This repository contains various versions of the account vending machine used to provision AWS accounts with custom configurations.
For AWS GovCloud(US) account vending, click here.
As an organization expands its use of AWS services, there is often a conversation about the need to create multiple AWS accounts to ensure separation of business processes or for security, compliance, and billing. Many of the customers we work with use separate AWS accounts for each business unit so they can meet the different needs of their organization. Although creating multiple accounts has simplified operational issues and provided benefits like security and resource isolation, a smaller blast radius, and simplified billing, it takes a lot of time to create, bootstrap and configure baseline settings. Customers want to manage account creation and bootstrapping in a scalable and efficient manner so that new accounts are created with a defined baseline and some governance guardrails are in place. Most importantly, customers want automation, to save time and resources.
The account builder is an AWS Service Catalog product that uses AWS Lambda and AWS Organizations APIs to create AWS accounts. On each invocation, the AWS Lambda function used in this sample solution does the following:
- Creates a new AWS account.
- If provided, creates an organization unit under the root account in AWS Organizations.
- Moves the newly created account from the organization root to the newly created organizational unit.
- Assumes the role OrganizationAccountAccessRole in the new account for the following:
- Creating an IAM user with the provided password.
- Adding the IAM user to a new group with least privilege permissions to access AWS Service Catalog.
- Deploying baseline templates for creating AWS Service Catalog portfolio and products.
- Deleting the default VPCs in all AWS Regions.
- Creating AWS Service Catalog products and portfolio inside the newly created account.
- Adding the provided IAM user and IAM role as principals to the created AWS Service Catalog portfolio.
This approach of bootstrapping accounts will reduce operational overhead and standardize account configurations across the provisioned AWS accounts. The following architecture outlines the process flow involved with account building :
As a part of creating a sample account vending machine from this repository, you will first launch a CloudFormation template to create the account vending machine set up in your account.
- Login to your AWS account which is a master account in AWS Organizations. Select one the following 4 regions from the top right corner on the AWS Management Console:
- Ohio (us-east-2)
- Oregon (us-west-2)
- Ireland (eu-west-1)
- Singapore (ap-southeast-1) Note: You can customize this implementation to work with linked accounts as well, but for the purposes of this exercise, we will use the master account.
- The scripts and templates needed for this exercise should be available in an S3 bucket one of the above choosen AWS regions.
- Create a new S3 bucket (or you can reuse any existing bucket as well)
- Upload all the scripts and templates available in the resources folder of this repo
- Make sure to update all these files:
- resources/AccountCreationLambdaSetup-cfn.yaml
- resources/accountbuilder.yml
- resources/Accountbaseline.yml
- resources/AccountCreationLambda.zip
- Navigate to the CloudFormation console and launch a new template pointing it to the resources/AccountCreationLambdaSetup-cfn.yaml template and click
Next
- On the
Specify stack details
page, enter the following parameters:AccountAdministrator
- Enter the ARN of the IAM entity (role or user or group) that will be performing account creation from AWS Service Catalog. You can go to the IAM console to find the ARN of the role/user/group. (eg. arn:aws:iam::010010011111:role/Administrator)SourceBucket
- Keep the default value for the S3 bucket. Note: To use your own S3 bucket, you can upload all the files in the /resources folder in Github to your own S3 bucket.SourceTemplate
- Keep to resources/Accountbaseline.yml. Note: To launch your own CloudFormation template in the new account, make sure the template parameters have a default value, and replace theAccountbaseline.yml
template we've provided for this demo. You will also have to edit the lambda function to reflect the parameters in your custom template.
- On the
Configure stack options
page, clickNext
. - On the
Review
page, check the checkbox forI acknowledge that AWS CloudFormation might create IAM resources.
, and clickCreate Stack
. - Once status of the stack changes to
CREATE COMPLETE
, click on the stack and open theOutputs
tab to see the output values. - In the the
Outputs
section of CloudFormation, copy the key and value column contents forAccountLambda
. You will be using this value during the execution of the account vending machine.
At this point, you have successfully set up the account vending machine in your account.
In this section, you will launch the account vending machine product created in AWS Service Catalog to create a new AWS account pre-configured with custom settings defined in this lab.
-
Login to your AWS account using the IAM role/user/group that you provided in the
AccountAdministrator
in the set up phase. -
On the Services menu, search and then choose
Service Catalog
. You will see an AWS Service Catalog product namedAccount Vending Machine
. -
In the
Products list
page, clickAccount Vending Machine
, and then clickLAUNCH PRODUCT
. -
On the
Product Version
page, configure: a.Name
: my-new-account-001 b. Select the available version. -
Click
NEXT
-
On the
Parameters
page, configure:MasterLambdaArn
: choose the value of 'AccountLambda' from the CloudFormation outputs noted in Lab SetupAccountEmail
: Enter a unique email address to be associated with the newly created accountOrganizationalUnitName
: Name of the organizational unit (OU) to which the account should be moved to. Keep the default value for placing the account at the root level.AccountName
: Enter an account nameStackRegion
: Choose the region where the preconfigured settings should be appliedSourceBucket
: Enter the name of the source bucket where your baseline CloudFormation template is available.BaselineTemplate
: Keep the default value to Accountbaseline.yml OR Enter the name of the account baseline CloudFormation template you wish to apply as a baseline.
-
Click
NEXT
. -
On the
TagOptions
page, clickNEXT
. -
On the Notifications page, click
NEXT
. -
On the Review page, review the configuration information, and click
LAUNCH
. This will create a CloudFormation stack. The initial status of the product is shown asUnder change
. Wait for few minutes, then refresh the screen till the status changes toAVAILABLE
. Note: You can go to the CloudFormation page to monitor the stack progress, or go to CloudWatch to view the step by step execution of the account vending lambda function. -
In the the
Outputs
section of AWS Service Catalog, you will see the account details of the newly created account as follows.
In this section, we will log in to the newly vended account using the user created as a part of the set up and explore the account configuration.
-
Login to your AWS account using the
LoginURL
provided in the Outputs of the previous section. Make sure you are in the same region as theStackRegion
in the previous section. -
On the credentials page, enter the following information:
- Username:
service-catalog-user
- Password:
service-catalog-2019
Note: You will be prompted to change your password at first log in.
- Username:
-
On the Services menu, search and then choose
Service Catalog
. On the products list page, you will be to see the pre-configured AWS Service Catalog products allowed for the current user to provision. -
As a part of the account setup, all the default VPCs from every region have been deleted for this account. You can validate this by going to the Services menu, search and then choose 'VPC'.
-
As a security best practice of least privilege, we have restricted the current user to launch AWS Service Catalog products only. You can validate this by trying to create a new VPC from the Amazon VPC console.
-
Now, we will try to perform the same function using AWS Service Catalog. But first, the user will need a key pair.
- Go to the Amazon EC2 console
- In the left navigation menu, select
Key Pairs
underNetwork & Security
- Click on the
Create a key pair
button, add name asdemo
, and clickCreate
. - Now, on the Services menu, search and then choose
Service Catalog
. On the products list page, selectAmazon VPC
, and click onLaunch Product
. - On the
Product Version
page, configure: a.Name
:my-custom-vpc-001
b. Select the available version.
-
Click
NEXT
-
On the
Parameters
page, configure:RegionAZ1Name
: Choose the availability zone for a region. eg. us-west-2aRegionAZ2Name
: Choose another availability zone for the same region as above. eg. us-west-2bVPCCIDR
: Keep the default value OR change it to a CIDR you want.SubnetAPublicCIDR
: Keep the default value OR change it to a CIDR you wantSubnetAPublicCIDR
: Keep the default value OR change it to a CIDR you wantSubnetAPrivateCIDR
: Keep the default value OR change it to a CIDR you wantSubnetBPrivateCIDR
: Keep the default value OR change it to a CIDR you wantCreateBastionInstance
: Keep the default value OR change it totrue
if you want a bastion instance created.BastionInstanceType
: Keep the default value OR change it to an instance type you wantEC2KeyPair
: Choose the key pair you created in Step 6BastionSSHCIDR
: Enter any value you want eg. 0.0.0.0/0LatestAmiId
: Keep the default value OR change it to an AMI ID you want
-
Click
NEXT
. -
On the
TagOptions
page, clickNEXT
. -
On the Notifications page, click
NEXT
. -
On the Review page, review the configuration information, and click
LAUNCH
. This will create a CloudFormation stack. The initial status of the product is shown asUnder change
. Wait for about 5 minutes, then refresh the screen till the status changes toAVAILABLE
. -
Validate the Outputs section on AWS Service Catalog screen to see the details of the VPC created.
-
Finally, on the Amazon VPC console, you can verify that a VPC is now created.
In conclusion, you were able to log in as an end user in the newly vended AWS account, and create AWS resources in a compliant manner using AWS Service Catalog.
This repository provides a method to enable on-demand creation of AWS accounts that can be customized to the requirements of an organization. Administrators and/or teams who are required to provision new accounts can use this approach to standardize the networking configuration and the resources that be provisioned when the new account is ready for use.
This repository was inspired by the AWS blog post on automation of AWS account creation.
Congratulations! 🎉 You have completed all the steps for setting up your own custom account vending machine using AWS Service Catalog.
To make sure you are not charged for any unwanted services, you can clean up by deleting the stack created in the Deployment steps stage and its resources. To delete any AWS Service Catalog products,
- Go to the AWS Service Catalog screen and make sure you are in the same region as you selected during the launch phase
- Go to the
Provisioned Products
screen, and terminate any products that you may have created as a part of the lab
To delete the stack and its resources
- From the AWS CloudFormation console in the region you used in the Lab Setup, select the stack that you created.
- Click
Delete Stack
. - In the confirmation message that appears, click
Yes
,Delete
.
At this stage, the status for your changes to DELETE_IN_PROGRESS
. In the same way you monitored the
creation of the stack, you can monitor its deletion by using the Events
tab. When AWS CloudFormation completes the deletion of the stack, it removes the stack from the list.
(Back to top)
Your contributions are always welcome! Please have a look at the contribution guidelines first. 🎉
This sample code is made available under the MIT-0 license. See the LICENSE file.