Skip to content

Commit 5fae173

Browse files
IevIeievgeniia ieromenko
IevIe
and
ievgeniia ieromenko
authored
updated Macie solution for Control Tower optional (#175)
Co-authored-by: ievgeniia ieromenko <ieviero@amazon.com>
1 parent 224fe29 commit 5fae173

File tree

6 files changed

+80
-39
lines changed

6 files changed

+80
-39
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ Follow the instructions within the [Quick Setup](aws_sra_examples/quick_setup) t
129129
| [GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org) | Configures GuardDuty within a delegated admin account for all accounts within an organization. | | |
130130
| [IAM Access Analyzer](aws_sra_examples/solutions/iam/iam_access_analyzer) | Configures an organization analyzer within a delegated admin account and account level analyzer within each account. | | [Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator)</li></ul> |
131131
| [IAM Account Password Policy](aws_sra_examples/solutions/iam/iam_password_policy) | Sets the account password policy for users to align with common compliance standards. | | <ul><li>AWS Control Tower</li></ul> |
132-
| [Macie](aws_sra_examples/solutions/macie/macie_org) | Configures Macie within a delegated admin account for all accounts within the organization. | | <ul><li>AWS Control Tower</li></ul> |
132+
| [Macie](aws_sra_examples/solutions/macie/macie_org) | Configures Macie within a delegated admin account for all accounts within the organization. | |
133133
| [S3 Block Account Public Access](aws_sra_examples/solutions/s3/s3_block_account_public_access) | Configures the account-level S3 BPA settings for all accounts within the organization. | Configures S3 BPA settings on buckets created by Control Tower only. | <ul><li>AWS Control Tower</li></ul> |
134134
| [Security Hub](aws_sra_examples/solutions/securityhub/securityhub_org) | Configures Security Hub within a delegated admin account for all accounts and governed regions within the organization. | | <ul><li>AWS Config in all Org Accounts</li><li>[Config Management Account](aws_sra_examples/solutions/config/config_management_account) (*if using AWS Control Tower*)</li></ul> |
135135
| [Inspector](aws_sra_examples/solutions/inspector/inspector_org) | Configure Inspector within a delegated admin account for all accounts and governed regions within the organization. | | |

‎aws_sra_examples/solutions/macie/macie_org/README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,10 +78,9 @@ The Lambda function is required to register the Macie delegated administrator ac
7878

7979
---
8080

81-
### 3.0 Audit Account<!-- omit in toc -->
81+
### 3.0 Audit Account (Security Tooling)<!-- omit in toc -->
8282

83-
The example solutions use `Audit Account` instead of `Security Tooling Account` to align with the default account name used within the AWS Control Tower setup process for the Security Account. The Account ID for the `Audit Account` SSM parameter is
84-
populated from the `SecurityAccountId` parameter within the `AWSControlTowerBP-BASELINE-CONFIG` StackSet.
83+
The example solutions use `Audit Account` instead of `Security Tooling Account` to align with the default account name used within the AWS Control Tower setup process for the Security Account. The Account ID for the `Audit Account` can be determined from the `SecurityAccountId` parameter within the `AWSControlTowerBP-BASELINE-CONFIG` StackSet in AWS Control Tower environments, but is specified manually in other environments, and then stored in an SSM parameter (this is all done in the common prerequisites solution).
8584

8685
#### 3.1 AWS CloudFormation<!-- omit in toc -->
8786

‎aws_sra_examples/solutions/macie/macie_org/lambda/src/common.py

Lines changed: 14 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@
1717
from botocore.exceptions import ClientError
1818

1919
if TYPE_CHECKING:
20-
from mypy_boto3_cloudformation import CloudFormationClient
2120
from mypy_boto3_iam.client import IAMClient
2221
from mypy_boto3_organizations import OrganizationsClient
22+
from mypy_boto3_ssm.client import SSMClient
2323
from mypy_boto3_sts.client import STSClient
2424

2525
# Setup Default Logger
@@ -33,6 +33,15 @@
3333
ORG_PAGE_SIZE = 20 # Max page size for list_accounts
3434
ORG_THROTTLE_PERIOD = 0.2
3535
BOTO3_CONFIG = Config(retries={"max_attempts": 10, "mode": "standard"})
36+
UNEXPECTED = "Unexpected!"
37+
38+
39+
try:
40+
MANAGEMENT_ACCOUNT_SESSION = boto3.Session()
41+
SSM_CLIENT: SSMClient = MANAGEMENT_ACCOUNT_SESSION.client("ssm")
42+
except Exception:
43+
LOGGER.exception(UNEXPECTED)
44+
raise ValueError("Unexpected error executing Lambda function. Review CloudWatch logs for details.") from None
3645

3746

3847
def assume_role(role: str, role_session_name: str, account: str = None, session: boto3.Session = None) -> boto3.Session:
@@ -112,32 +121,14 @@ def get_account_ids(accounts: list, exclude_accounts: list = None) -> list:
112121

113122

114123
def get_control_tower_regions() -> list: # noqa: CCR001
115-
"""Query 'AWSControlTowerBP-BASELINE-CLOUDWATCH' CloudFormation stack to identify customer regions.
124+
"""Query SSM Parameter Store to identify customer regions.
116125
117126
Returns:
118127
Customer regions chosen in Control Tower
119128
"""
120-
management_account_session = boto3.Session()
121-
cfn_client: CloudFormationClient = management_account_session.client("cloudformation", config=BOTO3_CONFIG)
122-
paginator = cfn_client.get_paginator("list_stack_instances")
123-
customer_regions = set()
124-
aws_account = ""
125-
all_regions_identified = False
126-
for page in paginator.paginate(StackSetName="AWSControlTowerBP-BASELINE-CLOUDWATCH", PaginationConfig={"PageSize": CLOUDFORMATION_PAGE_SIZE}):
127-
for instance in page["Summaries"]:
128-
if not aws_account:
129-
aws_account = instance["Account"]
130-
customer_regions.add(instance["Region"])
131-
continue
132-
if aws_account == instance["Account"]:
133-
customer_regions.add(instance["Region"])
134-
continue
135-
all_regions_identified = True
136-
break
137-
if all_regions_identified:
138-
break
139-
sleep(CLOUDFORMATION_THROTTLE_PERIOD)
140-
129+
customer_regions = []
130+
ssm_response = SSM_CLIENT.get_parameter(Name="/sra/regions/customer-control-tower-regions")
131+
customer_regions = ssm_response["Parameter"]["Value"].split(",")
141132
return list(customer_regions)
142133

143134

‎aws_sra_examples/solutions/macie/macie_org/templates/sra-macie-org-configuration.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,17 @@ Resources:
261261
- logs:PutLogEvents
262262
Resource: !Sub arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${pMacieOrgLambdaFunctionName}:log-stream:*
263263

264+
- PolicyName: "ssm-access"
265+
PolicyDocument:
266+
Version: "2012-10-17"
267+
Statement:
268+
- Effect: "Allow"
269+
Action:
270+
- ssm:GetParameter
271+
- ssm:GetParameters
272+
Resource:
273+
- !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/sra*"
274+
264275
- PolicyName: sra-macie-org-policy-organizations
265276
PolicyDocument:
266277
Version: 2012-10-17

‎aws_sra_examples/solutions/macie/macie_org/templates/sra-macie-org-main-ssm.yaml

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@ Metadata:
2525
- pAuditAccountId
2626
- pLogArchiveAccountId
2727
- pRootOrganizationalUnitId
28+
29+
- Label:
30+
default: IAM Properties
31+
Parameters:
32+
- pStackSetAdminRole
33+
- pStackExecutionRole
2834

2935
- Label:
3036
default: Macie Delivery Properties
@@ -50,6 +56,10 @@ Metadata:
5056
- pLambdaLogLevel
5157

5258
ParameterLabels:
59+
pStackSetAdminRole:
60+
default: Stack Set Role
61+
pStackExecutionRole:
62+
default: Stack execution role
5363
pAuditAccountId:
5464
default: Audit Account ID
5565
pControlTowerRegionsOnly:
@@ -88,6 +98,16 @@ Metadata:
8898
default: SRA Staging S3 Bucket Name
8999

90100
Parameters:
101+
pStackSetAdminRole:
102+
AllowedValues: [sra-stackset]
103+
Default: sra-stackset
104+
Description: The administration role name that is used in the stackset.
105+
Type: String
106+
pStackExecutionRole:
107+
AllowedValues: [sra-execution]
108+
Default: sra-execution
109+
Description: The execution role name that is used in the stack.
110+
Type: String
91111
pAuditAccountId:
92112
AllowedPattern: '^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$'
93113
ConstraintDescription:
@@ -253,12 +273,12 @@ Resources:
253273
Type: AWS::CloudFormation::StackSet
254274
Properties:
255275
StackSetName: sra-macie-org-configuration-role
256-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
276+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
257277
CallAs: SELF
258278
Capabilities:
259279
- CAPABILITY_NAMED_IAM
260280
Description: !Sub ${pSRASolutionVersion} - Deploys an IAM role via ${pSRASolutionName} for configuring Macie
261-
ExecutionRoleName: AWSControlTowerExecution
281+
ExecutionRoleName: !Ref pStackExecutionRole
262282
ManagedExecution:
263283
Active: true
264284
OperationPreferences:
@@ -284,10 +304,10 @@ Resources:
284304
Type: AWS::CloudFormation::StackSet
285305
Properties:
286306
StackSetName: sra-macie-org-delivery-kms-key
287-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
307+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
288308
CallAs: SELF
289309
Description: !Sub ${pSRASolutionVersion} - Deploys a KMS Key via ${pSRASolutionName} for encrypting Macie findings
290-
ExecutionRoleName: AWSControlTowerExecution
310+
ExecutionRoleName: !Ref pStackExecutionRole
291311
ManagedExecution:
292312
Active: true
293313
OperationPreferences:
@@ -320,10 +340,10 @@ Resources:
320340
DependsOn: rMacieDeliveryKMSKeyStackSet
321341
Properties:
322342
StackSetName: sra-macie-org-delivery-s3-bucket
323-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
343+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
324344
CallAs: SELF
325345
Description: !Sub ${pSRASolutionVersion} - Deploys an S3 bucket via ${pSRASolutionName} for storing Macie findings
326-
ExecutionRoleName: AWSControlTowerExecution
346+
ExecutionRoleName: !Ref pStackExecutionRole
327347
ManagedExecution:
328348
Active: true
329349
OperationPreferences:

‎aws_sra_examples/solutions/macie/macie_org/templates/sra-macie-org-main.yaml

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@ Metadata:
2525
- pAuditAccountId
2626
- pLogArchiveAccountId
2727
- pRootOrganizationalUnitId
28+
29+
- Label:
30+
default: IAM Properties
31+
Parameters:
32+
- pStackSetAdminRole
33+
- pStackExecutionRole
2834

2935
- Label:
3036
default: Macie Delivery Properties
@@ -50,6 +56,10 @@ Metadata:
5056
- pLambdaLogLevel
5157

5258
ParameterLabels:
59+
pStackSetAdminRole:
60+
default: Stack Set Role
61+
pStackExecutionRole:
62+
default: Stack execution role
5363
pAuditAccountId:
5464
default: Audit Account ID
5565
pControlTowerRegionsOnly:
@@ -88,6 +98,16 @@ Metadata:
8898
default: SRA Staging S3 Bucket Name
8999

90100
Parameters:
101+
pStackSetAdminRole:
102+
AllowedValues: [sra-stackset]
103+
Default: sra-stackset
104+
Description: The administration role name that is used in the stackset.
105+
Type: String
106+
pStackExecutionRole:
107+
AllowedValues: [sra-execution]
108+
Default: sra-execution
109+
Description: The execution role name that is used in the stack.
110+
Type: String
91111
pAuditAccountId:
92112
AllowedPattern: ^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$
93113
ConstraintDescription:
@@ -246,12 +266,12 @@ Resources:
246266
Type: AWS::CloudFormation::StackSet
247267
Properties:
248268
StackSetName: sra-macie-org-configuration-role
249-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
269+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
250270
CallAs: SELF
251271
Capabilities:
252272
- CAPABILITY_NAMED_IAM
253273
Description: !Sub ${pSRASolutionVersion} - Deploys an IAM role via ${pSRASolutionName} for configuring Macie
254-
ExecutionRoleName: AWSControlTowerExecution
274+
ExecutionRoleName: !Ref pStackExecutionRole
255275
ManagedExecution:
256276
Active: true
257277
OperationPreferences:
@@ -277,10 +297,10 @@ Resources:
277297
Type: AWS::CloudFormation::StackSet
278298
Properties:
279299
StackSetName: sra-macie-org-delivery-kms-key
280-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
300+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
281301
CallAs: SELF
282302
Description: !Sub ${pSRASolutionVersion} - Deploys a KMS Key via ${pSRASolutionName} for encrypting Macie findings
283-
ExecutionRoleName: AWSControlTowerExecution
303+
ExecutionRoleName: !Ref pStackExecutionRole
284304
ManagedExecution:
285305
Active: true
286306
OperationPreferences:
@@ -313,10 +333,10 @@ Resources:
313333
DependsOn: rMacieDeliveryKMSKeyStackSet
314334
Properties:
315335
StackSetName: sra-macie-org-delivery-s3-bucket
316-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
336+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
317337
CallAs: SELF
318338
Description: !Sub ${pSRASolutionVersion} - Deploys an S3 bucket via ${pSRASolutionName} for storing Macie findings
319-
ExecutionRoleName: AWSControlTowerExecution
339+
ExecutionRoleName: !Ref pStackExecutionRole
320340
ManagedExecution:
321341
Active: true
322342
OperationPreferences:

0 commit comments

Comments
 (0)