thiezn / awsaccountmgr

AWS Multi-Account Management - Use standalone or through AWS Deployment Framework

Multi-Account management in AWS Organizations

!IMPORTANT! - The code has not been tested properly yet in production and no unit/integration testing have been implemented. Use at your own risk.

This repository contains code that manages the process around AWS account creation. It assumes you are working with the AWS Deployment Framework for managing deployments in a multi-account AWS organization.

Current Features

• Create new AWS accounts within existing AWS Organization
• Move accounts to the organizational unit defined in config files
• Optionally remove default VPC resources on accounts
• Create and update account aliasses
• Account tagging
• Optional protection from moving accounts directly between organizational units (Related to AWS Deployment Framework)
• Create and update account alternate contacts

Not supported due to AWS Organization API limitations

• Updating account names
• Updating account email addresses
• Removing accounts
• Handling root account credentials and MFA

Installation & Configuration

Note we are only supporting python3.6 and up, I really like my f-strings..

Install the package using pip

pip3 install awsaccountmgr

Next define configuration files for the accounts you would like to manage. You can have multiple configuration files for logical separation. The script will iterate and validate each file before sequentially creating/updating the defined accounts.

Here is an example file

Accounts:
  # Account with only mandatory parameters
  - AccountFullName: playgroundaccount
    OrganizationalUnitPath: playground/
    Email: [email protected]

  # Delete the default VPC for this account
  - AccountFullName: usdevaccount
    OrganizationalUnitPath: us/dev
    Email: [email protected]
    DeleteDefaultVPC: True

  # Account with all available parameters
  - AccountFullName: myrootaccount
    OrganizationalUnitPath: /
    Email: [email protected]
    DeleteDefaultVPC: True
    AllowDirectMoveBetweenOU: True
    Alias: IDontWantMyAliasToBeTheSameAsTheAccountFullName
    AllowBilling: False
    AlternateContacts:
      Operations:
        Email: [email protected]
        Name: myname
        Title: Doctor
        PhoneNumber: [phone]

      Security:
        Email: [email protected]
        Name: myname
        Title: Doctor
        PhoneNumber: [phone]

      Billing:
        Email: [email protected]
        Name: myname
        Title: Doctor
        PhoneNumber: [phone]

    Tags:
      - CostCenter: 123456789

To create new accounts or move accounts to a different OU you only have to update the relevant account configuration file and re-run the script.

The OU name is the name of the direct parent of the account. If you want to move an account to the root you can provide the AWS organization id (eg "r-abc1"). If you are dealing with nested organizational units you can seperate them with a / (see examples above).

If you provide the 'AlternateContacts' key, all three alternate contact types will be fully updated with the declared configuration. If you for instance only provide an Operations contact entry, it will try to remove the Security and Billing contact information.

Usage

Once the configuration files are defined you can start the script locally with:

awsaccountmgr <root_ou_id> <config folder path>

You will have to have AWS credentials stored (using AWS CLI or environment variables) on your machine. If the assumed role is not resided in the master account the script will try to assume the OrganizationAccountAccessRole role in the master account. This is useful for people using the AWS Deployment Framework to run this script from a pipeline in the deployment account.

To see all available command line options, run awsaccountmgr --help

TODO: Describe how you can setup the AWS Deployment Framework pipeline to run this on updates and scheduled time. Quick summary

• Create cc-buildonly ADF pipeline
• add buildspec.yml similar to example-buildspec.yml
• Update the ADF global.yml files to ensure the deployment account is able to do organizations related stuff in the master account
• TIP: If you add a schedule to the ADF pipeline you can reasonably ensure the accounts are configured as defined in the yaml files.
• TIP2: perhaps this module can be used in combination with a lambda triggered by cloudwatch events related to relevant organizations actions. This will immediately correct any changes someone does to accounts to whats being defined in the configuration files.

awsaccountmgr's Issues

Retrieve organizational root OU and master account programmatically

At the moment we need to provide the root OU id and the master account ID to the script. It should be possible to retrieve this from the organizations API using the describe_organization() method.

Configure default settings in configuration files

It would be nice to be able to set the configuration file defaults in each file. This would make the file more readable and ensure consistency between accounts.

An example could be:

Defaults:
    DeleteDefaultVPC: True
    AllowDirectMoveBetweenOU: True
    AllowBilling: False
    Tags:
      - CostCenter: 123456789

Accounts:
  - AccountFullName: myrootaccount
    OrganizationalUnitPath: r-abc1
    Email: [email protected]

Missing files in sdist

It appears that the manifest is missing at least one file necessary to build
from the sdist for version 0.0.9. You're in good company, about 5% of other
projects updated in the last year are also missing files.

+ /tmp/venv/bin/pip3 wheel --no-binary awsaccountmgr -w /tmp/ext awsaccountmgr==0.0.9
Looking in indexes: http://10.10.0.139:9191/root/pypi/+simple/
Collecting awsaccountmgr==0.0.9
  Downloading http://10.10.0.139:9191/root/pypi/%2Bf/57b/3def90302676e/awsaccountmgr-0.0.9.tar.gz (10 kB)
    ERROR: Command errored out with exit status 1:
     command: /tmp/venv/bin/python3 -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-wheel-fxwkvxbn/awsaccountmgr/setup.py'"'"'; __file__='"'"'/tmp/pip-wheel-fxwkvxbn/awsaccountmgr/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' egg_info --egg-base /tmp/pip-wheel-fxwkvxbn/awsaccountmgr/pip-egg-info
         cwd: /tmp/pip-wheel-fxwkvxbn/awsaccountmgr/
    Complete output (5 lines):
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-wheel-fxwkvxbn/awsaccountmgr/setup.py", line 8, in <module>
        with open('HISTORY.md', 'r') as f:
    FileNotFoundError: [Errno 2] No such file or directory: 'HISTORY.md'
    ----------------------------------------
ERROR: Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.

Generate configuration file for missing accounts

It would be handy if we can generate a configuration file of all accounts not defined in any of the configuration files. This would help when starting to use this script, but also as a verification step to ensure all accounts in your AWS organization are managed.

Target root OU using '/' instead of root OU id (eg. r-abc1)

At the moment when we want to move an account to the root OU we need to provide the root OU id. It would be easier if we can just provide a / to indicate we want to put something in root.