Creating an AWS Governance Account | by Teri Radichel | Cloud Safety | Jan, 2023

By Admin

January 23, 2023

0

1

ACM.139 Creating OUs and Accounts in an AWS Group

This can be a continuation of my collection on Automating Cybersecurity Metrics.

Within the final publish we created some code for an AWS governance person, group, and function.

The following query that involves thoughts is — The place ought to I deploy these governance IAM assets? I additionally ought to take into consideration the place the ROOT person will exist and run instructions. Moreover, the place do I need to create AWS IAM customers?

Nicely, let’s begin with what I do know.

I do know I don’t need to have customers actively working within the prime degree root group account to which all different accounts are linked. Because of this, I’m going to create a brand new account for the governance crew to handle service management insurance policies for the group.

I additionally need to create a brand new organizational department related to these adjustments I’m testing so I can apply and take a look at my new on that department of my group solely. To try this I’m going to create a brand new Organizational Unit (OU). An OU is a container to which you’ll add AWS accounts. Then you possibly can apply insurance policies to the OU and the insurance policies will apply to all of the accounts under that container.

Create a New OU

I exploit AWS Management Tower at the moment which applies sure controls to accounts in my group. I haven’t but absolutely automated my method so I’m going to go forward and create a brand new Organizational Unit within the console manually.

AWS Management Tower goes to use some controls and add the OU to my group.

Now my new OU exhibits up in my Management Tower hierarchy

In the event you solely use AWS Organizations, you should utilize the AWS CLI so as to add a brand new OU:

You can even use CloudFormation.

Nevertheless, in case you try this and you utilize AWS Management Tower, then you should individually “register” the OU in AWS Management Tower.

I don’t see a method to make use of CloudFormation to simply handle Management Tower. It’s important to use a particular device with manifest recordsdata and extra infrastructure (examine the associated fee) to customise your Management Tower implementation.

That is among the points I’ve with AWS Management Tower. The intent is nice. I’m unsure in regards to the implementation simply but. At any charge, I’m going to go away Management Tower in place because of the advantages for now and take a look at out my adjustments from inside that context, however you don’t want Management Tower. You may create an AWS Group and add an OU with out AWS Management Tower.

Add a brand new Governance account

I’m going so as to add a brand new Governance account in my Administrator OU. As soon as once more you are able to do that inside the Management Tower UI.

Fill within the required info ~ you’ll in all probability need to use an alias for the account e-mail so it’s not tied to a single particular person:

Select the brand new Administration OU:

Anticipate the account to be created and for all of the controls to be utilized.

As with the OU, in case you solely use AWS Organizations, you possibly can create the account programmatically and add it to the OU with the AWS CLI or CloudFormation.

As soon as the account is created you’ll see the AWS Organizations hierarchy.

Subsequent up — Delegate AWS Organizations administration

Subsequent, I need to delegate administration of the group to the brand new governance account. I would really like it if the governance admins might create SCPs for the group within the governance account. I wish to limit any and all actions within the root account so all actions within the cloud account happen from the governance account down.

I’m unsure at this level if that is doable. The documentation isn’t precisely clear, so the best approach to learn how it actually works is to attempt it out in a future publish.

Observe for updates.

Teri Radichel

In the event you favored this story ~ clap, observe, tip, purchase me a espresso, or rent me 🙂

Medium: Teri Radichel
Electronic mail Checklist: Teri Radichel
Twitter: @teriradichel
Twitter (firm): @2ndSightLab
Mastodon: @teriradichel@infosec.alternate
Publish: @teriradichel
Fb: 2nd Sight Lab
Slideshare: Displays by Teri Radichel 
Speakerdeck: Displays by Teri Radichel
Books: Teri Radichel on Amazon
Recognition: SANS Distinction Makers Award, AWS Hero, IANS School
Certifications: SANS
Schooling: BA Enterprise, Grasp of Sofware Engineering, Grasp of Infosec
How I obtained into safety: Girl in tech
Purchase me a espresso: Teri Radichel
Firm (Penetration Checks, Assessments, Coaching): 2nd Sight Lab
Request providers through LinkedIn: Teri Radichel or IANS Analysis