AWS Control Towerのcloudformationを読み解いたので誰かに褒めてほしい

AWS Control Towerを触ってみた

Contorl Towerの東京リージョンがサポートされたので触ってみました。
色々と調査する過程で、Control Towerを有効化した時に
裏側で流れるcloudformationを読み解いて図示したので
きっと誰かの役に立つと思いブログ化してみました。

Control Towerを有効化する前

簡単に、有効化前はorganizationsの配下にたくさんアカウントがいると仮定します。

Control Towerを有効化した後

control towerを有効化しても、既存アカウントに即座には影響はありません。

control towerが有効化されているOUの配下にアカウントを持ってくると
各種設定(cloudformationやらSCPやら)が有効化されます。

ここで、SCPは分かりやすくドキュメントに整理されていました。 docs.aws.amazon.com

ただ、cloudformationの方は、分かりやすく記載されたものが
見つけられませんでした。
ドキュメントをみてみると、cloudformaitonを確認するのが良いと書いてあったので、
大変でしたが自分で読み解いてみました。
読み解くと結構時間かかったので、
今後、同じ想いで苦労する人を救いたい一心で結果を図示してみました。

裏側のcloudformationを図示

全部読み解くと、下記のようになっていました。
control towerの全体図です。

裏側のcloudformation詳細

ここからは各stackの中身を記載していきます。
読み解く時にはメモが参考になると思います。
もし間違いを見つけた場合は、ご連絡いただけますと嬉しいです。

AWSControlTowerBP-BASELINE-CLOUDTRAIL

概要

trailを有効化し結果をS3とlogsに出力する
S3はアーカイブアカウント宛で、マルチリージョンを記録します
logs連携は有効化され、retentionは14日
configはsnsを設定、セキュリティアカウントの「aws-controltower-AllConfigNotification」に通知 します

デプロイ対象

下記のcontroltowerを有効化した1つのリージョン
core ou
custome ou

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure AWS CloudTrail

Parameters:
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'

  EnableLogFileValidation:
    Type: String
    Default: 'true'
    Description: Indicates whether CloudTrail validates the integrity of log files.
    AllowedValues:
      - 'true'
      - 'false'

  IncludeGlobalEvents:
    Type: String
    Default: 'true'
    Description: Indicates whether the trail is publishing events from global services, such as IAM, to the log files.
    AllowedValues:
      - 'true'
      - 'false'

  MultiRegion:
    Type: String
    Default: 'true'
    Description: Indicates whether the CloudTrail trail is created in the region in which you create the stack (false) or in all regions (true).
    AllowedValues:
      - 'true'
      - 'false'

  AllConfigTopicName:
    Type: String
    Default: ''
    Description: All Configuration Notification SNS Topic in Security Account that AWS Config delivers notifications to.

  SecurityAccountId:
    Type: 'String'
    Description: AWS Account Id of the Security account.

  AuditBucketName:
    Type: String
    Default: ''
    Description: Audit Bucket name from the Log Archive Account

  PublishToCloudWatchLogs:
    Type: String
    Default: 'true'
    Description: Indicates whether notifications are published to CloudWatch Logs.
    AllowedValues:
      - 'true'
      - 'false'

  LogsRetentionInDays:
    Description: 'Specifies the number of days you want to retain CloudTrail log events in the CloudWatch Logs.'
    Type: Number
    Default: 14
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]

  AWSLogsS3KeyPrefix:
    Type: 'String'
    Description: 'Organization ID to use as the S3 Key prefix for storing the audit logs'

Conditions:
  IsMultiRegion: !Equals
    - !Ref MultiRegion
    - 'true'

  IsPublishToCloudWatchLogs: !Equals
    - !Ref PublishToCloudWatchLogs
    - 'true'

Resources:
  Trail:
    Type: AWS::CloudTrail::Trail
    Properties:
      TrailName: !Sub ${ManagedResourcePrefix}-BaselineCloudTrail
      S3BucketName: !Ref AuditBucketName
      S3KeyPrefix: !Ref AWSLogsS3KeyPrefix
      SnsTopicName: !Sub arn:aws:sns:${AWS::Region}:${SecurityAccountId}:${AllConfigTopicName}
      IsLogging: True
      EnableLogFileValidation: !Ref EnableLogFileValidation
      IncludeGlobalServiceEvents: !If
        - IsMultiRegion
        - True
        - !Ref IncludeGlobalEvents
      IsMultiRegionTrail: !Ref MultiRegion
      CloudWatchLogsLogGroupArn: !If
        - IsPublishToCloudWatchLogs
        - !GetAtt TrailLogGroup.Arn
        - !Ref AWS::NoValue
      CloudWatchLogsRoleArn: !If
        - IsPublishToCloudWatchLogs
        - !GetAtt TrailLogGroupRole.Arn
        - !Ref AWS::NoValue

  TrailLogGroup:
    Type: 'AWS::Logs::LogGroup'
    Condition: IsPublishToCloudWatchLogs
    Properties:
      LogGroupName: !Sub ${ManagedResourcePrefix}/CloudTrailLogs
      RetentionInDays: !Ref LogsRetentionInDays

  TrailLogGroupRole:
     Type: 'AWS::IAM::Role'
     Condition: IsPublishToCloudWatchLogs
     Properties:
       RoleName: !Sub ${ManagedResourcePrefix}-CloudWatchLogsRole
       AssumeRolePolicyDocument:
         Version: '2012-10-17'
         Statement:
         - Sid: CloudTrailAssumeRole
           Effect: Allow
           Principal:
             Service: 'cloudtrail.amazonaws.com'
           Action: 'sts:AssumeRole'
       Policies:
       - PolicyName: 'cloudtrail-policy'
         PolicyDocument:
           Version: '2012-10-17'
           Statement:
           - Sid: AWSCloudTrailCreateLogStream
             Effect: Allow
             Action: 'logs:CreateLogStream'
             Resource: !GetAtt 'TrailLogGroup.Arn'
           - Sid: AWSCloudTrailPutLogEvents
             Effect: Allow
             Action: 'logs:PutLogEvents'
             Resource: !GetAtt 'TrailLogGroup.Arn'

Outputs:
  BaselineCloudTrail:
    Description: Baseline CloudTrail
    Value: !GetAtt 'Trail.Arn'
  CloudWatchLogsGroupArn:
    Description: CloudWatch Log Group ARN for Baseline CloudTrail
    Value: !GetAtt 'TrailLogGroup.Arn'
  CloudWatchLogsGroupName:
    Description: CloudWatch Log Group Name for Baseline CloudTrail
    Value: !Ref TrailLogGroup

AWSControlTowerBP-BASELINE-CLOUDWATCH

概要

LambdaとSNS。
configのルールに準拠していない場合は、子アカウントのLambdaを経由して
AuditアカウントのSNSに通知する
デフォルトではSNSの名前は下記になっている
aws-controltower-AggregateSecurityNotifications

デプロイ対象

下記のcontroltowerがサポートされている全リージョン
core ou
custome ou

cloudformation template

---
AWSTemplateFormatVersion: '2010-09-09'
Description: Configure Cloudwatch Rule, local SNS Topic, forwarding notifications from local SNS Topic to Security Topic
Parameters:
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'
  SecurityTopicName:
    Type: String
    Description: Security Notification SNS Topic Name.
  SecurityAccountId:
    Type: 'String'
    Description: AWS Account Id of the Security account.
  LogsRetentionInDays:
    Description: 'Specifies the number of days you want to retain notification forwarding log events in the Lambda log group.'
    Type: Number
    Default: 14
    AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
  EnableConfigRuleComplianceChangeAlarm:
    Type: String
    Description: "Enable notifications for AWS Config rule compliance status changes?"
    Default: true
    AllowedValues:
    - true
    - false

Mappings:
  TopicNameSuffix:
    LocalTopicName:
      Suffix: 'SecurityNotifications'

Conditions:
  EnableConfigRuleChangeNotification: !Equals
    - !Ref EnableConfigRuleComplianceChangeAlarm
    - 'true'

Resources:

  ForwardSnsNotification:
    Type: 'AWS::Lambda::Function'
    Properties:
      FunctionName: !Sub ${ManagedResourcePrefix}-NotificationForwarder
      Description: SNS message forwarding function for aggregating account notifications.
      Code:
        ZipFile:
          !Sub |
            from __future__ import print_function
            import boto3
            import json
            import os
            def lambda_handler(event, context):
                #print("Received event: " + json.dumps(event, indent=2))
                sns = boto3.client('sns')
                subject=event['Records'][0]['Sns']['Subject']
                if subject is None:
                    subject = 'None'
                message = event['Records'][0]['Sns']['Message']
                try:
                    msg = json.loads(message)
                    message = json.dumps(msg, indent=4)
                    if 'detail-type' in msg:
                      subject = msg['detail-type']
                except:
                    print('Not json')
                response = sns.publish(
                    TopicArn=os.environ.get('sns_arn'),
                    Subject=subject,
                    Message=message
                )
                print(response)
                return response
      Handler: 'index.lambda_handler'
      MemorySize: 128
      Role: !Sub arn:aws:iam::${AWS::AccountId}:role/${ManagedResourcePrefix}-ForwardSnsNotificationRole
      Runtime: 'python3.6'
      Timeout: 60
      Environment:
        Variables:
          sns_arn: !Sub arn:aws:sns:${AWS::Region}:${SecurityAccountId}:${SecurityTopicName}

  ForwardSnsNotificationGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Sub '/aws/lambda/${ForwardSnsNotification}'
      RetentionInDays: !Ref LogsRetentionInDays

  LocalSecurityTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Join [ "-", [ !Ref ManagedResourcePrefix, !FindInMap [TopicNameSuffix, LocalTopicName, Suffix] ]]
      TopicName: !Join [ "-", [ !Ref ManagedResourcePrefix, !FindInMap [TopicNameSuffix, LocalTopicName, Suffix] ]]

  SNSNotificationPolicy:
    Type: AWS::SNS::TopicPolicy
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F18
            reason: "Condition restricts permissions to current account."
    Properties:
      Topics:
        - !Ref LocalSecurityTopic
      PolicyDocument:
        Statement:
          - Sid: __default_statement_ID
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
            - SNS:GetTopicAttributes
            - SNS:SetTopicAttributes
            - SNS:AddPermission
            - SNS:RemovePermission
            - SNS:DeleteTopic
            - SNS:Subscribe
            - SNS:ListSubscriptionsByTopic
            - SNS:Publish
            - SNS:Receive
            Resource: !Ref LocalSecurityTopic
            Condition:
              StringEquals:
                AWS:SourceOwner: !Sub ${AWS::AccountId}
          - Sid: TrustCWEToPublishEventsToMyTopic
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sns:Publish
            Resource: !Ref LocalSecurityTopic

  SNSNotificationSubscription:
    Type: "AWS::SNS::Subscription"
    Properties:
      Endpoint: !GetAtt ForwardSnsNotification.Arn
      Protocol: lambda
      TopicArn: !Ref LocalSecurityTopic

  SNSInvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: sns.amazonaws.com
      SourceArn: !Ref LocalSecurityTopic
      FunctionName: !GetAtt ForwardSnsNotification.Arn

  # Enable notifications for AWS Config Rule compliance changes
  CWEventRuleComplianceChangeEvent:
    Type: AWS::Events::Rule
    Condition: EnableConfigRuleChangeNotification
    Properties:
      Name: !Sub ${ManagedResourcePrefix}-ConfigComplianceChangeEventRule
      Description: 'CloudWatch Event Rule to send notification on Config Rule compliance changes.'
      EventPattern:
        {
          "source": [
            "aws.config"
          ],
          "detail-type": [
            "Config Rules Compliance Change"
          ]
        }
      State: ENABLED
      Targets:
      - Id: !Sub 'Compliance-Change-Topic'
        Arn: !Ref LocalSecurityTopic

Outputs:
  LocalSecurityTopic:
    Description: Local Security Notification SNS Topic ARN
    Value: !Ref LocalSecurityTopic
  LocalSecurityTopicName:
    Description: Local Security Notification SNS Topic Name
    Value: !GetAtt LocalSecurityTopic.TopicName

AWSControlTowerBP-BASELINE-CONFIG

概要

configを有効化し、security(Audit)のアカウントにアグリゲーションする configの通知はsecurity(Audit)のアカウントの下記に通知する aws-controltower-AllConfigNotifications

デプロイ対象

下記のcontroltowerがサポートされている全リージョン
core ou
custome ou

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure AWS Config

Parameters:
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'

  AllSupported:
    Type: String
    Default: 'true'
    Description: Indicates whether to record all supported resource types.
    AllowedValues:
      - 'true'
      - 'false'

  IncludeGlobalResourceTypes:
    Type: String
    Default: 'true'
    Description: Indicates whether AWS Config records all supported global resource types.
    AllowedValues:
      - 'true'
      - 'false'

  ResourceTypes:
    Type: CommaDelimitedList
    Description: A list of valid AWS resource types to include in this recording group. Eg. AWS::CloudTrail::Trail

  Frequency:
    Type: String
    Default: 1hour
    Description: The frequency with which AWS Config delivers configuration snapshots.
    AllowedValues:
      - 1hour
      - 3hours
      - 6hours
      - 12hours
      - 24hours

  AllConfigTopicName:
    Type: String
    Default: ''
    Description: All Configuration Notification SNS Topic in Security Account that AWS Config delivers notifications to.

  SecurityAccountId:
    Type: 'String'
    Description: AWS Account Id of the Security account.

  AuditBucketName:
    Type: String
    Default: ''
    Description: Audit Bucket name from the Log Archive Account

  AWSLogsS3KeyPrefix:
    Type: 'String'
    Description: Organization ID to use as the S3 Key prefix for storing the audit logs

  HomeRegionName:
    Type: 'String'
    Description: The name of the home region for the customer

  IsHomeRegionInitialControlTowerRegion:
    Type: 'String'
    AllowedValues:
       - 'true'
       - 'false'
    Description: Indicates whether the Home Region of the customer is one of the initial regions in which AWS Control Tower launched.

Conditions:
  IsAllSupported: !Equals
    - !Ref AllSupported
    - 'true'

  CreateHomeRegionConfigAggregatorAuthorization: !Equals
   -  !Ref IsHomeRegionInitialControlTowerRegion
   -  'false'

  CreateRegionalConfigAggregatorAuthorization: !Equals
   -  !Ref IsHomeRegionInitialControlTowerRegion
   -  'true'

Mappings:
  Settings:
    FrequencyMap:
      1hour   : One_Hour
      3hours  : Three_Hours
      6hours  : Six_Hours
      12hours : Twelve_Hours
      24hours : TwentyFour_Hours

Resources:
  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: !Sub ${ManagedResourcePrefix}-BaselineConfigRecorder
      RoleARN: !Sub arn:aws:iam::${AWS::AccountId}:role/${ManagedResourcePrefix}-ConfigRecorderRole
      RecordingGroup:
        AllSupported: !Ref AllSupported
        IncludeGlobalResourceTypes: !Ref IncludeGlobalResourceTypes
        ResourceTypes: !If
          - IsAllSupported
          - !Ref AWS::NoValue
          - !Ref ResourceTypes

  ConfigDeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    Properties:
      Name: !Sub ${ManagedResourcePrefix}-BaselineConfigDeliveryChannel
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: !FindInMap
          - Settings
          - FrequencyMap
          - !Ref Frequency
      S3BucketName: !Ref AuditBucketName
      S3KeyPrefix: !Ref AWSLogsS3KeyPrefix
      SnsTopicARN: !Sub arn:aws:sns:${AWS::Region}:${SecurityAccountId}:${AllConfigTopicName}

  AuthorizerPdx:
    Condition: CreateRegionalConfigAggregatorAuthorization
    Type: "AWS::Config::AggregationAuthorization"
    Properties:
      AuthorizedAccountId: !Ref SecurityAccountId
      AuthorizedAwsRegion: us-west-2
  AuthorizerIad:
    Condition: CreateRegionalConfigAggregatorAuthorization
    Type: "AWS::Config::AggregationAuthorization"
    Properties:
      AuthorizedAccountId: !Ref SecurityAccountId
      AuthorizedAwsRegion: us-east-1
  AuthorizerCmh:
    Condition: CreateRegionalConfigAggregatorAuthorization
    Type: "AWS::Config::AggregationAuthorization"
    Properties:
      AuthorizedAccountId: !Ref SecurityAccountId
      AuthorizedAwsRegion: us-east-2
  AuthorizerDub:
    Condition: CreateRegionalConfigAggregatorAuthorization
    Type: "AWS::Config::AggregationAuthorization"
    Properties:
      AuthorizedAccountId: !Ref SecurityAccountId
      AuthorizedAwsRegion: eu-west-1
  AuthorizerSyd:
    Condition: CreateRegionalConfigAggregatorAuthorization
    Type: "AWS::Config::AggregationAuthorization"
    Properties:
      AuthorizedAccountId: !Ref SecurityAccountId
      AuthorizedAwsRegion: ap-southeast-2
  HomeRegionAuthorizer:
    Condition: CreateHomeRegionConfigAggregatorAuthorization
    Type: "AWS::Config::AggregationAuthorization"
    Properties:
      AuthorizedAccountId: !Ref SecurityAccountId
      AuthorizedAwsRegion: !Ref HomeRegionName

Outputs:
  BaselineConfigRecorder:
    Description: Baseline Config Recorder
    Value:  !Ref ConfigRecorder
  BaselineConfigDeliveryChannel:
    Description: Baseline Config Delivery Channel
    Value: !Ref ConfigDeliveryChannel

AWSControlTowerBP-BASELINE-ROLES

概要

Auditのアカウントからスイッチロールが可能なよう
readonlyとadminの2種類のroleを作成する

デプロイ対象

下記のcontroltowerが有効化された単一リージョン
core ou
custome ou

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the Cross-Account IAM Security Roles for the member accounts.

Parameters:
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'
  SecurityAccountAdminRoleArn:
    Type: String
    Description: Admin role ARN from the security account.
  SecurityAccountReadOnlyRoleArn:
    Type: String
    Description: Admin role ARN from the security account.
  EnableAdminRole:
    Type: String
    Default: 'true'
    Description: Create an administrative cross-account role from Security Account to this account.
    AllowedValues:
      - 'true'
      - 'false'
  EnableReadOnlyRole:
    Type: String
    Default: 'true'
    Description: Create a read-only cross-account role from Security Account to this account.
    AllowedValues:
      - 'true'
      - 'false'

Conditions:
  CreateAdminRole: !Equals
    - !Ref EnableAdminRole
    - 'true'
  CreateReadOnlyRole: !Equals
    - !Ref EnableReadOnlyRole
    - 'true'

Resources:
  AdminExecutionRole:
    Type: AWS::IAM::Role
    Condition: CreateAdminRole
    Properties:
      RoleName: !Sub ${ManagedResourcePrefix}-AdministratorExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref SecurityAccountAdminRoleArn
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess

  ReadOnlyExecutionRole:
    Type: AWS::IAM::Role
    Condition: CreateReadOnlyRole
    Properties:
      RoleName: !Sub ${ManagedResourcePrefix}-ReadOnlyExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS:
                - !Ref SecurityAccountReadOnlyRoleArn
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess

AWSControlTowerBP-BASELINE-SERVICE-ROLES

概要

AWSControlTowerBP-BASELINE-CLOUDWATCH
の実行に必要なlambdaとconfig用のロールを作成する

デプロイ対象

下記のcontroltowerが有効化された単一リージョン core ou custome ou

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure AWS Config and SNS Notification Forward IAM Roles

Parameters:
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'

  SecurityTopicName:
    Type: String
    Description: Security Notification SNS Topic Name.

  SecurityAccountId:
    Type: 'String'
    Description: AWS Account Id of the Security account.

Resources:

  ConfigRecorderRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ManagedResourcePrefix}-ConfigRecorderRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - config.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSConfigRole
        - arn:aws:iam::aws:policy/ReadOnlyAccess

  ForwardSnsNotificationLambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub ${ManagedResourcePrefix}-ForwardSnsNotificationRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: 'lambda.amazonaws.com'
          Action:
          - 'sts:AssumeRole'
      Path: '/'
      ManagedPolicyArns:
      - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
      Policies:
      - PolicyName: sns
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - 'sns:publish'
            Resource: !Sub arn:aws:sns:*:${SecurityAccountId}:${SecurityTopicName}

Outputs:
  BaselineConfigRole:
    Description: Baseline Config Role
    Value: !GetAtt 'ConfigRecorderRole.Arn'

AWSControlTowerBP-SECURITY-TOPICS

概要

SNSのtopicを2つ作成する
AggregateSecurityNotifications
AllConfigNotifications
各アカウントで何かあったときの受け口となるSNS Topic

対象

下記のcontroltowerがサポートされている全リージョン audit

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the SNS Topics for Security Account

Parameters:
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'
  AllConfigurationEmail:
    Type: 'String'
    Description: Email for receiving all AWS configuration events
  SecurityNotificationEmail:
    Type: 'String'
    Description: Email for the security administrator(s)
  OrgID:
    Type: 'String'
    Description: AWS Organizations ID to allow notifications from member accounts
  SubscribeToAllConfigurationTopic:
    Type: String
    Default: false
    Description: Indicates whether AllConfigurationEmail will be subscribed to the AllConfigurationTopicName topic.
    AllowedValues:
      - true
      - false

Conditions:
  Subscribe: !Equals
    - !Ref SubscribeToAllConfigurationTopic
    - 'true'

Mappings:
  TopicNameSuffix:
    AllConfigurationTopicName:
      Suffix: 'AllConfigNotifications'
    NotifyTopicName:
      Suffix: 'AggregateSecurityNotifications'

Resources:
  SNSAllConfigurationTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Join [ "-", [ !Ref ManagedResourcePrefix, !FindInMap [TopicNameSuffix, AllConfigurationTopicName, Suffix] ]]
      TopicName: !Join [ "-", [ !Ref ManagedResourcePrefix, !FindInMap [TopicNameSuffix, AllConfigurationTopicName, Suffix] ]]

  SNSAllConfigurationTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref SNSAllConfigurationTopic
      PolicyDocument:
        Statement:
          - Sid: AWSSNSPolicy
            Action:
              - sns:Publish
            Effect: Allow
            Resource: !Ref SNSAllConfigurationTopic
            Principal:
              Service:
                - cloudtrail.amazonaws.com
                - config.amazonaws.com

  SNSAllConfigurationEmailNotification:
    Condition: Subscribe
    Type: AWS::SNS::Subscription
    Properties:
      Endpoint: !Ref AllConfigurationEmail
      Protocol: email
      TopicArn: !Ref SNSAllConfigurationTopic

  SNSNotification:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: !Join [ "-", [ !Ref ManagedResourcePrefix, !FindInMap [TopicNameSuffix, NotifyTopicName, Suffix] ]]
      TopicName: !Join [ "-", [ !Ref ManagedResourcePrefix, !FindInMap [TopicNameSuffix, NotifyTopicName, Suffix] ]]
      Subscription:
      - Protocol: email
        Endpoint: !Ref SecurityNotificationEmail

  SNSNotificationPolicy:
    Type: AWS::SNS::TopicPolicy
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F18
            reason: "Conditions restrict permissions to Organization account and publishing only to member accounts."
    Properties:
      Topics:
        - !Ref SNSNotification
      PolicyDocument:
        Statement:
          - Sid: __default_statement_ID
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
            - SNS:GetTopicAttributes
            - SNS:SetTopicAttributes
            - SNS:AddPermission
            - SNS:RemovePermission
            - SNS:DeleteTopic
            - SNS:Subscribe
            - SNS:ListSubscriptionsByTopic
            - SNS:Publish
            - SNS:Receive
            Resource: !Ref SNSNotification
            Condition:
              StringEquals:
                AWS:SourceOwner: !Sub ${AWS::AccountId}
          - Sid: AWSSNSPolicy
            Effect: Allow
            Principal:
              AWS: "*"
            Action: sns:Publish
            Resource: !Ref SNSNotification
            Condition:
              StringEquals:
                aws:PrincipalOrgID: !Ref OrgID

Outputs:
  SecurityTopicARN:
    Description: Security Notification SNS Topic ARN
    Value: !Ref SNSNotification
  SecurityTopicName:
    Description: Security Notification SNS Topic Name
    Value: !GetAtt SNSNotification.TopicName
  AllConfigTopicARN:
    Description: All Configuration Notification SNS Topic ARN
    Value: !Ref SNSAllConfigurationTopic
  AllConfigTopicName:
    Description: All Configuration Notification SNS Topic Name
    Value: !GetAtt SNSAllConfigurationTopic.TopicName

AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-READ-PROHIBITED

概要

config ruleを作成する
ルール：S3_BUCKET_PUBLIC_READ_PROHIBITED

デプロイ対象

下記のcontroltowerがサポートされている全リージョン Log archive
audit

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure AWS Config rules to check that your S3 buckets do not allow public access

Parameters:
  ConfigRuleName:
    Type: 'String'
    Description: 'Name for the Config rule'

Resources:
  CheckForS3PublicRead:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: !Sub ${ConfigRuleName}
      Description: Checks that your S3 buckets do not allow public read access. If an S3 bucket policy or bucket ACL allows public read access, the bucket is noncompliant.
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

AWSControlTowerGuardrailAWS-GR-AUDIT-BUCKET-PUBLIC-WRITE-PROHIBITED

概要

config ruleを作成する
ルール：S3_BUCKET_PUBLIC_WRITE_PROHIBITED

デプロイ対象

下記のcontroltowerがサポートされている全リージョン
Log archive
audit

AWSTemplateFormatVersion: 2010-09-09
Description: Configure AWS Config rules to check that your S3 buckets do not allow public access

Parameters:
  ConfigRuleName:
    Type: 'String'
    Description: 'Name for the Config rule'

Resources:
  CheckForS3PublicWrite:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: !Sub ${ConfigRuleName}
      Description: Checks that your S3 buckets do not allow public write access. If an S3 bucket policy or bucket ACL allows public write access, the bucket is noncompliant.
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket

AWSControlTowerLoggingResources

概要

バケットを2つ作成する
1つはaudit。ここに他アカウントからのconfigやtrail結果が書き込まれる
2つ目は上記のs3へのアクセスログを記録するためのバケット

デプロイ対象

下記のcontroltowerが有効化された単一リージョン
Log archive

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure an Audit S3 bucket for the Log Archive account.

Parameters:
  SSEAlgorithm:
    Type: 'String'
    Default: 'AES256'
    Description: S3 bucket SSE Algorithm.
    AllowedValues:
    - 'AES256'
    - 'aws:kms'
  KMSMasterKeyID:
    Type: 'String'
    Description: 'KMS key ID required if SSE algorithm is aws:kms.'
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'
  RetentionDays:
    Type: String
    Description: 'No of Days to retain the logs, after which it will be permanently deleted'
  TransitionToGlacier:
    Type: String
    Description: 'Do you wish to transition the logs to Glacier before permanently deleting?'
    Default: 'No'
    AllowedValues:
    - 'Yes'
    - 'No'
  TransitionDays:
    Type: String
    Description: 'No of Days to transition the data from S3 to Glacier'
  AWSLogsS3KeyPrefix:
    Type: 'String'
    Description: 'Organization ID to use as the S3 Key prefix for storing the audit logs'

Conditions:
  UseKMS: !Equals
    - !Ref SSEAlgorithm
    - 'aws:kms'
  MoveToGlacier: !Equals
    - !Ref TransitionToGlacier
    - 'Yes'

Resources:
  # Create S3 Server Access Logging bucket
  S3LoggingBucket:
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ManagedResourcePrefix}-s3-access-logs-${AWS::AccountId}-${AWS::Region}
      AccessControl: LogDeliveryWrite
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - !If
          - UseKMS
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
              KMSMasterKeyID: !Ref KMSMasterKeyID
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
  # Create S3 Audit bucket
  S3AuditBucket:
    DeletionPolicy: Retain
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ManagedResourcePrefix}-logs-${AWS::AccountId}-${AWS::Region}
      VersioningConfiguration:
        Status: Enabled
      LoggingConfiguration:
        DestinationBucketName: !Ref S3LoggingBucket
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - !If
          - UseKMS
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
              KMSMasterKeyID: !Ref KMSMasterKeyID
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
      LifecycleConfiguration:
        Rules:
        - !If
          - MoveToGlacier
          - Id: RetentionRule
            Status: Enabled
            ExpirationInDays: !Ref RetentionDays
            NoncurrentVersionExpirationInDays: !Ref RetentionDays
            Transitions:
                - TransitionInDays: !Ref TransitionDays
                  StorageClass: Glacier
            NoncurrentVersionTransitions:
                - TransitionInDays: !Ref TransitionDays
                  StorageClass: Glacier
          - Id: RetentionRule
            Status: Enabled
            ExpirationInDays: !Ref RetentionDays
            NoncurrentVersionExpirationInDays: !Ref RetentionDays
  # Create Bucket Policy for S3 Audit bucket
  S3AuditBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3AuditBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSBucketPermissionsCheck
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
                - config.amazonaws.com
            Action: s3:GetBucketAcl
            Resource:
              - !Sub "arn:aws:s3:::${S3AuditBucket}"
          - Sid: AWSBucketDelivery
            Effect: Allow
            Principal:
              Service:
                - cloudtrail.amazonaws.com
                - config.amazonaws.com
            Action: s3:PutObject
            Resource:
                    - Fn::Join:
                        - ""
                        -
                          - "arn:aws:s3:::"
                          - !Ref "S3AuditBucket"
                          - !Sub "/${AWSLogsS3KeyPrefix}/AWSLogs/*/*"

Outputs:
  BucketName:
    Description: Audit S3 bucket name
    Value: !Ref S3AuditBucket
  LoggingBucketName:
    Description: S3 Access Logging Bucket name
    Value: !Ref S3LoggingBucket
  AuditLogsS3KeyPrefix:
    Description: S3 Key prefix for storing the audit logs
    Value: !Ref AWSLogsS3KeyPrefix

AWSControlTowerSecurityResources

概要

Lambda実行用のロール(adminとreadonlyの2つ)

対象

下記のcontroltowerが有効化された単一リージョン
audit

cloudformation template

AWSTemplateFormatVersion: 2010-09-09
Description: Configure the Cross-Account IAM Audit Roles for Audit Account

Parameters:
  ManagedResourcePrefix:
    Type: 'String'
    Description: 'Prefix for the managed resources'
  AuditAccountId:
    Type: 'String'
    Description: 'Audit account Id'
  LoggingAccountId:
    Type: 'String'
    Description: 'Logging account Id'

Resources:
  AdministrationRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ManagedResourcePrefix}-AuditAdministratorRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
      Policies:
        - PolicyName: !Sub AssumeRole-${ManagedResourcePrefix}-AuditAdministratorRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub "arn:aws:iam::*:role/${ManagedResourcePrefix}-AdministratorExecutionRole"

  ReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${ManagedResourcePrefix}-AuditReadOnlyRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
      Policies:
        - PolicyName: !Sub AssumeRole-${ManagedResourcePrefix}-AuditReadOnlyRole
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - sts:AssumeRole
                Resource:
                  - !Sub "arn:aws:iam::*:role/${ManagedResourcePrefix}-ReadOnlyExecutionRole"

  # AWSConfig Aggregator for Guardrail compliance
  GuardrailsComplianceAggregator:
    Type: AWS::Config::ConfigurationAggregator
    Properties:
      AccountAggregationSources:
        - AccountIds:
          - !Ref AuditAccountId
          - !Ref LoggingAccountId
          AllAwsRegions: true
      ConfigurationAggregatorName: !Sub ${ManagedResourcePrefix}-GuardrailsComplianceAggregator

Outputs:
  CrossAccountAdminRole:
    Description: Audit Administrator Role
    Value: !GetAtt 'AdministrationRole.Arn'
  CrossAccountReadOnlyRole:
    Description: Audit ReadOnly Role
    Value: !GetAtt 'ReadOnlyRole.Arn'

最後に

役に立った人がいれば褒めて欲しい。。。。
Organization管理は、自社の管理しか深く関わらず、
サンプル数が少ないので
他の詳しい人の考え方も聞きたいと思う事がよくあります。
何かあればコメント頂けると嬉しいです。