santiago-labs / telophasecli

Open Source AWS Control Tower

Telophase

Documentation

Full documentation here: https://docs.telophase.dev

Why Telophase?

Automation and Compliance are key concerns when adopting a multi-account AWS setup. Telophase manages your AWS Organization as IaC, and deeply integrates with IaC providers, like Terraform or CDK. This integration allows:

1. Workflow Automation: Automates account creation and decommissioning, integrating with existing automation workflows, like CI or ServiceNow.
2. IaC <> Account Binding: Enables binding accounts to IaC blueprints for automatic provisioning of resources in a newly created account.
3. Easier Compliance Deployment: Enables binding Service Control Policies (SCPs) to accounts as part of your Account provisioning workflow to make sure every Account is compliant. We make it easy to test SCPs before they are deployed.

Currently, Telophase is a CLI tool only. In the future, we plan to offer a web UI.

Install

If you'd like another method, please let us know by opening an issue!

Go

go install github.com/santiago-labs/telophasecli@latest

Homebrew

brew tap Santiago-Labs/telophasecli
brew install telophasecli

Quick links

• Intro
  • Quickstart
• Features
  • Manage AWS Organization as IaC
  • Manage Service Control Policies
  • Assign IaC Blueprints to Accounts
  • Testing
  • Terminal UI
• CLI
  • telophase diff
  • telophase deploy
  • telophase account import
• Organization.yml Reference
  • Reference

Community

Join our Slack community:

Future Development

• Support for multi-cloud organizations with a unified account factory.
  • Azure
  • GCP
• Drift detection/prevention
• Guardrails around account resources
• Guardrails around new Accounts, similar to Control Tower rules.

Comparisons

Telophase vs Control Tower

Manage Accounts via code not a UI. Telophase leaves the controls up to you and your IaC.

Telophase vs CDK with multiple environments

Telophase wraps your usage of CDK so that you can apply the cdk to multiple accounts in parallel. Telophase lets you focus on your actual infrastructure and not worrying about setting up the right IAM roles for multi account management.

telophasecli's Issues

Support for stacksets

Stacksets can be helpful for automatically deploying on account creation within an OU or Organization. However, a lot of what stacksets set out to do can be accomplished via telophasecli's Stacks. Its worth investigating if users need to deploy stacksets for OUs that aren't managed by telophasecli or if there is another use case.

Automatic cleanup of resource on Stack removal from `organization.yml`

Currently, we encourage users when they want to clean up to:

1. remove resources tracked in a Telophase Stack
2. apply telophase for the empty Stack
3. Stop tracking the Stack in organization.yml

We should support removing a Stack from the organization.yml and having the resources be automatically cleaned up on deploy.

Alternatively, we could follow the same proposed pattern with Accounts. With Accounts, we plan to set Delete: true so that the resource needs to be explicitly cleaned up by telohasecli.

Rollback support for CDK/Cloudformation

Sometimes you want to call aws cloudformation --rollback-stack across all managed telophase accounts.

We should support this underlying call

Allow multiple files to represent an `organization.yml`

organization.yml has become a large file for many users. Let's manage it so that you can reference another filepath to represent smaller OUs

Fix rendering of + when showing account diff

The email should say [email protected]

Enable Create-Organization from telophase

Currently, telophase can only be setup once AWS organizations has been enable by the end user. It can be helpful to provision the root AWS Organization via code. For example, aws_organizations_organization in terraform.

We want to enable users to create a fresh Organization with telophase and have all of their configuration in code for setting the feature_set and aws_service_access_principals.

For more content, aws_service_access_principals are configured via aws organizations enable-aws-service-access

Add support for account deletion

We want to allow explicit account deletion by setting a field Delete: true in the Accounts: field

For example,

    Accounts:
      - Email: "[email protected]"
        Name: "MyAccount"
        Delete: true