avatarTeri Radichel

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

3394

Abstract

        <div>
          <div>
            <h2>Deploying an AWS Account Using a Deployment Container</h2>
            <div><h3>ACM.413 Migrating my code from my POC to my container that requires MFA to run a deployment job</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*YBPoUjjLUBOoM2G0Fk4Q9A.png)"></div>
          </div>
        </div>
      </a>
    </div><p id="49b0">I already redeployed my OUs according to this naming scheme so I could use the new consistent naming in the last post.</p><div id="772c" class="link-block">
      <a href="https://readmedium.com/naming-conventions-that-minimize-complexity-for-policies-and-roles-446d12cceeb3">
        <div>
          <div>
            <h2>Naming Conventions That Minimize Complexity for Policies and Roles</h2>
            <div><h3>ACM.416 Revisiting the names of AWS Organizational Units, Accounts, and Roles</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*7OL0tSlLgtviLaeTJD02ag.png)"></div>
          </div>
        </div>
      </a>
    </div><p id="e2f1">Recall that I created an IAM account already. The generic deploy script for an account looks like this (leveraging my container and common functions and templates.) I updated it in the last post to deploy an account alias for each new account.</p><figure id="ae86"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*kH_9DKmRrTuUq9kCnRncQQ.png"><figcaption></figcaption></figure><p id="982a">My IAM account script looks like this:</p><figure id="264c"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*UWps5nUV5oruI1UknKoUkg.png"><figcaption></figcaption></figure><p id="4981">Besides the Account, OU, and comments, little changes for each new account script. In fact, I could probably add automating these account scripts to my <i>gen_code</i> function later.</p><div id="129a" class="link-block">
      <a href="https://readmedium.com/generating-cloudformation-deployment-code-with-a-simple-script-e63febf22140">
        <div>
          <div>
            <h2>Generating CloudFormation Deployment Code With a Simple Script</h2>
            <div><h3>ACM.400 Look — no generative AI!</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*kLPaR2_nTyVgVwiIFtlAow.png)"></div>
          </div>
        </div>
      </a>
    </div><p id="5b6e">But anyway I have all my account scripts along with OUs and other things the root-orgadmin user can deploy in the deploy/root-orgadmin folder:</p><figure id="f244"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*bNEp_i3jfRBa6i58PIP7iw.png"><figcaption></figcaption></figure><p id="066f">I updated the file I source in my local test script to call all these functions. I haven’t tested every single one because I’m focusing on the “all accounts” option that deploys all the accounts in parallel.</p><figure id="a8af"><img src="https://cdn-images-1.read

Options

medium.com/v2/resize:fit:800/1*StxE5VFHc04DmuSoMQh8hQ.png"><figcaption></figcaption></figure><p id="3396">Here’s the file that calls all the account scripts:</p><p id="d767">As long as I don’t have typos, it works.</p><p id="f168">My accounts are created in a matter of minutes (with a couple of rounds to fix errors):</p><figure id="f317"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*OtDQc5c6io0UpKbo1EDnXg.png"><figcaption></figcaption></figure><p id="f537">My aliases are created:</p><figure id="f8b2"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*G9Gz44LZoo_WsqUeKtKCWA.png"><figcaption></figcaption></figure><p id="2ed2">I inadvertently deployed my OUs with an output name that had “account” in it and it conflicted with some of my account outputs so they failed to create.</p><p id="2699">I fixed the OU output names and redeployed the accounts but while doing so got this error because apparently you can’t call the function to get the root id simultaneously. There is some overlap in requests for the OU ID multiple times. I can fix that later to reduce calls to AWS Organizations, but I expect to run this code very infrequently. I also ran the script a second time and did not get any errors with no changes on my end.</p><figure id="655b"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*2-ZXjUUvSjQ-G1djGCt6kQ.png"><figcaption></figcaption></figure><p id="6f07">Now I have almost all my OUs and accounts, a way to configure new accounts by using the organizations role when they are created and all my account aliases are assigned so it’s easy to access them.</p><p id="ce87">More to do, as always.</p><p id="4818">Verify that all the accounts got created in the correct OUs.</p><p id="1b24">That’s it!</p><p id="4fc7">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="1e17"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="843d"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

Deploying AWS Accounts In Parallel Using CloudFormation

ACM.419 Deploying an organizational structure in a new AWS account using a container that requires MFA for deployment jobs

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: AWS Organizations | IAM | Deploying a Static Website

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the last post, I added an account alias to any new account I deploy. The account alias is used to log into the account and switch roles using an alias instead of an account number. In the process, I now have the functionality to assume the AWS Organizations role when creating a new account and configure it as needed.

Now that I have that completed I want to create my accounts in parallel because they can all pretty much be created at once with the same template.

I’m going to leverage my parallel processing code and OU and Account deployment code from previous posts to deploy all of that.

I already redeployed my OUs according to this naming scheme so I could use the new consistent naming in the last post.

Recall that I created an IAM account already. The generic deploy script for an account looks like this (leveraging my container and common functions and templates.) I updated it in the last post to deploy an account alias for each new account.

My IAM account script looks like this:

Besides the Account, OU, and comments, little changes for each new account script. In fact, I could probably add automating these account scripts to my gen_code function later.

But anyway I have all my account scripts along with OUs and other things the root-orgadmin user can deploy in the deploy/root-orgadmin folder:

I updated the file I source in my local test script to call all these functions. I haven’t tested every single one because I’m focusing on the “all accounts” option that deploys all the accounts in parallel.

Here’s the file that calls all the account scripts:

As long as I don’t have typos, it works.

My accounts are created in a matter of minutes (with a couple of rounds to fix errors):

My aliases are created:

I inadvertently deployed my OUs with an output name that had “account” in it and it conflicted with some of my account outputs so they failed to create.

I fixed the OU output names and redeployed the accounts but while doing so got this error because apparently you can’t call the function to get the root id simultaneously. There is some overlap in requests for the OU ID multiple times. I can fix that later to reduce calls to AWS Organizations, but I expect to run this code very infrequently. I also ran the script a second time and did not get any errors with no changes on my end.

Now I have almost all my OUs and accounts, a way to configure new accounts by using the organizations role when they are created and all my account aliases are assigned so it’s easy to access them.

More to do, as always.

Verify that all the accounts got created in the correct OUs.

That’s it!

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
AWS
Organizations
Accounts
Cloudformation
Configuration
Recommended from ReadMedium