...
...
...
...
| Info |
|---|
This article explains how to add AWS Organizations to Cloudaware. AWS Organization is policy-based management for multiple AWS accounts. |
| Table of Contents |
|---|
About AWS Organizations
AWS Organizations offers policy-based management for multiple AWS accounts. With Organizations, you can create groups of AWS accounts, automate account creation, apply and manage policies for those groups. Organizations enables enable you to centrally manage policies across multiple accounts, without requiring custom scripts and manual processes.
Using AWS Organizations, you can create Service Control Policies (SCPs) that centrally control AWS service use across multiple AWS accounts. You can also use Organizations to help automate the creation of new accounts through APIs. AWS Organizations helps simplify the billing for multiple accounts by enabling you to setup set up a single payment method for all the accounts in your organization through consolidated billing. AWS Organizations is available to all AWS customers at no additional charge.
More information can be found here
Anchor
...
.
...
Benefits Of Using AWS Organizations
...
In Cloudaware
No need to manually add every AWS account
Automate
...
the onboarding of your AWS Accounts
...
into Cloudaware
Ability to see which AWS
...
Organizational Accounts exist but are not
...
in Cloudaware CMDB as AWS Accounts.
...
- Cloudaware AWS Organization Master account has been added to Cloudaware CMDB.
- Cloudaware has following IAM permission on AWS Organization Master Account
...
...
Adding AWS Organization To Cloudaware
1. Log in to Cloudaware account → Admin → Amazon Organizations & Accounts. Click +Add.
2. Address Cloudaware AWS Start Guide to add AWS Organizations Master Account using IAM Role integration type.
3. Ensure that Cloudaware CloudFormation template you will apply has the following permissions in place:
| Code Block |
|---|
"organizations:Des*"
"organizations:Li*" |
4. Click Check → Save. Go back to Admin → Organizations & Amazon Accounts → N configured → the tab ‘Accounts' to ensure AWS Organization Master Account has a green status indicator
...
- Log in to Cloudaware CMDB and navigate to AWS Organizations.
- You should see at least one AWS Organization and N number of AWS Organizational Accounts.
...
- If you do not see any AWS Organizations, there are two possible reasons:
- Insufficient permissions on AWS Organization Master Account.
- AWS Organization Master Account has not been added to Cloudaware.
...
- Download Cloudaware Cloudformation Template with IAM policy from the Cloudaware Admin Panel or use your custom template with policy.
- Deploy Cloudformation template on every AWS Organizations Sub-Account.
...
- Provide External ID or indicate whether it was left blank.
- Once the request has been resolved, all AWS Organization Sub-Accounts will show up in the admin panel.
...
.
5. Select the tab 'Organizations' → click +Add Amazon Organization. Fill out the form selecting your Organization Master Account in Trusted Account and providing other account-related data. Click Check → Save.
6. In Cloudaware, navigate to AMAZON WEB SERVICES → Security, Identity, Compliance → Organizations. AWS Organization should be visible in Cloudaware.
...
| Note |
|---|
Collection of AWS Organizational Accounts may take up to 6 hours. |
Using AWS CloudFormation StackSets With AWS Organizations
Use AWS CloudFormation StackSets to roll out Cloudaware CloudFormation stack over multiple AWS accounts in your AWS Organization and allow Cloudaware to collect AWS Organization Sub-Accounts.
Requirements
Ensure that you are using AWS Organizations. Read more
Ensure all features are enabled in your AWS Organization. NOTE: this action is irreversible! Read more
Pre-configuration
1. Sign in to AWS Console as an administrator.
2. Enable trusted access with AWS Organizations:
2.1. Select CloudFormation under Management & Governance.
2.2. Select StackSets. Click Enable trusted access.
...
Once it is done, StackSets creates the necessary IAM roles in the AWS Organizations master account and target accounts where stack instances will be deployed.
The IAM service-linked role created in the Organization master account has the suffix CloudFormationStackSetsOrgAdmin. You can modify or delete this role only if trusted access with AWS Organizations is disabled.
The IAM service-linked role created in each target account has the suffix CloudFormationStackSetsOrgMember. You can modify or delete this role only if trusted access with AWS Organizations is disabled, or if the account is removed from the target organization or organizational unit (OU).
StackSet Creation
1. Log in to your Cloudaware account → Admin → Amazon Organizations & Accounts. Click +Add.
...
2. Select 'Using IAM Role'. Download the Cloudaware CloudFormation template ensuring the following permissions are in place:
| Code Block |
|---|
"organizations:Des*"
"organizations:Li*" |
3. Gо back to AWS Console. Select Services → CloudFormation under Management & Governance → StackSets.
4. Click Create StackSet.
...
5. Select 'Template is ready' and 'Upload a template file'. Click Choose file to upload the Cloudaware CloudFormation template you downloaded earlier. Click Next.
...
6. Give a name to the stack set. Replace 'auto-generate' role with a custom Role Name in CloudAware Role Name. Insert External ID*.
...
*Get External ID generated by clicking ‘Generate Random’ button in 'Add Amazon Details' form in Cloudaware.
...
7. Select the policies to be enabled. Click Next.
8. Select 'Service-Managed Permissions'*. Click Next.
...
*If you prefer using Self-Managed permissions, set up:
AWSCloudFormationStackSetAdministrationRole in the master account using the template https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/AWSCloudFormationStackSetAdministrationRole.yml
AWSCloudFormationStackSetExecutionRole which trusts the root account in each(!) sub-account using the template https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/AWSCloudFormationStackSetExecutionRole.yml
Read more
9. Optional: set deployment options*. Click Next.
*You can limit the stackset deployment to specific OUs to limit account discovery in the AWS Organization. Read more to learn how to specify the OUs as deployment targets.
IMPORTANT: If you already have a specific OU onboarded by Cloudaware and would like to add another one(s) - please create a stackset with new OU(s) specified using the same Role Name and External ID as you used when adding your first OU.
10. Review the stackset details. Click Submit. Wait for the stackset to be created.
11. Contact your dedicated account manager at tam@cloudaware.com to provide the custom Role Name and External ID used during the stackset creation, along with your AWS Organization Master Account ID.
| Note |
|---|
The auto-collection of AWS Organizational Sub-Accounts in Cloudaware may take time. |
Identify AWS Organizational Accounts That Got Onboarded Successfully
1. In Cloudaware CMDB Navigator, go to AMAZON WEB SERVICES → Security, Identity, Compliance → Organizations.
2. You should see at least one AWS Organization and N number of AWS Organizational Accounts.
Identify AWS Organizational Accounts That Didn't Get Onboarded Successfully
...
1. In Cloudaware CMDB Navigator, go to AMAZON WEB SERVICES → Security, Identity, Compliance → AWS Organizational Accounts.
2. Click
...
Browse Objects:
...
3. Paste the following query and click Search:
| Code Block |
|---|
`Deleted From AWS` equals null -> `AWS Organization Account Name` ASC, `Account`.`Account Name` as "Actual Account", `Account ID`, `Email`, `Joined Method`, `Joined Timestamp`, `Parent Root ARN`, `Status` |
Any AWS Organizational Account accounts where 'Actual Account' is blank could not be auto-added successfully because Cloudaware was can't be automatically added since Cloudaware is unable to assume IAM role in itits IAM role.
Troubleshooting
If you do not see any AWS Organizations, there are two possible reasons:
Insufficient permissions on AWS Organizations Master Account.
AWS Organizations Master Account has not been added to Cloudaware.
If the AWS Organization master account has been added to Cloudaware but auto-collection doesn't take place, check if Role Name and External ID are custom, as they shouldn't be left auto-populated by Cloudaware during the StackSet creation.