You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: .github/ISSUE_TEMPLATE/guidance.md
+6-5Lines changed: 6 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,10 +1,9 @@
1
1
---
2
2
name: Guidance
3
3
about: Ask a guidance question
4
-
title: "[Guidance]"
4
+
title: '[Guidance]'
5
5
labels: question
6
6
assignees: ''
7
-
8
7
---
9
8
10
9
<!--
@@ -18,6 +17,7 @@ clarification, instead of filing a new issue.
18
17
-->
19
18
20
19
### The Question
20
+
21
21
<!--
22
22
Ask your question here. Include any details relevant. Make sure you are not
23
23
falling prey to the [X/Y problem][2]!
@@ -27,8 +27,9 @@ falling prey to the [X/Y problem][2]!
27
27
28
28
### Environment
29
29
30
-
-**Example:**<!-- Name of the example in question -->
31
-
-**Framework**<!-- [all | Customizations for Control Tower | CloudFormation StackSets | etc... ] -->
30
+
-**Example:**<!-- Name of the example in question -->
31
+
-**Framework**<!-- [all | Customizations for Control Tower | CloudFormation StackSets | etc... ] -->
32
+
33
+
### Other information
32
34
33
-
### Other information
34
35
<!-- e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc -->
Copy file name to clipboardExpand all lines: CHANGELOG.md
+83Lines changed: 83 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,7 @@
3
3
## Table of Contents<!-- omit in toc -->
4
4
5
5
-[Introduction](#introduction)
6
+
-[2022-03-14](#2022-03-14)
6
7
-[2022-01-07](#2022-01-07)
7
8
-[2021-12-16](#2021-12-16)
8
9
-[2021-12-10](#2021-12-10)
@@ -20,6 +21,88 @@ All notable changes to this project will be documented in this file.
20
21
21
22
---
22
23
24
+
## 2022-03-14
25
+
26
+
### Added<!-- omit in toc -->
27
+
28
+
- Added new document [DOWNLOAD-AND-STAGE-SOLUTIONS.md](aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md) to explain the steps for downloading the SRA example code and staging the solutions within the S3 staging bucket.
29
+
- Added [Security Hub Organization](aws_sra_examples/solutions/securityhub/securityhub_org) solution to configure Security Hub using AWS Organizations. All existing accounts are added to the central admin account, standards are enabled/disabled per
30
+
provided parameters, a region aggregator is created per the provided paramenter, and a parameter is provided for disabling Security Hub within all accounts and regions via SNS fanout.
31
+
32
+
### Changed<!-- omit in toc -->
33
+
34
+
- Updated the [CFCT-DEPLOYMENT-INSTRUCTIONS.md](aws_sra_examples/docs/CFCT-DEPLOYMENT-INSTRUCTIONS.md) document to remove references to the common_cfct_setup solution.
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
44
+
- Removed the Lambda function that created a new OU and moved the management account. This is no longer required due to the latest version of the CFCT solution supporting deployments to the management account within the root OU.
- Added a template to create a KMS key for sharing CloudFormation outputs via Secrets Manager secrets.
47
+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
48
+
- Updated the staging bucket policy to fix the reference to the AWSControlTowerExecution role ARN.
49
+
- Added SRA version parameter to main templates for triggering updates to StackSets.
50
+
- Added logic within the descriptions to reference the rControlTowerExecutionRoleStack resource if the cCreateAWSControlTowerExecutionRole condition is met. This logic avoids creating an empty stack when the condition is false.
- Added main templates to simplify deployments via nested stacks.
59
+
- Updated the CFCT configuration to use the main templates and parameters.
60
+
- Added pRegisterDelegatedAdminAccount parameter to determine whether or not to register the delegated administrator account. This allows the ability to register the delegated admin accounts outside of this solution.
- Added main templates to simplify deployments via nested stacks.
63
+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
64
+
- Updated the CFCT configuration to use the main templates and parameters.
65
+
- Added pRegisterDelegatedAdminAccount parameter to determine whether or not to register the delegated administrator account.
66
+
- Moved the list_config_recorder_status.py script from the utils/aws_control_tower/helper_scripts to the solution scripts folder.
67
+
- Updated and moved the Operational-Best-Practices-for-Encryption-and-Keys.yaml conformance pack template to the templates/aws_config_conformance_packs folder.
- Added main templates to simplify deployments via nested stacks.
90
+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
91
+
- Added a parameter and logic to disable Macie within all accounts and regions using SNS fanout.
92
+
-[S3 Block Account Public Access](aws_sra_examples/solutions/s3/s3_block_account_public_access) solution
93
+
- Added main templates to simplify deployments via nested stacks.
94
+
- Updated documentation, diagram, and templates to be consistent with the rest of the solutions.
95
+
96
+
### Removed<!-- omit in toc -->
97
+
98
+
- The `Account Security Hub Enabler` solution was replaced with the [Security Hub Organization](aws_sra_examples/solutions/securityhub/securityhub_org) solution.
99
+
- The `package-lambda.sh` script was replaced by the stage_solution.sh script.
100
+
- The `Prerequisites for AWS Control Tower solutions` files were replaced with the [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution.
101
+
102
+
### Fixed<!-- omit in toc -->
103
+
104
+
- Fixed checkov metadata entries to use updated [check suppression via CFN Metadata](https://github.com/bridgecrewio/checkov/pull/2216).
Copy file name to clipboardExpand all lines: README.md
+15-23Lines changed: 15 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,9 +17,11 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
17
17
## Introduction
18
18
19
19
This repository contains code to help developers and engineers deploy AWS security-related services in an `AWS Control Tower` multi-account environment following patterns that align with the
20
-
[AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). The Amazon Web Services (AWS) Security Reference Architecture (AWS SRA) is a holistic set of guidelines for deploying the full complement of AWS security services in a multi-account environment.
20
+
[AWS Security Reference Architecture](https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/). The Amazon Web Services (AWS) Security Reference Architecture (AWS SRA) is a holistic set of guidelines for deploying
21
+
the full complement of AWS security services in a multi-account environment.
21
22
22
-
The AWS service configurations and resources (e.g. IAM roles and policies) deployed by these templates are deliberately very restrictive. They are intended to illustrate an implementation pattern rather than provide a complete solution. You may need to modify and tailor these solutions to suit your environment and security needs.
23
+
The AWS service configurations and resources (e.g. IAM roles and policies) deployed by these templates are deliberately very restrictive. They are intended to illustrate an implementation pattern rather than provide a complete solution. You may need
24
+
to modify and tailor these solutions to suit your environment and security needs.
23
25
24
26
The examples within this repository have been deployed and tested within an `AWS Control Tower` environment using `AWS CloudFormation` as well as the `Customizations for AWS Control Tower (CFCT)` solution.
25
27
@@ -30,8 +32,8 @@ The examples within this repository have been deployed and tested within an `AWS
30
32
1. Setup the environment to configure [AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/getting-started-with-control-tower.html) within a new or existing AWS account.
31
33
2. Deploy the [Common Prerequisites](aws_sra_examples/solutions/common/common_prerequisites) solution.
- Customizations for AWS Control Tower (CFCT) - [Solution Documentation](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/)
35
37
4. (Optional) - Deploy the [Customizations for AWS Control Tower (CFCT) Setup](aws_sra_examples/solutions/common/common_cfct_setup) solution. **Note** Only implement if the CFCT deployment method was selected.
36
38
5. Per your requirements select one or all of the [Example Solutions](aws_sra_examples/solutions) to implement via the selected deployment method.
37
39
@@ -53,26 +55,24 @@ The examples within this repository have been deployed and tested within an `AWS
-[Prerequisites for AWS Control Tower solutions](aws_sra_examples/utils/aws_control_tower/prerequisites)
67
-
- packaging_scripts
68
-
- package-lambda.sh (Creates the Lambda zip file and uploads to an S3 bucket)
68
+
- packaging_scripts/stage-solution.sh (Package and stage all the AWS SRA example solutions. For more information see [Staging script details](aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md#staging-script-details))
69
69
70
70
## Environment Setup
71
71
72
72
Based on the deployment method selected these solutions are required to implement SRA solutions.
73
73
74
-
-[Common Customizations for AWS Control Tower (CFCT) Setup](aws_sra_examples/solutions/common/common_cfct_setup)
The example solutions within this repository can be managed/deployed to accounts using AWS Organizations or directly within individual accounts. The suffix on the solution name identifies how the solution is managed/deployed.
| acct | The solution is managed/deployed within each account |
112
-
| org | The solution is managed/deployed to accounts via AWS Organizations |
113
-
| ou | The solution is managed/deployed to accounts via Organization Units |
114
-
115
107
## Frequently Asked Questions
116
108
117
109
Q. How were these particular solutions chosen? A. All the examples in this repository are derived from common patterns that many customers ask us to help them deploy within their environments. We will be adding to the examples over time.
0 commit comments