Skip to content

Commit 88fa0b3

Browse files
tnielsen2tnielsen2
authored
Merge pull request #2 from West-Michigan-AWS-Users-Group/add-cdk-deploy-refactor-for-multiple-stacks
Add cdk deploy refactor for multiple stacks
2 parents 1c7c304 + 0cbccd8 commit 88fa0b3

10 files changed

+171
-143
lines changed

‎README.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,26 @@
11
# wmaug-management-infrastructure
22

3-
TypeScript multi-stack AWS CDK app for managing the AWS Management account for the West Michigan AWS Users Group.
4-
3+
TypeScript multi-stack AWS CDK app for managing the AWS Management account for the West Michigan AWS Users Group.
54

65
## Stack information
6+
77
- Sso
88
- Creates the AWS SSO resources for the WMAUG Management account.
99
- Creates and defines permissions for groups.
1010
- Assigns groups to permission sets
1111
- Scp
12-
- Stack containing SCPs for the WMAUG org.
12+
- Stack containing SCPs for the WMAUG org.
1313
- Deny the creation of access keys
1414
- Deny the deployment of resources in any region other than us-east-1 and us-east-2
1515

1616
## Manually deploying the Sso stack
17+
1718
npx cdk deploy Sso --parameters instanceArnParam="arn:aws:sso:::instance/ssoins-123456789abcdefg" \
1819
--parameters wmaugManagementAccountNumberParam="123456789abcd" \
1920
--parameters wmaugModeratorAccountNumberParam="123456789abcd" \
2021
--parameters wmaugModeratorAdminGroupId="12345678-1234-1234-1234-abcdefghijkl" \
2122
--parameters wmaugFullAdminGroupId="12345678-1234-1234-1234-abcdefghijkl"
2223

2324
## Manually deploying the Scp stack
24-
npx cdk deploy Scp
2525

26+
npx cdk deploy Scp

‎bin/wmaug-management-infrastructure.ts

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
#!/usr/bin/env node
2-
import 'source-map-support/register';
3-
import * as cdk from 'aws-cdk-lib';
4-
import { Sso } from '../lib/wmaug-management-infrastructure-sso';
5-
import { Scp } from '../lib/wmaug-management-infrastructure-scp';
2+
import "source-map-support/register";
3+
import * as cdk from "aws-cdk-lib";
4+
import { Sso } from "../lib/wmaug-management-infrastructure-sso";
5+
import { Scp } from "../lib/wmaug-management-infrastructure-scp";
66

77
const app = new cdk.App();
8-
new Sso(app, 'Sso', {
9-
env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'us-east-2' },
8+
new Sso(app, "Sso", {
9+
env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: "us-east-2" },
1010
});
1111

12-
new Scp(app, 'Scp', {
13-
env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: 'us-east-2' },
14-
});
12+
new Scp(app, "Scp", {
13+
env: { account: process.env.CDK_DEFAULT_ACCOUNT, region: "us-east-2" },
14+
});

‎cdk.json

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
{
22
"app": "npx ts-node --prefer-ts-exts bin/wmaug-management-infrastructure.ts",
33
"watch": {
4-
"include": [
5-
"**"
6-
],
4+
"include": ["**"],
75
"exclude": [
86
"README.md",
97
"cdk*.json",
@@ -19,10 +17,7 @@
1917
"context": {
2018
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
2119
"@aws-cdk/core:checkSecretUsage": true,
22-
"@aws-cdk/core:target-partitions": [
23-
"aws",
24-
"aws-cn"
25-
],
20+
"@aws-cdk/core:target-partitions": ["aws", "aws-cn"],
2621
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
2722
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
2823
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,

‎jest.config.js

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
module.exports = {
2-
testEnvironment: 'node',
3-
roots: ['<rootDir>/test'],
4-
testMatch: ['**/*.test.ts'],
2+
testEnvironment: "node",
3+
roots: ["<rootDir>/test"],
4+
testMatch: ["**/*.test.ts"],
55
transform: {
6-
'^.+\\.tsx?$': 'ts-jest'
7-
}
6+
"^.+\\.tsx?$": "ts-jest",
7+
},
88
};

‎lib/wmaug-management-infrastructure-scp.ts

Lines changed: 40 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,51 @@
1-
import * as cdk from 'aws-cdk-lib';
2-
import { Construct } from 'constructs';
3-
import * as orgs from 'aws-cdk-lib/aws-organizations';
4-
1+
import * as cdk from "aws-cdk-lib";
2+
import { Construct } from "constructs";
3+
import * as orgs from "aws-cdk-lib/aws-organizations";
54

65
export class Scp extends cdk.Stack {
76
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
87
super(scope, id, props);
98

10-
new orgs.CfnPolicy(this, 'denyIamAccessKeyCreation', {
11-
name: 'denyIamAccessKeyCreation',
12-
description: 'Deny IAM access key creation',
13-
type: 'SERVICE_CONTROL_POLICY',
14-
content:{
15-
"Version": "2012-10-17",
16-
"Statement": {
17-
"Effect": "Deny",
18-
"Action": [
19-
"iam:CreateAccessKey",
20-
"iam:CreateUser",
21-
"iam:CreateLoginProfile",
22-
"iam:UpdateLoginProfile",
23-
"iam:DeleteAccessKey",
24-
"iam:DeleteUser",
25-
"iam:DeleteLoginProfile"
26-
],
27-
"Resource": "*"
28-
}
9+
new orgs.CfnPolicy(this, "denyIamAccessKeyCreation", {
10+
name: "denyIamAccessKeyCreation",
11+
description: "Deny IAM access key creation",
12+
type: "SERVICE_CONTROL_POLICY",
13+
content: {
14+
Version: "2012-10-17",
15+
Statement: {
16+
Effect: "Deny",
17+
Action: [
18+
"iam:CreateAccessKey",
19+
"iam:CreateUser",
20+
"iam:CreateLoginProfile",
21+
"iam:UpdateLoginProfile",
22+
"iam:DeleteAccessKey",
23+
"iam:DeleteUser",
24+
"iam:DeleteLoginProfile",
25+
],
26+
Resource: "*",
2927
},
28+
},
3029
});
31-
30+
3231
// create SCP blocking access to all regions except us-east-1 and us-east-2
33-
new orgs.CfnPolicy(this, 'denyAllRegionsExceptUSEast', {
34-
name: 'denyAllRegionsExceptUSEast',
35-
description: 'Deny all regions except us-east-1 and us-east-2',
36-
type: 'SERVICE_CONTROL_POLICY',
37-
content:{
38-
"Version": "2012-10-17",
39-
"Statement": {
40-
"Effect": "Deny",
41-
"Action": "*",
42-
"Resource": "*",
43-
"Condition": {
44-
"StringNotEquals": {
45-
"aws:RequestedRegion": [
46-
"us-east-1",
47-
"us-east-2"
48-
]
49-
}
50-
}
51-
}
32+
new orgs.CfnPolicy(this, "denyAllRegionsExceptUsEast", {
33+
name: "denyAllRegionsExceptUsEast",
34+
description: "Deny all regions except us-east-1 and us-east-2",
35+
type: "SERVICE_CONTROL_POLICY",
36+
content: {
37+
Version: "2012-10-17",
38+
Statement: {
39+
Effect: "Deny",
40+
Action: "*",
41+
Resource: "*",
42+
Condition: {
43+
StringNotEquals: {
44+
"aws:RequestedRegion": ["us-east-1", "us-east-2"],
45+
},
46+
},
5247
},
48+
},
5349
});
54-
55-
}
50+
}
5651
}

‎lib/wmaug-management-infrastructure-sso.ts

Lines changed: 73 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,86 +1,110 @@
1-
import * as cdk from 'aws-cdk-lib';
2-
import { Construct } from 'constructs';
3-
import * as sso from 'aws-cdk-lib/aws-sso';
1+
import * as cdk from "aws-cdk-lib";
2+
import { Construct } from "constructs";
3+
import * as sso from "aws-cdk-lib/aws-sso";
44

55
export class Sso extends cdk.Stack {
66
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
77
super(scope, id, props);
88

9-
const instanceArnParam = new cdk.CfnParameter(this, 'instanceArnParam', {
10-
type: 'String',
11-
description: 'The ARN of the SSO instance',
9+
const instanceArnParam = new cdk.CfnParameter(this, "instanceArnParam", {
10+
type: "String",
11+
description: "The ARN of the SSO instance",
1212
});
1313

1414
// start account number parameters
15-
const wmaugManagementAccountNumberParam = new cdk.CfnParameter(this, 'wmaugManagementAccountNumberParam', {
16-
type: 'String',
17-
description: 'The account number of the WMAUG management account',
18-
});
15+
const wmaugManagementAccountNumberParam = new cdk.CfnParameter(
16+
this,
17+
"wmaugManagementAccountNumberParam",
18+
{
19+
type: "String",
20+
description: "The account number of the WMAUG management account",
21+
},
22+
);
1923

20-
const wmaugModeratorAccountNumberParam = new cdk.CfnParameter(this, 'wmaugModeratorAccountNumberParam', {
21-
type: 'String',
22-
description: 'The account number of the WMAUG moderator account',
23-
});
24+
const wmaugModeratorAccountNumberParam = new cdk.CfnParameter(
25+
this,
26+
"wmaugModeratorAccountNumberParam",
27+
{
28+
type: "String",
29+
description: "The account number of the WMAUG moderator account",
30+
},
31+
);
2432

2533
// start group GUID parameters
2634

27-
const wmaugModeratorAdminGroupId = new cdk.CfnParameter(this, 'wmaugModeratorAdminGroupId', {
28-
type: 'String',
29-
description: 'The GUID of the wmaugModeratorAdmin SSO group',
30-
});
35+
const wmaugModeratorAdminGroupId = new cdk.CfnParameter(
36+
this,
37+
"wmaugModeratorAdminGroupId",
38+
{
39+
type: "String",
40+
description: "The GUID of the wmaugModeratorAdmin SSO group",
41+
},
42+
);
3143

32-
const wmaugFullAdminGroupId = new cdk.CfnParameter(this, 'wmaugFullAdminGroupId', {
33-
type: 'String',
34-
description: 'The GUID of the wmaugFullAdmin SSO group',
35-
});
44+
const wmaugFullAdminGroupId = new cdk.CfnParameter(
45+
this,
46+
"wmaugFullAdminGroupId",
47+
{
48+
type: "String",
49+
description: "The GUID of the wmaugFullAdmin SSO group",
50+
},
51+
);
3652

3753
// Start permission set policy creation
38-
const wmaugModeratorAdminPermissionSet = new sso.CfnPermissionSet(this, 'wmaugModeratorAdminPermissionSet', {
39-
// Use the value of the CFN parameter
40-
instanceArn: instanceArnParam.valueAsString,
41-
name: 'wmaugModeratorAdminPermissionSet',
42-
description: 'Permission set WMAUG moderators and administrators will use',
43-
managedPolicies: ['arn:aws:iam::aws:policy/AdministratorAccess'],
44-
});
54+
const wmaugModeratorAdminPermissionSet = new sso.CfnPermissionSet(
55+
this,
56+
"wmaugModeratorAdminPermissionSet",
57+
{
58+
// Use the value of the CFN parameter
59+
instanceArn: instanceArnParam.valueAsString,
60+
name: "wmaugModeratorAdminPermissionSet",
61+
description:
62+
"Permission set WMAUG moderators and administrators will use",
63+
managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"],
64+
},
65+
);
4566

46-
const wmaugFullAdminPermissionSet = new sso.CfnPermissionSet(this, 'wmaugFullAdminPermissionSet', {
47-
// Use the value of the CFN parameter
48-
instanceArn: instanceArnParam.valueAsString,
49-
name: 'wmaugFullAdminPermissionSet',
50-
description: 'Permission set WMAUG owners will use',
51-
managedPolicies: ['arn:aws:iam::aws:policy/AdministratorAccess'],
52-
});
67+
const wmaugFullAdminPermissionSet = new sso.CfnPermissionSet(
68+
this,
69+
"wmaugFullAdminPermissionSet",
70+
{
71+
// Use the value of the CFN parameter
72+
instanceArn: instanceArnParam.valueAsString,
73+
name: "wmaugFullAdminPermissionSet",
74+
description: "Permission set WMAUG owners will use",
75+
managedPolicies: ["arn:aws:iam::aws:policy/AdministratorAccess"],
76+
sessionDuration: "PT12H",
77+
},
78+
);
5379

5480
// Assign moderator admin to moderator account
55-
new sso.CfnAssignment(this, 'wmaugModeratorAdminModeratorAssignment', {
81+
new sso.CfnAssignment(this, "wmaugModeratorAdminModeratorAssignment", {
5682
instanceArn: instanceArnParam.valueAsString,
5783
permissionSetArn: wmaugModeratorAdminPermissionSet.attrPermissionSetArn,
58-
principalType: 'GROUP',
84+
principalType: "GROUP",
5985
principalId: wmaugModeratorAdminGroupId.valueAsString,
6086
targetId: wmaugModeratorAccountNumberParam.valueAsString,
61-
targetType: 'AWS_ACCOUNT',
62-
});
87+
targetType: "AWS_ACCOUNT",
88+
});
6389

6490
// Assign full admin to management account
65-
new sso.CfnAssignment(this, 'wmaugFullAdminManagementAssignment', {
91+
new sso.CfnAssignment(this, "wmaugFullAdminManagementAssignment", {
6692
instanceArn: instanceArnParam.valueAsString,
6793
permissionSetArn: wmaugFullAdminPermissionSet.attrPermissionSetArn,
68-
principalType: 'GROUP',
94+
principalType: "GROUP",
6995
principalId: wmaugFullAdminGroupId.valueAsString,
7096
targetId: wmaugManagementAccountNumberParam.valueAsString,
71-
targetType: 'AWS_ACCOUNT',
97+
targetType: "AWS_ACCOUNT",
7298
});
7399

74100
// Assign full admin to moderator account
75-
new sso.CfnAssignment(this, 'wmaugFullAdminModeratorAssignment', {
101+
new sso.CfnAssignment(this, "wmaugFullAdminModeratorAssignment", {
76102
instanceArn: instanceArnParam.valueAsString,
77103
permissionSetArn: wmaugFullAdminPermissionSet.attrPermissionSetArn,
78-
principalType: 'GROUP',
104+
principalType: "GROUP",
79105
principalId: wmaugFullAdminGroupId.valueAsString,
80106
targetId: wmaugModeratorAccountNumberParam.valueAsString,
81-
targetType: 'AWS_ACCOUNT',
107+
targetType: "AWS_ACCOUNT",
82108
});
83109
}
84-
85-
86-
}
110+
}

0 commit comments

Comments
 (0)