Package: awsaccountmgr
Multi-Account management in AWS Organizations!IMPORTANT!- The code has not been tested properly yet in production and no unit/integration testing have been implemented. Use at your own risk.This repository contains code that manages the process around AWS account creation. It assumes you are working with theAWS Deployment Frameworkfor managing deployments in a multi-account AWS organization.Current FeaturesCreate new AWS accounts within existing AWS OrganizationMove accounts to the organizational unit defined in config filesOptionally remove default VPC resources on accountsCreate and update account aliassesAccount taggingOptional protection from moving accounts directly between organizational units (Related to AWS Deployment Framework)Create and update account alternate contactsNot supported due to AWS Organization API limitationsUpdating account namesUpdating account email addressesRemoving accountsHandling root account credentials and MFAInstallation & ConfigurationNote we are only supporting python3.6 and up, I really like my f-strings..Install the package using pippip3installawsaccountmgrNext define configuration files for the accounts you would like to manage. You can have multiple configuration files for logical separation. The script will iterate and validate each file before sequentially creating/updating the defined accounts.Here is an example fileAccounts:# Account with only mandatory parameters-AccountFullName:playgroundaccountOrganizationalUnitPath:playground/Email:playgroundaccount@moorspots.com# Delete the default VPC for this account-AccountFullName:usdevaccountOrganizationalUnitPath:us/devEmail:usdevaccount@moorspots.comDeleteDefaultVPC:True# Account with all available parameters-AccountFullName:myrootaccountOrganizationalUnitPath:/Email:myrootaccount@moorspots.comDeleteDefaultVPC:TrueAllowDirectMoveBetweenOU:TrueAlias:IDontWantMyAliasToBeTheSameAsTheAccountFullNameAllowBilling:FalseAlternateContacts:Operations:Email:myops@moorspots.comName:mynameTitle:DoctorPhoneNumber:+31307161111Security:Email:mysecurity@moorspots.comName:mynameTitle:DoctorPhoneNumber:+31307161111Billing:Email:mybilling@moorspots.comName:mynameTitle:DoctorPhoneNumber:+31307161111Tags:-CostCenter:123456789To create new accounts or move accounts to a different OU you only have to update the relevant account configuration file and re-run the script.The OU name is the name of the direct parent of the account. If you want to move an account to the root you can provide the AWS organization id (eg "r-abc1"). If you are dealing with nested organizational units you can seperate them with a / (see examples above).If you provide the 'AlternateContacts' key, all three alternate contact types will be fully updated with the declared configuration. If you for instance only provide an Operations contact entry, it will try to remove the Security and Billing contact information.UsageOnce the configuration files are defined you can start the script locally with:awsaccountmgr<root_ou_id><configfolderpath>You will have to have AWS credentials stored (using AWS CLI or environment variables) on your machine. If the assumed role is not resided in the master account the script will try to assume the OrganizationAccountAccessRole role in the master account. This is useful for people using the AWS Deployment Framework to run this script from a pipeline in the deployment account.To see all available command line options, runawsaccountmgr --helpTODO: Describe how you can setup the AWS Deployment Framework pipeline to run this on updates and scheduled time. Quick summaryCreate cc-buildonly ADF pipelineadd buildspec.yml similar to example-buildspec.ymlUpdate the ADF global.yml files to ensure the deployment account is able to do organizations related stuff in the master accountTIP: If you add a schedule to the ADF pipeline you can reasonably ensure the accounts are configured as defined in the yaml files.TIP2: perhaps this module can be used in combination with a lambda triggered by cloudwatch events related to relevant organizations actions. This will immediately correct any changes someone does to accounts to whats being defined in the configuration files.Release History0.0.16 (2021-12-06)FIX: Use standalone context for updating master account0.0.15 (2021-12-06)FIX: Avoid raising an error when trying to remove an alternate contact thats non existing0.0.14 (2021-12-06)FIX: The API has a more strict formatting for the phone field. Default to "00000000" when phone field is not provided0.0.13 (2021-12-06)FIX: / is an invalid character for Alternate contact fields. Defaulting to NotApplicable andnot@applicable.com0.0.12 (2021-12-06)FIX: all alternate contact fields are mandatory. Defaulting to N/A when not provided0.0.11 (2021-12-06)Added capability to update AWS account alternate contactsFIX: configuration example showed Tags as dict items, corrected to list of dicts0.0.10 (2020-11-10)FIX: Retrying subnet and IGW describe calls. Sometimes they are not yet available after a new account creation.0.0.9 (2019-10-09)FIX: AllowDirectMoveBetweenOU parameter now works as intended0.0.8 (2019-10-09)FIX: Using pagination when listing Org Units0.0.7 (2019-09-23)setup.py now includes dependency librariesFIX: describe_vpcs call sometimes failed on creating new account0.0.6 (2019-08-01)Configuration files now support '/' to target root0.0.5 (2019-08-01)FIX: Removing VPCs through threads working properly0.0.4 (2019-07-31)Retrieving master_account_id from APIDeleting VPCs now using threads0.0.3 (2019-07-30)Removing default VPCs in all regions0.0.2 (2019-07-30)config_directory is now a mandatory parameter0.0.1 (2019-07-30)Thanks to @deltagarrett for testing!Initial version