Free AI web copilot to create summaries, insights and extended knowledge, download it at here

2531

Abstract

ou can use with AWS Organizations</h2> <div><h3>undefined</h3></div> <div><p>undefined</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/)"></div> </div> </div> </a> </div><p id="e3ee">I’m showing three here but the list is much longer. The second to last column shows you whether trusted access is allowed so you can use the service with AWS Organizations.</p><figure id="c1f0"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*ScUVy9sWNBW8TmJBU_30oA.png"><figcaption></figcaption></figure><p id="ef40">If you look at the two functions I created to enable account management and Cloud Trail, they are essentially the same with a different service principal.</p><figure id="3ed0"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*CCHlRS9SllJS1IMc71sltQ.png"><figcaption></figcaption></figure><p id="6cff">I can pretty easily write a generic function for that:</p><figure id="3547"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*h-UkPE-b_ajYmOHl1HgKTg.png"><figcaption></figcaption></figure><p id="11b6">I can also create a disable service function:</p><figure id="574b"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*KOcoKF8uBqAX0DstdjMHMQ.png"><figcaption></figcaption></figure><p id="7fb0">Now I can call the function like this:</p><figure id="e06c"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*qqquh3r8OvQLjShYuotwzw.png"><figcaption></figcaption></figure><p id="2e9d">And in fact I can enable and disable all the services I want to use or not use in one place. But I need the service identifier. Unfortunately it does not appear in that table so we’ll have to click each link to get the service principal:</p><figure id="9f99"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*HTyMR71-WHs20FE1BBywSg.png"><figcaption></figcaption></figure><p id="58d3">But that’s pretty easy and then I can have a list of services in one place and enable or disable them.</p><figure id="79f4"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Jr2HS4hEMK5PTb0_Bx-kJg.png"><figcaption></figcaption></figure><p id="0e4e">You’ll notice that artifacts and stacksets are commented out above. That’s because I got an error that said I specified an invalid service when I ran my script. Perhaps the error message meant to say the service is already disable

Options

d but that’s not what it said. It says I’m passing in an invalid service principal and according to the documentation I’m not. Either way seems like a bug. Be aware that if you enable those services, you may not be able to disable them. At least not through the AWS CLI.</p><p id="4ce1">Other than that my script worked like a charm. You can see I added some comments and links at the bottom for services that need to be manually enabled. I also disabled most services, because I don’t want to turn them on and get hit with a whopping bill so I need to review that first. I enable a few things I will definitely use — like AWS GuardDuty and AWS Trusted Advisor has a free tier so why not.</p><figure id="a0f8"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*RgtuMtHGYChRaSsMm54pgw.png"><figcaption></figcaption></figure><p id="0071">Hopefully I’ll get a chance to write about all these later.</p><p id="cadf">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="1e17"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="843d"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

Generic Methods for Enabling and Disabling Services for an AWS Organization

ACM.395 Quickly configure trusted access for services across your organization with some simple code

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: AWS Security | Secure Code | AWS Organizations

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the last post we checked out delegated access for Account Management in AWS Organizations to see what functionality it provides.

Trusted Access and Delegation for Account Management on AWS

ACM.394 Account Management in AWS Organizations

medium.com

While we’re at it I’m going to write a quick (hopefully) post on functions to enable any service available for an AWS Organization.

If you take a look at this documentation page you can see all the services that you can use with AWS Organizations to manage resources across the organization instead of in each individual account.

AWS services that you can use with AWS Organizations

undefined

I’m showing three here but the list is much longer. The second to last column shows you whether trusted access is allowed so you can use the service with AWS Organizations.

If you look at the two functions I created to enable account management and Cloud Trail, they are essentially the same with a different service principal.

I can pretty easily write a generic function for that:

I can also create a disable service function:

Now I can call the function like this:

And in fact I can enable and disable all the services I want to use or not use in one place. But I need the service identifier. Unfortunately it does not appear in that table so we’ll have to click each link to get the service principal:

But that’s pretty easy and then I can have a list of services in one place and enable or disable them.

You’ll notice that artifacts and stacksets are commented out above. That’s because I got an error that said I specified an invalid service when I ran my script. Perhaps the error message meant to say the service is already disabled but that’s not what it said. It says I’m passing in an invalid service principal and according to the documentation I’m not. Either way seems like a bug. Be aware that if you enable those services, you may not be able to disable them. At least not through the AWS CLI.

Other than that my script worked like a charm. You can see I added some comments and links at the bottom for services that need to be manually enabled. I also disabled most services, because I don’t want to turn them on and get hit with a whopping bill so I need to review that first. I enable a few things I will definitely use — like AWS GuardDuty and AWS Trusted Advisor has a free tier so why not.

Hopefully I’ll get a chance to write about all these later.

Follow for updates.

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab