Skip to content

Commit dbf0d12

Browse files
Brian969Brian969
authored
(docs)Update installation.md (#667)
* Update installation.md * Update sample configs with ap-northeast-3 * fix error in developer guide * Improve SCP * block sharing snapshots and ec2 images * tweak-scp-lockdown-snapsharing * Update installation.md
1 parent 2db94af commit dbf0d12

File tree

7 files changed

+57
-47
lines changed

7 files changed

+57
-47
lines changed

‎docs/developer/developer-guide.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -754,7 +754,7 @@ There is a script called `cdk.sh` in `src/deployments/cdk` that allows you to de
754754
755755
The script enables development mode which means that accounts, organizations, configuration, limits and outputs will be loaded from the local environment instead of loading the values from DynamoDB. The local files that need to be available in the `src/deployments/cdk` folder are the following.
756756
757-
1. `accounts.json` based on `accelerator/accounts`
757+
1. `accounts.json` based on `accelerator/accounts` (-Parameters table)
758758
759759
```json
760760
[
@@ -777,7 +777,7 @@ The script enables development mode which means that accounts, organizations, co
777777
]
778778
```
779779
780-
2. `organizations.json` based on `accelerator/organizations`
780+
2. `organizations.json` based on `accelerator/organizations` (-Parameters table)
781781
782782
```json
783783
[
@@ -796,7 +796,7 @@ The script enables development mode which means that accounts, organizations, co
796796
]
797797
```
798798
799-
3. `limits.json` based on `accelerator/limits`
799+
3. `limits.json` based on `accelerator/limits` (-Parameters table)
800800
801801
```json
802802
[
@@ -819,7 +819,7 @@ The script enables development mode which means that accounts, organizations, co
819819
]
820820
```
821821
822-
4. `outputs.json` based on `outputs.json` in the Accelerator configuration bucket
822+
4. `outputs.json` based on the -Outputs table
823823
824824
```json
825825
[

‎docs/installation/installation.md‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ If deploying to an internal AWS employee account, to successfully install the so
220220
## 2.5. Installation
221221

222222
1. You can find the latest release in the repository [here](https://github.com/aws-samples/aws-secure-environment-accelerator/releases).
223+
- Due to some breaking dependency issues, customers can only install or upgrade to v1.3.1 or above (older releases continue to function, but cannot be installed)
223224
2. Download the CloudFormation (CFN) template `AcceleratorInstallerXXX.template.json` for the release you plan to install
224225
3. Use the provided CloudFormation template to deploy a new stack in your Management (root) AWS account
225226
- As previously stated we do not support installation in sub-accounts
@@ -230,7 +231,7 @@ If deploying to an internal AWS employee account, to successfully install the so
230231
8. Add an `Email` address to be used for State Machine Status notification
231232
9. The `GithubBranch` should point to the release you selected
232233
- if upgrading, change it to point to the desired release
233-
- the latest stable branch is currently `release/v1.3.0`, case sensitive
234+
- the latest stable branch is currently `release/v1.3.1`, case sensitive
234235
10. Apply a tag on the stack, Key=`Accelerator`, Value=`PBMM` (case sensitive).
235236
11. **ENABLE STACK TERMINATION PROTECTION** under `Stack creation options`
236237
12. The stack typically takes under 5 minutes to deploy.
@@ -266,6 +267,7 @@ If deploying to an internal AWS employee account, to successfully install the so
266267
Current Issues:
267268

268269
- Occasionally CloudFormation fails to return a completion signal. After the credentials eventually fail (1 hr), the state machine fails. Simply rerun the state machine.
270+
- New deployments to existing organizations with more than 20 accounts will fail on SSM document sharing as we fail to paginate the API call. Remove the SSM remediation documents from all of the OU's, i.e. `"documents": []` and set `"remediation": false` on the 4 config rules in global-options. Will be resolved in v1.3.1. Adding a new SSM document to the config file which results in it being shared to more than 20 accounts will also fail. Assuming no OU has more than 20 accounts, customers can deploy the SSM document one OU at a time to work around this issue.
269271

270272
Issues in Older Releases:
271273

@@ -301,7 +303,8 @@ Issues in Older Releases:
301303
- Each new VIP will use a new high port (i.e. 7007, 7008, etc.), all of which map back to port 443
302304
- Detailed steps can be read [here](./guides/public-facing-workload-via-fortigate.md).
303305
4. In your `home` region (i.e. ca-central-1), Enable AWS SSO, Set the SSO directory to MAD, set the SSO email attrib to: \${dir:email}, create all default permission sets and any desired custom permission sets, map MAD groups to perm sets
304-
5. On a per role basis, you need to enable the CWL Account Selector in the Security and the Ops accounts
306+
5. On a per role basis, you need to enable the CWL Account Selector in the Security and the Ops accounts, in each account:
307+
- Go to CloudWatch, Settings, Under `Cross-account cross-region` select `Configure`, Under `View cross-account cross-region` select `Enable`, choose `AWS Organization account selector`, click `Enable`
305308
6. Customers are responsible for the ongoing management and rotation of all passwords on a regular basis per their organizational password policy. This includes the passwords of all IAM users, MAD users, firewall users, or other users, whether deployed by the Accelerator or not. We do NOT automatically rotate any passwords, but strongly encourage customers do so, on a regular basis.
306309

307310
2. During the installation we request required limit increases, resources dependent on these limits will not be deployed
@@ -315,6 +318,7 @@ Issues in Older Releases:
315318

316319
## 3.1. Considerations
317320

321+
- Due to some breaking dependency issues, customers can only install or upgrade to v1.3.1 or above (older releases continue to function, but cannot be installed)
318322
- Always compare your configuration file with the config file from the release you are upgrading to in order to validate new or changed parameters or changes in parameter types / formats.
319323
- do NOT update to the latest firewall AMI - see the the last bullet in section [5.1. Accelerator Design Constraints / Decisions](#51-accelerator-design-constraints--decisions)
320324
- do NOT update the `organization-admin-role` - see bullet 2 in section [2.2.6. Other](#226-other)
@@ -358,7 +362,7 @@ Issues in Older Releases:
358362

359363
## 3.2. Summary of Upgrade Steps (all versions)
360364

361-
1. Login to your Organization Management (root) AWS account with administrative priviliges
365+
1. Login to your Organization Management (root) AWS account with administrative privileges
362366
2. Ensure a valid Github token is stored in secrets manager [(section 2.3.2)](#232-create-github-personal-access-token-and-store-in-secrets-manager)
363367
3. Review and implement any relevant tasks noted in the upgrade considerations in [section 3.1](#31-considerations)
364368
4. Update the config file in Code Commit with new parameters and updated parameter types based on the version you are upgrading to (this is important as features are iterating rapidly)
@@ -375,12 +379,13 @@ Issues in Older Releases:
375379
- The pipeline will automatically run and trigger the upgraded state machine
376380
9. If you are using a pre-existing GitHub token:
377381

378-
- Update the Installer CloudFormation stack using the template downloaded in step 5, updating the `GithubBranch` to the latest release (eg. `release/v1.2.5`)
382+
- Update the Installer CloudFormation stack using the template downloaded in step 5, updating the `GithubBranch` to the latest release (eg. `release/v1.3.1`)
379383
- Go to AWS CloudFormation and select the stack: `PBMMAccel-what-you-provided`
380384
- Select Update, select Replace current template, Select Upload a template file
381385
- Select Choose File and select the template you downloaded in step 5 (`AcceleratorInstallerXYZ.template.json`)
382386
- Select Next, Update `GithubBranch` parameter to `release/vX.Y.Z` where X.Y.Z represents the latest release
383387
- Click Next, Next, I acknowledge, Update
388+
- Wait for the CloudFormation stack to update (`Update_Complete` status) (Requires manual refresh)
384389
- Go To Code Pipeline and Release the PBMMAccel-InstallerPipeline
385390

386391
# 4. Existing Organizations / Accounts

‎reference-artifacts/SAMPLE_CONFIGS/config.example.json‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
"supported-regions": [
2626
"ap-northeast-1",
2727
"ap-northeast-2",
28+
"ap-northeast-3",
2829
"ap-south-1",
2930
"ap-southeast-1",
3031
"ap-southeast-2",
@@ -48,17 +49,17 @@
4849
"central-security-services": {
4950
"account": "security",
5051
"region": "${HOME_REGION}",
51-
"security-hub-excl-regions": [],
52+
"security-hub-excl-regions": ["ap-northeast-3"],
5253
"guardduty": true,
53-
"guardduty-excl-regions": [],
54+
"guardduty-excl-regions": ["ap-northeast-3"],
5455
"guardduty-s3": true,
55-
"guardduty-s3-excl-regions": [],
56+
"guardduty-s3-excl-regions": ["ap-northeast-3"],
5657
"cwl": true,
5758
"access-analyzer": true,
5859
"config-excl-regions": [],
5960
"config-aggr-excl-regions": [],
6061
"macie": true,
61-
"macie-excl-regions": [],
62+
"macie-excl-regions": ["ap-northeast-3"],
6263
"macie-frequency": "FIFTEEN_MINUTES"
6364
},
6465
"central-operations-services": {
@@ -568,9 +569,7 @@
568569
{
569570
"name": "EC2-INSTANCE-PROFILE-PERMISSIONS",
570571
"type": "custom",
571-
"resource-types": [
572-
"AWS::IAM::Role"
573-
],
572+
"resource-types": ["AWS::IAM::Role"],
574573
"runtime": "nodejs12.x",
575574
"parameters": {
576575
"AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
@@ -2083,7 +2082,7 @@
20832082
],
20842083
"aws-config": [
20852084
{
2086-
"excl-regions": [],
2085+
"excl-regions": ["ap-northeast-3"],
20872086
"rules": [
20882087
"EC2-INSTANCE-PROFILE",
20892088
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -2641,7 +2640,7 @@
26412640
],
26422641
"aws-config": [
26432642
{
2644-
"excl-regions": [],
2643+
"excl-regions": ["ap-northeast-3"],
26452644
"rules": [
26462645
"EC2-INSTANCE-PROFILE",
26472646
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -3226,7 +3225,7 @@
32263225
],
32273226
"aws-config": [
32283227
{
3229-
"excl-regions": [],
3228+
"excl-regions": ["ap-northeast-3"],
32303229
"rules": [
32313230
"EC2-INSTANCE-PROFILE",
32323231
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -3811,7 +3810,7 @@
38113810
],
38123811
"aws-config": [
38133812
{
3814-
"excl-regions": [],
3813+
"excl-regions": ["ap-northeast-3"],
38153814
"rules": [
38163815
"EC2-INSTANCE-PROFILE",
38173816
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -4396,7 +4395,7 @@
43964395
],
43974396
"aws-config": [
43984397
{
4399-
"excl-regions": [],
4398+
"excl-regions": ["ap-northeast-3"],
44004399
"rules": [
44014400
"EC2-INSTANCE-PROFILE",
44024401
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -4948,7 +4947,7 @@
49484947
],
49494948
"aws-config": [
49504949
{
4951-
"excl-regions": [],
4950+
"excl-regions": ["ap-northeast-3"],
49524951
"rules": [
49534952
"EC2-INSTANCE-PROFILE",
49544953
"EC2-INSTANCE-PROFILE-PERMISSIONS",

‎reference-artifacts/SAMPLE_CONFIGS/config.lite-example.json‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
"supported-regions": [
2626
"ap-northeast-1",
2727
"ap-northeast-2",
28+
"ap-northeast-3",
2829
"ap-south-1",
2930
"ap-southeast-1",
3031
"ap-southeast-2",
@@ -48,17 +49,17 @@
4849
"central-security-services": {
4950
"account": "security",
5051
"region": "${HOME_REGION}",
51-
"security-hub-excl-regions": [],
52+
"security-hub-excl-regions": ["ap-northeast-3"],
5253
"guardduty": true,
53-
"guardduty-excl-regions": [],
54+
"guardduty-excl-regions": ["ap-northeast-3"],
5455
"guardduty-s3": true,
55-
"guardduty-s3-excl-regions": [],
56+
"guardduty-s3-excl-regions": ["ap-northeast-3"],
5657
"cwl": true,
5758
"access-analyzer": true,
5859
"config-excl-regions": [],
5960
"config-aggr-excl-regions": [],
6061
"macie": true,
61-
"macie-excl-regions": [],
62+
"macie-excl-regions": ["ap-northeast-3"],
6263
"macie-frequency": "FIFTEEN_MINUTES"
6364
},
6465
"central-operations-services": {
@@ -568,9 +569,7 @@
568569
{
569570
"name": "EC2-INSTANCE-PROFILE-PERMISSIONS",
570571
"type": "custom",
571-
"resource-types": [
572-
"AWS::IAM::Role"
573-
],
572+
"resource-types": ["AWS::IAM::Role"],
574573
"runtime": "nodejs12.x",
575574
"parameters": {
576575
"AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
@@ -2020,7 +2019,7 @@
20202019
],
20212020
"aws-config": [
20222021
{
2023-
"excl-regions": [],
2022+
"excl-regions": ["ap-northeast-3"],
20242023
"rules": [
20252024
"EC2-INSTANCE-PROFILE",
20262025
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -2578,7 +2577,7 @@
25782577
],
25792578
"aws-config": [
25802579
{
2581-
"excl-regions": [],
2580+
"excl-regions": ["ap-northeast-3"],
25822581
"rules": [
25832582
"EC2-INSTANCE-PROFILE",
25842583
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -3163,7 +3162,7 @@
31633162
],
31643163
"aws-config": [
31653164
{
3166-
"excl-regions": [],
3165+
"excl-regions": ["ap-northeast-3"],
31673166
"rules": [
31683167
"EC2-INSTANCE-PROFILE",
31693168
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -3748,7 +3747,7 @@
37483747
],
37493748
"aws-config": [
37503749
{
3751-
"excl-regions": [],
3750+
"excl-regions": ["ap-northeast-3"],
37523751
"rules": [
37533752
"EC2-INSTANCE-PROFILE",
37543753
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -4333,7 +4332,7 @@
43334332
],
43344333
"aws-config": [
43354334
{
4336-
"excl-regions": [],
4335+
"excl-regions": ["ap-northeast-3"],
43374336
"rules": [
43384337
"EC2-INSTANCE-PROFILE",
43394338
"EC2-INSTANCE-PROFILE-PERMISSIONS",

‎reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
"supported-regions": [
2727
"ap-northeast-1",
2828
"ap-northeast-2",
29+
"ap-northeast-3",
2930
"ap-south-1",
3031
"ap-southeast-1",
3132
"ap-southeast-2",
@@ -49,17 +50,17 @@
4950
"central-security-services": {
5051
"account": "security",
5152
"region": "${HOME_REGION}",
52-
"security-hub-excl-regions": [],
53+
"security-hub-excl-regions": ["ap-northeast-3"],
5354
"guardduty": true,
54-
"guardduty-excl-regions": [],
55+
"guardduty-excl-regions": ["ap-northeast-3"],
5556
"guardduty-s3": true,
56-
"guardduty-s3-excl-regions": [],
57+
"guardduty-s3-excl-regions": ["ap-northeast-3"],
5758
"cwl": true,
5859
"access-analyzer": true,
5960
"config-excl-regions": [],
6061
"config-aggr-excl-regions": [],
6162
"macie": true,
62-
"macie-excl-regions": [],
63+
"macie-excl-regions": ["ap-northeast-3"],
6364
"macie-frequency": "FIFTEEN_MINUTES"
6465
},
6566
"central-operations-services": {
@@ -573,9 +574,7 @@
573574
{
574575
"name": "EC2-INSTANCE-PROFILE-PERMISSIONS",
575576
"type": "custom",
576-
"resource-types": [
577-
"AWS::IAM::Role"
578-
],
577+
"resource-types": ["AWS::IAM::Role"],
579578
"runtime": "nodejs12.x",
580579
"parameters": {
581580
"AWSManagedPolicies": "AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess, CloudWatchAgentServerPolicy",
@@ -589,7 +588,7 @@
589588
"CustomerManagedPolicies": ["${SEA::EC2InstaceProfilePermissions}"],
590589
"ResourceId": "RESOURCE_ID"
591590
}
592-
}
591+
},
593592
{
594593
"name": "ELB_LOGGING_ENABLED",
595594
"remediation-action": "SSM-ELB-Enable-Logging",
@@ -2575,7 +2574,7 @@
25752574
],
25762575
"aws-config": [
25772576
{
2578-
"excl-regions": [],
2577+
"excl-regions": ["ap-northeast-3"],
25792578
"rules": [
25802579
"EC2-INSTANCE-PROFILE",
25812580
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -3133,7 +3132,7 @@
31333132
],
31343133
"aws-config": [
31353134
{
3136-
"excl-regions": [],
3135+
"excl-regions": ["ap-northeast-3"],
31373136
"rules": [
31383137
"EC2-INSTANCE-PROFILE",
31393138
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -3718,7 +3717,7 @@
37183717
],
37193718
"aws-config": [
37203719
{
3721-
"excl-regions": [],
3720+
"excl-regions": ["ap-northeast-3"],
37223721
"rules": [
37233722
"EC2-INSTANCE-PROFILE",
37243723
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -4303,7 +4302,7 @@
43034302
],
43044303
"aws-config": [
43054304
{
4306-
"excl-regions": [],
4305+
"excl-regions": ["ap-northeast-3"],
43074306
"rules": [
43084307
"EC2-INSTANCE-PROFILE",
43094308
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -4888,7 +4887,7 @@
48884887
],
48894888
"aws-config": [
48904889
{
4891-
"excl-regions": [],
4890+
"excl-regions": ["ap-northeast-3"],
48924891
"rules": [
48934892
"EC2-INSTANCE-PROFILE",
48944893
"EC2-INSTANCE-PROFILE-PERMISSIONS",
@@ -5711,7 +5710,7 @@
57115710
],
57125711
"aws-config": [
57135712
{
5714-
"excl-regions": [],
5713+
"excl-regions": ["ap-northeast-3"],
57155714
"rules": [
57165715
"EC2-INSTANCE-PROFILE",
57175716
"EC2-INSTANCE-PROFILE-PERMISSIONS",

‎reference-artifacts/SCPs/ASEA-Guardrails-Sensitive.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@
3838
"ec2:DisassociateRouteTable",
3939
"ec2:AllocateAddress",
4040
"ec2:AssociateAddress",
41+
"ec2:ModifyImageAttribute",
42+
"ec2:ModifySnapshotAttribute",
43+
"rds:ModifyDBSnapshotAttribute",
44+
"rds:ModifyDBClusterSnapshotAttribute",
4145
"globalaccelerator:Create*",
4246
"globalaccelerator:Update*",
4347
"kms:ScheduleKeyDeletion",

0 commit comments

Comments
 (0)