Skip to content

Commit 308e106

Browse files
authored
Create test PBMM config, reducing costs, other minor tweaks and doc updates (#734)
* Create test PBMM config-reducing costs * clarify FAQ for rename operations * Update ASEA-Guardrails-Part2.json - block services w/no 3rd party assessments * Update ASEA-Guardrails-Part2.json - block iq * Update ASEA-Guardrails-Part1.json - unblock deleting cfn buckets * tweak SH rules * Update installation.md - tweak internal PMP instructions * Tweak regional services SCP - well-architected now in most regions - mobile analytics replaced with pinpoint - import/export needs service team whitelist outside us
1 parent 2eef81d commit 308e106

14 files changed

+3479
-44
lines changed

docs/faq/faq.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@
7878
- remove quarantine SCP from newly created accounts
7979
- we do not support forward slashes (`/`) in ou names, even though the AWS platform does
8080
- More details:
81+
- If an AWS account is renamed, an account email is changed, or an OU is renamed, on the next state machine execution, the config file will automatically be updated.
8182
- If you edit an Accelerator controlled SCP through Organizations, we will reset it per what is defined in the Accelerator configuration files.
8283
- If you add/remove an SCP from a top-level ou or Accelerator controlled account, we will put them back as defined in the Accelerator configuration file.
8384
- If you move an account between top-level ou's, we will put it back to its original designated top-level ou.

docs/installation/customization-index.md

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,24 +14,24 @@
1414

1515
Samples with Descriptions:
1616

17-
1. Full PBMM configuration [file](../../reference-artifacts/SAMPLE_CONFIGS/config.example.json) (`config.example.json`)
17+
1. **Full PBMM configuration** [file](../../reference-artifacts/SAMPLE_CONFIGS/config.example.json) (`config.example.json`)
1818
- The full PBMM configuration file was based on feedback from customers moving into AWS at scale and at a rapid pace. Customers of this nature have indicated that they do not want to have to upsize their perimeter firewalls or add Interface endpoints as their developers start to use new AWS services. These are the two most expensive components of the deployed architecture solution.
19-
2. Light weight PBMM configuration [file](../../reference-artifacts/SAMPLE_CONFIGS/config.lite-example.json) (`config.lite-example.json`) **(Recommended for most new PBMM customers)**
19+
2. **Light weight PBMM configuration** [file](../../reference-artifacts/SAMPLE_CONFIGS/config.lite-example.json) (`config.lite-example.json`) **(Recommended for most new PBMM customers)**
2020
- To reduce solution costs and allow customers to grow into more advanced AWS capabilities, we created this lighter weight configuration that does not sacrifice functionality, but could limit performance. This config file:
21-
- only deploys the 6 required centralized Interface Endpoints (removes 56). All services remain accessible using the AWS public endpoints, but require traversing the perimeter firewalls
21+
- only deploys the 9 required centralized Interface Endpoints (removes 50). All services remain accessible using the AWS public endpoints, but require traversing the perimeter firewalls
2222
- removes the perimeter VPC Interface Endpoints
2323
- reduces the Fortigate instance sizes from c5n.2xl to c5n.xl (VM08 to VM04)
2424
- removes the Unclass ou and VPC
2525
- The Accelerator allows customers to easily add or change this functionality in future, as and when required without any impact
26-
3. Ultra-Light sample configuration [file](../../reference-artifacts/SAMPLE_CONFIGS/config.ultralite-example.json) (`config.ultralite-example.json`)
27-
- This configuration file was created to represent an extremely minimalistic Accelerator deployment, simply to demonstrate the art of the possible for an extremely simple config. This config has:
26+
3. **Ultra-Light sample configuration** [file](../../reference-artifacts/SAMPLE_CONFIGS/config.ultralite-example.json) (`config.ultralite-example.json`)
27+
- This configuration file was created to represent an extremely minimalistic Accelerator deployment, simply to demonstrate the art of the possible for an extremely simple config. This example is NOT recommended as it violates many AWS best practices. This This config has:
2828
- no `shared-network` or `perimeter` accounts
2929
- no networking (VPC, TGW, ELB, SG, NACL, endpoints) or route53 (zones, resolvers) objects
3030
- no Managed AD, AD Connector, rsyslog cluster, RDGW host, or 3rd party firewalls
3131
- only enables/deploys AWS security services in 2 regions (ca-central-1, us-east-1) (Not recommended)
3232
- only deploys 2 AWS config rules w/SSM remediation
3333
- renamed log-archive (Logs), security (Audit) and operations (Ops) account names
34-
4. Multi-Region sample configuration [file](../../reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json) (`config.multi-region-example.json`)
34+
4. **Multi-Region sample configuration** [file](../../reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json) (`config.multi-region-example.json`)
3535
- This configuration file was created to represent a more advanced multi-region version of the Full PBMM configuration file from bullet 1 above. This config:
3636
- adds a TGW in us-east-1, peered to the TGW in ca-central-1
3737
- adds TGW static routes, including several dummy sample static routes
@@ -44,6 +44,21 @@ Samples with Descriptions:
4444
- local account VPC set to use central endpoints, associates appropriate centralized hosted zones to VPC (also creates 5 local endpoints)
4545
- adds a VGW for DirectConnect to the perimeter VPC
4646
- adds the 3rd AZ in ca-central-1 (MAD & ADC in AZ a & b)
47+
5. **Test PBMM configuration** [file](../../reference-artifacts/SAMPLE_CONFIGS/config.test-example.json) (`config.test-example.json`) **(Use for testing PBMM configuration)**
48+
- Further reduces solution costs, while demonstrating full solution functionality (NOT recommendend for production). This config file:
49+
- uses the Light weight PBMM configuration as the starting point
50+
- consolidates Dev/Test/Prod OU to a single Workloads OU/VPC
51+
- only enables Security Hub, Config and Macie in ca-central-1 and us-east-1
52+
- reduces the Fortigate instance sizes from c5n.xl to c5.xl
53+
- reduces the rsyslog and RDGW instance sizes from t2.large to t2.medium
54+
- removes the second rsyslog node
55+
- reduces the size of the MAD from Enterprise to Standard edition
56+
- removes the on-premise R53 resolvers (hybrid dns)
57+
- reduced various log retention periods and the VPCFlow log interval
58+
- removes the two example workload accounts
59+
- The most expensive individual component of this sample is the perimeter 3rd party firewalls
60+
- this example will be updated in the near future, removing the 3rd party firewalls
61+
- we will add a NATGW for egress. For ingress, customers will need to manually target the perimeter ALB to point to each backend-ALB's IP's and manually update the IP's when they change (the next major SEA code release will include functionality to automate this capability)
4762

4863
## 1.2. **Deployment Customizations**
4964

docs/installation/installation.md

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -158,21 +158,20 @@ Before installing, you must first:
158158

159159
If deploying to an internal AWS employee account, to successfully install the solution with the 3rd party firewalls, you need to enable Private Marketplace (PMP) before starting:
160160

161-
**NOTE: As of Late January 2021 the process has changed - you must now also create an Account Group associated with your Organization management account number and associate this group with your default experience. Will update click-by-click instructions at a future time.**
162-
163161
1. In the Organization Management account go here: https://aws.amazon.com/marketplace/privatemarketplace/create
164-
2. Click Create Marketplace
165-
3. Go to Profile sub-tab, click the `Not Live` slider to make it `Live`
166-
4. Click the `Software requests` slider to turn `Requests off`
167-
5. Change the name field (i.e. append `-PMP`) and change the color, so it is clear PMP is enabled for users
168-
6. Search Private Marketplace for Fortinet products
169-
7. Unselect the `Approved Products` filter and then select:
170-
- `Fortinet FortiGate (BYOL) Next-Generation Firewall`
171-
8. Select "Add to Private Marketplace" in the top right
172-
- Due to PMP provisioning delays, this sometimes fails when attempted immediately following enablement of PMP - retry after 20 minutes.
173-
9. Wait a couple of minutes while it adds item to your PMP - do NOT subscribe or accept the EULA
174-
- Repeat for `Fortinet FortiManager (BYOL) Centralized Security Management`
175-
10. While not used in this account, you must now subscribe to the two subscriptions and accept the EULA for each product (you will need to do the same in the perimeter account, once provisioned below)
162+
2. Click Create Marketplace, and wait for activation to complete
163+
3. Go to the "Account Groups" sub-menu and add the Management/root account number in `Associate AWS account`
164+
4. Use the default experience `New Private Marketplace`
165+
5. Go to "Experiences" sub-menu, "Settings" sub-tab, and click the `Not Live` slider to make it `Live`
166+
6. Ensure the `Software requests` slider is set to `Requests off`
167+
7. Change the name field (i.e. append `-PMP`) and change the color, so it is clear PMP is enabled for users
168+
8. Go to the "Products" sub-tab (in "Experiences"), then select the "All AWS Marketplace products" nested sub-tab
169+
9. Search Private Marketplace for Fortinet products and select
170+
- `Fortinet FortiGate (BYOL) Next-Generation Firewall` and
171+
- `Fortinet FortiManager (BYOL) Centralized Security Management`
172+
1. Select "Add" in the top right
173+
- Due to PMP provisioning delays, this sometimes fails when attempted immediately following enablement of PMP or if adding each product individually - retry after 20 minutes.
174+
11. While not used in this account, you must now subscribe to the two subscriptions and accept the EULA for each product (you will need to do the same in the perimeter account, once provisioned below)
176175
- If you are deploying in any region except ca-central-1 or wish to switch to a different license type, you need the new AMI id's. After successfully subscribing, continue one more step and click the “Continue to Configuration”. When you get the below screen, select your region and version (v6.4.4 recommended at this time). Marketplace will provide the required AMI id. Document the two AMI id's, as you will need to update them in your config.json file below.
177176

178177
![New AMI ID](img/new-ami-id.png)

reference-artifacts/CONFIG_SAMPLES_MOVED.md

Lines changed: 0 additions & 2 deletions
This file was deleted.

reference-artifacts/SAMPLE_CONFIGS/config.example.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,11 +146,11 @@
146146
},
147147
{
148148
"name": "PCI DSS v3.2.1",
149-
"controls-to-disable": ["PCI.IAM.3", "PCI.KMS.1", "PCI.S3.3", "PCI.EC2.3", "PCI.Lambda.2"]
149+
"controls-to-disable": ["PCI.IAM.3", "PCI.S3.3", "PCI.EC2.3", "PCI.Lambda.2"]
150150
},
151151
{
152152
"name": "CIS AWS Foundations Benchmark v1.2.0",
153-
"controls-to-disable": ["CIS.1.20", "CIS.1.22", "CIS.2.8"]
153+
"controls-to-disable": ["CIS.1.20", "CIS.1.22"]
154154
}
155155
]
156156
},

reference-artifacts/SAMPLE_CONFIGS/config.lite-example.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,11 +146,11 @@
146146
},
147147
{
148148
"name": "PCI DSS v3.2.1",
149-
"controls-to-disable": ["PCI.IAM.3", "PCI.KMS.1", "PCI.S3.3", "PCI.EC2.3", "PCI.Lambda.2"]
149+
"controls-to-disable": ["PCI.IAM.3", "PCI.S3.3", "PCI.EC2.3", "PCI.Lambda.2"]
150150
},
151151
{
152152
"name": "CIS AWS Foundations Benchmark v1.2.0",
153-
"controls-to-disable": ["CIS.1.20", "CIS.1.22", "CIS.2.8"]
153+
"controls-to-disable": ["CIS.1.20", "CIS.1.22"]
154154
}
155155
]
156156
},

reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -150,11 +150,11 @@
150150
},
151151
{
152152
"name": "PCI DSS v3.2.1",
153-
"controls-to-disable": ["PCI.IAM.3", "PCI.KMS.1", "PCI.S3.3", "PCI.EC2.3", "PCI.Lambda.2"]
153+
"controls-to-disable": ["PCI.IAM.3", "PCI.S3.3", "PCI.EC2.3", "PCI.Lambda.2"]
154154
},
155155
{
156156
"name": "CIS AWS Foundations Benchmark v1.2.0",
157-
"controls-to-disable": ["CIS.1.20", "CIS.1.22", "CIS.2.8"]
157+
"controls-to-disable": ["CIS.1.20", "CIS.1.22"]
158158
}
159159
]
160160
},

0 commit comments

Comments
 (0)