Automated Deployment of a Resource Policy for an AWS Organizations

ACM.397 Deploying an Organization Resource Policy with CloudFormation to define Delegated Administrators that operate outside the Management Account

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Part of my series on Automating Cybersecurity Metrics. The Code.

🔒 Related Stories: AWS Organizations | AWS Security

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the last post I created some functions for assigning accounts as Delegated Administrators for AWS services that integrate with Organizations.

In this post I want to assign the root-orgadmin account I created as an administrator for AWS Organizations. However, AWS Organizations does not work the same way as the services that work with it.

Note:

I have an update version that deploys this resource using my container that requires MFA for deployments here:

Here’s the original proof of concept version:

For AWS Organizations itself we can apply a resource policy that specifies which accounts can take what actions related to AWS Organizations to your AWS Organization.

Let’s see if we can automate that in our new code base.

The documentation says we can use the AWS Organizations put-resource-policy command, but it’s linking to the old version of the documentation. Here’s the latest:

The statement looks like a typical policy: Effect, Principal, Action, Resource, and optional Condition.

So what do we want in our statement?

Principal: root-orgadmin account

Action: Any AWS Organizations actions

Resources: Any except the management account or the root-orgadmin

We’ll segregate duties in other accounts below this one. We may want to consider additional restrictions as well, but the whole point of this account is to perform any Organizations actions. It will set up the AWS Organization and then we will lock the account down and only use it in case of emergency.

So for now, let’s try to give the orgadmin AWS account full access to AWS Organizations.

First we need to create the policy. Recall that I created my directory structure for resources by parsing the AWS documentation.

I only added one variation so far and that was for my empty stack to import my AWS Organization. I’ve since moved that to emptystack/emptystack.yaml.

When I list the directories under resources/organizations/ I see the following directories:

We want to create a Resource Policy type:

Here are the properties:

The content is the policy with an interesting warning on drift detection:

What does that mean exactly? I don’t know. Are they talking about ToJsonString function in AWS Language Extensions? I looked at the CloudFormation language extensions and they had other security implications I don’t like and don’t recall at the moment so I don’t use them.

If you scroll down, AWS has examples of an object vs a string. Here are couple examples — there are more for both JSON and YAML:

JSON object:

JSON String

Now, what I’m wondering is if this same statement is true for all policies created in CloudFormation, or just this one. I’ll save that for another day but someone might want to test that and if true, add that comment to all CloudFormation policy template. I don’t recall seeing that before but maybe I missed it.

Here’s my code:

resources/organizations/resourcepolicy/resourcepolicy.yaml

Now there’s a problem with the above. When I tried to run that I got an unsupported action error. That’s because we can only specify the supported AWS Organizations actions:

So what’s the problem with this scenario? What if you need to create an account? You still have to do that in the management account and actions taken in the management account are not governed by SCPs. More on that later.

That fact is making my plans complicated at the moment.

resources/organizations/resourcepolicy/resourcepolicy_functions.sh

deploy/rootadminrole/organization_resource_policy.sh

I deploy that stack successfully.

Now we can check to see if the policy exists for our AWS Organization in the AWS Organizations dashboard console. And it does.

Recall that I did this in my container that requires MFA to execute deployment jobs:

Great! On to the next step.

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab