enable_control_tower.yml

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0

---
AWSTemplateFormatVersion: "2010-09-09"
Description: Cloud Foundations on AWS Control Tower deployment

Metadata:
  "AWS::CloudFormation::Interface":
    ParameterGroups:
      - Label:
          default: "AWS Organization"
        Parameters:
          - pCreateNewAwsOrg
          - pSecurityOuName
          - pSandboxOuName
      - Label:
          default: "Security Account"
        Parameters:
          - pDeployNewSecurityAccount
          - pImportedSecurityAccountId
          - pSecurityAccountAlias
          - pSecurityAccountEmailAddress
      - Label:
          default: "Log Archive Account"
        Parameters:
          - pDeployNewLogArchiveAccount
          - pImportedLogArchiveAccountId
          - pLogArchiveAccountAlias
          - pLogArchiveAccountEmailAddress
      - Label:
          default: "Control Tower"
        Parameters:
          - pVersion
          - pGovernedRegions
          - pLoggingBucketRetentionPeriod
          - pAccessLoggingBucketRetentionPeriod
    ParameterLabels:
      pCreateNewAwsOrg:
        default: "Create new AWS Organization"
      pSecurityOuName:
        default: "Security OU Name"
      pSandboxOuName:
        default: "Additional Control Tower OU"
      pImportedSecurityAccountId:
        default: "Import Security Account ID"
      pSecurityAccountAlias:
        default: "Security account alias"
      pSecurityAccountEmailAddress:
        default: "Security account email address"
      pImportedLogArchiveAccountId:
        default: "Import Log Archive account ID"
      pLogArchiveAccountAlias:
        default: "Log Archive account alias"
      pLogArchiveAccountEmailAddress:
        default: "Log Archive account email address"
      pVersion:
        default: "Landing Zone version"
      pGovernedRegions:
        default: "Governed Regions"
      pLoggingBucketRetentionPeriod:
        default: "Logging Bucket Retention Period"
      pAccessLoggingBucketRetentionPeriod:
        default: "Access Logging Bucket Retention Period"
      pDeployNewSecurityAccount:
        default: "Deploy new Security account"
      pDeployNewLogArchiveAccount:
        default: "Deploy new Log Archive account"

Parameters:
  pCreateNewAwsOrg:
    Type: String
    Description: Specify whether to create the AWS Organization or if one already exists. Select no if you already have an AWS Organization.
    Default: "Yes"
    AllowedValues:
      - "Yes"
      - "No"
  pDeployNewLogArchiveAccount:
    Type: String
    Description: Deploy a NEW Log Archive account or select No and enter an existing AWS account ID to use a pre-existing account
    Default: "Yes"
    AllowedValues:
      - "Yes"
      - "No"
  pLogArchiveAccountAlias:
    Type: String
    Description: The AWS account alias for the Log Archive account. If importing a pre-existing Log Archive account, leave blank.
    Default: "Log Archive"
  pLogArchiveAccountEmailAddress:
    Type: String
    Description: The Log Archive email address for any newly created Log Archive account. Leave this blank if importing a pre-existing Log Archive account.
  pImportedLogArchiveAccountId:
    Type: String
    Description: If you selected No for creating a new Log Archive account, enter the existing account ID that will serve as your Log Archive account ID.
  pDeployNewSecurityAccount:
    Type: String
    Description: Deploy a NEW Security account or select No and enter an existing AWS account ID to use a pre-existing account
    Default: "Yes"
    AllowedValues:
      - "Yes"
      - "No"
  pSecurityAccountAlias:
    Type: String
    Description: The AWS account alias for the Security account. If importing a pre-existing Security account, leave blank.
    Default: "Audit"
  pSecurityAccountEmailAddress:
    Type: String
    Description: The Security email address for any newly created Security account. Leave this blank if importing a pre-existing Security account.
  pImportedSecurityAccountId:
    Type: String
    Description: If you selected No for creating a new Security account, enter the existing account ID that will serve as your Security account ID.
  pVersion:
    Type: String
    Description: The version number of Landing Zone
    Default: "3.3"
  pGovernedRegions:
    Type: CommaDelimitedList
    Description: List of governed regions
    Default: "us-east-1, us-west-2"
  pSecurityOuName:
    Type: String
    Description: The security Organizational Unit name
    Default: "Security"
  pSandboxOuName:
    Type: String
    Description: Name of additional OU to be created and registered in Control Tower
    Default: "Sandbox"
  pLoggingBucketRetentionPeriod:
    Type: Number
    Description: Retention period for centralized logging bucket
    Default: 365
  pAccessLoggingBucketRetentionPeriod:
    Type: Number
    Description: Retention period for access logging bucket
    Default: 90

Conditions:
  cCreateNewAwsOrg: !Equals ["Yes", !Ref pCreateNewAwsOrg]
  cDeployNewLogArchiveAccount: !Equals ["Yes", !Ref pDeployNewLogArchiveAccount]
  cDeployNewSecurityAccount: !Equals ["Yes", !Ref pDeployNewSecurityAccount]

Resources:
  rOrganization:
    Type: "AWS::Organizations::Organization"
    Condition: cCreateNewAwsOrg
    Properties:
      FeatureSet: ALL

  rOrgWaiter:
    Type: "AWS::CloudFormation::WaitConditionHandle"
    Metadata:
      WaitOn: !If [cCreateNewAwsOrg, !Ref rOrganization, !Ref AWS::NoValue ]

  rLoggingAccount:
    Type: "AWS::Organizations::Account"
    DependsOn:
      - rOrgWaiter
    Condition: cDeployNewLogArchiveAccount
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
    Properties:
      AccountName: !Ref pLogArchiveAccountAlias
      Email: !Ref pLogArchiveAccountEmailAddress

  rSecurityAccount:
    Type: "AWS::Organizations::Account"
    DependsOn:
      - rOrgWaiter
    Condition: cDeployNewSecurityAccount
    UpdateReplacePolicy: Retain
    DeletionPolicy: Retain
    Properties:
      AccountName: !Ref pSecurityAccountAlias
      Email: !Ref pSecurityAccountEmailAddress

  rAWSControlTowerAdmin:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "Ignoring explicit role name"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "controltower.amazonaws.com"
            Action: "sts:AssumeRole"
      Path: "/service-role/"
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSControlTowerServiceRolePolicy"
      RoleName: AWSControlTowerAdmin
      Tags:
        - Key: "aws-cloudformation:stack-name"
          Value: !Ref "AWS::StackName"
        - Key: "aws-cloudformation:stack-id"
          Value: !Ref "AWS::StackId"
        - Key: "aws-cloudformation:logical-id"
          Value: rAWSControlTowerAdmin

  rAWSControlTowerAdminPolicy:
    Type: "AWS::IAM::Policy"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W12
            reason: "Ignoring star in policy"
    Properties:
      PolicyName: AWSControlTowerAdminPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: "ec2:DescribeAvailabilityZones"
            Resource: "*"
      Roles:
        - !Ref rAWSControlTowerAdmin

  rAWSControlTowerCloudTrailRole:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "Ignoring explicit role name"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "cloudtrail.amazonaws.com"
            Action: "sts:AssumeRole"
      Path: "/service-role/"
      RoleName: AWSControlTowerCloudTrailRole
      Tags:
        - Key: "aws-cloudformation:stack-name"
          Value: !Ref "AWS::StackName"
        - Key: "aws-cloudformation:stack-id"
          Value: !Ref "AWS::StackId"
        - Key: "aws-cloudformation:logical-id"
          Value: rAWSControlTowerCloudTrailRole

  rAWSControlTowerCloudTrailRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: AWSControlTowerCloudTrailRolePolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - "logs:CreateLogStream"
              - "logs:PutLogEvents"
            Resource: !Sub "arn:${AWS::Partition}:logs:*:*:log-group:aws-controltower/CloudTrailLogs:*"
      Roles:
        - !Ref rAWSControlTowerCloudTrailRole

  rAWSControlTowerConfigAggregatorRoleForOrganizations:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "Ignoring explicit role name"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "config.amazonaws.com"
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSConfigRoleForOrganizations"
      Path: "/service-role/"
      RoleName: AWSControlTowerConfigAggregatorRoleForOrganizations
      Tags:
        - Key: "aws-cloudformation:stack-name"
          Value: !Ref "AWS::StackName"
        - Key: "aws-cloudformation:stack-id"
          Value: !Ref "AWS::StackId"
        - Key: "aws-cloudformation:logical-id"
          Value: rAWSControlTowerConfigAggregatorRoleForOrganizations

  rAWSControlTowerStackSetRole:
    Type: "AWS::IAM::Role"
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: W28
            reason: "Ignoring explicit role name"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "cloudformation.amazonaws.com"
            Action: "sts:AssumeRole"
      Path: "/service-role/"
      RoleName: AWSControlTowerStackSetRole
      Tags:
        - Key: "aws-cloudformation:stack-name"
          Value: !Ref "AWS::StackName"
        - Key: "aws-cloudformation:stack-id"
          Value: !Ref "AWS::StackId"
        - Key: "aws-cloudformation:logical-id"
          Value: rAWSControlTowerStackSetRole

  rAWSControlTowerStackSetRolePolicy:
    Type: "AWS::IAM::Policy"
    Properties:
      PolicyName: AWSControlTowerStackSetRolePolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: "sts:AssumeRole"
            Resource: !Sub "arn:${AWS::Partition}:iam::*:role/AWSControlTowerExecution"
      Roles:
        - !Ref rAWSControlTowerStackSetRole

  rSecurityAccountWaiter:
    Type: "AWS::CloudFormation::WaitConditionHandle"
    Metadata:
      WaitOn: !If
        - cDeployNewSecurityAccount
        - !Ref rSecurityAccount
        - !Ref "AWS::NoValue"

  rLogArchiveAccountWaiter:
    Type: "AWS::CloudFormation::WaitConditionHandle"
    Metadata:
      WaitOn: !If
        - cDeployNewLogArchiveAccount
        - !Ref rLoggingAccount
        - !Ref "AWS::NoValue"

  rControlTowerLandingZone:
    Type: "AWS::ControlTower::LandingZone"
    DependsOn:
      - rSecurityAccountWaiter
      - rLogArchiveAccountWaiter
      - rAWSControlTowerAdmin
    Properties:
      Version: !Ref pVersion
      Manifest:
        governedRegions: !Ref pGovernedRegions
        organizationStructure:
          security:
            name: !Ref pSecurityOuName
          sandbox:
            name: !Ref pSandboxOuName
        centralizedLogging:
          accountId: !If
            - cDeployNewLogArchiveAccount
            - !Ref rLoggingAccount
            - !Ref pImportedLogArchiveAccountId
          configurations:
            loggingBucket:
              retentionDays: !Ref pLoggingBucketRetentionPeriod
            accessLoggingBucket:
              retentionDays: !Ref pAccessLoggingBucketRetentionPeriod
          enabled: true
        securityRoles: # specify your Audit/Security Tooling account
          accountId: !If
            - cDeployNewSecurityAccount
            - !Ref rSecurityAccount
            - !Ref pImportedSecurityAccountId
        accessManagement: # enable identity center or not
          enabled: true

Outputs:
  LoggingAccountId:
    Description: Logging Account ID
    Condition: cDeployNewLogArchiveAccount
    Value: !Ref rLoggingAccount
  SecurityAccountId:
    Description: Security Account ID
    Condition: cDeployNewSecurityAccount
    Value: !Ref rSecurityAccount
  LandingZoneId:
    Description: Control Tower Landing Zone ID
    Value: !GetAtt rControlTowerLandingZone.LandingZoneIdentifier