Skip to content

Commit 802c461

Browse files
author
ievgeniia ieromenko
committed
adding CfCT templates
1 parent cea07f9 commit 802c461

File tree

3 files changed

+231
-2
lines changed

3 files changed

+231
-2
lines changed

‎aws_sra_examples/solutions/security_lake/security_lake_org/README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,15 +156,15 @@ Choose a Deployment Method:
156156
In the `management account (home region)`, launch the [sra-security-lake-org-main-ssm.yaml](templates/sra-security-lake-org-main-ssm.yaml) template. This uses an approach where some of the CloudFormation parameters are populated from SSM parameters created by the [SRA Prerequisites Solution](../../common/common_prerequisites/).
157157

158158
```bash
159-
aws cloudformation deploy --template-file $PWD/aws_sra_examples/solutions/security-lake/security-lake-org/templates/sra-security-lake-org-main-ssm.yaml --stack-name sra-security-lake-org-main-ssm --capabilities CAPABILITY_NAMED_IAM --parameter-overrides pSecurityLakeWarning=<ACCEPT_OR_REJECT>
159+
aws cloudformation deploy --template-file $PWD/aws_sra_examples/solutions/security_lake/security_lake_org/templates/sra-security-lake-org-main-ssm.yaml --stack-name sra-security-lake-org-main-ssm --capabilities CAPABILITY_NAMED_IAM --parameter-overrides pSecurityLakeWarning=<ACCEPT_OR_REJECT>
160160
```
161161

162162
##### Important<!-- omit in toc -->
163163

164164
Pay close attention to the `--parameter-overrides` argument. For launching of the AWS Cloudformation stack using the command above to be successful, the `pSecurityLakeWarning` parameter in the `--parameter-overrides` argument must be set to `Accept`. If it is set to `Reject` the stack launch will fail and provide an error.
165165
- To create an Audit account subscriber with data access, add `pRegisterAuditAccountDataSubscriber` parameter in the `--parameter-overrides` with argument set to `true`. Provide value for `pAuditAccountDataSubscriberExternalId` parameter.
166166
- To create an Audit account subscriber with query access, add `pRegisterAuditAccountQuerySubscriber` parameter in the `--parameter-overrides` with argument set to `true`. Provide value for `pAuditAccountQuerySubscriberExternalId` parameter.
167-
- To creates a resource link to shared tables in an Audit account, , add `pCreateResourceLink` parameter in the `--parameter-overrides` with argument set to `true`
167+
- To creates a resource link to shared tables in an Audit account, add `pCreateResourceLink` parameter in the `--parameter-overrides` with argument set to `true`
168168

169169
#### Verify Solution Deployment<!-- omit in toc -->
170170

‎aws_sra_examples/solutions/security_lake/security_lake_org/customizations_for_aws_control_tower/manifest.yaml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
#Default region for deploying Custom Control Tower: Code Pipeline, Step functions, Lambda, SSM parameters, and StackSets
3+
region: us-east-1
4+
version: 2021-03-15
5+
6+
# Control Tower Custom Resources (Service Control Policies or CloudFormation)
7+
resources:
8+
# -----------------------------------------------------------------------------
9+
# Organization shield
10+
# -----------------------------------------------------------------------------
11+
- name: sra-security-lake-main-ssm
12+
resource_file: templates/sra-security-lake-main-ssm.yaml
13+
parameters:
14+
- parameter_key: pSecurityLakeOrgLambdaRoleName
15+
parameter_value: sra-security-lake-org-lambda
16+
- parameter_key: pCreateResourceLink
17+
parameter_value: 'false'
18+
- parameter_key: pCreateLakeFormationSlr
19+
parameter_value: 'true'
20+
- parameter_key: pSRASecurityLakeMetaStoreManagerRoleName
21+
parameter_value: AmazonSecurityLakeMetaStoreManagerV2
22+
- parameter_key: pSourceVersion
23+
parameter_value: '2.0'
24+
- parameter_key: pCloudTrailManagementEvents
25+
parameter_value: ALL
26+
- parameter_key: pCloudTrailLambdaDataEvents
27+
parameter_value: ALL
28+
- parameter_key: pCloudTrailS3DataEvents
29+
parameter_value: ''
30+
- parameter_key: pSecurityHubFindings
31+
parameter_value: ALL
32+
- parameter_key: pVpcFlowLogs
33+
parameter_value: ALL
34+
- parameter_key: pWafLogs
35+
parameter_value: ''
36+
- parameter_key: pRoute53Logs
37+
parameter_value: ALL
38+
- parameter_key: pVpcFlowLogs
39+
parameter_value: ALL
40+
- parameter_key: pOrgConfigurationSources
41+
parameter_value: ROUTE53,VPC_FLOW,SH_FINDINGS,CLOUD_TRAIL_MGMT,LAMBDA_EXECUTION,EKS_AUDIT
42+
- parameter_key: pCreateOrganizationConfiguration
43+
parameter_value: 'true'
44+
- parameter_key: pSecurityLakeOrgKeyAlias
45+
parameter_value: sra-security-lake-org-key
46+
- parameter_key: pComplianceFrequency
47+
parameter_value: 7
48+
- parameter_key: pControlTowerRegionsOnly
49+
parameter_value: 'true'
50+
- parameter_key: pCreateLambdaLogGroup
51+
parameter_value: 'false'
52+
- parameter_key: pEnabledRegions
53+
parameter_value: ''
54+
- parameter_key: pLambdaLogGroupKmsKey
55+
parameter_value: ''
56+
- parameter_key: pLambdaLogGroupRetention
57+
parameter_value: 14
58+
- parameter_key: pLambdaLogLevel
59+
parameter_value: INFO
60+
- parameter_key: pSRAAlarmEmail
61+
parameter_value: ''
62+
- parameter_key: pSRASolutionVersion
63+
parameter_value: v1.0
64+
- parameter_key: pRegisterAuditAccountDataSubscriber
65+
parameter_value: 'false'
66+
- parameter_key: pAuditAccountDataSubscriberPrefix
67+
parameter_value: sra-audit-account-data-subscriber
68+
- parameter_key: pAuditAccountDataSubscriberExternalId
69+
parameter_value: ''
70+
- parameter_key: pAuditAccountQuerySubscriberPrefix
71+
parameter_value: sra-audit-account-query-subscriber
72+
- parameter_key: pAuditAccountQuerySubscriberExternalId
73+
parameter_value: ''
74+
- parameter_key: pRegisterAuditAccountQuerySubscriber
75+
parameter_value: 'false'
76+
- parameter_key: pStackSetAdminRole
77+
parameter_value: sra-stackset
78+
- parameter_key: pStackExecutionRole
79+
parameter_value: sra-execution
80+
- parameter_key: pSecurityLakeWarning
81+
parameter_value: Reject
82+
- parameter_key: pDisableSecurityLake
83+
parameter_value: 'false'
84+
deploy_method: stack_set
85+
deployment_targets:
86+
accounts:
87+
- REPLACE_ME_ORG_MANAGEMENT_ACCOUNT_NAME

‎aws_sra_examples/solutions/security_lake/security_lake_org/customizations_for_aws_control_tower/parameters/sra-security-lake-main-ssm.json

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
[
2+
{
3+
"ParameterKey": "pSecurityLakeOrgLambdaRoleName",
4+
"ParameterValue": "sra-security-lake-org-lambda"
5+
},
6+
{
7+
"ParameterKey": "pCreateResourceLink",
8+
"ParameterValue": "false"
9+
},
10+
{
11+
"ParameterKey": "pCreateLakeFormationSlr",
12+
"ParameterValue": "true"
13+
},
14+
{
15+
"ParameterKey": "pSRASecurityLakeMetaStoreManagerRoleName",
16+
"ParameterValue": "AmazonSecurityLakeMetaStoreManagerV2"
17+
},
18+
{
19+
"ParameterKey": "pSourceVersion",
20+
"ParameterValue": "2.0"
21+
},
22+
{
23+
"ParameterKey": "pCloudTrailManagementEvents",
24+
"ParameterValue": "ALL"
25+
},
26+
{
27+
"ParameterKey": "pCloudTrailLambdaDataEvents",
28+
"ParameterValue": "ALL"
29+
},
30+
{
31+
"ParameterKey": "pCloudTrailS3DataEvents",
32+
"ParameterValue": ""
33+
},
34+
{
35+
"ParameterKey": "pSecurityHubFindings",
36+
"ParameterValue": "ALL"
37+
},
38+
{
39+
"ParameterKey": "pVpcFlowLogs",
40+
"ParameterValue": "ALL"
41+
},
42+
{
43+
"ParameterKey": "pWafLogs",
44+
"ParameterValue": ""
45+
},
46+
{
47+
"ParameterKey": "pRoute53Logs",
48+
"ParameterValue": "ALL"
49+
},
50+
{
51+
"ParameterKey": "pVpcFlowLogs",
52+
"ParameterValue": "ALL"
53+
},
54+
{
55+
"ParameterKey": "pOrgConfigurationSources",
56+
"ParameterValue": "ROUTE53,VPC_FLOW,SH_FINDINGS,CLOUD_TRAIL_MGMT,LAMBDA_EXECUTION,EKS_AUDIT"
57+
},
58+
{
59+
"ParameterKey": "pCreateOrganizationConfiguration",
60+
"ParameterValue": "true"
61+
},
62+
{
63+
"ParameterKey": "pSecurityLakeOrgKeyAlias",
64+
"ParameterValue": "sra-security-lake-org-key"
65+
},
66+
{
67+
"ParameterKey": "pComplianceFrequency",
68+
"ParameterValue": "7"
69+
},
70+
{
71+
"ParameterKey": "pControlTowerRegionsOnly",
72+
"ParameterValue": "true"
73+
},
74+
{
75+
"ParameterKey": "pCreateLambdaLogGroup",
76+
"ParameterValue": "false"
77+
},
78+
{
79+
"ParameterKey": "pEnabledRegions",
80+
"ParameterValue": ""
81+
},
82+
{
83+
"ParameterKey": "pLambdaLogGroupKmsKey",
84+
"ParameterValue": ""
85+
},
86+
{
87+
"ParameterKey": "pLambdaLogGroupRetention",
88+
"ParameterValue": "14"
89+
},
90+
{
91+
"ParameterKey": "pLambdaLogLevel",
92+
"ParameterValue": "INFO"
93+
},
94+
{
95+
"ParameterKey": "pSRAAlarmEmail",
96+
"ParameterValue": ""
97+
},
98+
{
99+
"ParameterKey": "pSRASolutionVersion",
100+
"ParameterValue": "v1.0"
101+
},
102+
{
103+
"ParameterKey": "pRegisterAuditAccountDataSubscriber",
104+
"ParameterValue": "false"
105+
},
106+
{
107+
"ParameterKey": "pAuditAccountDataSubscriberPrefix",
108+
"ParameterValue": "sra-audit-account-data-subscriber"
109+
},
110+
{
111+
"ParameterKey": "pAuditAccountDataSubscriberExternalId",
112+
"ParameterValue": ""
113+
},
114+
{
115+
"ParameterKey": "pAuditAccountQuerySubscriberPrefix",
116+
"ParameterValue": "sra-audit-account-query-subscriber"
117+
},
118+
{
119+
"ParameterKey": "pAuditAccountQuerySubscriberExternalId",
120+
"ParameterValue": ""
121+
},
122+
{
123+
"ParameterKey": "pRegisterAuditAccountQuerySubscriber",
124+
"ParameterValue": "false"
125+
},
126+
{
127+
"ParameterKey": "pStackSetAdminRole",
128+
"ParameterValue": "sra-stackset"
129+
},
130+
{
131+
"ParameterKey": "pStackExecutionRole",
132+
"ParameterValue": "sra-execution"
133+
},
134+
{
135+
"ParameterKey": "pSecurityLakeWarning",
136+
"ParameterValue": "Reject"
137+
},
138+
{
139+
"ParameterKey": "pDisableSecurityLake",
140+
"ParameterValue": "false"
141+
}
142+
]

0 commit comments

Comments
 (0)