Skip to content

README.md

Latest commit

 

History

History
195 lines (113 loc) · 8.62 KB

README.md

File metadata and controls

195 lines (113 loc) · 8.62 KB

Config Organization

Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0

Table of Contents

Introduction

The Config Organization solution will enable AWS Config, delegate administration to a member account, and configure AWS Config for all the existing and future AWS Organization accounts. The Config Organization solution will enable an aggregator in delegated administrator account to collect AWS Config configuration and compliance data for the AWS Organization. AWS Config is also configured to send the configuration snapshots and configuration history files to a central S3 bucket encrypted with a KMS key.

Deployed Resource Details

Architecture

1.0 Organization Management Account

1.1 AWS CloudFormation

  • All resources are deployed via AWS CloudFormation as a StackSet and Stack Instance within the management account or a CloudFormation Stack within a specific account.
  • For parameter details, review the AWS CloudFormation templates.

1.2 Lambda Execution IAM Role

  • IAM role used by the Lambda function to enable the AWS Config and set up AWS Config delivery channel within each account and region provided.

1.3 Configuration IAM Role

  • IAM role assumed by the Lambda function within the management account to configure AWS Config within each account and region provided.

1.4 AWS Lambda Function

  • The Lambda function includes logic to enable and configure AWS Config.

1.5 Lambda CloudWatch Log Group

  • All the AWS Lambda Function logs are sent to a CloudWatch Log Group </aws/lambda/<LambdaFunctionName> to help with debugging and traceability of the actions performed.
  • By default the AWS Lambda Function will create the CloudWatch Log Group and logs are encrypted with a CloudWatch Logs service managed encryption key.

1.6 Dead Letter Queue (DLQ)

  • SQS dead letter queue used for retaining any failed Lambda events.

1.7 Alarm SNS Topic

  • SNS Topic used to notify subscribers when messages hit the DLQ.

1.8 Regional Event Rules

  • The Organization Compliance Scheduled Event Rule triggers the AWS Lambda Function to capture AWS Account status updates (e.g. suspended to active).
  • The AWS Organizations Event Rule triggers the AWS Lambda Function when updates are made to accounts within the organization.
    • When AWS Accounts are added to the AWS Organization. (e.g. account created via AWS Organizations console, account invited from another AWS Organization).
  • The Global Event Rule in us-east-1 forwards the AWS Organization events to the Home Region default Event Bus.
    • If the Home Region is different from the Global Region (e.g. us-east-1), then global event rules are created within the Global Region to forward events to the Home Region default Event Bus.

1.9 AWS Config

  • AWS Config is enabled for each existing active account and region during the initial setup.
  • AWS Config will be automatically enabled for new member accounts when added to the AWS Organization.

2.0 Log Archive Account

2.1 AWS CloudFormation

2.2 AWS Config Delivery S3 Bucket

  • S3 bucket where AWS Config configurations snapshots are exported for each account/region within the AWS Organization.

2.3 Configuration IAM Role

2.4 AWS Config

3.0 Audit Account (Security Tooling)

The example solutions use Security Account Id for the Security Tooling Account. NOTE Conceptually the Security Tooling Account equivalent of Control Tower's default Audit Account. The Account ID for the Security Account Id SSM parameter is populated from the SecurityAccountId parameter within the sra-easy-setup Stack.

3.1 AWS CloudFormation

3.2 Notification SNS Topic

  • Configuration Notification SNS Topic in Audit Account that AWS Config delivers notifications to.

3.3 AWS Config Delivery KMS Key

  • KMS key to encrypt the configuration snapshots with a customer managed KMS key.

3.4 Configuration IAM Role

3.5 AWS Config Aggregator IAM Role

  • IAM role used by AWS Config to access AWS Organizations APIs.

3.6 AWS Config Aggregator

  • AWS Config Aggregator configured in the delegated administrator account to collect AWS Config configuration and compliance data for the AWS Organization.

3.7 SNS Topic KMS Key

  • KMS key to encrypt the SNS Topic with a customer managed KMS key.

3.8 AWS Config

4.0 All Existing and Future Organization Member Accounts

4.1 AWS CloudFormation

4.2 Configuration IAM Role

4.3 AWS Config

Implementation Instructions

Prerequisites

  1. Download and Stage the SRA Solutions. Note: This only needs to be done once for all the solutions.
  2. Verify that the SRA Prerequisites Solution has been deployed.

Solution Deployment

Choose a Deployment Method:

AWS CloudFormation

In the management account (home region), launch an AWS CloudFormation Stack using the option below:

  • Use the sra-config-org-main-ssm.yaml template. This uses an approach where some of the CloudFormation parameters are populated from SSM parameters created by the SRA Prerequisites Solution.

    aws cloudformation deploy --template-file $HOME/aws-sra-examples/aws_sra_examples/solutions/config/config_org/templates/sra-config-org-main-ssm.yaml --stack-name sra-config-org-main-ssm --capabilities CAPABILITY_NAMED_IAM

Verify Solution Deployment

  1. Log into the Audit account and navigate to the AWS Config page.
    1. Verify the correct AWS Config configurations have been applied to each account and region.
    2. Verify all existing accounts have been enabled.
    3. Verify the correct AWS Config Aggregator configurations have been applied.
    4. Verify all existing accounts have been enabled. Note: It can take a few minutes to complete.
  2. Log into the Log archive account and navigate to the S3 page.
    1. Verify the sample configuration snapshots have been delivered.

Solution Delete Instructions

  1. In the management account (home region), delete the AWS CloudFormation Stack (sra-config-org-main-ssm).
  2. In the management account (home region), delete the AWS CloudWatch Log Group (e.g. /aws/lambda/<solution_name>) for the Lambda function deployed.
  3. In the log archive acccount (home region), delete the S3 bucket (e.g. sra-config-delivery-<account_id>-<aws_region>) created by the solution.

References