
     # via requests
-click==8.1.3
+click==8.1.6
     # via
     #   black
     #   safety
 colorama==0.4.6
     # via radon
 coverage==7.2.7
-    # via -r requirements-dev.in
-dill==0.3.6
+    # via -r requirements/requirements-dev.in
+dill==0.3.7
     # via pylint
-dparse==0.6.2
+dparse==0.6.3
     # via safety
 flake8==3.9.2
-    # via -r requirements-dev.in
+    # via -r requirements/requirements-dev.in
 future==0.18.3
     # via radon
 gitdb==4.0.10
     # via gitpython
-gitpython==3.1.31
+gitpython==3.1.32
     # via bandit
 idna==3.4
     # via requests
 isort==5.12.0
     # via
-    #   -r requirements-dev.in
+    #   -r requirements/requirements-dev.in
     #   pylint
 lazy-object-proxy==1.9.0
     # via astroid
@@ -52,8 +52,8 @@ mccabe==0.6.1
     #   pylint
 mdurl==0.1.2
     # via markdown-it-py
-mypy==1.3.0
-    # via -r requirements-dev.in
+mypy==1.4.1
+    # via -r requirements/requirements-dev.in
 mypy-extensions==1.0.0
     # via
     #   black
@@ -62,64 +62,70 @@ packaging==21.3
     # via
     #   dparse
     #   safety
-pathspec==0.11.1
+pathspec==0.11.2
     # via black
 pbr==5.11.1
     # via stevedore
-platformdirs==3.6.0
+platformdirs==3.10.0
     # via
     #   black
     #   pylint
 pycodestyle==2.7.0
     # via flake8
 pyflakes==2.3.1
     # via flake8
-pygments==2.15.1
+pygments==2.16.1
     # via rich
-pylint==2.17.4
-    # via -r requirements-dev.in
-pyparsing==3.1.0
+pylint==2.17.5
+    # via -r requirements/requirements-dev.in
+pyparsing==3.1.1
     # via packaging
-pyyaml==6.0
+pyyaml==6.0.1
     # via
     #   bandit
     #   xenon
 radon==5.1.0
     # via
-    #   -r requirements-dev.in
+    #   -r requirements/requirements-dev.in
     #   xenon
 requests==2.31.0
     # via
     #   safety
     #   xenon
-rich==13.4.2
+rich==13.5.2
     # via bandit
 ruamel-yaml==0.17.32
     # via safety
 ruamel-yaml-clib==0.2.7
     # via ruamel-yaml
 safety==2.3.5
-    # via -r requirements-dev.in
+    # via -r requirements/requirements-dev.in
 six==1.16.0
     # via mando
 smmap==5.0.0
     # via gitdb
 stevedore==5.1.0
     # via bandit
-toml==0.10.2
-    # via dparse
-tomlkit==0.11.8
+tomli==2.0.1
+    # via
+    #   black
+    #   dparse
+    #   mypy
+    #   pylint
+tomlkit==0.12.1
     # via pylint
-typing-extensions==4.6.3
-    # via mypy
+typing-extensions==4.7.1
+    # via
+    #   astroid
+    #   mypy
 urllib3==1.26.16
     # via
-    #   -c requirements.in
+    #   -c requirements/requirements.in
     #   requests
 wrapt==1.15.0
     # via astroid
 xenon==0.9.0
-    # via -r requirements-dev.in
+    # via -r requirements/requirements-dev.in
 
 # The following packages are considered to be unsafe in a requirements file:
 # setuptools

package.json

@@ -8,40 +8,40 @@ attrs==23.1.0
     # via
     #   cattrs
     #   jsii
-aws-cdk-asset-awscli-v1==2.2.195
+aws-cdk-asset-awscli-v1==2.2.200
     # via aws-cdk-lib
 aws-cdk-asset-kubectl-v20==2.1.2
     # via aws-cdk-lib
-aws-cdk-asset-node-proxy-agent-v5==2.0.165
+aws-cdk-asset-node-proxy-agent-v5==2.0.166
     # via aws-cdk-lib
-aws-cdk-lib==2.84.0
+aws-cdk-lib==2.90.0
     # via
     #   -r requirements/requirements.in
     #   cdk-nag
-boto3==1.26.155
+boto3==1.28.21
     # via -r requirements/requirements.in
-botocore==1.29.155
+botocore==1.31.21
     # via
     #   boto3
     #   s3transfer
 cattrs==23.1.2
     # via jsii
-cdk-nag==2.27.42
+cdk-nag==2.27.93
     # via -r requirements/requirements.in
-constructs==10.2.54
+constructs==10.2.69
     # via
     #   -r requirements/requirements.in
     #   aws-cdk-lib
     #   cdk-nag
-exceptiongroup==1.1.1
+exceptiongroup==1.1.2
     # via cattrs
-importlib-resources==5.12.0
+importlib-resources==6.0.1
     # via jsii
 jmespath==1.0.1
     # via
     #   boto3
     #   botocore
-jsii==1.84.0
+jsii==1.86.1
     # via
     #   aws-cdk-asset-awscli-v1
     #   aws-cdk-asset-kubectl-v20
@@ -75,7 +75,7 @@ typeguard==2.13.3
     #   cdk-nag
     #   constructs
     #   jsii
-typing-extensions==4.6.3
+typing-extensions==4.7.1
     # via
     #   cattrs
     #   jsii

requirements/requirements-dev.txt

@@ -15,13 +15,16 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 from typing import Dict, Generator, List
+import importlib
 
 import boto3
 from aws_cdk import Stack
 from aws_cdk.aws_controltower import CfnEnabledControl
 from constructs import Construct
 
-from constants import GUARDRAILS_CONFIGURATION
+from constants import GUARDRAILS_CONFIGURATION, AWS_CONTROL_TOWER_REGION
+
+ROLE_ARN = getattr(importlib.import_module("constants"), "ROLE_ARN", None)
 
 
 class AwsControlTowerGuardrailsStack(Stack):
@@ -77,10 +80,21 @@ def get_organizational_unit_arns(
             Dict[str, str]: map from organizational unit arn to organizational id
         """
 
+        if ROLE_ARN != None and ROLE_ARN != "":
+            session_name = ROLE_ARN.split("/")[-1][0:64]
+            response = boto3.client("sts").assume_role(RoleArn=ROLE_ARN, RoleSessionName=session_name)
+            boto3_session = boto3.session.Session(
+                aws_access_key_id=response["Credentials"]["AccessKeyId"],
+                aws_secret_access_key=response["Credentials"]["SecretAccessKey"],
+                aws_session_token=response["Credentials"]["SessionToken"]
+            )
+            client = boto3_session.client("organizations", region_name = AWS_CONTROL_TOWER_REGION)
+        else:
+            client = boto3.client("organizations")
+
         organizational_units_arns = {}
 
         for organizational_unit_id in organizational_units_ids:
-            client = boto3.client("organizations")
 
             response = client.describe_organizational_unit(
                 OrganizationalUnitId=organizational_unit_id