Field Notes: Customizing the AWS Control Tower Account Factory with AWS Service Catalog
AWS Architecture BlogField Notes: Customizing the AWS Control Tower Account Factory with AWS Service Catalogby Remek Hetman | on23 OCT 2020| inArchitecture,AWS Control Tower,AWS Lambda,AWS Service Catalog,Technical How-to|Permalink|ShareMany AWS customers who are managing hundreds or thousands of accounts know how complex and time consuming this process can be. To reduce the burden and simplify the process of creating new accounts, last year AWS released a new service,AWS Control Tower.AWS Control Tower helps you automate the process of setting up a multi-account AWS environment (AWS Landing Zone) that is secure, well-architected, and ready to use. This Landing Zone is created following best practices established through AWS’ experience working with thousands of enterprises as they move to the cloud. This includes the configuration ofAWS Organizations, centralized logging, federated access, mandatory guardrails, and networking.Those elements are a good starting point to cover the initial configuration of the new account. For some organizations, the next step is to baseline a newly vended account to align it with the company policies and compliance requirements. This means create or deploy necessary roles, policies, governance controls, security groups and so on.In this blog post, I describe a solution that helps achieve consistent governance and compliance requirements across accounts created by AWS Control Tower. The solution uses theAWS Service Catalogas the repository of products that will be deployed into the new accounts.Prerequisites and assumptionsBefore I get into how it works, let’s first review a few key AWS Service Catalog concepts:An AWS Service Catalogproductis a blueprint for building your AWS resources that you want to make available for deployment on AWS along with the configuration information.Aportfoliois a collection of products, together with the configuration information.Aprovisioned productis anAWS CloudFormation stack.Constraintscontrol the way users can deploy a product. With launch constraints, you can specify a role that the AWS Service Catalog can assume to launch a product.ReviewAWS Service Catalog reference blueprintsfor a quick way to set up and configure AWS Service Catalog portfolios and products.You need an AWS Service Catalog portfolio with products that you plan to deploy to the accounts. The portfolio has to be created in the AWS Control Tower primary account. If you don’t have a portfolio, the starting point would be to review these resources:Getting Started GuideAWS Service Catalog Preventative ControlAWS CloudFormation support for AWS Service Catalog productsSolution OverviewThis solution supports the following scenarios:Deployment of products to the newly vended AWS Control Tower account (Figure 1)Update and deployment of products to existing accounts (Figure 2)Figure 1 – Deployment to new accountThe architecture diagram in figure 1 shows the process of deploying products to the new account.AWS Control Towercreates a new accountOnce an account is created successfully, Amazon CloudWatch Events trigger anAWS Lambda functionThe Lambda function pulls the configuration from anAmazon S3 bucketand:Validates configurationGrants Lambda role access to portfolio(s)Creates StackSet constrains for productsLambda calls the AWS Step FunctionThe AWS Step Function orchestrates deployment of the AWS Service Catalog products and monitors progressFigure 2 – Update or deployment to an existing accountThe architecture diagram in figure 2 shows process of updating product or deploying product to the existing account.User uploads update configuration to an Amazon S3 BucketUpdate triggers AWS Lambda FunctionLambda function reads uploaded configuration and:Validates configurationGrants Lambda role access to portfolio(s)Creates StackSet constrains for productsCalls AWS Step FunctionAWS Step Function orchestrate update/deployment of AWS Service Catalog products and monitoring progressDeployment and configurationBefore proceeding with the deployment, you must install Python3.Then, follow these steps:Download the solution fromGitHubGo to foldersrcand run the following command:“pip3 install –r requirements.txt –t .”Zip content of the src folder to “control-tower-account-factory-solution.zip” fileUpload zip file to your Amazon S3 bucket created in the AWS Region where you want to deploy the solutionLaunch theAWS CloudFormation templateAWS CloudFormation Template Parameters:ConfigurationBucketName – name of the Amazon S3 bucket from where AWS Lambda function should pull the configuration file. You can provide the name of an existing bucket.CreateConfigurationBucket – set to true if you want to create a bucket specified in previous parameter. If a bucket exists, set value to falseConfigurationFileName – name of the configuration file for a new account. Default value: config.ymlUpdateFileName – name of the configuration file for updates. Default value: update.ymlSourceCodeBucketName – name of the bucket where you uploaded the zipped Lambda codeSourceCodePackageName – name of the zipped file contain Lambda. If the file was uploaded to folder, include the name of folder(s) as well. Example: my_folder/control-tower-account-factory-solution.zipBaselineFunctionName –name of the AWS Lambda function. Default value: control-tower- account-factory-lambdaBaselinetLambdaRoleName –name of the AWS Lambda function IAM role. Default value: control-tower- account-factory-lambda-roleStateMachineName  – name of the AWS Step Function. Default value: control-tower- account-factory-state-machineStateMachineRoleName – name of the AWS Step Function IAM role. Default value: control-tower- account-factory-state-machine-roleTrackingTableName – name of the DynamoDB table to track all deployment and updates. Default value: control-tower-account-factory-tracking-tableMaxIterations –maximum iteration of the AWS Step Function before the reports time out. Default value: 30. It can be overwrite in configuration file. For more information see Configuration section.TopicName – (optional) name of the SNS Topic that will be used for sending notification. Default value: control-tower- account-factory-account-notificationNotificationEmail – (optional) the email address where to send the notification. If this isn’t provided, the SNS topic won’t be created.Configuration FilesThe configuration files have to be in the YAML format, you can use the following schemas for new or existing accounts:Configuration schema for new account:The configuration can apply to all new accounts or can be divided based on the organization unit associated with the new account. Also, you can mix deployments where some products are always deployed and some only to specific organization units.Example configuration fileConfiguration schema for existing accountsThis configuration can be used to update provisioned products or deploy products into existing accounts. You can specify a target location either as account(s), organization unit(s) or both. If you specified an organization unit as a target, the product(s) will be updated/deployed to all accounts associated with organization unit.If the product doesn’t exist in the account, the Lambda function attempts to deploy it. You can manage this by setting the parameter ‘deployifnotexist’to true. If omitted or set to false, Lambda won’t provision the product to an existing account.Example configuration fileAll products deployed by the AWS Service Catalog are provisioned under their own name that has to be unique across all provisioned products. In this example, products are provisioned under the following naming convention:<account id where product is provision>-<”provision_name” from configuration file>

Example:  123456789-my-productIn the configuration file you can specify dependencies between products. Dependencies need to be provided as the list ofprovisioned product namenot a product name. If provided, deployment of the product will be suspended until all dependencies successfully deployed.The Step Function is running in the loop with interval of 1 minute and checking if dependencies were deployed. In the event of an error in the dependency naming or configuration, the step function iterates only until it reaches the maximum iterations defined in the configuration file. If the maximum iterations are reached, the step function reports time out and interrupts the products’ deployment.Important:if you updating a product by adding a new AWS Region, you cannot specify the dependency or run updates in existing regions the same time. In this scenario you should break the update as follows:Upload configuration to create dependencies in the new regionUpload configuration to create products only in the new regionYou can find different examples of configuration files inGitHub.Note:The name of the configuration file and Amazon S3 location must match the values provided in the AWS CloudFormation template during solution deployment.AWS Lambda functions deployment considerationsWhen deploying product is a Lambda function, you need to consider two requirements:The source code of the Lambda function needs to be in the Amazon S3 bucket created in the same AWS region where you are planning to deploy a Lambda functionThe destination account needs to have permission to the source Amazon S3 bucketTo accommodate both requirements, the approach is to create an Amazon S3 bucket under the AWS Control Tower primary account. There is one Amazon S3 bucket in each Region where the functions will be deployed.Each deployment bucket should have attached the following policy:{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<S3 bucket name>/*",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalOrgID": "<AWS Organizations Id>"
                },
                "StringLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::*:role/AWSControlTowerExecution",
        "arn:aws:iam::*:role/< name of the Lambda IAM role – default: control-tower-account-factory-lambda-role>"
                    ]
                }
            }
        }
    ]
}This allows the deployment role to access Lambda’s source code from any account in your AWS Organizations.ConclusionIn this blog post, I’ve outlined a solution to help you drive consistent governance and compliance requirements across accounts vended though AWS Control Tower. This solution provides enterprises with mechanisms to manage all deployments from a centralized account. Also, this reduces the need for maintaining multiple separate CI/CD pipelines.  Therefore you can simplify and reduce deployment time in a multi-account environment.This solution allows you keep provisioned products up to date by updating existing products or bringing old accounts to the same compliance level as the new accounts.Since this solution supports deployment to existing accounts and can be run without AWS Control Tower, it can be used for deployment of any AWS Service Catalog product either in single or multiple account environments. This solution then becomes an integral part of CI/CD pipeline.For more information, review theAWS Control Tower documentationandAWS Service Catalog documentation. Also, review the links listed in the “Prerequisites and assumptions” section of this post. Also, explore the AWS Solution presented in this video:Solving with AWS Solutions: Customizations for Control Tower.Field Notes provides hands-on technical guidance from AWS Solutions Architects, consultants, and technical account managers, based on their experiences in the field solving real-world business problems for customers.TAGS:Field NotesRemek HetmanRemek is a Senior Cloud Infrastructure Architect with Amazon Web Services Professional Services. He works with AWS financial enterprise customers providing technical guidance and assistance for Infrastructure, Security, DevOps, and Big Data to help them make the best use of AWS services. Outside of work, he enjoys spending time actively, and pursuing his passion – astronomy.
Many AWS customers who are managing hundreds or thousands of accounts know how complex and time consuming this process can be. To reduce the burden and simplify the process of creating new accounts, last year AWS released a new service, AWS Control Tower. AWS Control Tower helps you automate the process of setting up a […]
Remek Hetman
Architecture AWS Control Tower AWS Lambda AWS Service Catalog Technical How-to