Skip to content

Commit

Permalink
Release: 1.12.0
Browse files Browse the repository at this point in the history
  • Loading branch information
AWS committed Feb 12, 2024
1 parent 26667e5 commit ac0facd
Show file tree
Hide file tree
Showing 47 changed files with 505 additions and 310 deletions.
4 changes: 4 additions & 0 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
| <a name="input_account_provisioning_customizations_repo_name"></a> [account\_provisioning\_customizations\_repo\_name](#input\_account\_provisioning\_customizations\_repo\_name) | Repository name for the account provisioning customizations files. For non-CodeCommit repos, name should be in the format of Org/Repo | `string` | `"aft-account-provisioning-customizations"` | no |
| <a name="input_account_request_repo_branch"></a> [account\_request\_repo\_branch](#input\_account\_request\_repo\_branch) | Branch to source account request repo from | `string` | `"main"` | no |
| <a name="input_account_request_repo_name"></a> [account\_request\_repo\_name](#input\_account\_request\_repo\_name) | Repository name for the account request files. For non-CodeCommit repos, name should be in the format of Org/Repo | `string` | `"aft-account-request"` | no |
| <a name="input_aft_enable_vpc"></a> [aft\_enable\_vpc](#input\_aft\_enable\_vpc) | Flag turning use of VPC on/off for AFT | `bool` | `true` | no |
| <a name="input_aft_feature_cloudtrail_data_events"></a> [aft\_feature\_cloudtrail\_data\_events](#input\_aft\_feature\_cloudtrail\_data\_events) | Feature flag toggling CloudTrail data events on/off | `bool` | `false` | no |
| <a name="input_aft_feature_delete_default_vpcs_enabled"></a> [aft\_feature\_delete\_default\_vpcs\_enabled](#input\_aft\_feature\_delete\_default\_vpcs\_enabled) | Feature flag toggling deletion of default VPCs on/off | `bool` | `false` | no |
| <a name="input_aft_feature_enterprise_support"></a> [aft\_feature\_enterprise\_support](#input\_aft\_feature\_enterprise\_support) | Feature flag toggling Enterprise Support enrollment on/off | `bool` | `false` | no |
Expand All @@ -120,6 +121,7 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
| <a name="input_aft_vpc_public_subnet_01_cidr"></a> [aft\_vpc\_public\_subnet\_01\_cidr](#input\_aft\_vpc\_public\_subnet\_01\_cidr) | CIDR Block to allocate to the Public Subnet 01 | `string` | `"192.168.2.0/25"` | no |
| <a name="input_aft_vpc_public_subnet_02_cidr"></a> [aft\_vpc\_public\_subnet\_02\_cidr](#input\_aft\_vpc\_public\_subnet\_02\_cidr) | CIDR Block to allocate to the Public Subnet 02 | `string` | `"192.168.2.128/25"` | no |
| <a name="input_audit_account_id"></a> [audit\_account\_id](#input\_audit\_account\_id) | Audit Account Id | `string` | n/a | yes |
| <a name="input_backup_recovery_point_retention"></a> [backup\_recovery\_point\_retention](#input\_backup\_recovery\_point\_retention) | Number of days to keep backup recovery points in AFT DynamoDB tables. Default = Never Expire | `number` | `null` | no |
| <a name="input_cloudwatch_log_group_retention"></a> [cloudwatch\_log\_group\_retention](#input\_cloudwatch\_log\_group\_retention) | Amount of days to keep CloudWatch Log Groups for Lambda functions. 0 = Never Expire | `string` | `"0"` | no |
| <a name="input_concurrent_account_factory_actions"></a> [concurrent\_account\_factory\_actions](#input\_concurrent\_account\_factory\_actions) | Maximum number of accounts that can be provisioned in parallel. | `number` | `5` | no |
| <a name="input_ct_home_region"></a> [ct\_home\_region](#input\_ct\_home\_region) | The region from which this module will be executed. This MUST be the same region as Control Tower is deployed. | `string` | n/a | yes |
Expand All @@ -129,6 +131,7 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
| <a name="input_global_customizations_repo_branch"></a> [global\_customizations\_repo\_branch](#input\_global\_customizations\_repo\_branch) | Branch to source global customizations repo from | `string` | `"main"` | no |
| <a name="input_global_customizations_repo_name"></a> [global\_customizations\_repo\_name](#input\_global\_customizations\_repo\_name) | Repository name for the global customization files. For non-CodeCommit repos, name should be in the format of Org/Repo | `string` | `"aft-global-customizations"` | no |
| <a name="input_log_archive_account_id"></a> [log\_archive\_account\_id](#input\_log\_archive\_account\_id) | Log Archive Account Id | `string` | n/a | yes |
| <a name="input_log_archive_bucket_object_expiration_days"></a> [log\_archive\_bucket\_object\_expiration\_days](#input\_log\_archive\_bucket\_object\_expiration\_days) | Amount of days to keep the objects stored in the AFT logging bucket | `number` | `365` | no |
| <a name="input_maximum_concurrent_customizations"></a> [maximum\_concurrent\_customizations](#input\_maximum\_concurrent\_customizations) | Maximum number of customizations/pipelines to run at once | `number` | `5` | no |
| <a name="input_terraform_api_endpoint"></a> [terraform\_api\_endpoint](#input\_terraform\_api\_endpoint) | API Endpoint for Terraform. Must be in the format of https://xxx.xxx. | `string` | `"https://app.terraform.io/api/v2/"` | no |
| <a name="input_terraform_distribution"></a> [terraform\_distribution](#input\_terraform\_distribution) | Terraform distribution being used for AFT - valid values are oss, tfc, or tfe | `string` | `"oss"` | no |
Expand Down Expand Up @@ -158,6 +161,7 @@ As of version 1.6.0, AFT collects anonymous operational metrics to help AWS impr
| <a name="output_aft_vpc_public_subnet_01_cidr"></a> [aft\_vpc\_public\_subnet\_01\_cidr](#output\_aft\_vpc\_public\_subnet\_01\_cidr) | n/a |
| <a name="output_aft_vpc_public_subnet_02_cidr"></a> [aft\_vpc\_public\_subnet\_02\_cidr](#output\_aft\_vpc\_public\_subnet\_02\_cidr) | n/a |
| <a name="output_audit_account_id"></a> [audit\_account\_id](#output\_audit\_account\_id) | n/a |
| <a name="output_backup_recovery_point_retention"></a> [backup\_recovery\_point\_retention](#output\_backup\_recovery\_point\_retention) | n/a |
| <a name="output_cloudwatch_log_group_retention"></a> [cloudwatch\_log\_group\_retention](#output\_cloudwatch\_log\_group\_retention) | n/a |
| <a name="output_ct_home_region"></a> [ct\_home\_region](#output\_ct\_home\_region) | n/a |
| <a name="output_ct_management_account_id"></a> [ct\_management\_account\_id](#output\_ct\_management\_account\_id) | n/a |
Expand Down
2 changes: 1 addition & 1 deletion VERSION
View file
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.11.1
1.12.0
1 change: 0 additions & 1 deletion locals.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ locals {
account_factory_product_name = "AWS Control Tower Account Factory"
log_archive_bucket_name = "aws-aft-logs"
log_archive_access_logs_bucket_name = "aws-aft-s3-access-logs"
log_archive_bucket_object_expiration_days = "365"
lambda_layer_codebuild_delay = "420s"
lambda_layer_python_version = chomp(trimspace(data.local_file.python_version.content))
lambda_runtime_python_version = format("%s%s", "python", chomp(trimspace(data.local_file.python_version.content)))
Expand Down
10 changes: 9 additions & 1 deletion main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ module "aft_account_provisioning_framework" {
aft_failure_sns_topic_arn = module.aft_account_request_framework.aft_failure_sns_topic_arn
aft_common_layer_arn = module.aft_lambda_layer.layer_version_arn
aft_kms_key_arn = module.aft_account_request_framework.aft_kms_key_arn
aft_enable_vpc = var.aft_enable_vpc
aft_vpc_private_subnets = module.aft_account_request_framework.aft_vpc_private_subnets
aft_vpc_default_sg = module.aft_account_request_framework.aft_vpc_default_sg
cloudwatch_log_group_retention = var.cloudwatch_log_group_retention
Expand All @@ -43,6 +44,7 @@ module "aft_account_request_framework" {
aft_account_provisioning_framework_sfn_name = local.aft_account_provisioning_framework_sfn_name
aft_common_layer_arn = module.aft_lambda_layer.layer_version_arn
cloudwatch_log_group_retention = var.cloudwatch_log_group_retention
aft_enable_vpc = var.aft_enable_vpc
aft_vpc_cidr = var.aft_vpc_cidr
aft_vpc_private_subnet_01_cidr = var.aft_vpc_private_subnet_01_cidr
aft_vpc_private_subnet_02_cidr = var.aft_vpc_private_subnet_02_cidr
Expand All @@ -53,6 +55,7 @@ module "aft_account_request_framework" {
request_framework_archive_path = module.packaging.request_framework_archive_path
request_framework_archive_hash = module.packaging.request_framework_archive_hash
lambda_runtime_python_version = local.lambda_runtime_python_version
backup_recovery_point_retention = var.backup_recovery_point_retention
}


Expand Down Expand Up @@ -95,6 +98,7 @@ module "aft_code_repositories" {
global_customizations_repo_branch = var.global_customizations_repo_branch
log_group_retention = var.cloudwatch_log_group_retention
global_codebuild_timeout = var.global_codebuild_timeout
aft_enable_vpc = var.aft_enable_vpc
}

module "aft_customizations" {
Expand Down Expand Up @@ -130,6 +134,7 @@ module "aft_customizations" {
customizations_archive_hash = module.packaging.customizations_archive_hash
global_codebuild_timeout = var.global_codebuild_timeout
lambda_runtime_python_version = local.lambda_runtime_python_version
aft_enable_vpc = var.aft_enable_vpc
}

module "aft_feature_options" {
Expand All @@ -142,7 +147,7 @@ module "aft_feature_options" {
source = "./modules/aft-feature-options"
log_archive_access_logs_bucket_name = local.log_archive_access_logs_bucket_name
log_archive_bucket_name = local.log_archive_bucket_name
log_archive_bucket_object_expiration_days = local.log_archive_bucket_object_expiration_days
log_archive_bucket_object_expiration_days = var.log_archive_bucket_object_expiration_days
aft_features_sfn_name = local.aft_features_sfn_name
aft_kms_key_arn = module.aft_account_request_framework.aft_kms_key_arn
aft_kms_key_id = module.aft_account_request_framework.aft_kms_key_id
Expand All @@ -159,6 +164,7 @@ module "aft_feature_options" {
enroll_support_lambda_function_name = local.enroll_support_lambda_function_name
enable_cloudtrail_lambda_function_name = local.enable_cloudtrail_lambda_function_name
lambda_runtime_python_version = local.lambda_runtime_python_version
aft_enable_vpc = var.aft_enable_vpc
}

module "aft_iam_roles" {
Expand Down Expand Up @@ -191,6 +197,8 @@ module "aft_lambda_layer" {
s3_bucket_name = module.aft_customizations.aft_codepipeline_customizations_bucket_name
builder_archive_path = module.packaging.builder_archive_path
builder_archive_hash = module.packaging.builder_archive_hash
cloudwatch_log_group_retention = var.cloudwatch_log_group_retention
aft_enable_vpc = var.aft_enable_vpc
}

module "aft_ssm_parameters" {
Expand Down
36 changes: 24 additions & 12 deletions modules/aft-account-provisioning-framework/lambda.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,12 @@ resource "aws_lambda_function" "create_role" {
timeout = 300
layers = [var.aft_common_layer_arn]

vpc_config {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
dynamic "vpc_config" {
for_each = var.aft_enable_vpc ? [1] : []
content {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
}
}
}

Expand All @@ -43,9 +46,12 @@ resource "aws_lambda_function" "tag_account" {
timeout = 300
layers = [var.aft_common_layer_arn]

vpc_config {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
dynamic "vpc_config" {
for_each = var.aft_enable_vpc ? [1] : []
content {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
}
}
}

Expand All @@ -69,9 +75,12 @@ resource "aws_lambda_function" "persist_metadata" {
timeout = 300
layers = [var.aft_common_layer_arn]

vpc_config {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
dynamic "vpc_config" {
for_each = var.aft_enable_vpc ? [1] : []
content {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
}
}
}

Expand All @@ -97,9 +106,12 @@ resource "aws_lambda_function" "account_metadata_ssm" {
timeout = 300
layers = [var.aft_common_layer_arn]

vpc_config {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
dynamic "vpc_config" {
for_each = var.aft_enable_vpc ? [1] : []
content {
subnet_ids = var.aft_vpc_private_subnets
security_group_ids = var.aft_vpc_default_sg
}
}
}

Expand Down
10 changes: 8 additions & 2 deletions modules/aft-account-provisioning-framework/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,11 +38,13 @@ variable "aft_features_sfn_name" {
}

variable "aft_vpc_private_subnets" {
type = list(string)
type = list(string)
default = null
}

variable "aft_vpc_default_sg" {
type = list(string)
type = list(string)
default = null
}

variable "provisioning_framework_archive_path" {
Expand Down Expand Up @@ -84,3 +86,7 @@ variable "enable_cloudtrail_lambda_function_name" {
variable "lambda_runtime_python_version" {
type = string
}

variable "aft_enable_vpc" {
type = bool
}
8 changes: 8 additions & 0 deletions modules/aft-account-request-framework/backup.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,14 @@ resource "aws_backup_plan" "aft_controltower_backup_plan" {
rule_name = "aft_controltower_backup_rule"
target_vault_name = aws_backup_vault.aft_controltower_backup_vault.name
schedule = "cron(0 * * * ? *)"

dynamic "lifecycle" {
for_each = var.backup_recovery_point_retention != null ? [1] : []
content {
delete_after = var.backup_recovery_point_retention
}
}

}
}

Expand Down
Loading

0 comments on commit ac0facd

Please sign in to comment.