aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
360 stars 205 forks source link

CfCT might not scale on environment with thousands of accounts #128

Closed rmsilva1973 closed 2 years ago

rmsilva1973 commented 2 years ago

Is your feature request related to a problem? Please describe. The architecture of the Customizations solution, centralized on master account and deploying the stacks on all the member accounts using stacksets is a good solution and works fine with multi account environment with dozens and perhaps a hundred accounts. However with environments with thousands of accounts where new acccounts can be created frequently, the execution times might be an issue. I'm proposing a complete revamp on it's design here.

Describe the feature you'd like An ideia would be for customization to create the deployment engine on the member accounts and them each account runs a pipeline deploying the stacks locally pulling the code from a central repo. The pipelines on the member accounts could use some message passing between them and master account to report the status (or errors) of the deployment of the CfCT stacks on member accounts

They [the member accounts[ could also subscribe to a topic on master account which would notify about updates to the repo with the stacks to be distributed.

Master account would deploy the stacks on newly created accounts only not triggering the pipelines on the other existing member accounts.

balltrev commented 2 years ago

Thanks for bringing this up @rmsilva1973, The performance of CfCT would depend on the quantity of accounts and regions being deployed to, and the types of customizations being deployed. We do recommend assessing CfCT with the specific use cases it's being considered for.

As for refactoring the architecture of CfCT, this is something we're unlikely to do in the near term.