Skip to content

Commit 5b302a6

Browse files
author
AWS
committed
Release: 1.9.0
1 parent c86136b commit 5b302a6

File tree

51 files changed

+644
-405
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+644
-405
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
120120
| <a name="input_aft_vpc_public_subnet_02_cidr"></a> [aft\_vpc\_public\_subnet\_02\_cidr](#input\_aft\_vpc\_public\_subnet\_02\_cidr) | CIDR Block to allocate to the Public Subnet 02 | `string` | `"192.168.2.128/25"` | no |
121121
| <a name="input_audit_account_id"></a> [audit\_account\_id](#input\_audit\_account\_id) | Audit Account Id | `string` | n/a | yes |
122122
| <a name="input_cloudwatch_log_group_retention"></a> [cloudwatch\_log\_group\_retention](#input\_cloudwatch\_log\_group\_retention) | Amount of days to keep CloudWatch Log Groups for Lambda functions. 0 = Never Expire | `string` | `"0"` | no |
123+
| <a name="input_concurrent_account_factory_actions"></a> [concurrent\_account\_factory\_actions](#input\_concurrent\_account\_factory\_actions) | Maximum number of accounts that can be provisioned in parallel. | `number` | `5` | no |
123124
| <a name="input_ct_home_region"></a> [ct\_home\_region](#input\_ct\_home\_region) | The region from which this module will be executed. This MUST be the same region as Control Tower is deployed. | `string` | n/a | yes |
124125
| <a name="input_ct_management_account_id"></a> [ct\_management\_account\_id](#input\_ct\_management\_account\_id) | Control Tower Management Account Id | `string` | n/a | yes |
125126
| <a name="input_github_enterprise_url"></a> [github\_enterprise\_url](#input\_github\_enterprise\_url) | GitHub enterprise URL, if GitHub Enterprise is being used | `string` | `"null"` | no |

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.8.0
1+
1.9.0

‎locals.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@ locals {
1818
lambda_layer_codebuild_delay = "420s"
1919
lambda_layer_python_version = "3.8"
2020
lambda_layer_name = "aft-common"
21+
create_role_lambda_function_name = "aft-account-provisioning-framework-create-aft-execution-role"
22+
tag_account_lambda_function_name = "aft-account-provisioning-framework-tag-account"
23+
persist_metadata_lambda_function_name = "aft-account-provisioning-framework-persist-metadata"
24+
account_metadata_ssm_lambda_function_name = "aft-account-provisioning-framework-account-metadata-ssm"
25+
delete_default_vpc_lambda_function_name = "aft-delete-default-vpc"
26+
enroll_support_lambda_function_name = "aft-enroll-support"
27+
enable_cloudtrail_lambda_function_name = "aft-enable-cloudtrail"
2128
ssm_paths = {
2229
aft_tf_aws_customizations_module_url_ssm_path = "/aft/config/aft-pipeline-code-source/repo-url"
2330
aft_tf_aws_customizations_module_git_ref_ssm_path = "/aft/config/aft-pipeline-code-source/repo-git-ref"

‎main.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ module "aft_account_provisioning_framework" {
2323
cloudwatch_log_group_retention = var.cloudwatch_log_group_retention
2424
provisioning_framework_archive_path = module.packaging.provisioning_framework_archive_path
2525
provisioning_framework_archive_hash = module.packaging.provisioning_framework_archive_hash
26+
create_role_lambda_function_name = local.create_role_lambda_function_name
27+
tag_account_lambda_function_name = local.tag_account_lambda_function_name
28+
persist_metadata_lambda_function_name = local.persist_metadata_lambda_function_name
29+
account_metadata_ssm_lambda_function_name = local.account_metadata_ssm_lambda_function_name
30+
delete_default_vpc_lambda_function_name = local.delete_default_vpc_lambda_function_name
31+
enroll_support_lambda_function_name = local.enroll_support_lambda_function_name
32+
enable_cloudtrail_lambda_function_name = local.enable_cloudtrail_lambda_function_name
33+
2634
}
2735

2836
module "aft_account_request_framework" {
@@ -41,6 +49,7 @@ module "aft_account_request_framework" {
4149
aft_vpc_public_subnet_01_cidr = var.aft_vpc_public_subnet_01_cidr
4250
aft_vpc_public_subnet_02_cidr = var.aft_vpc_public_subnet_02_cidr
4351
aft_vpc_endpoints = var.aft_vpc_endpoints
52+
concurrent_account_factory_actions = var.concurrent_account_factory_actions
4453
request_framework_archive_path = module.packaging.request_framework_archive_path
4554
request_framework_archive_hash = module.packaging.request_framework_archive_hash
4655
}
@@ -143,6 +152,9 @@ module "aft_feature_options" {
143152
cloudwatch_log_group_retention = var.cloudwatch_log_group_retention
144153
feature_options_archive_path = module.packaging.feature_options_archive_path
145154
feature_options_archive_hash = module.packaging.feature_options_archive_hash
155+
delete_default_vpc_lambda_function_name = local.delete_default_vpc_lambda_function_name
156+
enroll_support_lambda_function_name = local.enroll_support_lambda_function_name
157+
enable_cloudtrail_lambda_function_name = local.enable_cloudtrail_lambda_function_name
146158
}
147159

148160
module "aft_iam_roles" {

‎modules/aft-account-provisioning-framework/cloudwatch.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
#
4+
resource "aws_cloudwatch_query_definition" "customization_request_query" {
5+
name = "Account Factory for Terraform/Customization Logs by Customization Request ID"
6+
7+
log_group_names = [
8+
"/aws/lambda/${var.create_role_lambda_function_name}",
9+
"/aws/lambda/${var.persist_metadata_lambda_function_name}",
10+
"/aws/lambda/${var.tag_account_lambda_function_name}",
11+
"/aws/lambda/${var.account_metadata_ssm_lambda_function_name}",
12+
"/aws/lambda/${var.delete_default_vpc_lambda_function_name}",
13+
"/aws/lambda/${var.enroll_support_lambda_function_name}",
14+
"/aws/lambda/${var.enable_cloudtrail_lambda_function_name}",
15+
]
16+
17+
query_string = <<EOF
18+
fields @timestamp, log_message.account_id as target_account_id, log_message.customization_request_id as customization_request_id, log_message.detail as detail, @logStream
19+
| sort @timestamp desc
20+
| filter log_message.customization_request_id == "INSERT-CUSTOMIZATION-REQUEST-ID-HERE"
21+
EOF
22+
}
23+
24+
resource "aws_cloudwatch_query_definition" "account_id_query" {
25+
name = "Account Factory for Terraform/Customization Logs by Account ID"
26+
27+
log_group_names = [
28+
"/aws/lambda/${var.create_role_lambda_function_name}",
29+
"/aws/lambda/${var.persist_metadata_lambda_function_name}",
30+
"/aws/lambda/${var.tag_account_lambda_function_name}",
31+
"/aws/lambda/${var.account_metadata_ssm_lambda_function_name}",
32+
"/aws/lambda/${var.delete_default_vpc_lambda_function_name}",
33+
"/aws/lambda/${var.enroll_support_lambda_function_name}",
34+
"/aws/lambda/${var.enable_cloudtrail_lambda_function_name}",
35+
]
36+
37+
query_string = <<EOF
38+
fields @timestamp, log_message.account_id as target_account_id, log_message.customization_request_id as customization_request_id, log_message.detail as detail, @logStream
39+
| sort @timestamp desc
40+
| filter log_message.account_id == "INSERT-ACCOUNT-ID-HERE" and @message like /customization_request_id/
41+
EOF
42+
}

‎modules/aft-account-provisioning-framework/lambda.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
#tfsec:ignore:aws-lambda-enable-tracing
77
resource "aws_lambda_function" "create_role" {
88
filename = var.provisioning_framework_archive_path
9-
function_name = "aft-account-provisioning-framework-create-aft-execution-role"
9+
function_name = var.create_role_lambda_function_name
1010
description = "AFT account provisioning framework - create_role"
1111
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_create_role.arn
1212
handler = "aft_account_provisioning_framework_create_role.lambda_handler"
@@ -33,7 +33,7 @@ resource "aws_cloudwatch_log_group" "create_role" {
3333
#tfsec:ignore:aws-lambda-enable-tracing
3434
resource "aws_lambda_function" "tag_account" {
3535
filename = var.provisioning_framework_archive_path
36-
function_name = "aft-account-provisioning-framework-tag-account"
36+
function_name = var.tag_account_lambda_function_name
3737
description = "AFT account provisioning framework - tag_account"
3838
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_tag_account.arn
3939
handler = "aft_account_provisioning_framework_tag_account.lambda_handler"
@@ -59,7 +59,7 @@ resource "aws_cloudwatch_log_group" "tag_account" {
5959
#tfsec:ignore:aws-lambda-enable-tracing
6060
resource "aws_lambda_function" "persist_metadata" {
6161
filename = var.provisioning_framework_archive_path
62-
function_name = "aft-account-provisioning-framework-persist-metadata"
62+
function_name = var.persist_metadata_lambda_function_name
6363
description = "AFT account provisioning framework - persist_metadata"
6464
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_persist_metadata.arn
6565
handler = "aft_account_provisioning_framework_persist_metadata.lambda_handler"
@@ -87,7 +87,7 @@ resource "aws_cloudwatch_log_group" "persist_metadata" {
8787
#tfsec:ignore:aws-lambda-enable-tracing
8888
resource "aws_lambda_function" "account_metadata_ssm" {
8989
filename = var.provisioning_framework_archive_path
90-
function_name = "aft-account-provisioning-framework-account-metadata-ssm"
90+
function_name = var.account_metadata_ssm_lambda_function_name
9191
description = "AFT account provisioning framework - account_metadata_ssm"
9292
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_persist_metadata.arn
9393
handler = "aft_account_provisioning_framework_account_metadata_ssm.lambda_handler"

‎modules/aft-account-provisioning-framework/variables.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,3 +52,31 @@ variable "provisioning_framework_archive_path" {
5252
variable "provisioning_framework_archive_hash" {
5353
type = string
5454
}
55+
56+
variable "create_role_lambda_function_name" {
57+
type = string
58+
}
59+
60+
variable "tag_account_lambda_function_name" {
61+
type = string
62+
}
63+
64+
variable "persist_metadata_lambda_function_name" {
65+
type = string
66+
}
67+
68+
variable "account_metadata_ssm_lambda_function_name" {
69+
type = string
70+
}
71+
72+
variable "delete_default_vpc_lambda_function_name" {
73+
type = string
74+
}
75+
76+
variable "enroll_support_lambda_function_name" {
77+
type = string
78+
}
79+
80+
variable "enable_cloudtrail_lambda_function_name" {
81+
type = string
82+
}

‎modules/aft-account-request-framework/eventbridge.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ resource "aws_cloudwatch_event_rule" "aft_control_tower_events" {
2222
"source": ["aws.controltower"],
2323
"detail-type": ["AWS Service Event via CloudTrail"],
2424
"detail": {
25-
"eventName": ["SetupLandingZone", "UpdateLandingZone", "RegisterOrganizationalUnit", "DeregisterOrganizationalUnit", "EnableGuardrail", "DisableGuardrail", "CreateManagedAccount", "UpdateManagedAccount"]
25+
"eventName": ["CreateManagedAccount", "UpdateManagedAccount"]
2626
}
2727
}
2828
EOF

‎modules/aft-account-request-framework/iam/role-policies/lambda-account-request-action-trigger.tpl‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,15 @@
6868
"arn:${data_aws_partition_current_partition}:kms:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:alias/aws/sns"
6969
]
7070
},
71+
{
72+
"Effect": "Allow",
73+
"Action": [
74+
"states:StartExecution"
75+
],
76+
"Resource": [
77+
"arn:${data_aws_partition_current_partition}:states:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:stateMachine:aft-account-provisioning-framework"
78+
]
79+
},
7180
{
7281
"Effect" : "Allow",
7382
"Action" : [

‎modules/aft-account-request-framework/lambda.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,12 @@ resource "aws_lambda_function" "aft_account_request_processor" {
137137
timeout = "300"
138138
layers = [var.aft_common_layer_arn]
139139

140+
environment {
141+
variables = {
142+
AFT_PROVISIONING_CONCURRENCY = var.concurrent_account_factory_actions
143+
}
144+
}
145+
140146
vpc_config {
141147
subnet_ids = tolist([aws_subnet.aft_vpc_private_subnet_01.id, aws_subnet.aft_vpc_private_subnet_02.id])
142148
security_group_ids = tolist([aws_security_group.aft_vpc_default_sg.id])

0 commit comments

Comments
 (0)