Productionize multi AWS Accounts (org-formation Landing Zone)
Tags: aws, security, organizations, devops
Published: 2021-08-17 11:59:12

Following-on from the ['Landing Zones, Organizations, OUs and Multi-Account Environments blog'](https://dev.to/aws-builders/landing-zones-organizations-ous-and-multi-account-environments-1243), I decided to "practice what I preach" with my personal AWS Accounts!

Currently I have 5-10 Accounts for different workloads (spikes, storage of personal data, web app hosting etc); I have had these accounts for many years and I manually used AWS Organizations via the Console to create & manage them

__NO__ guardrails or SCPs have been implemented, I have probably deployed & configured some AWS services wrong and I have probably created IAM users with broad (*) permissions

The purpose of this blog is to address the above concerns; To refactor my accounts into a Landing Zone that follows the AWS best practices.

# My Accounts - Current Account Architecture
The below Diagram shows my current Account structure

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wnji4b9lxkjbzsy0e407.jpg)


# org-formation - Overview
Taken from [github org-formation](https://github.com/org-formation/org-formation-cli); _AWS Organization Formation is an Infrastructure as Code (IaC) tool for AWS Organizations._

org-formation orchestrates CloudFormation and AWS Organizations for account creation and resource provisioning


## Tasks / Features
__Tasks__ files can be added to enable a variety of Automated features such as:
+ OrganizationAccountAccessRole restrictions (SCPs)
+ Budget Alarms
+ AWS Access Key Rotation checks
+ Enabling CloudTrail
+ Centralising and Enabling Guard Duty
+ Many IAM Configurations (Password Policy, force MFA)
+ Many S3 Configurations (Prohibit Read & Write, Enable encryption)
+ VPC Security Groups conform to (user-defined) ALLOW list

This feature list is what I intend to implement on my Accounts.
For the full list of available org-formation features, please refer to the __40mb__ [pdf](https://github.com/org-formation/org-formation-cli/raw/master/docs/features.pdf)


## FYI on Tooling Decision
Control Tower? Terraform? CloudFormation? org-formation? CDK?...
+ It is not the purpose of this post to go into the detailed comparisons of these tools.

I am an AWS Architect at Version 1, I have experienced all of the above tools used to produce Landing Zones for Clients.

## org-formation (DAPx)
One of the Version 1 DAPx Landing Zone Accelerators is built upon [org-formation](https://github.com/org-formation/org-formation-cli), I have used this for my Landing Zone.
+ It is not the purpose of this post to *sell* DAPx, please message me if you would like to know more about [DAPx](https://www.version1.com/it-service/dapx/), 



# My Accounts - Target Accounts Architecture Design
The below diagram shows the Target Account structure that is aligned to the best practices & architecture detailed in the ['LZs, Organizations, OUs and Multi-Account Environments blog'](https://dev.to/aws-builders/landing-zones-organizations-ous-and-multi-account-environments-1243)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n23otqwohbpnxt727oj7.jpg)


## Development Summary
org-formation is a highly flexible and powerful toolkit, to prevent content bloat I will provide only a few code/console snippets for key important featues.


### IAM Role - Account/OU Access
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jao4ovi7us7zisr394ov.jpg)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e48vh4ohoqe6pyl7n18e.jpg)


### Secure Defaults
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o81ddh9s4gbebrxynyts.jpg)


### Budget Alarms
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aisldhp6os36xj2dvpen.jpg)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/his986d5imisr0if4zad.jpg)


### GuardDuty
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/40wlsmcq5w1nz5smw7g2.jpg)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5dh3qz18gg2ur2ocm3is.jpg)



### AWS Config
Centralised AWS Config in the Master Account, AWS Config has access to all member/child accounts.
The LogArchive Bucket is in the LogArchive Account, this has Access Restrictions and Cleardown Policies by-default
AWS Config Findings Alerts (inc SNS Topic by-default), All [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html) are available to use
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j18rx0gkgpumqacsn2ap.jpg)


### CloudTrail
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nazgy3nams8ddgu0rtb3.jpg)


### SCPs
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r7m7d2v6ng9qyzaznlcy.jpg)
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9ib3uk5ove7dh5lkis2o.jpg)


# The End Result
The below diagram shows the final Account Structure & AWS Services that have now been implemented
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l0pced9aorz8yzz7ja9f.jpg)

##Cleanup on isle "Config Findings"
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/41zaedne1xfxod8hnzlc.jpg)
These Config Rule Alerts include:
+ *access-keys-rotated*
+ *iam-password-policy*
+ *root-account-mfa-enabled*
+ *s3-bucket-server-side-encryption-enabled*
+ *vpc-sg-open-only-to-authorized-ports*

Once I have remediated these I will feel a lot better about the security of my AWS accounts!



Thank you for reading, constructive feedback is welcomed.