Automate activities in Control Tower provisioned AWS accounts

Table of contents

1. Introduction
2. Architecture
3. Prerequisites
4. Tools and services
5. Usage
6. Clean up
7. Reference
8. Contributing
9. License

Introduction

This project will configure the following settings on a new AWS account provisioned by AWS Control Tower:

1. Deletes the default VPC in every region
2. Adds a CloudWatch Logs resource policy that allows Route53 to log DNS requests to CloudWatch in the us-east-1 (Northern Virginia) region
3. Enables the account-wide public S3 block setting
4. Modifies account-level ECS settings
5. Associates specific principals to shared AWS Service Catalog portfolios
6. Grants specific AWS SSO groups access to the new account
7. Blocks public SSM document sharing
8. Enables EBS encryption by default
9. Applies an IAM password policy that complies with the CIS AWS Foundations Benchmark

Architecture

1. When AWS Control Tower provisions a new account, a CreateManagedAccount event is sent to the Amazon EventBridge default event bus.
2. An Amazon EventBridge rule matches the CreateManagedAccount event and triggers an AWS Step Functions state machine that executes AWS Lambda functions.
3. Step Functions assumes the AWSControlTowerExecution IAM role in the new account and uses the AWS SDK service integration to set the password policy using iam:UpdateAccountPasswordPolicy, adds the account-level S3 public block setting, creates a CloudWatch Logs resource policy in the us-east-1 region that allows Route 53 to write DNS query logs to CloudWatch
4. Step Functions then uses the AWS SDK service integration to call ec2:DescribeRegions to get a list of regions
5. The "Regional Lambda" function assumes the AWSControlTowerExecution IAM role in the new account and enables various ECS settings, deletes the default VPC, enables EBS encryption by default, and blocks public SSM document sharing from all regions
6. The "Portfolio Share Lambda" function assumes the AWSControlTowerExecution IAM role in the new account and accepts shared Service Catalog portfolios in the new account and grants specific principals access to those portfolios.
7. The "SSO Group Assignment Lambda" function assigns any AWS SSO groups following the convention AWS-O-<PermissionSetName> access to the new account with the <PermissionSetName> permission set. The groups are defined in the OrganizationGroups CloudFormation stack parameter.

Prerequisites

• Python 3, installed
• AWS Command Line Interface (AWS CLI) version 2, installed
• AWS Serverless Application Model (SAM), installed
• Docker Desktop, installed

Tools and services

• AWS SAM - The AWS Serverless Application Model (SAM) is an open-source framework for building serverless applications. It provides shorthand syntax to express functions, APIs, databases, and event source mappings.
• AWS Lambda - AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers, creating workload-aware cluster scaling logic, maintaining event integrations, or managing runtimes.
• AWS Control Tower - AWS Control Tower provides the easiest way to set up and govern a secure, multi-account AWS environment, called a landing zone.
• AWS Organizations - AWS Organizations helps you centrally manage and govern your environment as you grow and scale your AWS resources.
• Amazon EventBridge - Amazon EventBridge is a serverless event bus service that you can use to connect your applications with data from a variety of sources.
• AWS Service Catalog - AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS.
• AWS Single Sign-On - AWS Single Sign-On (AWS SSO) is where you create, or connect, your workforce identities in AWS once and manage access centrally across your AWS organization.
• AWS Systems Manager - Systems Manager provides a unified user interface so you can track and resolve operational issues across your AWS applications and resources from a central place.

Usage

Parameters

Parameter	Type	Default	Description
OrganizationGroups	String	us-east-1	List of AWS SSO groups that should have access to all accounts
ExecutionRoleName	String	AWSControlTowerExecution	Execution IAM role name
PortfolioIds	String	None	Service Catalog Portfolio IDs
PermissionSets	String	None	AWS SSO Permission Set names
SigningProfileVersionArn	String	None	Code Signing Profile Version ARN
GitHubOrg	String	aws-samples	Source code organization
GitHubRepo	String	aws-control-tower-account-setup-using-step-functions	Source code repository

Installation

The CloudFormation stack must be deployed in the same AWS account and region where the AWS Control Tower landing zone has been created. This is usually the AWS Organizations Management account.

git clone https://github.com/aws-samples/aws-control-tower-account-setup-using-step-functions
cd aws-control-tower-account-setup-using-step-functions
aws signer put-signing-profile --platform-id "AWSLambda-SHA384-ECDSA" --profile-name AccountSetupProfile
sam build
sam deploy \
  --guided \
  --signing-profiles \
    SSOAssignmentFunction=AccountSetupProfile \
    ServiceCatalogPortfolioFunction=AccountSetupProfile \
    RegionalFunction=AccountSetupProfile \
    AccountFunction=AccountSetupProfile \
    DependencyLayer=AccountSetupProfile \
  --tags "GITHUB_ORG=aws-samples GITHUB_REPO=aws-control-tower-account-setup-using-step-functions"

Clean up

Deleting the CloudFormation Stack will remove the Lambda functions, state machine and EventBridge rule and new accounts will no longer be updated after they are created.

sam delete

Reference

This solution is inspired by these references:

• Why not Terraform?
• AWS Solutions Library - Customizations for AWS Control Tower
• AWS Deployment Framework
• How to automate the creation of multiple accounts in AWS Control Tower
• Enabling AWS IAM Access Analyzer on AWS Control Tower accounts
• Automating AWS Security Hub Alerts with AWS Control Tower lifecycle events
• Using lifecycle events to track AWS Control Tower actions and trigger automated workflows

Contributing

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.