AWS Essentials Configuration

Below overview summarizes what configuration is deployed on the master and linked accounts.

		Master Account	Linked Account	description
Federated access	CloudFormation	X	X*	all resources are deployed using CloudFormation Stacks and StackSets
	IAM SAML Provider	X		for SAML2.0 federated access used by Swo engineers
	IAM OpenID Provider	X	X	For providing service programmatic access. Example: SWO Billing Engine will authenticate and authorize using OpenID
	IAM roles for SAML provider SWOAdminRole SWOReadOnlyRole SWOBillingRole SWOSupportRole	X		Roles are to be assumed by SWO engineers only via the IAM SAML provider Example: AAD → SAML Provider (master account) → SWOAdminRole (master account) Brief description of deployed roles: SWOAdminRole – with AWS-managed AdministratorAccess IAM policy attached This role can be assumed by users who are members of dedicated SWO AD group SWOBillingRole – with AWS-managed Billing and SupportUser IAM policy attached This role can be assumed by users who are members of dedicated SWO AD group SWOReadOnlyRole – with AWS-managed ReadOnlyAccesss IAM policy attached This role can be assumed by users who are members of dedicated SWO AD group SWOSupportRole – with AWS-managed SupportUser IAM policy attached This role can be assumed by users who are members of dedicated SWO AD group
	Cross account IAM roles SWOAdminRole SWOReadOnlyRole SWOBillingRole SWOSupportRole		X*	deployed only where Swo provides support roles to be assumed only from corresponding roles from master (management) account in the same AWS Organization Example: AAD → SAML Provider (master account) → SWOAdminRole (master account) → SWOAdminRole (linked account)* SWOAdminRole – with AWS-managed AdministratorAccess IAM policy attached This role can be assumed from SWOAdminRole in the master (management) account SWOBillingRole – with AWS-managed Billing and SupportUser IAM policy attached This role can be assumed from SWOBillingRole in the master (management) account SWOReadOnlyRole – with AWS-managed ReadOnlyAccesss IAM policy attached This role can be assumed from SWOReadOnlyRole in the master (management) account SWOSupportRole – with AWS-managed SupportUser IAM policy attached This role can be assumed from SWOSupportRole in master (management) account
	IAM roles for OpenID SWOOpenIDCAssumeBillingOnlyRole SWOOpenIDCAssumeCDERole	X	X optional	Roles assumed by services for programmatic access like the billing engine
	IAM user SWOAzureAdAutomationUser credentials of this user are stored in AWS Secrets Manager	X		Service user used by Azure Lighthouse to establish SAML Federation
	AWS Secrets Manager SWOAzureAdFederationSecret	X		Used to securely store credentials used for SAML federation
	Lambda Functions SWOAzureAdMetadataLambda SWOReturnCredentialsToAzureLambda	X		Functions automate the deployment and configuration of federated access between AWS and Swo AAD
	Parameters stored in SSM Parameters store SWOCustomerName SWOCustomerSCU OrganizationUnitSsmParameter LighthouseSAMLFederationVersion LighthouseOpenIDFederationVersion	X		Parameters required as configuration for CloudFormation and/or Lambda Functions
Guardrails	CloudFormation	X	X*	All resources are deployed using CloudFormation Stacks and optionally Stacksets
	Service Control Policies (SCP) SWORestrictAccessToBillingPortalScp SWORestrictAccessToSupportPortalScp this is conditionally deployed for PLES customers SWODenyAccessToModifySWORolesAndPoliciesScp SWODenyAccessToModifySWORolesOrPoliciesScpV2 SWODenyLeaveOrganisationScp	X		Service Control Policies put boundaries on permissions in all Linked Accounts in the AWS Organisation
	IAM Permissions Boundary SWOMasterPermissionsBoundary	X		This Permissions Boundary is used to apply restrictions to all IAM principals (IAM users and IAM roles) with the exclusion of SWO IAM Roles. Its purpose is to protect SWO resources deployed in the master (management) account
	Lambda Functions SWOScpDeployLambdaFunction SWOApplyPermissionsBoundaryLambda SWOBudgetSADLambda* SWOBudgetSADLambdaRunner*	X	X* optional	Functions automate the deployment and configuration of Service Control Policies and Permissions Boundary in the master (management) account. SAD lambda and lambda runner automate the Budget threshold editing.
	CloudTrail SWOManagementEventsTrail	X		CloudTrail used to log all API calls in the master (management) account. It’s presence is required by SOW EventBridge rules. `To record events with a detail-type value of AWS API Call via CloudTrail, a CloudTrail trail with logging enabled is required.` Events from AWS services - Amazon EventBridge
	Cost And Usage Report	X		A CUR report stored in S3 bucket for billing purposes
	AWS Budget SWOSpendAnomalyBudget
	S3 Buckets Cloudtrail S3 Bucket Default lifecycle rule for all objects: 30 days transition to Standard IA 90 days expire Cost and Usage Reports S3 Bucket Default lifecycle rule for all objects: 30 days transition to Standard IA 365 days expire	X		S3 buckets used to store critical logging and billing information
	EventBridge Rules SWOLinkedAccountCreationEventRule SWOSnsModificationEventRule SWOIamRoleModificationEventRule SWOIamPolicyModificationEventRule SWOScpModificationEventRule SWORootAccountActivityEventRule SWOCloudTrailModificationEventRule SWOLambdaModificationEventRule SWOUserOrRoleCreationEventRule* SWOSADLambdaTriggerEventRule**	X	X** optional	Set of detective EventBridge rules to notify about SWO resources modification. The notifications are sent via respective SNS Topics to all configures subscriptions. SWO is notified about: Root login detection SWO IAM Roles modification SWO IAM Policies modification SWO SNS Topics modification SWO Service Control Policies SWO Lambda functions modification SWO CloudTrail modification (including "Stop/Start logging") New Linked account creation *SWOUserOrRoleCreationRule - this rule is used to trigger Permissions Boundary deployment on any newly created user or role
	SNS Topics SWOLinkedAccountCreationSnsTopic SWOEventNotificationsSnsTopic SWOSNSTopicSAD*	X	X* optional	SNS Topics used by EventBridge rules to send notifications about defined events.
	IAM Roles & Policies SWOBudgetSADFnExecutionRole SWOBudgetSADPolicy SWOCrossAccountSQSWriteSADPolicy SWOSNSTopicBudgetPolicy SnsLambdaPermission SWOSADLambdaTriggerEventRulePermission	X	X optional	Permissions for integrating alarms from Budget with event management SQS.
	SSM Parameters SimpleVersionParameter	X