You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Jun 14, 2023. It is now read-only.
-[Minimal security best practices](#minimal-security-best-practices)
24
+
-[Costs](#costs)
25
+
-[Cleaning up accounts](#cleaning-up-accounts)
26
+
-[Known limitations](#known-limitations)
27
+
-[SDLC Organization](#sdlc-organization)
28
+
-[Getting Help](#getting-help)
29
+
-[Next](#next)
28
30
29
31
This repository contains examples of using the AWS Bootstrap Kit to set your development and deployment environment on AWS. The AWS Bootstrap Kit is a strongly opinionated CDK set of constructs built for companies looking to follow AWS best practices on Day 1.
30
32
@@ -79,8 +81,8 @@ DNS hierarchy:
79
81
Basically the same as above but:
80
82
* Environments = [AWS Accounts](https://aws.amazon.com/organizations/faqs/#Organizing_AWS_accounts) (not a *user* account but actually a isolated environment tied to an email (& password) and unique id)
81
83
* Set of Environments = Set of AWS Accounts under a main one = [AWS Organizations](https://aws.amazon.com/organizations/faqs/)
82
-
* Users and Permissions management solution = [AWS SSO](https://aws.amazon.com/single-sign-on/faqs)
83
-
* Login Web Portal = AWS SSO endpoint
84
+
* Users and Permissions management solution = [AWS IAM Identity Center](https://aws.amazon.com/single-sign-on/faqs)
85
+
* Login Web Portal = AWS access portal URL
84
86
* Central Activity logs = Centralized [AWS Cloudtrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html)
85
87
* Central Bills = [AWS Consolidated Billing](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/consolidated-billing.html)
Copy file name to clipboardExpand all lines: doc/control-tower.md
+3-3
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
1
# Path to AWS Control Tower
2
2
3
-
[AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html) provides an easy way to setup a Landing Zone in AWS: it will create a multi-account structure with proper set of permissions (using [AWS SSO](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)) and guardrails (using [Service Control Policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) (SCPs) and [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html)).
3
+
[AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html) provides an easy way to setup a Landing Zone in AWS: it will create a multi-account structure with proper set of permissions (using [AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)) and guardrails (using [Service Control Policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) (SCPs) and [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html)).
4
4
5
5
Control Tower focuses on providing a secured multi-accounts environment. It creates multiples AWS resources for you:
6
6
- One Organization
7
7
- One or two Organizational Units (OUs): Security (mandatory) and Sandbox (optional)
8
8
- Two AWS Accounts in the Security OU: Log Archive and Audit
9
-
- A directory in AWS SSO
9
+
- A directory in AWS IAM Identity Center
10
10
- A set of guardrails: proactive with SCPs and reactive with AWS Config.
11
11
- ...
12
12
You can get more details on Control Tower [here](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html).
@@ -176,4 +176,4 @@ Control Tower is now set up and governs the Bootstrap Kit resources (Org, OUs, a
176
176
177
177
Note that the Administrator user now has the following permissions: [AWSOrganizationsFullAccess](https://github.com/SummitRoute/aws_managed_policies/blob/master/policies/AWSOrganizationsFullAccess) on the bootstrap kit accounts (instead of AWSAdministratorAccess). See [docs](https://docs.aws.amazon.com/controltower/latest/userguide/sso.html):
178
178
179
-
179
+
Copy file name to clipboardExpand all lines: source/1-SDLC-organization/README.md
+19-19
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ Step # | Feature | Description
15
15
2 | [Configure your local credentials](#configure-your-local-credentials) | `aws configure --profile main-admin`
16
16
3 | [Fork and init the repo](#clone-and-init-the-repo) | Get the code
17
17
4 | [Deploy the pipeline](#install-dependencies-and-deploy-the-pipeline) | Deploy your organization through a CI/CD pipeline
18
-
5 | [Setup your SSO domain](#setup-your-sso-domain) | Prepare you user permissions and groups
18
+
5 | [Setup your IAM Identity Center domain](#setup-your-sso-domain) | Prepare you user permissions and groups
19
19
6 | [Setup your dev environment](#setup-your-dev-environment) | Prepare your local environment to be ready to develop
20
20
7 | [Start coding](#next-step) | Jump to next section about developing and deploying your first web site
21
21
@@ -283,15 +283,15 @@ If you added `domain_name` in your config file (`cdk.json`) earlier, a last step
283
283
**Your Done! Now you can manage your domain through AWS Route53**
284
284
</details>
285
285
286
-
### Enable SSO
286
+
### Enable IAM Identity Center
287
287
288
-
In order to facilitate the management of permissions on the access to this different accounts we suggest to setup an SSO portal following the steps described bellow. That's going to give you the capability to centrally manage and access your different AWS account with a single identity (login and password) or even delegate this to a third party provider such as Google Workspace (GSuite).
288
+
In order to facilitate the management of permissions on the access to this different accounts we suggest to setup an AWs access portal following the steps described bellow. That's going to give you the capability to centrally manage and access your different AWS account with a single identity (login and password) or even delegate this to a third party provider such as Google Workspace (GSuite).
289
289
290
290
Staying with IAM users and groups would means not getting a central portal with a single identity and would force you to remember the different account ID and role to login into:
291
291
292
292
293
293
294
-
294
+
295
295
296
296
297
297
*Whatch this quick presentation video to learn more:*
@@ -300,15 +300,15 @@ Staying with IAM users and groups would means not getting a central portal with
300
300
<img src="https://img.youtube.com/vi/_qNkFxp1Z_k/hqdefault.jpg" alt="AWS Single Sign On video"/>
301
301
</a>
302
302
303
-
### Setup your SSO domain
303
+
### Setup your IAM Identity Center domain
304
304
305
305
<details>
306
306
<summary>Click to go through this step</summary>
307
307
308
308
Sorry we can't automate those step yet :cry:
309
309
310
310
311
-
1. Go to the <ahref="https://console.aws.amazon.com/singlesignon/home"target="_blank">AWS SSO Home page</a> and Click *Enable AWS SSO*
311
+
1. Go to the <ahref="https://console.aws.amazon.com/singlesignon/home"target="_blank">AWS IAM Identity Center Home page</a> and Click *Enable*
312
312
313
313
#### Create permission sets
314
314
@@ -504,7 +504,7 @@ Now we are going to assign the **Administrators** group to all the accounts with
504
504
505
505
**Now let's create your Administrator user !**
506
506
507
-
#### Create your administrator SSO user
507
+
#### Create your administrator user
508
508
509
509
510
510
@@ -526,27 +526,27 @@ Now we are going to create an Administrator user, we basically will follow the s
526
526
527
527
1. Well done your account has been successfully activated! Click *Continue*
528
528
529
-
1. You have now access to your SSO app list. Click on *AWS Account* card to expand the list of accounts
529
+
1. You have now access to your app list. Click on *AWS Account* card to expand the list of accounts
530
530
531
531
1. Click on your main account to expand the list of your access to this account
532
532
533
533
1. Click on *Management console* to access to the console of your main account
534
534
535
-
1. Your are now connected with your new SSO Administrator user
535
+
1. Your are now connected with your new Administrator user
536
536
537
-
**Let's assign the Developers group to Dev, Staging and Prod accounts with this new SSO Administrator user**
537
+
**Let's assign the Developers group to Dev, Staging and Prod accounts with this new Administrator user**
538
538
539
-
#### Customize your SSO endpoint
539
+
#### Customize your AWS access portal URL
540
540
541
-
From now on, you or any of your developers won't have to login anymore directly to AWS console but directly through AWS SSO portal. In the previous step you might have noticed that your SSO console is accessible through a unique URL such as `https://d-123456789a.awsapps.com/start ` which is not that easy to remember, let's customize it to match your company domain:
541
+
From now on, you or any of your developers won't have to login anymore directly to AWS console but directly through AWS access portal. In the previous step you might have noticed that your AWS user portal is accessible through a unique URL such as `https://d-123456789a.awsapps.com/start ` which is not that easy to remember, let's customize it to match your company domain:
542
542
543
-
1. Search for *SSO* on the console home page and go to the service
543
+
1. Search for *Identity Center* on the console home page and go to the service
544
544
545
545
1. At the bottom of the page, click the *Customize* link located in *User portal* section
546
546
547
547
1. Type your domain name and click *Save*
548
548
549
-
**Tada !! You can now login to AWS Console through your SSO portal using your customized url !**
549
+
**Tada !! You can now login to AWS Console through your AWS access portal using your customized url !**
550
550
551
551
</details>
552
552
@@ -555,7 +555,7 @@ From now on, you or any of your developers won't have to login anymore directly
555
555
<details>
556
556
<summary>Click to go through this step</summary>
557
557
558
-
#### Create a developer SSO user
558
+
#### Create a developer user
559
559
560
560
(This section is optional but will be one to use each time you want to onboard a new dev in your team)
561
561
@@ -577,7 +577,7 @@ Now we are going to create a Developer user with enough rate to develop and publ
577
577
578
578
1. Well done your account has been successfully activated! Click *Continue*
579
579
580
-
1. You have now access to your SSO app list with your Developer user
580
+
1. You have now access to your app list with your Developer user
581
581
582
582
583
583
#### AWS CLI V2
@@ -606,7 +606,7 @@ aws sso login --profile dev
606
606
607
607
In order to interact with your different environment through the [awscli](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html) or any AWS SDKs locally, you will need to get your credentials.
608
608
609
-
To authenticate requests made using the CLI, we need to give the credentials generated by AWS SSO and link them to what we call `profile`. So for each environment you want to have access to through AWS CLI v2 and CDK you will have to configure a specific profile for it running the command below.
609
+
To authenticate requests made using the CLI, we need to give the credentials generated by AWS IAM Identity Center and link them to what we call `profile`. So for each environment you want to have access to through AWS CLI v2 and CDK you will have to configure a specific profile for it running the command below.
610
610
611
611
Here we setup your first profile that will be used to replace your IAM user administrator one (`--profile dev`):
612
612
@@ -667,9 +667,9 @@ aws sso login --profile dev
667
667
668
668
**Now you can interact with your different AWS Accounts using AWS CLI**
669
669
670
-
#### CDK and SSO
670
+
#### CDK and IAM Identity Center
671
671
672
-
CDK and AWS SSO are not yet friends (see github issue [5455](https://github.com/aws/aws-cdk/issues/5455)). So since in the future we will have to deploy infrastructure as code apps into multiple environment, we will need to make it work.
672
+
CDK and AWS IAM Identity Center are not yet friends (see github issue [5455](https://github.com/aws/aws-cdk/issues/5455)). So since in the future we will have to deploy infrastructure as code apps into multiple environment, we will need to make it work.
673
673
674
674
There is several workaround and here is one using a quick utility written in nodejs called "cdk-sso-sync":
Copy file name to clipboardExpand all lines: source/2-landing-page/README.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -84,7 +84,7 @@ As you can see in the [code](../lib/landing-page-stack.ts#L44), the public url w
84
84
cdk deploy --profile dev
85
85
```
86
86
87
-
> If you get the error message *Unable to resolve AWS account to use. It must be either configured when you define your CDK or through the environment*, you may need to refresh your SSO credentials by running the SSO login command described [here](../1-SDLC-organization/README.md#cdk-and-sso) to set up your dev profile with developer account credentials.
87
+
> If you get the error message *Unable to resolve AWS account to use. It must be either configured when you define your CDK or through the environment*, you may need to refresh your IAM Identity Center credentials by running the AWS access portal login command described [here](../1-SDLC-organization/README.md#cdk-and-sso) to set up your dev profile with developer account credentials.
88
88
89
89
1. Retrieve the CloudFormation ouput called *LandingPageStack.LandingPageUrl* to navigate to your landing page
0 commit comments