Skip to content

Commit e13e9b9

Browse files
IevIeievgeniia ieromenko
IevIe
and
ievgeniia ieromenko
authored
Updated Config conformance pack solution for CT optional (#176)
* Updated Config conformance pack solution for CT optional * linting fixes * linting fixes --------- Co-authored-by: ievgeniia ieromenko <ieviero@amazon.com>
1 parent 5fae173 commit e13e9b9

File tree

6 files changed

+60
-36
lines changed

6 files changed

+60
-36
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ Follow the instructions within the [Quick Setup](aws_sra_examples/quick_setup) t
122122
| [Account Alternate Contacts](aws_sra_examples/solutions/account/account_alternate_contacts) | Sets the billing, operations, and security alternate contacts for all accounts within the organization. | | <ul><li>AWS Control Tower</li></ul> |
123123
| [CloudTrail](aws_sra_examples/solutions/cloudtrail/cloudtrail_org) | Organization trail with defaults set to configure data events (e.g. S3 and Lambda) to avoid duplicating the Control Tower configured CloudTrail. Options for configuring management events. | CloudTrail enabled in each account with management events only. | |
124124
| [Config Management Account](aws_sra_examples/solutions/config/config_management_account) | Enables AWS Config in the Management account to allow resource compliance monitoring. | Configures AWS Config in all accounts except for the Management account in each governed region. | <ul><li>AWS Control Tower</li></ul> |
125-
| [Config Organization Conformance Pack](aws_sra_examples/solutions/config/config_conformance_pack_org) | Deploys a conformance pack to all accounts and provided regions within an organization. | | <ul><li>AWS Control Tower</li><li>[Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator)</li><li>[Config Management Account](aws_sra_examples/solutions/config/config_management_account)</li></ul> |
125+
| [Config Organization Conformance Pack](aws_sra_examples/solutions/config/config_conformance_pack_org) | Deploys a conformance pack to all accounts and provided regions within an organization. | | <ul><li>AWS Config in all Org Accounts</li><li>[Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator)</li><li>[Config Management Account](aws_sra_examples/solutions/config/config_management_account) in Control Tower environment</li></ul> |
126126
| [Config Organization Aggregator](aws_sra_examples/solutions/config/config_aggregator_org) | **Not required for most Control Tower environments.** Deploy an Organization Config Aggregator to a delegated admin other than the Audit account. | Organization Config Aggregator in the Management account and Account Config Aggregator in the Audit account. | <ul><li>AWS Control Tower</li><li>[Common Register Delegated Administrator](aws_sra_examples/solutions/common/common_register_delegated_administrator)</li></ul> |
127127
| [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) | Configures the EC2 default EBS encryption to use the default KMS key within all provided regions. | | <ul><li>AWS Control Tower</li></ul> |
128128
| [Firewall Manager](aws_sra_examples/solutions/firewall_manager/firewall_manager_org) | Demonstrates configuring a security group policy and WAF policies for all accounts within an organization. | | <ul><li>AWS Control Tower</li></ul> |

‎aws_sra_examples/solutions/config/config_conformance_pack_org/README.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,9 @@ evaluate your AWS environment, use one of the sample conformance pack templates.
5858

5959
---
6060

61-
### 3.0 Audit Account<!-- omit in toc -->
61+
### 3.0 Audit Account (Security Tooling)<!-- omit in toc -->
6262

63-
The example solutions use `Audit Account` instead of `Security Tooling Account` to align with the default account name used within the AWS Control Tower setup process for the Security Account. The Account ID for the `Audit Account` SSM parameter is
64-
populated from the `SecurityAccountId` parameter within the `AWSControlTowerBP-BASELINE-CONFIG` StackSet.
63+
The example solutions use `Audit Account` instead of `Security Tooling Account` to align with the default account name used within the AWS Control Tower setup process for the Security Account. The Account ID for the `Audit Account` can be determined from the `SecurityAccountId` parameter within the `AWSControlTowerBP-BASELINE-CONFIG` StackSet in AWS Control Tower environments, but is specified manually in other environments, and then stored in an SSM parameter (this is all done in the common prerequisites solution).
6564

6665
#### 3.1 AWS CloudFormation<!-- omit in toc -->
6766

‎aws_sra_examples/solutions/config/config_conformance_pack_org/scripts/list_config_recorder_status.py

Lines changed: 8 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
if TYPE_CHECKING:
2727
from mypy_boto3_cloudformation import CloudFormationClient
2828
from mypy_boto3_organizations import OrganizationsClient
29+
from mypy_boto3_ssm.client import SSMClient
2930
from mypy_boto3_sts.client import STSClient
3031

3132
# Logging Settings
@@ -34,18 +35,17 @@
3435
logging.getLogger("botocore").setLevel(logging.CRITICAL)
3536

3637
# Global Variables
37-
CLOUDFORMATION_PAGE_SIZE = 20
38-
CLOUDFORMATION_THROTTLE_PERIOD = 0.2
3938
MAX_THREADS = 20
4039
ORG_PAGE_SIZE = 20 # Max page size for list_accounts
4140
ORG_THROTTLE_PERIOD = 0.2
42-
ASSUME_ROLE_NAME = "AWSControlTowerExecution"
41+
ASSUME_ROLE_NAME = "sra-execution"
4342
BOTO3_CONFIG = Config(retries={"max_attempts": 10, "mode": "standard"})
4443

4544
try:
4645
MANAGEMENT_ACCOUNT_SESSION = boto3.Session()
4746
ORG_CLIENT: OrganizationsClient = MANAGEMENT_ACCOUNT_SESSION.client("organizations", config=BOTO3_CONFIG)
4847
CFN_CLIENT: CloudFormationClient = MANAGEMENT_ACCOUNT_SESSION.client("cloudformation", config=BOTO3_CONFIG)
48+
SSM_CLIENT: SSMClient = MANAGEMENT_ACCOUNT_SESSION.client("ssm")
4949
except Exception as error:
5050
LOGGER.error({"Unexpected_Error": error})
5151
raise ValueError("Unexpected error executing Lambda function. Review CloudWatch logs for details.") from None
@@ -101,29 +101,14 @@ def get_all_organization_accounts() -> list:
101101

102102

103103
def get_control_tower_regions() -> list: # noqa: CCR001
104-
"""Query 'AWSControlTowerBP-BASELINE-CLOUDWATCH' CloudFormation stack to identify customer regions.
104+
"""Query SSM Parameter Store to identify customer regions.
105105
106106
Returns:
107-
Customer regions chosen in Control Tower
107+
Customer regions
108108
"""
109-
paginator = CFN_CLIENT.get_paginator("list_stack_instances")
110-
customer_regions = set()
111-
aws_account = ""
112-
all_regions_identified = False
113-
for page in paginator.paginate(StackSetName="AWSControlTowerBP-BASELINE-CLOUDWATCH", PaginationConfig={"PageSize": CLOUDFORMATION_PAGE_SIZE}):
114-
for instance in page["Summaries"]:
115-
if not aws_account:
116-
aws_account = instance["Account"]
117-
customer_regions.add(instance["Region"])
118-
continue
119-
if aws_account == instance["Account"]:
120-
customer_regions.add(instance["Region"])
121-
continue
122-
all_regions_identified = True
123-
break
124-
if all_regions_identified:
125-
break
126-
sleep(CLOUDFORMATION_THROTTLE_PERIOD)
109+
customer_regions = []
110+
ssm_response = SSM_CLIENT.get_parameter(Name="/sra/regions/customer-control-tower-regions")
111+
customer_regions = ssm_response["Parameter"]["Value"].split(",")
127112

128113
return list(customer_regions)
129114

‎aws_sra_examples/solutions/config/config_conformance_pack_org/templates/sra-config-conformance-pack-org-delivery-bucket.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ Resources:
9494
StringLike:
9595
aws:PrincipalArn:
9696
- !Sub arn:${AWS::Partition}:iam::*:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms
97-
- !Sub arn:${AWS::Partition}:iam::*:role/AWSControlTowerExecution
97+
- !Sub arn:${AWS::Partition}:iam::*:role/sra-execution
9898
Resource: !Sub arn:${AWS::Partition}:s3:::${rConformancePackBucket}
9999
Principal: '*'
100100

‎aws_sra_examples/solutions/config/config_conformance_pack_org/templates/sra-config-conformance-pack-org-main-ssm.yaml

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,12 @@ Metadata:
2020
- pSRAStagingS3BucketName
2121
- pSourceStackName
2222

23+
- Label:
24+
default: IAM Properties
25+
Parameters:
26+
- pStackSetAdminRole
27+
- pStackExecutionRole
28+
2329
- Label:
2430
default: Conformance Pack Properties
2531
Parameters:
@@ -38,6 +44,10 @@ Metadata:
3844
- pOrganizationId
3945

4046
ParameterLabels:
47+
pStackSetAdminRole:
48+
default: Stack Set Role
49+
pStackExecutionRole:
50+
default: Stack execution role
4151
pAuditAccountId:
4252
default: Audit Account ID
4353
pConformancePackName:
@@ -66,6 +76,16 @@ Metadata:
6676
default: SRA Staging S3 Bucket Name
6777

6878
Parameters:
79+
pStackSetAdminRole:
80+
AllowedValues: [sra-stackset]
81+
Default: sra-stackset
82+
Description: The administration role name that is used in the stackset.
83+
Type: String
84+
pStackExecutionRole:
85+
AllowedValues: [sra-execution]
86+
Default: sra-execution
87+
Description: The execution role name that is used in the stack.
88+
Type: String
6989
pAuditAccountId:
7090
AllowedPattern: ^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$
7191
ConstraintDescription:
@@ -176,10 +196,10 @@ Resources:
176196
Type: AWS::CloudFormation::StackSet
177197
Properties:
178198
StackSetName: sra-config-conformance-pack-org-delivery-bucket
179-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
199+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
180200
CallAs: SELF
181201
Description: !Sub ${pSRASolutionVersion} - Creates S3 bucket to store the conformance pack results
182-
ExecutionRoleName: AWSControlTowerExecution
202+
ExecutionRoleName: !Ref pStackExecutionRole
183203
ManagedExecution:
184204
Active: true
185205
OperationPreferences:
@@ -208,7 +228,7 @@ Resources:
208228
DependsOn: rConfigConformancePackOrgDeliveryBucketStackSet
209229
Properties:
210230
StackSetName: sra-config-conformance-pack-org-deployment
211-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
231+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
212232
CallAs: SELF
213233
Description: !If
214234
- cRegisterDelegatedAdmin
@@ -220,7 +240,7 @@ Resources:
220240
]
221241
- !Sub ${pSRASolutionVersion} - This template creates an AWS Organizations Config Conformance Pack in the Control Tower Audit account. -
222242
'config_conformance_pack_org' solution in repo, https://github.com/aws-samples/aws-security-reference-architecture-examples.
223-
ExecutionRoleName: AWSControlTowerExecution
243+
ExecutionRoleName: !Ref pStackExecutionRole
224244
ManagedExecution:
225245
Active: true
226246
OperationPreferences:

‎aws_sra_examples/solutions/config/config_conformance_pack_org/templates/sra-config-conformance-pack-org-main.yaml

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@ Metadata:
1818
- pSRAStagingS3BucketName
1919
- pSRASolutionVersion
2020

21+
- Label:
22+
default: IAM Properties
23+
Parameters:
24+
- pStackSetAdminRole
25+
- pStackExecutionRole
26+
2127
- Label:
2228
default: Conformance Pack Properties
2329
Parameters:
@@ -36,6 +42,10 @@ Metadata:
3642
- pOrganizationId
3743

3844
ParameterLabels:
45+
pStackSetAdminRole:
46+
default: Stack Set Role
47+
pStackExecutionRole:
48+
default: Stack execution role
3949
pAuditAccountId:
4050
default: Audit Account ID
4151
pConformancePackName:
@@ -62,6 +72,16 @@ Metadata:
6272
default: SRA Staging S3 Bucket Name
6373

6474
Parameters:
75+
pStackSetAdminRole:
76+
AllowedValues: [sra-stackset]
77+
Default: sra-stackset
78+
Description: The administration role name that is used in the stackset.
79+
Type: String
80+
pStackExecutionRole:
81+
AllowedValues: [sra-execution]
82+
Default: sra-execution
83+
Description: The execution role name that is used in the stack.
84+
Type: String
6585
pAuditAccountId:
6686
AllowedPattern: ^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$
6787
ConstraintDescription:
@@ -163,10 +183,10 @@ Resources:
163183
Type: AWS::CloudFormation::StackSet
164184
Properties:
165185
StackSetName: sra-config-conformance-pack-org-delivery-bucket
166-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
186+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
167187
CallAs: SELF
168188
Description: !Sub ${pSRASolutionVersion} - Creates S3 bucket to store the conformance pack results
169-
ExecutionRoleName: AWSControlTowerExecution
189+
ExecutionRoleName: !Ref pStackExecutionRole
170190
ManagedExecution:
171191
Active: true
172192
OperationPreferences:
@@ -195,7 +215,7 @@ Resources:
195215
DependsOn: rConfigConformancePackOrgDeliveryBucketStackSet
196216
Properties:
197217
StackSetName: sra-config-conformance-pack-org-deployment
198-
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/service-role/AWSControlTowerStackSetRole
218+
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
199219
CallAs: SELF
200220
Description: !If
201221
- cRegisterDelegatedAdmin
@@ -207,7 +227,7 @@ Resources:
207227
]
208228
- !Sub ${pSRASolutionVersion} - This template creates an AWS Organizations Config Conformance Pack in the Control Tower Audit account. -
209229
'config_conformance_pack_org' solution in repo, https://github.com/aws-samples/aws-security-reference-architecture-examples.
210-
ExecutionRoleName: AWSControlTowerExecution
230+
ExecutionRoleName: !Ref pStackExecutionRole
211231
ManagedExecution:
212232
Active: true
213233
OperationPreferences:

0 commit comments

Comments
 (0)