Field Notes: Extending the Baseline in AWS Control Tower to Accelerate the Transition from AWS Landing Zone
AWS Architecture BlogField Notes: Extending the Baseline in AWS Control Tower to Accelerate the Transition from AWS Landing Zoneby MinWoo Lee | on02 NOV 2021| inArchitecture,AWS Control Tower,Management & Governance,Technical How-to|Permalink|ShareCustomers who adopt and operate theAWS Landing Zonesolution as a scalable multi-account environment are starting to migrate to theAWS Control Towerservice. They are doing so to enjoy the added benefits of managed services such as stability, feature enhancement, and operational efficiency. Customers who fully use the baseline for governance control provided by AWS Landing Zone for their member accounts may want to apply the baseline of the same feature without omission even when transitioning to AWS Control Tower. To baseline an account is to set up common blueprints and guardrails required for an organization to enable governance at the start of the account.As shown in Table 1, AWS Control Tower provides most of the features that are mapped with the baseline of the AWS Landing Zone solution through the baseline stacks, guardrails, and account factory, but some features are unique to AWS Landing Zone.Table 1. AWS Landing Zone andAWS Control Tower BaselinemappingAWS Landing Zone baseline stackAWS Control Tower baseline stackAWS-Landing-Zone-Baseline-EnableCloudTrailAWSControlTowerBP-BASELINE-CLOUDTRAILAWS-Landing-Zone-Baseline-SecurityRolesAWSControlTowerBP-BASELINE-ROLESAWS-Landing-Zone-Baseline-EnableConfigAWSControlTowerBP-BASELINE-CLOUDWATCHAWSControlTowerBP-BASELINE-CONFIGAWSControlTowerBP-BASELINE-SERVICE-ROLESAWS-Landing-Zone-Baseline-ConfigRoleAWSControlTowerBP-BASELINE-SERVICE-ROLESAWS-Landing-Zone-Baseline-EnableConfigRuleGuardrails – Enable guardrail on OU(AWSControlTowerGuardrailAWS-GR-xxxxx)AWS-Landing-Zone-Baseline-EnableConfigRulesGlobalGuardrails – Enable guardrail on OU(AWSControlTowerGuardrailAWS-GR-xxxxx)AWS-Landing-Zone-Baseline-PrimaryVPCAccount Factory – Network ConfigurationAWS-Landing-Zone-Baseline-IamPasswordPolicy–AWS-Landing-Zone-Baseline-EnableNotifications–The baselines uniquely provided by AWS Landing Zone are as follows:AWS-Landing-Zone-Baseline-IamPasswordPolicyAWS Lambdato configure AWS Identity and Access Management (IAM)custom password policy(such as minimum password length, password expires period, password complexity, and password history in member accounts).AWS-Landing-Zone-Baseline-EnableNotificationsAmazon CloudWatch alarmsdeliver CloudTrail application programming interface (API) activity such as Security Group changes, Network ACL changes, and Amazon Elastic Compute Cloud (Amazon EC2) instance type changes to the security administrator.AWS provides the AWS Control Tower lifecycle events andCustomizations for AWS Control Toweras a way to add features that are not included by default in AWS Control Tower. Customizations for AWS Control Tower is an AWS solution that allows you to easily add customizations using AWS CloudFormation templates and service control polices.This blog post explains how to modify and deploy the code to apply AWS Landing Zone specific baselines such as IamPasswordPolicy and EnableNotifications into AWS Control Tower usingCustomizations for the AWS Control Tower.Overview of solutionAdhering to the package folder structure of Customizations for AWS Control Tower, modify the AWS Landing Zone IamPasswordPolicy, EnableNotifications template, parameter file, and manifest file to match the AWS Control Tower deployment environment.When the modified package is uploaded to the source repository, contents of the package are validated and built by launchingAWS CodePipeline. The AWS Landing Zone specific baseline is deployed in member accounts throughAWS CloudFormation StackSetsin the AWS Control Tower management account.When a new or existing account is enrolled in AWS Control Tower, the same AWS Landing Zone specific baseline is automatically applied to that account by the lifecycle event (CreateManagedAccount status is SUCCEEDED).Figure 1 shows how the default baseline of AWS Control Tower and the specific baseline of AWS Landing Zone are applied to member accounts.Figure 1. Default and custom baseline deployment in AWS Control TowerWalkthroughThis solution follows these steps:Download and extract the latest version of theAWS Landing Zone Configurationsource package. The package contains several functional components including baseline of IamPasswordPolicy, EnableNotifications for applying to accounts in AWS Landing Zone environment. If you are transitioning from AWS Landing Zone to AWS Control Tower, you may use the AWS Landing Zone configuration source package that exists in your management account.Download and extract the configuration source package of your Customizations for AWS Control Tower.Create templates and parameters folder structure for customizing configuration package source of Customizations for AWS Control Tower.Copy the template and parameter files of the IamPasswordPolicy baseline from the AWS Landing Zone configuration source to the Customizations for AWS Control Tower configuration source.Open the parameter file (JSON), and modify the parameter value to match your organization’s password policy.Copy the template and parameter files of the EnableNotifications baseline from the AWS Landing Zone configuration source to the Customizations for AWS Control Tower configuration source.Open the parameter file (JSON), and change the LogGroupName parameter value to theCloudWatch log groupname of your AWS Control Tower environment. Select whether or not to use each alarm in the parameter value.Open the template file (YAML), and modify the AlarmActions properties of all CloudWatch alarms to refer to the security topic of theAmazon Simple Notification Service(Amazon SNS) that exists in your AWS Control Tower environment.Open the manifest (YAML) file in the configuration source of Customizations for AWS Control Tower, and update with the modified IamPasswordPolicy and EnableNotifications parameter, template file path, andorganizational unitto be applied.If you have customizations which have already been deployed and operated through Customizations for AWS Control Tower, do not remove existing contents, and consecutively add customized resource in resources section.Compress the completed source package, and upload it to the source repository of Customizations for AWS Control Tower.Check the results for applying this solution in AWS Control Tower.In the management account, wait for all AWS CodePipeline steps in Customizations for AWS Control Tower to be completed.In the management account, check that the CloudFormation IamPasswordPolicy and EnableNotifications StackSet is deployed.In a member account, check that the custom password policy is configured in Account Settings of IAM.In a member account, check that alarms are created in All Alarms of CloudWatch.PrerequisitesFor this walkthrough, you should have the following prerequisites:AWS Control Tower deployment.An AWS Control Towermember account.Customizations for AWS Control Towersolution deployment.IAM user and roles, and permission to allow use of ‘CustomControlTowerKMSKey’ inAWS Key Management Service Key Policyto access Amazon Simple Storage Service (Amazon S3) as the configuration source.This is not required in case of using CodeCommit as source repository, but it assumes thatAmazon S3is used for this solution.If the IamPasswordPolicy and EnableNotifications baseline for the AWS Landing Zone service has been deployed in the AWS Control Tower environment, it is necessary to deletestack instancesandStackSetassociated with the following CloudFormation StackSets:AWS-Landing-Zone-Baseline-IamPasswordPolicyAWS-Landing-Zone-Baseline-EnableNotificationsAn IAM orAWS Single Sign-On(AWS SSO) account with the following settings:Permission with AdministratorAccessAccess type with Programmatic access and AWS Management Console accessAWS Command Line Interface(AWS CLI) and Linux Zip package installation in work environment.An IAM or AWS SSO user for member account (optional).Prepare the work environmentDownload the AWS Landing Zone configuration package and Customizations for AWS Control Tower configuration package, and create a folder structure.Open your terminal AWS Command Line Interface (AWS CLI).Note:Confirm that AWS Config and credentials for the AWS Command Line Interface (AWS CLI) are properly set as access method (IAM or AWS SSO user) you are using in management account.Change to home directory and download theaws-landing-zone-configuration.zipfile.cd ~
wget https://s3.amazonaws.com/solutions-reference/aws-landing-zone/latest/aws-landing-zone-configuration.zipExtract AWS Landing Zone configuration file to new directory (Namedalz).unzip aws-landing-zone-configuration.zip -d ~/alzDownload_custom-control-tower-configuration.zipfile in Customizations for AWS Control Tower configuration’s S3 bucket. Use your AWS Account Id and home Region in S3 bucket name.Note:If you have already used the Customizations for AWS Control Tower configuration package, or have the Auto Build parameter set to true, usecustom-control-tower-configuration.zipinstead of_custom-control-tower-configuration.zip.aws s3 cp s3://custom-control-tower-configuration-<AWS Account Id >-<AWS Region>/_custom-control-tower-configuration.zip ~/Figure 2. Downloading source package of Customizations for AWS Control TowerExtract Customizations for AWS Control Tower configuration file to new directory (Namedcfct).unzip _custom-control-tower-configuration.zip -d ~/cfctCreate templates and parameters directory under Customizations for AWS Control Tower configuration directory.cd ~/cfct
mkdir templates parametersNow you will see directories and files under Customizations for AWS Control Tower configuration directory.Note:example-configurationis just an example, and will not be used in this blog post.Figure 3. Directory structure of Customizations for AWS Control TowerCustomize to include AWS Landing Zone specific baselineStart customization work by integrating the AWS Landing Zone IamPasswordPolicy and EnableNotifications baseline related files into the structure of Customizations for AWS Control Tower configuration package.Copy the IamPasswordPolicy baseline template and parameter file into the Customizations for AWS Control Tower configuration directory.cp ~/alz/templates/aws_baseline/aws-landing-zone-iam-password-policy.template ~/cfct/templates/
cp ~/alz/parameters/aws_baseline/aws-landing-zone-iam-password-policy.json ~/cfct/parameters/Open the copiedaws-landing-zone-iam-password-policy.json, then adjust it to be compliant with your optional password policy requirement.Copy the EnableNotifications baseline template and parameter file into the Customizations for AWS Control Tower configuration directory.cp ~/alz/templates/aws_baseline/aws-landing-zone-notifications.template ~/cfct/templates/
cp ~/alz/parameters/aws_baseline/aws-landing-zone-notifications.json ~/cfct/parameters/Open the copiedaws-landing-zone-notifications.template.Removethe following four lines from theSNSNotificationTopicparameter:SNSNotificationTopic:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /org/member/local_sns_arn
    Description: "Local Admin SNS Topic for Landing Zone"ModifyAlarmActions under Properties for each of 11 CloudWatch alarms as follows:AlarmActions:
      - !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:aws-controltower-SecurityNotifications'Openaws-landing-zone-notifications.json.Removethe following five lines from theSNSNotificationTopicparameter key, and parameter value at the bottom of file. Make sure to remove the including comma preceding the JSON syntax.,
  {
    "ParameterKey": "SNSNotificationTopic",
    "ParameterValue": "/org/member/local_sns_arn"
  }Modifythe parameter value of LogGroupName parameter key as follows:{
"ParameterKey": "LogGroupName",
"ParameterValue": "aws-controltower/CloudTrailLogs"
},6. Open themanifest.yamlunder root of the Customizations for AWS Control Tower configuration directory, then modify it to include IamPasswordPolicy and EnableNotifications baseline. If there are customizations that  have been previously used in the manifest file of Customizations for AWS Control Tower, add them at the end.7. Properly adjustregion,resource_file,parameter_file, andorganizational_unitsfor your AWS Control Tower environment.Note:Choose the proper organizational units because Customizations for AWS Control Tower will try to deploy customization resources to all AWS accounts within operational units defined inorganizational_unitsproperty. If you want to select specificaccounts, consider using accounts property instead oforganizational_unitsproperty.Review the following sample manifest file:---
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
region: ap-northeast-2
version: 2021-03-15

# Control Tower Custom Resources (Service Control Policies or CloudFormation)
resources:
  - name: IamPasswordPolicy
    resource_file: templates/aws-landing-zone-iam-password-policy.template
    parameter_file: parameters/aws-landing-zone-iam-password-policy.json
    deploy_method: stack_set
    deployment_targets:
      organizational_units:
        - Security
        - Infrastructure
        - app-services
        - app-reports

  - name: EnableNotifications
    resource_file: templates/aws-landing-zone-notifications.template
    parameter_file: parameters/aws-landing-zone-notifications.json
    deploy_method: stack_set
    deployment_targets:
      organizational_units:
        - Security
        - Infrastructure
        - app-services
        - app-reportsCompress all files within the root of the Customizations for AWS Control Tower configuration directory into thecustom-control-tower-configuration.zipfile.cd ~/cfct/
zip -r custom-control-tower-configuration.zip ./Upload thecustom-control-tower-configuration.zipfile into the Customizations for AWS Control Tower configuration S3 bucket. Use your AWS Account Id and Home Region in the S3 bucket name.aws s3 cp ~/cfct/custom-control-tower-configuration.zip s3://custom-control-tower-configuration-<AWS Account Id>-<AWS Region>/Figure 4. Uploading source package of Customizations for AWS Control TowerVerify solutionNow, you can verify the results for applying this solution.Log in to your AWS Control Tower management account.Navigate toAWS CodePipeline service, then selectCustom-Control-Tower-CodePipeline.Wait for all pipeline stages to complete.Go toAWS CloudFormation, then choose StackSets.Search with the keywordcustom. This will result in two custom StackSets.Figure 5. Custom StackSet of Customizations for AWS Control TowerLog in to your AWS Control Tower member account.Note:You need an IAM or AWS SSO user, or simply switch the role to AWSControlTowerExecution in the member account.Go toIAM, then choose Account settings. You will see a configured custom password policy.Figure 6. IAM custom password policy of member accountGo toAmazon CloudWatch, then choose All alarms. You will see 11 configured alarms.Figure 7. Amazon CloudWatch alarms of member accountCleaning upResources deployed to member accounts by this solution can be removed through the CloudFormation Stack function in the management account.RunDelete stack from StackSet, followed byDelete StackSet, for the following two StackSets.CustomControlTower-IamPasswordPolicyCustomControlTower-EnableNotificationsConclusionIn this blog post, you learned how to extend the baseline in AWS Control Tower to include the baseline specific to AWS Landing Zone. The principal idea is to use Customizations for AWS Control Tower, and additionally add guardrails, such as AWS Config rule and service control policy, which are not included by default in AWS Control Tower. This helps the transition of AWS Landing Zone to the AWS Control Tower, and enhances the governance control capability of the enterprise.Related reading:Seamless Transition from an AWS Landing Zone to AWS Control TowerField Notes provides hands-on technical guidance from AWS Solutions Architects, consultants, and technical account managers, based on their experiences in the field solving real-world business problems for customers.TAGS:Field NotesMinWoo LeeMinWoo Lee is a Solutions Architect in AWS Korea. He works on multi-account architectures for large enterprise customers. He enjoys helping customers achieve governance and control on their cloud journey.
Customers who adopt and operate the AWS Landing Zone solution as a scalable multi-account environment are starting to migrate to the AWS Control Tower service. They are doing so to enjoy the added benefits of managed services such as stability, feature enhancement, and operational efficiency. Customers who fully use the baseline for governance control provided […]
MinWoo Lee
Architecture AWS Control Tower Management & Governance Technical How-to