How to track AWS account metadata within your AWS Organizations
AWS Architecture BlogHow to track AWS account metadata within your AWS Organizationsby Jonathan Nguyen, Chris Wright, Jason Ratcliffe, and Joe Denton | on03 AUG 2022| inAmazon API Gateway,Amazon DynamoDB,Amazon EventBridge,Architecture,AWS Lambda,AWS Organizations,AWS Step Functions|Permalink|ShareUnited Services Automobile Association (USAA)is a San Antonio-based insurance, financial services, banking, and FinTech company supporting millions of military members and their families. USAA has partnered with Amazon Web Services (AWS) to digitally transform and build multiple USAA solutions that help keep members safe and save members’ money and time.Why build an AWS account metadata solution?The USAA Cloud Program developed a centralized solution for collecting all AWS account metadata to facilitate core enterprise functions, such as financial management, remediation of vulnerable and insecure configurations, and change release processes for critical application and infrastructure changes.Companies without centralized metadata solutions may have distributed documents and wikis that contain account metadata, which has to be updated manually. Manually inputting/updating information generally leads to outdated or incorrect metadata and, in addition, requires individuals to reach out to multiple resources and teams to collect specific information.Solution overviewUSAA utilizesAWS Organizationsand a series ofGitLabprojects to create, manage, and baseline all AWS accounts and infrastructure within the organization, including identity and access management, security, and networking components. Within their GitLab projects, each deployment uses a GitLab baseline version that determines what version of the project was provisioned within the AWS account.During the creation and onboarding of new AWS accounts, which are created for each application team and use-case, there is specific data that is used for tracking and governance purposes, and applied across the enterprise. USAA’s Public Cloud Security team took an opportunity within a hackathon event to develop the solution depicted in Figure 1.AWS account is created conforming to a naming convention and added to AWS Organizations.Metadata tracked per AWS account includes:AWS account namePoints of contactLine of business (LOB)Cost center #Application ID #StatusCloud governance record #GitLab baseline versionAmazon EventBridgerule invokesAWS Step Functionswhen new AWS accounts are created.Step Functions invoke anAWS Lambdafunction to pull AWS account metadata and load into a centralizedAmazon DynamoDBtable with Streams enabled to support automation.A privateAmazon API Gatewayis exposed to USAA’s internal network, which queries the DynamoDB table and provides AWS account metadata.Figure 1. Overview of USAA architecture automation workflow to manage AWS account metadataAfter the solution was deployed, USAA teams leveraged the data in multiple ways:User interface:a front-end user-interface querying the API Gateway to allow internal users on the USAA network to filter and view metadata for any AWS accounts within AWS Organizations.Event-driven automation:DynamoDB streams for any changes in the table that would invoke a Lambda function, which would check the most recent version from GitLab and the GitLab baseline version in the AWS account. For any outdated deployments, the Lambda function invokes the CI/CD pipeline for that AWS account to deploy a standardized set of IAM, infrastructure, and security resources and configurations.Incident response:the Cyber Threat Response team reduces mean-time-to-respond by developing automation to query the API Gateway to append points-of-contact, environment, and AWS account name for custom detections as well as Security Hub andAmazon GuardDutyfindings.Financial management:Internal teams have integrated workflows to their applications to query the API Gateway to return cost center, LOB, and application ID to assist with financial reporting and tracking purposes. This replaces manually reviewing the AWS account metadata from an internal and manually updated wiki page.Compliance and vulnerability management:automated notification systems were developed to send consolidated reports to points-of-contact listed in the AWS account from the API Gateway to remediate non-compliant resources and configurations.ConclusionIn this post, we reviewed how USAA enabled core enterprise functions and teams to collect, store, and distribute AWS account metadata by developing a secure and highly scalable serverless application natively in AWS. The solution has been leveraged for multiple use-cases, including internal application teams in USAA’s production AWS environment.Jonathan NguyenJonathan Nguyen is a Shared Delivery Team Senior Security Consultant at AWS. His background is in AWS Security with a focus on Threat Detection and Incident Response. Today, he helps enterprise customers develop a comprehensive AWS Security strategy and deploy security solutions at scale, and he trains customers on AWS Security best practices.Chris WrightChris Wright is a Lead Cloud Security Engineer at USAA. He has over 25 years of enterprise IT experience in application design, solution architecture, systems integration, and public cloud security - across a variety of industries including healthcare, manufacturing, and financial services. He is currently focused on securely enabling public cloud solutions to continue providing world-class financial services to the military community.Jason RatcliffeJason Ratcliffe is a Lead Cloud Security Engineer at USAA. He has over 15 years of enterprise security experience focused in Unix/Linux, Container, and Cloud security within the financial services industry. He helps lead and deliver secure and scalable architectures for USAA and its members.Joe DentonJoe Denton is a Staff Cloud Security Architect at USAA. He has a broad range of enterprise engineering experience encompassing cloud security, platform engineering, and DevOps enablement. His current focus is on maturing USAA’s cloud and container security strategy.
United Services Automobile Association (USAA) is a San Antonio-based insurance, financial services, banking, and FinTech company supporting millions of military members and their families. USAA has partnered with Amazon Web Services (AWS) to digitally transform and build multiple USAA solutions that help keep members safe and save members’ money and time. Why build an AWS […]
Jonathan Nguyen
Amazon API Gateway Amazon DynamoDB Amazon EventBridge Architecture AWS Lambda AWS Organizations AWS Step Functions