search

aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
354 stars 205 forks source link

CfCT - error when enabling recommended controls #167

Closed RoxanaTeodosiu closed 8 months ago

RoxanaTeodosiu commented 1 year ago

Describe the bug When adapting the provided CfCT solution for enabling a recommended control from the CT list of controls, the CodePipeline fails at the "CloudformationResource" step with the following message: "ResourceLogicalId:RecommendedControlAWSGREC2VOLUMEINUSECHECK, ResourceType:AWS::ControlTower::EnabledControl, ResourceStatusReason:Resource handler returned message: "Organizational unit ou-xxxx-xxxxxxx is not registered with AWS Control Tower. (Service: AWSControlTower; Status Code: 404; Error Code: ResourceNotFoundException; Request ID: xxxxxxxx; Proxy: null)" (RequestToken: xxxxxxxx, HandlerErrorCode: NotFound)." The error is found in the StackSet logs.

To Reproduce Deploy the CfCT solution and create at least one OU with 2 accounts. Modify the manifest file as following:

region: eu-west-1
version: 2021-03-15
enable_stack_set_deletion: true  
resources:
  - name: stackset-AWS-GR-EC2-VOLUME-INUSE-CHECK
    resource_file: example-configuration/templates/enable_controls.template
    deploy_method: stack_set
    deployment_targets: # accounts property is not supported for SCPs
      accounts: # :type: list
        - xxxxx
        - xxxxx
     regions:
      - eu-west-1

Add the referenced template file in example-configuration/templates/

AWSTemplateFormatVersion: '2010-09-09'
Description: Template for enabling controls in the Landing zone
Resources:
RecommendedControlAWSGREC2VOLUMEINUSECHECK:
        Type: "AWS::ControlTower::EnabledControl"
        Description: Detect whether Amazon EBS volumes are attached to Amazon EC2 instances
        Properties:
            ControlIdentifier: "arn:aws:controltower:eu-west-1::control/AWS-GR_EC2_VOLUME_INUSE_CHECK"
            TargetIdentifier: "arn:aws:organizations::xxxxxx:ou/o-yyyyy/ou-zzzz"

Expected behavior The AWS-GR_EC2_VOLUME_INUSE_CHECK control should be enabled on the 2 accounts belonging to the existing and registered OU.

Please complete the following information about the solution:

Additional context The CT, Ou and accounts have been deployed a week ago.

RoxanaTeodosiu commented 1 year ago

UPDATE: It seems that the deployment method "stack_set" is incompatible with activating the control rule on the management account.

stumins commented 1 year ago

Hi @RoxanaTeodosiu,

The error message provided does not appear to be an issue with CfCT but rather Control Tower itself, e.g. you are attempting to enable a Control against an unenrolled OU:

"Organizational unit ou-xxxx-xxxxxxx is not registered with AWS Control Tower. (Service: AWSControlTower; Status Code: 404; Error Code: ResourceNotFoundException; Request ID: xxxxxxxx; Proxy: null)"

Have you confirmed that the relevant OU is registered with Control Tower?

Additionally, please note that SCP-based preventative controls do not affect the management account. Config-based detective controls should operate as normal.

The root user and any administrators in the management account can perform work that controls would otherwise deny. This exception is intentional. It prevents the management account from entering into an unusable state. All actions taken within the management account continue to be tracked in the logs contained within the log archive account, for purposes of accountability and auditing.

https://docs.aws.amazon.com/controltower/latest/userguide/controls.html#exception-to-controls

RoxanaTeodosiu commented 1 year ago

Hi @stumins,

Thank you for replying! The OU on which I was searching to enable the recommended control from the CT list is the Security OU created by CT when deploying the landing zone. I have kept the default configuration for testing.

After many tests, I noticed that the error message I was getting on the management account in the Step functions was in fact received from the 2 accounts in the Security OU on which the CfCT solution was deploying the CloudFormation stacks. The problem is that the AWS::ControlTower::EnabledControl is to be made on the management account and not on the accounts in the indicated OU. So, the operation fails as the information it searches for is not available in the child accounts.

So maybe this problem should be taken into account as an enhancement pour allowing the customization (through CloudFormation stacks) of the landing zone also at the management account level. Today the CF stacks are applied on the child accounts.

stumins commented 11 months ago

In the snippet you provided, it looks like you are trying to deploy the EnabledControl stack directly to the target accounts using CFCT:

...
- name: stackset-AWS-GR-EC2-VOLUME-INUSE-CHECK
    resource_file: example-configuration/templates/enable_controls.template
    deploy_method: stack_set
    deployment_targets: # accounts property is not supported for SCPs
      accounts: # :type: list
        - xxxxx
        - xxxxx
...

I believe the correct route here is to specify the TargetIdentifier for the EnabledControl within the stack template, as you did, then to use CFCT to deploy that stack only to the management account. You can use the parameters feature of CFN + CFCT to have a dynamic TargetIdentifier passed a deploy-time if needed.

To deploy stacks to the CT management account using CFCT, you'll need to create the AWSControlTowerExecutionRole as specified in https://docs.aws.amazon.com/controltower/latest/userguide/cfct-root-ou.html

RoxanaTeodosiu commented 11 months ago

Hi Stu,

Thank you for the reply. I've tested the workaround and I confirm that by adding the missing AWSControlTowerExecutionRole role and by choosing to target only the managent account, it works. So maybe this workaround should be integrated in the CfCT deployment stack for this kind of use.

In the meanwhile I've developed a custom solution for dealing with this and more as it turns out, we cannot make more than 10 concurrent calls to CT for enabling controls. If we have a rather longer list of controls we want to apply, we quickly have a limit.

Thanks again for the helping out. Kind regards