AWS Essentials Configuration
Below overview summarizes what configuration is deployed on the master and linked accounts.
| Master Account | Linked Account | description | |
---|---|---|---|---|
Federated access | CloudFormation | X | X* | all resources are deployed using CloudFormation Stacks and StackSets |
IAM SAML Provider | X |
| for SAML2.0 federated access used by Swo engineers | |
IAM OpenID Provider | X | X | For providing service programmatic access. Example: SWO Billing Engine will authenticate and authorize using OpenID | |
IAM roles for SAML provider
| X |
| Roles are to be assumed by SWO engineers only via the IAM SAML provider Example: AAD → SAML Provider (master account) → SWOAdminRole (master account) Brief description of deployed roles:
| |
Cross account IAM roles
|
| X* | *deployed only where Swo provides support roles to be assumed only from corresponding roles from master (management) account in the same AWS Organization Example: AAD → SAML Provider (master account) → SWOAdminRole (master account) → SWOAdminRole (linked account)
| |
IAM roles for OpenID
| X | X optional | Roles assumed by services for programmatic access like the billing engine | |
IAM user
| X |
| Service user used by Azure Lighthouse to establish SAML Federation | |
AWS Secrets Manager
| X |
| Used to securely store credentials used for SAML federation | |
Lambda Functions
| X |
| Functions automate the deployment and configuration of federated access between AWS and Swo AAD | |
Parameters stored in SSM Parameters store
| X |
| Parameters required as configuration for CloudFormation and/or Lambda Functions | |
Guardrails | CloudFormation | X | X* | All resources are deployed using CloudFormation Stacks and optionally Stacksets |
Service Control Policies (SCP)
| X |
| Service Control Policies put boundaries on permissions in all Linked Accounts in the AWS Organisation | |
IAM Permissions Boundary
| X |
| This Permissions Boundary is used to apply restrictions to all IAM principals (IAM users and IAM roles) with the exclusion of SWO IAM Roles. Its purpose is to protect SWO resources deployed in the master (management) account | |
Lambda Functions
| X | X* optional | Functions automate the deployment and configuration of Service Control Policies and Permissions Boundary in the master (management) account. SAD lambda and lambda runner automate the Budget threshold editing. | |
CloudTrail
| X |
| CloudTrail used to log all API calls in the master (management) account. It’s presence is required by SOW EventBridge rules.
| |
Cost And Usage Report | X |
| A CUR report stored in S3 bucket for billing purposes | |
AWS Budget
|
|
|
| |
S3 Buckets
| X |
| S3 buckets used to store critical logging and billing information | |
EventBridge Rules
| X | X** optional | Set of detective EventBridge rules to notify about SWO resources modification. The notifications are sent via respective SNS Topics to all configures subscriptions. SWO is notified about:
*SWOUserOrRoleCreationRule - this rule is used to trigger Permissions Boundary deployment on any newly created user or role | |
SNS Topics
| X | X* optional | SNS Topics used by EventBridge rules to send notifications about defined events. | |
| IAM Roles & Policies
| X | X optional | Permissions for integrating alarms from Budget with event management SQS. |
| SSM Parameters
| X |
|
|