Background

AWS Manage Tower supplies a straightforward method to setup and govern an Amazon Web Solutions (AWS) multi-account atmosphere, following prescriptive guidelines. AWS Manage Tower orchestrates the abilities of other AWS solutions, which includes AWS Businesses, AWS Support Catalog, and AWS Solitary Sign-On (AWS SSO), to create a landing zone rapidly. AWS SSO is really a cloud-based support that simplifies the method that you manage SSO usage of AWS accounts and company applications using Protection Assertion Markup Vocabulary (SAML) 2.0. You may use AWS Manage Tower to generate and provision brand new AWS accounts and make use of AWS SSO to assign user usage of those newly-produced accounts.

Some clients have to provision tens, or even hundreds, of brand new AWS accounts at once and assign usage of many users. If you work with AWS Control Tower, achieving this needs that you provision an AWS accounts in AWS Manage Tower, and assign the user usage of the AWS accounts in AWS SSO before shifting to another AWS account. This technique adds complexity and period for administrators who manage the AWS atmosphere while delaying users’ usage of their AWS accounts.

In this website post, we’ll demonstrate how exactly to automate creating several AWS accounts in AWS Control Tower, and how exactly to automate assigning user usage of the AWS accounts in AWS SSO, having the ability to repeat the process very easily for subsequent batches of accounts. This answer simplifies the provisioning and assignment processes, while allowing automation for the AWS environment, and enables your builders to start out making use of and experimenting on AWS quicker.

Providers used

This solution uses the next AWS services:

Higher level solution overview

Determine 1 displays the architecture and workflow of the batch AWS accounts development and SSO assignment procedures.

Before starting

This solution is configured to be deployed in the North Virginia Region (us-east-1). Nevertheless, you can transform the CloudFormation template to perform in virtually any Region that supports all of the services required in the perfect solution is.

AWS Control Tower Account Factory may take around 25 minutes to generate and provision a fresh account. During this time, you’ll be struggling to use AWS Control Tower to execute actions such as for example creating an organizational unit (OU) or enabling a guardrail on an OU. As a recommendation, running this solution throughout a time period once you usually do not anticipate using AWS Control Tower’s features is most beneficial practice.

Collect needed information

Note: You’ll want already configured AWS Control Tower, AWS Organizations, and AWS SSO to utilize this solution.

Before deploying the answer, you will need to first collect some information for AWS CloudFormation.

The mandatory information you’ll have to gather in these steps is:

• AWS SSO instance ARN
• AWS SSO Identity Store ID
• Admin email address
• Amazon S3 bucket
• AWS SSO user group ARN

Prerequisite information: AWS SSO instance ARN

From the net console

You’ll find these details under Settings in the AWS SSO web console as shown in Figure 2.

From the CLI

You can even understand this information by running the next CLI command using AWS Command Line Interface (AWS CLI):

aws sso-admin list-instances

The output is comparable to the next:

"Instances": [

"InstanceArn": "arn:aws:sso:::instance/ssoins-abc1234567",
"IdentityStoreId": "d-123456abcd"

        Take note of the InstanceArn value from the output, as this is found in the AWS SSO instance ARN.

aws sso-admin list-permission-sets --instance-arn 

"PermissionSets": [
"arn:aws:sso:::permissionSet/ssoins-abc1234567/ps-1234567890abcdef",
"arn:aws:sso:::permissionSet/ssoins-abc1234567/ps-abcdef1234567890"
]
     

     aws sso-admin describe-permission-set --instance-arn  --permission-set-arn      

     
"PermissionSet": 
"Name": "AWSPowerUserAccess",
"PermissionSetArn": "arn:aws:sso:::permissionSet/ssoins-abc1234567/ps-abc123def4567890",
"Description": "Provides full usage of AWS services and resources, but will not allow management of Users and groups",
"CreatedDate": "2020-08-28T11:20:34.242000-04:00",
"SessionDuration": "PT1H"

 

     AccountName,SSOUserEmail,AccountEmail,SSOUserFirstName,SSOUserLastName,OrgUnit,Status,AccountId,ErrorMsg

Where in fact the first line may be the column names, and each subsequent line provides the new AWS accounts that you would like to generate and automatically assign that SSO user group to the permission set.

CSV fields

Figure 7 shows the facts that are contained in our example for both new AWS accounts that’ll be created.

1. 1. The  NewAccountHandler  function is triggered from an object upload in to the Amazon S3 bucket, validates the input file entries, and uploads the validated input entries to the Amazon DynamoDB table file.

1. 1. The CreateManagedAccount  function queries the DynamoDB table to obtain the details of another account to be created. When there is another account to be created, then your batch account creation process progresses to Step 4, it completes otherwise.

1. 1. The CreateManagedAccount  function launches the AWS Control Tower Account Factory product in AWS Service Catalog to generate and provision a fresh account.

1. 1. After Account Factory has completed the account creation workflow, it creates the CreateManagedAccount lifecycle event, and the function log states if the workflow SUCCEEDED or FAILED .

1. 1. The CloudWatch Events rule detects the CreateManagedAccount  AWS Control Tower Lifecycle Event, and triggers the CreateManagedAccount  and CreateAccountAssignment  functions, and sends email notification to the administrator via AWS SNS.

1. 1. The CreateManagedAccount  function updates the Amazon DynamoDB table with the outcomes of the AWS account creation workflow. If the account was created, it updates the input file entry in the Amazon DynamoDB table with the account ID; otherwise, it updates the entry in the table with the correct failure or error reason.

1. 1. The  CreateAccountAssignment  function assigns the AWS SSO Permission Set with the correct AWS IAM policies to an individual Group specified in the Parameters when launching the AWS CloudFormation stack.

1. 1. Once the Amazon DynamoDB table is updated, the Amazon DynamoDB stream triggers the CreateManagedAccount  function for subsequent AWS accounts or when new AWS account list CSV files are updated, steps 1-9 are repeated then.

Upload the CSV file

After the AWS account list CSV file has been created, upload it in to the Amazon S3 bucket developed by the stack.

Deploying the answer

To launch the AWS CloudFormation stack

Now that all of the requirements and the specifications to perform the solution are prepared, it is possible to launch the AWS CloudFormation stack:

1. 1. Open the AWS CloudFormation launch wizard in the console.

1. 1. In the Create stack page, choose Next .

      

      Figure 8: Create stack in CloudFormation

1. 1. On the Specify stack details page, update the default parameters to utilize the info you captured in the prerequisites as shown in Figure 9, and choose Next .

      

      Figure 9: Input parameters into AWS CloudFormation

1. 1. On the Configure stack option page, choose Next .

1. 1. On the Review page, check the box “ I acknowledge that AWS CloudFormation might create IAM resources. ” and choose Create Stack .

1. 1. After the AWS CloudFormation stack has completed, go directly to the Amazon S3 web console and choose the Amazon S3 bucket that you defined in the AWS CloudFormation stack.

1. 1. Upload the AWS account list CSV file with the info to generate new AWS accounts. See To generate the AWS Account list CSV file above for information on creating the CSV file.

Workflow and solution details

Whenever a new file is uploaded to the Amazon S3 bucket, the next actions occur:

1. 1. Once you upload the AWS account list CSV file to the Amazon S3 bucket, the Amazon S3 service triggers a meeting for newly uploaded objects that invokes the Lambda function NewAccountHandler .

1. 1. This Lambda function executes the next steps:
      • • Checks if the Lambda function was invoked by an Amazon S3 event, or the CloudFormation CREATE event.
      • • If the function is really a new object uploaded from Amazon S3, browse the object.
      • • Validate this content of the CSV apply for the mandatory columns and values.
      • • If the info includes a valid format, insert a fresh item with the info in to the Amazon DynamoDB table, as shown in Figure 10 below.

          

          Figure 10: DynamoDB table items with AWS accounts details

      • • Amazon DynamoDB is configured to initiate the Lambda function CreateManagedAccount  when insert , update , or delete items are initiated.
      • • The Lambda function CreateManagedAccount checks for update event type. When something is updated in the table, the Lambda checks this item function, and when the AWS account isn’t created, the Lambda function invokes the AWS Control Tower Account Factory from the AWS Service Catalog to make a new AWS account with the facts stored in the Amazon DynamoDB item.
      • • AWS Control Tower Account Factory starts the AWS account creation process. Once the account creation process completes, the status of Account Factory will show as Available in Provisioned products , as shown in Figure 11.

          

          Figure 11: AWS Service Catalog provisioned products for AWS account creation

      • • In line with the Control Tower lifecycle events, the CreateAccountAssignment Lambda function will undoubtedly be invoked once the CreateManagedAccount event is delivered to CloudWatch Events. An AWS SNS topic can be triggered to send a contact notification to the administrator email as shown in Figure 12 below.

          

          Figure 12: AWS email notification when account creation completes

      • • When invoked, the Lambda function CreateAccountAssignment assigns the AWS SSO user group to the brand new AWS account with the permission set defined in the AWS CloudFormation stack.

          

          Figure 13: New AWS account showing user groups with permission sets assigned

Figure 13 above shows the brand new AWS account with an individual groups and the assigned permission sets. This completes the automation process. The AWS SSO users which are area of the user group will automatically be permitted to access the brand new AWS account with the defined permission set.

Handling common resources of error

This solution connects multiple components to facilitate the brand new AWS account creation and AWS SSO permission set assignment. The correctness of the parameters in the AWS CloudFormation stack is essential to make certain that when AWS Control Tower creates a fresh AWS account, it really is accessible.

To verify that solution works, make sure that the e-mail address is really a valid email, you get access to that email, which is not being used for just about any existing AWS account. Following a new account is established, it isn’t possible to improve its root account email, if you input an invalid or inaccessible email, you need to develop a new AWS account and take away the invalid account.

You will see common errors by visiting AWS Service Catalog web console. Under Provisioned products , you can view all your AWS Control Tower Account Factory-launched AWS accounts.

Selecting Error beneath the Status column teaches you the foundation of the error. Figure 15 below can be an example of the foundation of the error:

Conclusion

In this article, we’ve shown you how exactly to automate batch creation of AWS accounts in AWS Control Tower and batch assignment of user usage of AWS accounts in AWS SSO. Once the batch AWS accounts creation and AWS SSO user access assignment processes are complete, the administrator will undoubtedly be notified by emails from AWS SNS. We’ve also explained the way to handle some common resources of errors and how to prevent them.

As you automate the batch AWS account user and creation access assignment, you can decrease the time you may spend on the undifferentiated heavy lifting work, and onboard your users in your company much more quickly, to allow them to begin using and experimenting on AWS immediately.

For more information about the guidelines of establishing an AWS multi-account environment, have a look at this documentation to find out more.

When you have feedback concerning this post, submit comments in the Comments section below.

Want more AWS Security news? Follow us on Twitter .