If you have enabled AWS Organizations support you may want to bootstrap all spokes within an organizational unit.
Following these steps will allow you to bootstrap all AWS Accounts that exist within the same organizational unit.
In your AWS Account you can find an AWS CodeBuild project named: servicecatalog-puppet-bootstrap-an-ou
Click Start Build
Before you select Start Build again, expand the Environment variables override section.
Set OU_OR_PATH to the OU path or AWS Organizational Unit ID that contains all of the spokes you want to bootstrap
Set IAM_ROLE_NAME to the name of the IAM Role that is assumable in the spoke accounts - this must be the same name in all accounts
Set IAM_ROLE_ARNS to the ARNs you want to assume before assuming before the IAM_ROLE_NAME. This is should you need to assume a role with cross account permissions.
Click Start Build again
The following steps should be executed using the Service Catalog Puppet CLI which is an application built using Python 3.7.
If you have not already installed the framework you can do so by following these steps:
It is good practice to install Python libraries in isolated environments.
You can create the a virtual environment using the following command:
virtualenv --python=python3.7 venv
source venv/bin/activate
Once you have decided where to install the library you can install the package:
pip install aws-service-catalog-puppet
This will install the library and all of the dependencies.
You should export the credentials for the account that allows you to list accounts in the org and assume an IAM Role in each of the spokes.
Then you can run the following command:
Without a Permission Boundary
servicecatalog-puppet bootstrap-spokes-in-ou /dev DevOpsAdminRole
In this example /dev is the ou path and DevOpsAdminRole is the name of the assumable role in each spoke account.
With a Permission Boundary
servicecatalog-puppet bootstrap-spokes-in-ou /dev DevOpsAdminRole --permission-boundary arn:aws:iam::aws:policy/AdministratorAccess
If your current role does not allow you to list accounts in the AWS Organization or allow you to assume-role across AWS accounts you can specify an ARN of an IAM role that does. When you do so the framework will assume that IAM Role first and then perform the bootstrapping.
servicecatalog-puppet bootstrap-spokes-in-ou /dev DevOpsAdminRole arn:aws:iam::0123456789010:role/OrgRoleThatAllowsListAndAssumeRole
You can use the following AWS CloudFormation template to provision the needed role:
# Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
AWSTemplateFormatVersion: '2010-09-09'
Description: IAM Role needed to use AWS Organizations to assume role into member AWS Accounts.
Parameters:
ServiceCatalogFactoryAccountId:
Description: The account you will be installing AWS Service Catalog Factory into
Type: String
OrganizationAccountAccessRole:
Description: Name of the IAM role used to access cross accounts for AWS Orgs usage
Default: OrganizationAccountAccessRole
Type: String
Resources:
RoleForBootstrappingSpokes:
Type: AWS::IAM::Role
Description: |
IAM Role needed by the account vending machine so it can create and move accounts
Properties:
Path: /servicecatalog-puppet/
Policies:
- PolicyName: Organizations
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- sts:AssumeRole
Resource: !Sub "arn:aws:iam::*:role/${OrganizationAccountAccessRole}"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
AWS: !Sub "arn:aws:iam::${ServiceCatalogFactoryAccountId}:root"
Action:
- "sts:AssumeRole"
Outputs:
RoleForBootstrappingSpokesArn:
Description: The ARN for your Assumable role in root account
Value: !GetAtt RoleForBootstrappingSpokes.Arn