Skip to content

Commit d4a9f3e

Browse files
naveenkoppulaBrian969
naveenkoppula
and
Brian969
authored
feat(core): Adding replacements in SCP and configuration (#623)
* Adding replacements in SCP and configuration * Updating to handle scp replacements * Fixing input to addScps step * Fixing moveAccount trigger * Fixing config updation on moveAccount trigger * Taking Accelerator as input param to installer template * Fixing SCPs * Update missed lowercase accelerator prefix replacement * home/global region in scp * making replacements as optional * Fixing linter * Validating previous Accel Name and Prefix * Move to resolving all regions from main config file * Adding additional replacements for firewall * remove regions from config files * Adding proper defaults for accelerator name and prefix * Fixing config for replacements as optional * fix placement of replacements * fix typo * fix incorrect firewall config Co-authored-by: Brian969 <56414362+Brian969@users.noreply.github.com>
1 parent bd156c0 commit d4a9f3e

33 files changed

+703
-312
lines changed

‎reference-artifacts/SAMPLE_CONFIGS/config.example.json‎

Lines changed: 65 additions & 56 deletions
Large diffs are not rendered by default.

‎reference-artifacts/SAMPLE_CONFIGS/config.lite-example.json‎

Lines changed: 62 additions & 53 deletions
Large diffs are not rendered by default.

‎reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json‎

Lines changed: 74 additions & 65 deletions
Large diffs are not rendered by default.

‎reference-artifacts/SAMPLE_CONFIGS/config.ultralite-example.json‎

Lines changed: 38 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
{
2+
"replacements": {
3+
"addl_regions": {
4+
"a": ["${HOME_REGION}"],
5+
"b": ["${HOME_REGION}, ${GBL_REGION}"],
6+
"c": ["${HOME_REGION}, ${GBL_REGION}"]
7+
}
8+
},
29
"global-options": {
310
"alz-baseline": false,
411
"ct-baseline": false,
@@ -11,15 +18,15 @@
1118
"workloadaccounts-param-filename": "config.json",
1219
"ignored-ous": [],
1320
"additional-global-output-regions": [],
14-
"supported-regions": ["ca-central-1", "us-east-1"],
21+
"supported-regions": ["${HOME_REGION}", "${GBL_REGION}"],
1522
"keep-default-vpc-regions": [],
1623
"aws-org-master": {
1724
"account": "master",
18-
"region": "ca-central-1"
25+
"region": "${HOME_REGION}"
1926
},
2027
"central-security-services": {
2128
"account": "security",
22-
"region": "ca-central-1",
29+
"region": "${HOME_REGION}",
2330
"security-hub-excl-regions": [],
2431
"guardduty": true,
2532
"guardduty-excl-regions": [],
@@ -36,12 +43,12 @@
3643
},
3744
"central-operations-services": {
3845
"account": "operations",
39-
"region": "ca-central-1",
46+
"region": "${HOME_REGION}",
4047
"cwl": true
4148
},
4249
"central-log-services": {
4350
"account": "log-archive",
44-
"region": "ca-central-1",
51+
"region": "${HOME_REGION}",
4552
"s3-retention": 730,
4653
"cwl-glbl-exclusions": [],
4754
"cwl-exclusions": [],
@@ -163,7 +170,7 @@
163170
{
164171
"filter-name": "SecurityGroupChangeMetric",
165172
"accounts": ["master"],
166-
"regions": ["ca-central-1"],
173+
"regions": ["${HOME_REGION}"],
167174
"loggroup-name": "/PBMMAccel/CloudTrail",
168175
"filter-pattern": "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }",
169176
"metric-namespace": "CloudTrailMetrics",
@@ -173,7 +180,7 @@
173180
{
174181
"filter-name": "NetworkAclChangeMetric",
175182
"accounts": ["master"],
176-
"regions": ["ca-central-1"],
183+
"regions": ["${HOME_REGION}"],
177184
"loggroup-name": "/PBMMAccel/CloudTrail",
178185
"filter-pattern": "{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation)}",
179186
"metric-namespace": "CloudTrailMetrics",
@@ -183,7 +190,7 @@
183190
{
184191
"filter-name": "GatewayChangeMetric",
185192
"accounts": ["master"],
186-
"regions": ["ca-central-1"],
193+
"regions": ["${HOME_REGION}"],
187194
"loggroup-name": "/PBMMAccel/CloudTrail",
188195
"filter-pattern": "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway)}",
189196
"metric-namespace": "CloudTrailMetrics",
@@ -193,7 +200,7 @@
193200
{
194201
"filter-name": "VpcChangeMetric",
195202
"accounts": ["master"],
196-
"regions": ["ca-central-1"],
203+
"regions": ["${HOME_REGION}"],
197204
"loggroup-name": "/PBMMAccel/CloudTrail",
198205
"filter-pattern": "{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }",
199206
"metric-namespace": "CloudTrailMetrics",
@@ -203,7 +210,7 @@
203210
{
204211
"filter-name": "Ec2InstanceChangeMetric",
205212
"accounts": ["master"],
206-
"regions": ["ca-central-1"],
213+
"regions": ["${HOME_REGION}"],
207214
"loggroup-name": "/PBMMAccel/CloudTrail",
208215
"filter-pattern": "{ ($.eventName = RunInstances) || ($.eventName = RebootInstances)|| ($.eventName = StartInstances) || ($.eventName = StopInstances) || ($.eventName= TerminateInstances) }",
209216
"metric-namespace": "CloudTrailMetrics",
@@ -213,7 +220,7 @@
213220
{
214221
"filter-name": "Ec2LargeInstanceChangeMetric",
215222
"accounts": ["master"],
216-
"regions": ["ca-central-1"],
223+
"regions": ["${HOME_REGION}"],
217224
"loggroup-name": "/PBMMAccel/CloudTrail",
218225
"filter-pattern": "{ (($.eventName = RunInstances) || ($.eventName = RebootInstances)|| ($.eventName = StartInstances) || ($.eventName = StopInstances) || ($.eventName= TerminateInstances)) && (($.requestParameters.instanceType= *.32xlarge) || ($.requestParameters.instanceType= *.24xlarge) || ($.requestParameters.instanceType= *.18xlarge) || ($.requestParameters.instanceType= *.16xlarge) || ($.requestParameters.instanceType= *.12xlarge) || ($.requestParameters.instanceType= *.10xlarge) || ($.requestParameters.instanceType= *.9xlarge) || ($.requestParameters.instanceType= *.8xlarge) || ($.requestParameters.instanceType = *.4xlarge)) }",
219226
"metric-namespace": "CloudTrailMetrics",
@@ -223,7 +230,7 @@
223230
{
224231
"filter-name": "CloudTrailChangeMetric",
225232
"accounts": ["master"],
226-
"regions": ["ca-central-1"],
233+
"regions": ["${HOME_REGION}"],
227234
"loggroup-name": "/PBMMAccel/CloudTrail",
228235
"filter-pattern": "{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail)|| ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName= StopLogging) }",
229236
"metric-namespace": "CloudTrailMetrics",
@@ -233,7 +240,7 @@
233240
{
234241
"filter-name": "ConsoleSignInFailureMetric",
235242
"accounts": ["master"],
236-
"regions": ["ca-central-1"],
243+
"regions": ["${HOME_REGION}"],
237244
"loggroup-name": "/PBMMAccel/CloudTrail",
238245
"filter-pattern": "{ ($.eventName = ConsoleLogin) && ($.errorMessage = \"Failedauthentication\") }",
239246
"metric-namespace": "CloudTrailMetrics",
@@ -243,7 +250,7 @@
243250
{
244251
"filter-name": "AuthorizationFailureMetric",
245252
"accounts": ["master"],
246-
"regions": ["ca-central-1"],
253+
"regions": ["${HOME_REGION}"],
247254
"loggroup-name": "/PBMMAccel/CloudTrail",
248255
"filter-pattern": "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") }",
249256
"metric-namespace": "CloudTrailMetrics",
@@ -253,7 +260,7 @@
253260
{
254261
"filter-name": "IamPolicyChangesMetric",
255262
"accounts": ["master"],
256-
"regions": ["ca-central-1"],
263+
"regions": ["${HOME_REGION}"],
257264
"loggroup-name": "/PBMMAccel/CloudTrail",
258265
"filter-pattern": "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}",
259266
"metric-namespace": "CloudTrailMetrics",
@@ -263,7 +270,7 @@
263270
{
264271
"filter-name": "ConsoleSignInWithoutMfaMetric",
265272
"accounts": ["master"],
266-
"regions": ["ca-central-1"],
273+
"regions": ["${HOME_REGION}"],
267274
"loggroup-name": "/PBMMAccel/CloudTrail",
268275
"filter-pattern": "{($.eventName=\"ConsoleLogin\") && ($.additionalEventData.MFAUsed !=\"Yes\") && ($.userIdentity.type != \"AssumedRole\")}",
269276
"metric-namespace": "CloudTrailMetrics",
@@ -273,7 +280,7 @@
273280
{
274281
"filter-name": "RootLoginMetric",
275282
"accounts": ["master"],
276-
"regions": ["ca-central-1"],
283+
"regions": ["${HOME_REGION}"],
277284
"loggroup-name": "/PBMMAccel/CloudTrail",
278285
"filter-pattern": "{ $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }",
279286
"metric-namespace": "CloudTrailMetrics",
@@ -283,7 +290,7 @@
283290
{
284291
"filter-name": "DisableOrDeleteCMKMetric",
285292
"accounts": ["master"],
286-
"regions": ["ca-central-1"],
293+
"regions": ["${HOME_REGION}"],
287294
"loggroup-name": "/PBMMAccel/CloudTrail",
288295
"filter-pattern": "{($.eventSource=kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}",
289296
"metric-namespace": "CloudTrailMetrics",
@@ -293,7 +300,7 @@
293300
{
294301
"filter-name": "AWSConfigChangesMetric",
295302
"accounts": ["master"],
296-
"regions": ["ca-central-1"],
303+
"regions": ["${HOME_REGION}"],
297304
"loggroup-name": "/PBMMAccel/CloudTrail",
298305
"filter-pattern": "{($.eventSource=config.amazonaws.com) && (($.eventName=StopConfigurationRecorder) || ($.eventName=DeleteDeliveryChannel) || ($.eventName=PutDeliveryChannel) || ($.eventName=PutConfigurationRecorder))}",
299306
"metric-namespace": "CloudTrailMetrics",
@@ -303,7 +310,7 @@
303310
{
304311
"filter-name": "RouteTableChangesMetric",
305312
"accounts": ["master"],
306-
"regions": ["ca-central-1"],
313+
"regions": ["${HOME_REGION}"],
307314
"loggroup-name": "/PBMMAccel/CloudTrail",
308315
"filter-pattern": "{($.eventName=CreateRoute) || ($.eventName=CreateRouteTable) || ($.eventName=ReplaceRoute) || ($.eventName=ReplaceRouteTableAssociation) || ($.eventName=DeleteRouteTable) || ($.eventName=DeleteRoute) || ($.eventName=DisassociateRouteTable)}",
309316
"metric-namespace": "CloudTrailMetrics",
@@ -313,7 +320,7 @@
313320
{
314321
"filter-name": "S3BucketPolicyChangesMetric",
315322
"accounts": ["master"],
316-
"regions": ["ca-central-1"],
323+
"regions": ["${HOME_REGION}"],
317324
"loggroup-name": "/PBMMAccel/CloudTrail",
318325
"filter-pattern": "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutBucketPolicy) || ($.eventName=PutBucketCors) || ($.eventName=PutBucketLifecycle) || ($.eventName=PutBucketReplication) || ($.eventName=DeleteBucketPolicy) || ($.eventName=DeleteBucketCors) || ($.eventName=DeleteBucketLifecycle) || ($.eventName=DeleteBucketReplication))}",
319326
"metric-namespace": "CloudTrailMetrics",
@@ -323,7 +330,7 @@
323330
{
324331
"filter-name": "SSOAuthUnapprovedIPMetric",
325332
"accounts": ["master"],
326-
"regions": ["ca-central-1"],
333+
"regions": ["${HOME_REGION}"],
327334
"loggroup-name": "/PBMMAccel/CloudTrail",
328335
"filter-pattern": "{ ($.eventSource=sso.amazonaws.com) && ($.eventName=Authenticate) && ($.sourceIPAddress != 10.10.10.*) }",
329336
"metric-namespace": "CloudTrailMetrics",
@@ -333,7 +340,7 @@
333340
{
334341
"filter-name": "IAMAuthUnapprovedIPMetric",
335342
"accounts": ["master"],
336-
"regions": ["ca-central-1"],
343+
"regions": ["${HOME_REGION}"],
337344
"loggroup-name": "/PBMMAccel/CloudTrail",
338345
"filter-pattern": "{ ($.eventName=ConsoleLogin) && ($.userIdentity.type=IAMUser) && ($.sourceIPAddress != 10.10.10.*) }",
339346
"metric-namespace": "CloudTrailMetrics",
@@ -343,7 +350,7 @@
343350
{
344351
"filter-name": "UnencryptedFilesystemCreatedMetric",
345352
"accounts": ["master"],
346-
"regions": ["ca-central-1"],
353+
"regions": ["${HOME_REGION}"],
347354
"loggroup-name": "/PBMMAccel/CloudTrail",
348355
"filter-pattern": "{ ($.eventName = CreateFileSystem) && ($.responseElements.encrypted IS FALSE) } ",
349356
"metric-namespace": "CloudTrailMetrics",
@@ -353,7 +360,7 @@
353360
],
354361
"alarms": {
355362
"default-accounts": ["master"],
356-
"default-regions": ["ca-central-1"],
363+
"default-regions": ["${HOME_REGION}"],
357364
"default-namespace": "CloudTrailMetrics",
358365
"default-statistic": "Sum",
359366
"default-period": 300,
@@ -484,7 +491,7 @@
484491
"ssm-automation": [
485492
{
486493
"accounts": ["operations"],
487-
"regions": ["ca-central-1"],
494+
"regions": ["${HOME_REGION}"],
488495
"documents": [
489496
{
490497
"name": "SSM-ELB-Enable-Logging",
@@ -643,15 +650,15 @@
643650
"ssm-automation": [
644651
{
645652
"account": "operations",
646-
"regions": ["ca-central-1"],
653+
"regions": ["${HOME_REGION}"],
647654
"documents": ["SSM-ELB-Enable-Logging", "Put-S3-Encryption"]
648655
}
649656
],
650657
"aws-config": [
651658
{
652659
"excl-regions": [],
653660
"rules": ["ELB_LOGGING_ENABLED", "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"],
654-
"remediate-regions": ["ca-central-1"]
661+
"remediate-regions": ["${HOME_REGION}"]
655662
}
656663
]
657664
},
@@ -691,15 +698,15 @@
691698
"ssm-automation": [
692699
{
693700
"account": "operations",
694-
"regions": ["ca-central-1"],
701+
"regions": ["${HOME_REGION}"],
695702
"documents": ["SSM-ELB-Enable-Logging", "Put-S3-Encryption"]
696-
}
703+
}
697704
],
698705
"aws-config": [
699706
{
700707
"excl-regions": [],
701708
"rules": ["ELB_LOGGING_ENABLED", "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"],
702-
"remediate-regions": ["ca-central-1"]
709+
"remediate-regions": ["${HOME_REGION}"]
703710
}
704711
]
705712
}

‎reference-artifacts/SAMPLE_CONFIGS/sample_snippets.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@
9191
"master"
9292
],
9393
"regions": [
94-
"ca-central-1"
94+
"${HOME_REGION}"
9595
],
9696
"loggroup-name": "/PBMMAccel/CloudTrail",
9797
"filter-pattern": "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }",
@@ -105,7 +105,7 @@
105105
"master"
106106
],
107107
"default-regions": [
108-
"ca-central-1"
108+
"${HOME_REGION}"
109109
],
110110
"default-namespace": "CloudTrailMetrics",
111111
"default-statistic": "Sum",
@@ -132,7 +132,7 @@
132132

133133
```
134134
"additional-cwl-regions": {
135-
"us-east-1": {
135+
"${GBL_REGION}": {
136136
"kinesis-stream-shard-count": 1
137137
}
138138
}
@@ -556,7 +556,7 @@
556556
{
557557
"name": "Main",
558558
"asn": 65521,
559-
"region": "ca-central-1",
559+
"region": "${HOME_REGION}",
560560
"features": {
561561
"DNS-support": true,
562562
"VPN-ECMP-support": true,
@@ -607,7 +607,7 @@
607607
{
608608
"name": "East",
609609
"asn": 64526,
610-
"region": "us-east-1",
610+
"region": "${GBL_REGION}",
611611
"features": {
612612
"DNS-support": true,
613613
"VPN-ECMP-support": true,
@@ -619,7 +619,7 @@
619619
"tgw-attach": {
620620
"associate-to-tgw": "Main",
621621
"account": "shared-network",
622-
"region": "ca-central-1",
622+
"region": "${HOME_REGION}",
623623
"tgw-rt-associate-local": ["core"],
624624
"tgw-rt-associate-remote": ["core"]
625625
},
@@ -697,7 +697,7 @@
697697
```
698698
"aws-config": [
699699
{
700-
"regions": ["ca-central-1", "us-east-1"],
700+
"regions": ["${HOME_REGION}", "${GBL_REGION}"],
701701
"excl-rules": ["ELB_LOGGING_ENABLED"]
702702
}
703703
]

0 commit comments

Comments
 (0)