Skip to content

Commit 1c925a1

Browse files
Brian969Brian969
authored
(docs) Documentation and sample config file updates for v133 release (#723)
* Various tweaks for 133 release - update vpc CIDR2 to array - remove CIDR2 from subnets - update sample snippets to include account level SCPs - update sample snippets to include interface endpoint sg enhancements - fix assumerole block for SEA created roles * Update installation.md * Move non VPC CIDRs to update top of file - enables updating all CIDRs in one spot, top of config file - ensures customers don't miss updating a IP list - no impact on existing deployments as replacements happen pre-execution * Update sm_inputs.md * Update faq.md * switch default organization-admin-role to AWS default
1 parent 6c37079 commit 1c925a1

File tree

9 files changed

+183
-109
lines changed

9 files changed

+183
-109
lines changed

‎docs/faq/faq.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,19 +70,20 @@
7070
- create, rename, modify, apply and remove SCP's
7171
- What can't I do:
7272
- modify Accelerator controlled SCP's
73-
- add/remove SCP's on top-level OU's (these are Accelerator controlled)
74-
- users can change SCP's on non-top-level ou's and accounts as they please
73+
- add/remove SCP's on top-level OU's (these are Accelerator controlled) or specific accounts that have Accelerator controlled SCPs
74+
- users can change SCP's on non-top-level ou's and non-Accelerator controlled accounts as they please
7575
- move an AWS account between top-level ou's (i.e. `Sandbox` to `Prod` is a security violation)
7676
- moving between `Prod/sub-ou-1` to `Prod/sub-ou2` or `Prod/sub-ou2/sub-ou2a/sub-ou2ab` is fully supported
7777
- create a top-level ou (need to validate, as they require config file entries)
7878
- remove quarantine SCP from newly created accounts
7979
- we do not support forward slashes (`/`) in ou names, even though the AWS platform does
8080
- More details:
8181
- If you edit an Accelerator controlled SCP through Organizations, we will reset it per what is defined in the Accelerator configuration files.
82-
- If you add/remove an SCP from a top-level ou, we will put them back as defined in the Accelerator configuration file.
82+
- If you add/remove an SCP from a top-level ou or Accelerator controlled account, we will put them back as defined in the Accelerator configuration file.
8383
- If you move an account between top-level ou's, we will put it back to its original designated top-level ou.
84-
- The Accelerator fully supports nested ou's, customers can create any depth ou structure in AWS Organizations and add/remove/change SCP's _below_ the top-level as they desire or move accounts between these ou's without restriction. Users can create ou's to the full AWS ou structure/depth.
84+
- The Accelerator fully supports nested ou's, customers can create any depth ou structure in AWS Organizations and add/remove/change SCP's _below_ the top-level as they desire or move accounts between these ou's without restriction. Users can create ou's to the full AWS ou structure/depth
8585
- Except for the Quarantine SCP applied to specific accounts, we do not 'control' SCP's below the top level, customers can add/create/customize SCP's
86+
- as of v1.3.3 customers can optionally control account level SCP's through the configuration file
8687

8788
### 1.1.3. How do I make changes to items I defined in the Accelerator configuration file during installation?
8889

‎docs/installation/installation.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,7 @@ If deploying to an internal AWS employee account, to successfully install the so
231231
8. Add an `Email` address to be used for State Machine Status notification
232232
9. The `GithubBranch` should point to the release you selected
233233
- if upgrading, change it to point to the desired release
234-
- the latest stable branch is currently `release/v1.3.2`, case sensitive
234+
- the latest stable branch is currently `release/v1.3.3`, case sensitive
235235
10. Apply a tag on the stack, Key=`Accelerator`, Value=`PBMM` (case sensitive).
236236
11. **ENABLE STACK TERMINATION PROTECTION** under `Stack creation options`
237237
12. The stack typically takes under 5 minutes to deploy.
@@ -330,7 +330,7 @@ Issues in Older Releases:
330330
- Upgrades to `v1.2.6 and above` from `v1.2.5 and below` - Ensure you apply the config file changes described in the release notes:
331331
- Cut-paste the new `"replacements": {},` section at the top of the example config file into your config file, as-is
332332
- Enables customers to leverage the repo provided SCP's without customization, simplifying upgrades, while allowing SCP region customization
333-
- the cloud-cidrX/cloud-maskX variables are examples of customer provided values that can be used to consistently auto-replace values throughout config files, these 4 specific variables are required for the firewalls to successfully deploy
333+
- the cloud-cidrX/cloud-maskX variables are examples of customer provided values that can be used to consistently auto-replace values throughout config files, these 4 specific variables are ***all*** required for the firewalls to successfully deploy
334334
- The new ${variable} are auto-replaced across your config files, SCP's and firewall config files.
335335
- as the variables should resolve to their existing values, you can leave your config file using hardcoded region and Accelerator prefix naming, or you can update them to make subsequent file comparisons easier for future upgrades. These are most useful for new installations in non ca-central-1 regions
336336
- Some repo provide filenames have changed, where they are referenced within the config file, you must update them to their new filenames

‎docs/installation/sm_inputs.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,26 @@ Providing any one or more of the following flags will only override the specifie
4545
}
4646
```
4747

48+
## 1.4. Generate verbose logging ithin state machine
49+
50+
- Added "verbose": "1" state machine input options
51+
- parameter is optional
52+
- parameter defaults to 0
53+
54+
```
55+
{"scope":"FULL", "mode":"APPLY", "verbose":"1"}
56+
```
57+
58+
## 1.5. ADDITIONAL MANDATORY STATE MACHINE INPUT FUNCTIONALITY
59+
60+
See [NEW: State Machine Behavior](https://github.com/aws-samples/aws-secure-environment-accelerator/blob/main/docs/installation/customization-index.md#2-new-state-machine-behavior).
61+
62+
- {"scope":"FULL", "mode":"APPLY"}
63+
- {"scope":"NEW-ACCOUNTS", "mode":"APPLY"}
64+
- {"scope":"GLOBAL-OPTIONS", "mode":"APPLY"}
65+
- {"scope":"OU", "targetOUs":[X], "mode":"APPLY"}
66+
- {"scope":"ACCOUNT", "targetAccounts":[X], "mode":"APPLY"}
67+
4868
---
4969

5070
[...Return to Accelerator Table of Contents](../index.md)

‎reference-artifacts/SAMPLE_CONFIGS/config.example.json‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,23 @@
55
"b": ["${HOME_REGION}", "${GBL_REGION}"],
66
"c": ["${HOME_REGION}", "${GBL_REGION}", "us-east-2", "us-west-1", "us-west-2"]
77
},
8-
"INFO": "This file will not work in us-east-1 without removing references to GBL_REGION",
9-
"INFO1": "If deploying the firewalls, both cidr values below must be supplied",
8+
"INFO": "Deploying in us-east-1 requires removing ${GBL_REGION} from the above variables",
9+
"INFO1": "If deploying the firewalls, both cidr values below MUST be supplied",
1010
"cloud-cidr1": "10.0.0.0",
1111
"cloud-mask1": "255.0.0.0",
1212
"cloud-cidr2": "100.96.252.0",
13-
"cloud-mask2": "255.255.254.0"
13+
"cloud-mask2": "255.255.254.0",
14+
"range-restrict": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"],
15+
"range-mad": "100.96.252.0/23",
16+
"range-dev-test": ["0.0.0.0/0"],
17+
"alarm-not-ip": "10.10.10.*"
1418
},
1519
"global-options": {
1620
"alz-baseline": false,
1721
"ct-baseline": false,
1822
"default-s3-retention": 90,
1923
"central-bucket": "AWSDOC-EXAMPLE-BUCKET",
20-
"organization-admin-role": "AWSCloudFormationStackSetExecutionRole",
24+
"organization-admin-role": "OrganizationAccountAccessRole",
2125
"default-cwl-retention": 731,
2226
"workloadaccounts-suffix": 1,
2327
"workloadaccounts-prefix": "config",
@@ -365,7 +369,7 @@
365369
"accounts": ["management"],
366370
"regions": ["${HOME_REGION}"],
367371
"loggroup-name": "/${ACCELERATOR_PREFIX_ND}/CloudTrail",
368-
"filter-pattern": "{ ($.eventSource=sso.amazonaws.com) && ($.eventName=Authenticate) && ($.sourceIPAddress != 10.10.10.*) }",
372+
"filter-pattern": "{ ($.eventSource=sso.amazonaws.com) && ($.eventName=Authenticate) && ($.sourceIPAddress != ${ALARM-NOT-IP}) }",
369373
"metric-namespace": "CloudTrailMetrics",
370374
"metric-name": "SSOAuthUnapprovedIPCount",
371375
"metric-value": "1"
@@ -375,7 +379,7 @@
375379
"accounts": ["management"],
376380
"regions": ["${HOME_REGION}"],
377381
"loggroup-name": "/${ACCELERATOR_PREFIX_ND}/CloudTrail",
378-
"filter-pattern": "{ ($.eventName=ConsoleLogin) && ($.userIdentity.type=IAMUser) && ($.sourceIPAddress != 10.10.10.*) }",
382+
"filter-pattern": "{ ($.eventName=ConsoleLogin) && ($.userIdentity.type=IAMUser) && ($.sourceIPAddress != ${ALARM-NOT-IP}) }",
379383
"metric-namespace": "CloudTrailMetrics",
380384
"metric-name": "IAMAuthUnapprovedIPCount",
381385
"metric-value": "1"
@@ -1059,7 +1063,7 @@
10591063
"central-resolver-rule-vpc": "Endpoint",
10601064
"log-group-name": "/${ACCELERATOR_PREFIX_ND}/MAD/example.local",
10611065
"share-to-account": "",
1062-
"restrict_srcips": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"],
1066+
"restrict_srcips": "${RANGE-RESTRICT}",
10631067
"num-rdgw-hosts": 1,
10641068
"min-rdgw-hosts": 1,
10651069
"max-rdgw-hosts": 2,
@@ -1104,7 +1108,7 @@
11041108
{
11051109
"description": "Allow RDP Traffic Inbound",
11061110
"type": ["RDP"],
1107-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
1111+
"source": "${RANGE-RESTRICT}"
11081112
}
11091113
],
11101114
"outbound-rules": [
@@ -1130,7 +1134,7 @@
11301134
"description": "Allow Traffic Inbound",
11311135
"tcp-ports": [514],
11321136
"udp-ports": [514],
1133-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
1137+
"source": "${RANGE-RESTRICT}"
11341138
}
11351139
],
11361140
"outbound-rules": [
@@ -1389,7 +1393,7 @@
13891393
"deploy": "local",
13901394
"name": "Perimeter",
13911395
"cidr": "10.7.4.0/22",
1392-
"cidr2": "100.96.250.0/23",
1396+
"cidr2": ["100.96.250.0/23"],
13931397
"region": "${HOME_REGION}",
13941398
"use-central-endpoints": false,
13951399
"flow-logs": "BOTH",
@@ -1573,7 +1577,7 @@
15731577
{
15741578
"description": "TLS Traffic Inbound",
15751579
"type": ["HTTPS"],
1576-
"source": ["0.0.0.0/0"]
1580+
"source": "${RANGE-DEV-TEST}"
15771581
}
15781582
],
15791583
"outbound-rules": [
@@ -1591,7 +1595,7 @@
15911595
"description": "Allow Mgmt Traffic Inbound",
15921596
"tcp-ports": [22, 443, 514, 541, 2032, 3000, 5199, 6020, 6028, 8080],
15931597
"udp-ports": [9443],
1594-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
1598+
"source": "${RANGE-RESTRICT}"
15951599
}
15961600
],
15971601
"outbound-rules": [
@@ -1613,7 +1617,7 @@
16131617
{
16141618
"description": "Mgmt Traffic, Customer Outbound traffic and ALBs",
16151619
"type": ["ALL"],
1616-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
1620+
"source": "${RANGE-RESTRICT}"
16171621
}
16181622
],
16191623
"outbound-rules": [
@@ -1824,7 +1828,7 @@
18241828
"vpc-name": "ForSSO",
18251829
"subnet": "ForSSO",
18261830
"size": "Small",
1827-
"restrict_srcips": ["10.249.1.0/24", "100.96.252.0/23"],
1831+
"restrict_srcips": ["10.249.1.0/24", "${RANGE-MAD}"],
18281832
"connect-account-key": "operations",
18291833
"connect-dir-id": 1001
18301834
}
@@ -1997,7 +2001,7 @@
19972001
"deploy": "shared-network",
19982002
"name": "Central",
19992003
"cidr": "10.1.0.0/16",
2000-
"cidr2": "100.96.252.0/23",
2004+
"cidr2": ["100.96.252.0/23"],
20012005
"region": "${HOME_REGION}",
20022006
"use-central-endpoints": true,
20032007
"flow-logs": "BOTH",
@@ -2179,17 +2183,17 @@
21792183
{
21802184
"az": "a",
21812185
"route-table": "CentralVPC_GCWide",
2182-
"cidr2": "100.96.252.0/25"
2186+
"cidr": "100.96.252.0/25"
21832187
},
21842188
{
21852189
"az": "b",
21862190
"route-table": "CentralVPC_GCWide",
2187-
"cidr2": "100.96.252.128/25"
2191+
"cidr": "100.96.252.128/25"
21882192
},
21892193
{
21902194
"az": "d",
21912195
"route-table": "CentralVPC_GCWide",
2192-
"cidr2": "100.96.253.0/25",
2196+
"cidr": "100.96.253.0/25",
21932197
"disabled": true
21942198
}
21952199
]
@@ -2247,7 +2251,7 @@
22472251
{
22482252
"description": "Mgmt RDP/SSH Traffic Inbound",
22492253
"type": ["RDP", "SSH"],
2250-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
2254+
"source": "${RANGE-RESTRICT}"
22512255
}
22522256
],
22532257
"outbound-rules": [
@@ -2736,7 +2740,7 @@
27362740
{
27372741
"description": "Mgmt RDP/SSH Traffic Inbound",
27382742
"type": ["RDP", "SSH"],
2739-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
2743+
"source": "${RANGE-RESTRICT}"
27402744
},
27412745
{
27422746
"description": "Central VPC Traffic Inbound",
@@ -3265,7 +3269,7 @@
32653269
{
32663270
"description": "Mgmt RDP/SSH Traffic Inbound",
32673271
"type": ["RDP", "SSH"],
3268-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
3272+
"source": "${RANGE-RESTRICT}"
32693273
},
32703274
{
32713275
"description": "Central VPC Traffic Inbound",
@@ -3794,7 +3798,7 @@
37943798
{
37953799
"description": "Mgmt RDP/SSH Traffic Inbound",
37963800
"type": ["RDP", "SSH"],
3797-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
3801+
"source": "${RANGE-RESTRICT}"
37983802
},
37993803
{
38003804
"description": "Central VPC Traffic Inbound",
@@ -4290,7 +4294,7 @@
42904294
{
42914295
"description": "Mgmt RDP/SSH Traffic Inbound",
42924296
"type": ["RDP", "SSH"],
4293-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
4297+
"source": "${RANGE-RESTRICT}"
42944298
},
42954299
{
42964300
"description": "Central VPC Traffic Inbound",
@@ -4771,7 +4775,7 @@
47714775
{
47724776
"description": "Mgmt RDP/SSH Traffic Inbound",
47734777
"type": ["RDP", "SSH"],
4774-
"source": ["10.0.0.0/8", "100.96.252.0/23", "100.96.250.0/23"]
4778+
"source": "${RANGE-RESTRICT}"
47754779
}
47764780
],
47774781
"outbound-rules": [

0 commit comments

Comments
 (0)