Field Notes: Clear Unused AWS SSO Mappings Automatically During AWS Control Tower Upgrades
AWS Architecture BlogField Notes: Clear Unused AWS SSO Mappings Automatically During AWS Control Tower Upgradesby Gaurav Gupta and Kishore Vinjam | on11 NOV 2021| inArchitecture,AWS Control Tower,Management & Governance,Technical How-to|Permalink|ShareIncreasingly organizations are usingAWS Control Towerto manage their multiple accounts as well as an external third-party identity source for their federation needs. Cloud architects who use these external identity sources, needed an automated way to clear the unused maps created by AWS Control Tower landing zone as part of the launch, or during update and repair operations. Though theAWS SSOmappings are inaccessible once the external identity source is configured, customers prefer to clear any unused mappings in the directory.You can remove the permissions sets and mappings that AWS Control Tower deployment creates in AWS SSO. However, when the landing zone is updated or repaired, the default permission sets and mappings are recreated in AWS SSO. In this blog post, we show you how to useAWS Control Tower Lifecycle eventsto automatically remove these permission sets and mappings when AWS Control Tower is upgraded or repaired. An AWS Lambda function runs on every upgrade and automatically removes the permission sets and mappings.Overview of solutionUsing thisCloudFormation template, you can deploy the solution that automatically removes the AWS SSO permission sets and mappings when you upgrade your AWS Control Tower environment. We useAWS CloudFormation,AWS Lambda, AWS SSO andAmazon CloudWatchservices to implement this solution.Figure 1 – Architecture showing how AWS services are used to automatically remove the AWS SSO permission sets and mappings when you upgrade your AWS Control Tower environmentTo clear the AWS SSO entities and leave the service enabled with no active mappings, we recommend the following steps. This is mainly for those who do not want to use the default AWS SSO deployed by AWS Control Tower.Log in to the AWS Control Tower Management Account and make sure you are in the AWS Control Tower Home Region.Launch AWS CloudFormation stack, which creates:An AWS Lambda function that:Checks/Delete(s) the permission sets mappings created by AWS Control Tower, andDeletes the permission sets created by AWS Control Tower.An AWSIAM rolethat is assigned to the preceding AWS Lambda Function with minimum required permissions.AnAmazon CloudWatch Event Rulethat is invoked upon UpdateLandingZone API and triggers the ClearMappingsLambda Lambda functionPrerequisitesFor this walkthrough, you should have the following prerequisites:Administrator access to AWS Control Tower management accountWalkthroughLog in to the AWS account where AWS Control Tower is deployed.Make sure you are in the home Region of AWS Control Tower.Deploy the providedCloudFormation template.Download the CloudFormation template.SelectAWS CloudFormation servicein the AWS ConsoleSelectCreate Stackand selectWith new resources (standard)Upload the template filedownloaded in Step 1Enter thestack nameand chooseNextUse the default values in the next page and chooseNextChooseCreate StackBy default, in your AWS Control Tower Landing Zone you will see thepermission setsandmappingsin your AWS SSO service page as shown in the following screenshots:Figure 2 – Permission sets created by AWS Control TowerFigure 3 – Account to Permission set mapping created by AWS Control TowerNow, you canupdate the AWS Control Tower Landing Zonewhich will invoke the Lambda function deployed using the CloudFormation template.Steps to update/repair Control Tower:Log in to the AWS account where AWS Control Tower is deployed.SelectLanding zone settingsfrom the left-hand pane of the Control Tower dashboardSelect the latest version as seen in the screenshot below.SelectRepairorUpdate, whichever option is available.SelectUpdate Landing Zone.Figure 4 – Updating AWS Control Tower Landing zoneOnce the update is complete, you can go to AWS SSO service page and check that the permission sets and the mappings have been removed as shown in the following screenshots:Figure 5 -Permission sets cleared automatically after Landing zone updateFigure 6 -Mappings cleared after Landing zone updateCleaning upIf you are only testing this solution, make sure to delete the CloudFormation template, which will remove the relevant resources to stop incurring charges.ConclusionIn this post, we provided a solution to clear AWS SSO Permission Sets and Mappings when you upgrade your AWS Control Tower Landing Zone. Remember, AWS SSO permission sets are added every time you upgrade AWS Control Tower Landing Zone. With this this solution you don’t have to manage any settings since the AWS Lambda function runs on every upgrade and removes the permission sets and mappings.Give it a try and let us know your thoughts in the comments!Field Notes provides hands-on technical guidance from AWS Solutions Architects, consultants, and technical account managers, based on their experiences in the field solving real-world business problems for customers.TAGS:Field NotesGaurav GuptaGaurav Gupta is a Sr. Product Manager for AWS Control Tower with specialized skills in building products for Cloud Governance. He is passionate about driving cloud adoption by helping enterprises meet regulatory requirements, improve processes and strengthen security. In his spare time, he plays cricket, reads, and travels.Kishore VinjamKishore Vinjam is a partner solutions architect focusing on AWS Service Catalog, AWS Control Tower, and AWS Marketplace. He is passionate about working in cloud technologies, and working with customers and building solutions for them. When not working, he likes to spend time with his family, hike, and play volleyball and ping-pong.
Increasingly organizations are using AWS Control Tower to manage their multiple accounts as well as an external third-party identity source for their federation needs. Cloud architects who use these external identity sources, needed an automated way to clear the unused maps created by AWS Control Tower landing zone as part of the launch, or during […]
Gaurav Gupta
Architecture AWS Control Tower Management & Governance Technical How-to