Automate activities in Control Tower provisioned AWS accounts
Table of contents
- Tools and services
- Clean up
This project will configure the following settings on a new AWS account provisioned by AWS Control Tower:
- Deletes the default VPC in every region
- Adds a CloudWatch Logs resource policy that allows Route53 to log DNS requests to CloudWatch in the us-east-1 (Northern Virginia) region
- Enables the account-wide public S3 block setting
- Modifies account-level ECS settings
- Associates specific principals to shared AWS Service Catalog portfolios
- Grants specific AWS SSO groups access to the new account
- When AWS Control Tower provisions a new account, a CreateManagedAccount event is sent to the Amazon EventBridge default event bus.
- An Amazon EventBridge rule matches the
CreateManagedAccountevent and triggers an AWS Step Functions state machine that executes AWS Lambda functions in parallel.
- The “Delete Default VPC Lambda” function assumes the
AWSControlTowerExecutionIAM role in the new account and deletes the default VPC from every region.
- The “Route53 Logs Lambda” function assumes the
AWSControlTowerExecutionIAM role in the new account and creates a CloudWatch Logs resource policy in the us-east-1 region that allows Route53 to write DNS query logs to CloudWatch.
- The “Public S3 Block Lambda” function assumes the
AWSControlTowerExecutionIAM role in the new account and enables the account-level S3 public block setting.
- The “ECS Settings Lambda” function assumes the
AWSControlTowerExecutionIAM role in the new account and enables various ECS settings.
- The “Portfolio Share Lambda” function assumes the
AWSControlTowerExecutionIAM role in the new account and accepts shared Service Catalog portfolios in the new account and grants specific principals access to those portfolios.
- The “SSO Group Assignment Lambda” function assigns any AWS SSO groups that start with
AWS-O-<PermissionSetName>access to the new account with the
- Python 3, installed
- AWS Command Line Interface (AWS CLI) version 2, installed
- AWS Serverless Application Model (SAM), installed
- Docker Desktop, installed
Tools and services
- AWS SAM – The AWS Serverless Application Model (SAM) is an open-source framework for building serverless applications. It provides shorthand syntax to express functions, APIs, databases, and event source mappings.
- AWS Lambda – AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers, creating workload-aware cluster scaling logic, maintaining event integrations, or managing runtimes.
- AWS Control Tower – AWS Control Tower provides the easiest way to set up and govern a secure, multi-account AWS environment, called a landing zone.
- AWS Organizations – AWS Organizations helps you centrally manage and govern your environment as you grow and scale your AWS resources.
- Amazon EventBridge – Amazon EventBridge is a serverless event bus service that you can use to connect your applications with data from a variety of sources.
- AWS Service Catalog – AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS.
- AWS Single Sign-On – AWS Single Sign-On (AWS SSO) is where you create, or connect, your workforce identities in AWS once and manage access centrally across your AWS organization.
|OrganizationGroups||String||us-east-1||List of AWS SSO groups that should have access to all accounts|
|ExecutionRoleName||String||AWSControlTowerExecution||Execution IAM role name|
|PortfolioIds||String||None||Service Catalog Portfolio IDs|
|PermissionSets||String||None||AWS SSO Permission Set names|
|SigningProfileVersionArn||String||None||Code Signing Profile Version ARN|
The CloudFormation stack must be deployed in the same AWS account and region where the AWS Control Tower landing zone has been created. This is usually the AWS Organizations Management account.
git clone https://github.com/aws-samples/aws-control-tower-account-setup-using-step-functions cd aws-control-tower-account-setup-using-step-functions aws signer put-signing-profile --platform-id "AWSLambda-SHA384-ECDSA" --profile-name AccountSetupProfile sam build sam deploy \ --guided \ --signing-profiles \ S3PublicBlockFunction=AccountSetupProfile \ DeleteDefaultVpcFunction=AccountSetupProfile \ Route53QueryLogsFunction=AccountSetupProfile \ ECSAccountSettingsFunction=AccountSetupProfile \ SSOAssignmentFunction=AccountSetupProfile \ ServiceCatalogPortfolioFunction=AccountSetupProfile \ DependencyLayer=AccountSetupProfile \ --tags "GITHUB_ORG=aws-samples GITHUB_REPO=aws-control-tower-account-setup-using-step-functions"
Deleting the CloudFormation Stack will remove the Lambda functions, state machine and EventBridge rule and new accounts will no longer be updated after they are created.
This solution is inspired by these references:
- Why not Terraform?
- AWS Solutions Library – Customizations for AWS Control Tower
- AWS Deployment Framework
- How to automate the creation of multiple accounts in AWS Control Tower
- Enabling AWS IAM Access Analyzer on AWS Control Tower accounts
- Automating AWS Security Hub Alerts with AWS Control Tower lifecycle events
- Using lifecycle events to track AWS Control Tower actions and trigger automated workflows
See CONTRIBUTING for more information.
This library is licensed under the MIT-0 License. See the LICENSE file.