AWS Cloud Operations Blog

Manage Control Tower life cycle actions intelligently using AWS Service Catalog, AWS Config, Amazon DynamoDB and AWS CloudFormation

As customers create and manage multi-account AWS environments, cloud administrators need to process where each account can apply configuration autonomously from a centralize configuration repository. Some of the customers I work with use AWS Control Tower to manage a multi account environment. Administrators use AWS Control Tower to create organization units for account grouping and then create multiple accounts in those organization units. These administrators would like a process to ensure consistency. For example, the administrator would like accounts across all regions to deploy a security configuration or apply an account base tagging strategy for resources that will be deployed. A mechanism to do this will be for the administrator to add an AWS CloudFormation template that contains the steps for applying the security configuration to a configuration repository, then each account will then retrieve the configuration and deploy it in its own environment.

In this blog post, I will show you how to enable administrators to configure an AWS Control Tower environment to automatically deploy configurations when needed using AWS Service Catalog, AWS Cloud Watch events and other AWS services.

This solution uses the following AWS services. Most of the resources are set up for you with an AWS CloudFormation stack:

Background

Here are some of AWS Service Catalog concepts referenced in this post. For more information, see Overview of AWS Service Catalog.

  • A product is a blueprint for building the AWS resources to make available for deployment on AWS, along with the configuration information. Create a product by importing an AWS CloudFormation template, or, in case of AWS Marketplace-based products, by copying the product to AWS Service Catalog. A product can belong to multiple portfolios.
  • A portfolio is a collection of products, together with the configuration information. Use portfolios to manage user access to specific products. You can grant portfolio access for an AWS Identity and Access Management (IAM) user, IAM group, or IAM role level.
  • A provisioned product is an AWS CloudFormation stack; that is, the AWS resources that are created. When an end-user launches a product, AWS Service Catalog provisions the product from an AWS CloudFormation stack.
  • Constraints control the way users can deploy a product. With launch constraints, you can specify a role that the AWS Service Catalog can assume to launch a product.

Solution overview­

The following diagram maps out the solution architecture.

Here’s the process for the administrator:

  1. The administrator deploys an AWS CloudFormation template that creates base components in the Control Tower management environment like API Gateway, DynamoDB, Lambda, Step Function and others. These components will be used by the add configuration and managed account configuration deployment process.
  2. The administrator uses the Add Configuration process to add a CloudFormation configuration item to the configuration database which will be used by the managed account deployment process.

Here’s the process when the managed account deploys a CloudFormation configuration item:

  1. Behind the scene, invisible to the end-user, a scheduled Cloud Watch rule triggers a Lambda in the managed account which communicates to the master account through an API Gateway. The process queries the configuration database for new CloudFormation configuration items.
  2. If there are new CloudFormation configuration item the managed account deploys the CloudFormation template and updates the configuration database.

Step 1: Configuring an environment

Prerequisites:

You will need the following information to deploy the base components:
A user with an administrator role
The name of a user, group or role who will launch AWS Service Catalog products. You will enter the user as follows:

  • User  :user/<username>
  • Role  :role/<rolename>
  • Group: group/<groupname>

Deploy the base components:

Deployment Methods:

Download content and use your own bucket.

  1. Download this content zip file
  2. Extract the zip file, it will create a folder called postaction
  3. Create an AWS S3 bucket, note the bucket name
  4. Upload the postaction folder to the bucket
  5. Drill down into the postaction folder
  6. Click the checkbox next to setup_ctpostaction_base.json
  7. Right click and copy the Object URL

Use content from existing location.

  1. Login to the AWS Control Tower console using the Control Tower master account with an administrator role.
  2. Verify that AWS Control Tower has been deployed successfully.
  3. Right click and copy this CloudFormation setup link.
  4. Open the AWS CloudFormation console in a new browser tab.
  5. In the AWS CloudFormation console, choose Create Stack, Amazon S3 URL, paste the URL you just copied, and then choose Next.
  6. On the Specify stack details page, specify the following:
    • Stack name: ctpostactionbase
    • SourceBucket: use default or enter your bucket name
  7. Leave the default values except as noted.
  8. On the Review page, check the box next to I acknowledge that AWS CloudFormation might create IAM resources with custom names, and choose Create.
  9. After the status of the stack changes to CREATE COMPLETE, select the stack and choose Outputs to see the output.

  • In the parameter screen the user  selects the parameters for the stack location and the target organization unit.
  • When the parameters have all been selected, the user  launches the AWS Service Catalog product.

Deploy a CloudFormation configuration item:

  1. Login to the AWS Service Catalog console
  2. Select Product list from the top left
  3. Select the SCproductCTAddConfigItem AWS Service Catalog product
  4. Select the LAUNCH PRODUCT button
  5. Enter a Name myfirstconfig select Next
  6. Parameters:
    1.  AutomationDescription: default
    2. AutonomousLevel:
      1. Autonomous – configuration will be deployed by the service.
    3. ActionMethod
      1. SpokePull – The manage accounts will download and install this configuration
      2. MasterPush – The Control Tower master account will push this configuration to manage accounts.
    4. S3StackLocation – The CloudFormation stack to be deployed
    5. OrgUnits – The OrgUnit to deploy the configuration to accounts in this OU will get the configuration
    6. Regions – The region to apply the configuration  select 1 or ALL
    7. AdministrationRoleARN – use default
    8. ExecutionRoleName – use default
  7. Select Next
  8. On the TagOptions page select Next
  9. On the Notifications page select Next
  10. On the Review page select Launch
  11. Monitor until the Status changes to Succeeded
  12. Optional – you can switch to a mange account to verify the configuration has been deployed.

Cleanup process

To avoid incurring cost, please delete resources that are not needed.  You can terminate the Service Catalog product deployed from the AWS Service Catalog console, select Provisioned products then select Action then Terminate.

Conclusion

In this post, you learned an easy way to for administrators to configure an AWS Control Tower environment to automatically deploy configurations when needed. You also saw how there’s an extra layer of governance and control when you use Control Tower and AWS Service Catalog to deploy resources to support business objectives.

About the Author

Kenneth Walsh is a solutions architect focusing on AWS Marketplace. Kenneth is passionate about cloud computing and loves being a trusted advisor for his customers.