Release: 1.9.2

AWS · AWS · commit 60ee77b6a90e · 2023-03-22T19:05:02.000Z
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.9.1
+1.9.2
diff --git a/locals.tf b/locals.tf
@@ -16,7 +16,7 @@ locals {
   log_archive_access_logs_bucket_name              = "aws-aft-s3-access-logs"
   log_archive_bucket_object_expiration_days        = "365"
   lambda_layer_codebuild_delay                     = "420s"
-  lambda_layer_python_version                      = "3.8"
+  lambda_layer_python_version                      = "3.9"
   lambda_layer_name                                = "aft-common"
   create_role_lambda_function_name                 = "aft-account-provisioning-framework-create-aft-execution-role"
   tag_account_lambda_function_name                 = "aft-account-provisioning-framework-tag-account"
diff --git a/modules/aft-account-provisioning-framework/lambda.tf b/modules/aft-account-provisioning-framework/lambda.tf
@@ -12,7 +12,7 @@ resource "aws_lambda_function" "create_role" {
   handler          = "aft_account_provisioning_framework_create_role.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 
@@ -39,7 +39,7 @@ resource "aws_lambda_function" "tag_account" {
   handler          = "aft_account_provisioning_framework_tag_account.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 
@@ -65,7 +65,7 @@ resource "aws_lambda_function" "persist_metadata" {
   handler          = "aft_account_provisioning_framework_persist_metadata.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 
@@ -93,7 +93,7 @@ resource "aws_lambda_function" "account_metadata_ssm" {
   handler          = "aft_account_provisioning_framework_account_metadata_ssm.lambda_handler"
   source_code_hash = var.provisioning_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = 300
   layers           = [var.aft_common_layer_arn]
 
diff --git a/modules/aft-account-request-framework/lambda.tf b/modules/aft-account-request-framework/lambda.tf
@@ -14,7 +14,7 @@ resource "aws_lambda_function" "aft_account_request_audit_trigger" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -58,7 +58,7 @@ resource "aws_lambda_function" "aft_account_request_action_trigger" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -96,7 +96,7 @@ resource "aws_lambda_function" "aft_controltower_event_logger" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -133,7 +133,7 @@ resource "aws_lambda_function" "aft_account_request_processor" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -177,7 +177,7 @@ resource "aws_lambda_function" "aft_invoke_aft_account_provisioning_framework" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -215,7 +215,7 @@ resource "aws_lambda_function" "aft_cleanup_resources" {
 
   source_code_hash = var.request_framework_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
diff --git a/modules/aft-code-repositories/codebuild.tf b/modules/aft-code-repositories/codebuild.tf
@@ -23,7 +23,7 @@ resource "aws_codebuild_project" "account_request" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
     environment_variable {
@@ -75,7 +75,7 @@ resource "aws_codebuild_project" "account_provisioning_customizations_pipeline"
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
 
diff --git a/modules/aft-customizations/codebuild.tf b/modules/aft-customizations/codebuild.tf
@@ -19,7 +19,7 @@ resource "aws_codebuild_project" "aft_global_customizations_terraform" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
 
@@ -89,7 +89,7 @@ resource "aws_codebuild_project" "aft_account_customizations_terraform" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
     environment_variable {
@@ -158,7 +158,7 @@ resource "aws_codebuild_project" "aft_create_pipeline" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
 
diff --git a/modules/aft-customizations/lambda.tf b/modules/aft-customizations/lambda.tf
@@ -13,7 +13,7 @@ resource "aws_lambda_function" "aft_customizations_identify_targets" {
 
   source_code_hash = var.customizations_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -41,7 +41,7 @@ resource "aws_lambda_function" "aft_customizations_execute_pipeline" {
 
   source_code_hash = var.customizations_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -68,7 +68,7 @@ resource "aws_lambda_function" "aft_customizations_get_pipeline_executions" {
 
   source_code_hash = var.customizations_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
diff --git a/modules/aft-feature-options/lambda.tf b/modules/aft-feature-options/lambda.tf
@@ -13,7 +13,7 @@ resource "aws_lambda_function" "aft_delete_default_vpc" {
 
   source_code_hash = var.feature_options_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -43,7 +43,7 @@ resource "aws_lambda_function" "aft_enroll_support" {
 
   source_code_hash = var.feature_options_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
@@ -72,7 +72,7 @@ resource "aws_lambda_function" "aft_enable_cloudtrail" {
 
   source_code_hash = var.feature_options_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = "300"
   layers           = [var.aft_common_layer_arn]
 
diff --git a/modules/aft-lambda-layer/codebuild.tf b/modules/aft-lambda-layer/codebuild.tf
@@ -15,7 +15,7 @@ resource "aws_codebuild_project" "codebuild" {
 
   environment {
     compute_type                = "BUILD_GENERAL1_MEDIUM"
-    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:3.0"
+    image                       = "aws/codebuild/amazonlinux2-x86_64-standard:4.0"
     type                        = "LINUX_CONTAINER"
     image_pull_credentials_type = "CODEBUILD"
 
diff --git a/modules/aft-lambda-layer/lambda.tf b/modules/aft-lambda-layer/lambda.tf
@@ -11,7 +11,7 @@ resource "aws_lambda_function" "codebuild_invoker" {
   handler          = "codebuild_invoker.lambda_handler"
   source_code_hash = var.builder_archive_hash
   memory_size      = 1024
-  runtime          = "python3.8"
+  runtime          = "python3.9"
   timeout          = 900
 
   vpc_config {
diff --git a/sources/aft-lambda-layer/aft_common/account_request_record_handler.py b/sources/aft-lambda-layer/aft_common/account_request_record_handler.py
@@ -10,10 +10,13 @@
 from aft_common.account_request_framework import (
     build_account_customization_payload,
     build_aft_account_provisioning_framework_event,
+    control_tower_param_changed,
     insert_msg_into_acc_req_queue,
+    provisioned_product_exists,
 )
 from aft_common.auth import AuthClient
 from aft_common.organizations import OrganizationsAgent
+from aft_common.shared_account import shared_account_request
 
 logger = logging.getLogger("aft")
 
@@ -27,6 +30,7 @@ def __init__(self, auth: AuthClient, event: Dict[str, Any]) -> None:
         self._old_image = self.record["dynamodb"].get("OldImage")
         self._new_image = self.record["dynamodb"].get("NewImage")
         self.control_tower_parameters_updated = self._control_tower_parameters_changed()
+        self.auth = auth
 
     @property
     def is_update_action(self) -> bool:
@@ -106,3 +110,45 @@ def handle_customization_request(self) -> None:
             sfn_name=account_provisioning_stepfunction,
             input=json.dumps(account_customization_payload),
         )
+
+    def process_request(self) -> None:
+
+        # Removing account from AFT
+        if self.record["eventName"] == "REMOVE":
+            logger.info("Delete account request received")
+            self.handle_remove()
+
+        # Triggering customization for shared account
+        elif not control_tower_param_changed(
+            record=self.record
+        ) and shared_account_request(event_record=self.record, auth=self.auth):
+            logger.info("Customization request received")
+            self.handle_customization_request()
+
+        # Vending new account
+        elif self.is_create_action and not provisioned_product_exists(
+            record=self.record
+        ):
+            logger.info("New account request received")
+            self.handle_account_request(new_account=True)
+
+        # Importing existing CT account into AFT and triggering customization
+        elif (
+            self.is_create_action
+            and provisioned_product_exists(record=self.record)
+            and not self.control_tower_parameters_updated
+        ):
+            logger.info("Customization request received for existing CT account")
+            self.handle_customization_request()
+
+        # Updating CT parameter for existing AFT account
+        elif self.is_update_action and self.control_tower_parameters_updated:
+            logger.info("Control Tower parameter update request received")
+            self.handle_account_request(new_account=False)
+
+        # Triggering customization for existing AFT account
+        elif self.is_update_action and not self.control_tower_parameters_updated:
+            logger.info("Customization request received")
+            self.handle_customization_request()
+        else:
+            raise Exception("Unsupported account request")
diff --git a/sources/aft-lambda-layer/aft_common/shared_account.py b/sources/aft-lambda-layer/aft_common/shared_account.py
@@ -20,14 +20,13 @@
 logger = logging.getLogger("aft")
 
 
-def shared_account_request(event_record: Dict[str, Any]) -> bool:
+def shared_account_request(event_record: Dict[str, Any], auth: AuthClient) -> bool:
     ct_params = ddb.unmarshal_ddb_item(event_record["dynamodb"]["NewImage"])[
         "control_tower_parameters"
     ]
     account_email = ct_params["AccountEmail"]
     account_name = ct_params["AccountName"]
     request_ou = ct_params["ManagedOrganizationalUnit"]
-    auth = AuthClient()
     shared_account_ids = get_shared_ids(
         aft_management_session=auth.get_aft_management_session()
     )
diff --git a/src/aft_lambda/aft_account_request_framework/aft_account_request_action_trigger.py b/src/aft_lambda/aft_account_request_framework/aft_account_request_action_trigger.py
@@ -30,60 +30,7 @@ def lambda_handler(event: Dict[str, Any], context: LambdaContext) -> None:
     try:
         record_handler = AccountRequestRecordHandler(auth=auth, event=event)
         logger.info(record_handler.record)
-
-        # Account record was deleted from `aft-request` repo
-        if record_handler.record["eventName"] == "REMOVE":
-            record_handler.handle_remove()
-            logger.info("Delete account request received")
-
-        # We only support customization actions against shared accounts
-        elif not control_tower_param_changed(
-            record=record_handler.record
-        ) and shared_account_request(event_record=record_handler.record):
-            logger.info("Customization request received")
-            record_handler.handle_customization_request()
-
-        # In this situation, a new entry has been added to the account request table
-        # but no provisioned product exists, that means no account should exist for this
-        # and we must process this as a new account request
-        elif record_handler.is_create_action and not provisioned_product_exists(
-            record=record_handler.record
-        ):
-            logger.info("New account request received")
-            record_handler.handle_account_request(new_account=True)
-
-        # In this situation, a new entry has been added to the account request table
-        # and a provisioned product exists, and No Control Tower parameters changed
-        elif (
-            record_handler.is_create_action
-            and provisioned_product_exists(record=record_handler.record)
-            and not record_handler.control_tower_parameters_updated
-        ):
-            logger.info("Customization request received for existing CT account")
-            record_handler.handle_customization_request()
-
-        # If we're processing a request that updates an existing entry in the
-        # account request table, we need to handle control tower parameter changes
-        # by routing the request to service catalog
-        elif (
-            record_handler.is_update_action
-            and record_handler.control_tower_parameters_updated
-        ):
-            logger.info("Control Tower parameter update request received")
-            record_handler.handle_account_request(new_account=False)
-
-        # In this situation we have an entry in the account request table, but no control
-        # tower parameters are being updated, we can optimize this flow but routing the
-        # request to the customization stepfunction directly
-        elif (
-            record_handler.is_update_action
-            and not record_handler.control_tower_parameters_updated
-        ):
-            logger.info("Customization request received")
-            record_handler.handle_customization_request()
-
-        else:
-            raise Exception("Unsupported account request")
+        record_handler.process_request()
 
     except Exception as error:
         notifications.send_lambda_failure_sns_message(
