| Table of Contents |
|---|
About AWS Organizations
AWS Organizations is a Policy-based management for multiple AWS accounts. AWS Organizations offers policy-based management for multiple AWS accounts. With Organizations, you can create groups of accounts, automate account creation, apply and manage policies for those groups. Organizations enables you to centrally manage policies across multiple accounts, without requiring custom scripts and manual processes.
Using AWS Organizations, you can create Service Control Policies (SCPs) that centrally control AWS service use across multiple AWS accounts. You can also use Organizations to help automate the creation of new accounts through APIs. Organizations helps simplify the billing for multiple accounts by enabling you to setup a single payment method for all the accounts in your organization through consolidated billing. AWS Organizations is available to all AWS customers at no additional charge.
More information can be found here
Benefits Of Using AWS Organizations In CloudAware
...
If you need instructions on how to download template and execute CloudFormation Stack, click here.
Adding multiple AWS accounts with CloudFormation StackSets
...
A stack set can be used to deploy Cloudaware CloudFormation template to multiple AWS accounts at once. Since stack sets perform stack operations across multiple accounts, you should have the necessary permissions defined in your AWS accounts before you create your first stack set.
Self-Managed Permissions
AWS Console
1. Log in to your AWS Console and locate the root account where the stack set is to be created.
2. In the root account, create an IAM role AWSCloudFormationStackSetAdministrationRole using this template: https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/AWSCloudFormationStackSetAdministrationRole.yml
3. In each (!) target account where individual stacks are to be created, create a service role named AWSCloudFormationStackSetExecutionRole that trusts the root account using this template: https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/AWSCloudFormationStackSetExecutionRole.yml
| Note |
|---|
When creating the trust relationship between each target account and a customized administration role, you can control which users and groups can perform stack set operations in which target accounts. You can also define:
|
4. Ensure that the root account has been added to CloudawareCloudAware. Any new AWS account where the stack set is deployed will show up in Cloudaware CloudAware automatically.
Service-Managed Permissions
...
AWS Organizations provides you with the centralized governance over your AWS accounts creation and management.
AWS Console
Before creating a stack set in your AWS Organizations Master Account:
...
3. Enable trusted access with AWS Organizations:
3 3.1. Open AWS Console as administrator of your AWS Organizations Master Account.
| Note |
|---|
The IAM service-linked role created in the organization master account has the suffix CloudFormationStackSetsOrgAdmin. You can modify or delete this role only if trusted access with AWS Organizations is disabled. The IAM service-linked role created in each target account has the suffix CloudFormationStackSetsOrgMember. You can modify or delete this role only if trusted access with AWS Organizations is disabled, or if the account is removed from the target organization or organizational unit (OU). |
3 3.2. Select CloudFormation under Management & Governance.
3 3.3. Select StackSets. Click Enable trusted access.
...
Once it is done, StackSets creates the necessary IAM roles in the AWS Organizations master account and target accounts to which stack instances will be deployed. Otherwise, check lgksptfgkkfmg
STEP 3. Notify CloudAware Support
...