• Landing Zone Accelerator on AWS
  • Included Services, Features, and Configuration References
    • Account Configuration
    • Global Configuration
    • Identity and Access Management (IAM) Configuration
    • Network Configuration
    • AWS Organizations Configuration
    • Security Configuration
    • Customization Configuration
    • Other Services and Features
  • Centralized Logging
    • Supported Log Types
    • Log Centralization Methods
  • Package Structure
    • @aws-accelerator/accelerator
    • @aws-accelerator/config
    • @aws-accelerator/constructs
    • @aws-accelerator/installer
    • @aws-accelerator/ui (future)
    • @aws-accelerator/utils
    • @aws-cdk-extensions/cdk-extensions
    • @aws-cdk-extensions/tester
  • Creating an Installer Stack
    • 1. Build the Installer stack for deployment
    • 2. Create a GitHub personal access token
    • 3. Store Token in Secrets Manager
    • 4. Deploy the Installer stack

Landing Zone Accelerator on AWS

The Landing Zone Accelerator on AWS solution helps you quickly deploy a secure, resilient, scalable, and fully automated cloud foundation that accelerates your readiness for your cloud compliance program. A landing zone is a cloud environment that offers a recommended starting point, including default accounts, account structure, network and security layouts, and so forth. From a landing zone, you can deploy workloads that utilize your solutions and applications.

The Landing Zone Accelerator (LZA) is architected to align with AWS best practices and in conformance with multiple, global compliance frameworks. When used in coordination with services such as AWS Control Tower, the Landing Zone Accelerator provides a comprehensive no-code solution across 35+ AWS services to manage and govern a multi-account environment built to support customers with highly-regulated workloads and complex compliance requirements. The LZA helps you establish platform readiness with security, compliance, and operational capabilities.

This solution is provided as an open-source project that is built using the AWS Cloud Development Kit (CDK). You install directly into your environment giving you full access to the infrastructure as code (IaC) solution. Through a simplified set of configuration files, you are able to configure additional functionality, guardrails and security services (eg. AWS Managed Config Rules, and AWS SecurityHub), manage your foundational networking topology (eg. VPCs, Transit Gateways, and Network Firewall), and generate additional workload accounts using the AWS Control Tower Account Factory.

There are no additional charges or upfront commitments required to use Landing Zone Accelerator on AWS. You pay only for AWS services enabled in order to set up your platform and operate your guardrails. This solution can also support non-standard AWS partitions, including AWS GovCloud (US), and the US Secret and Top Secret regions.

For an overview and solution deployment guide, please visit Landing Zone Accelerator on AWS

IMPORTANT: This solution will not, by itself, make you compliant. It provides the foundational infrastructure from which additional complementary solutions can be integrated. The information contained in this solution implementation guide is not exhaustive. You must be review, evaluate, assess, and approve the solution in compliance with your organization’s particular security features, tools, and configurations. It is the sole responsibility of you and your organization to determine which regulatory requirements are applicable and to ensure that you comply with all requirements. Although this solution discusses both the technical and administrative requirements, this solution does not help you comply with the non-technical administrative requirements.

This solution collects anonymous operational metrics to help AWS improve the quality of features of the solution. For more information, including how to disable this capability, please see the implementation guide.

Included Services, Features, and Configuration References

Account Configuration

Used to manage all of the AWS accounts within the AWS Organization. Adding a new account configuration to accounts-config.yaml will invoke the account creation process from Landing Zone Accelerator on AWS.

Global Configuration

Used to manage all of the global properties that can be inherited across the AWS Organization. Defined in global-config.yaml.

Identity and Access Management (IAM) Configuration

Used to manage all of the IAM resources across the AWS Organization. Defined in iam-config.yaml.

Network Configuration

Used to manage and implement network resources to establish a WAN/LAN architecture to support cloud operations and application workloads in AWS. Defined in network-config.yaml.

AWS Organizations Configuration

Used to manage organizational units and policies in the AWS Organization. Defined in organization-config.yaml.

Security Configuration

Used to manage configuration of AWS security services. Defined in security-config.yaml.

Customization Configuration

Used to manage configuration of custom applications and CloudFormation stacks. Defined in the optional file customizations-config.yaml.

Other Services and Features

Other mandatory and non-configurable services/features deployed by the solution are described in the Architecture overview and Architecture details section of the solution Implementation Guide.

Centralized Logging

The Landing Zone Accelerator Centralized Logging solution provides the ability to consolidate and manage log files from various sources into a Centralized Logging Account. This enables users to consolidate logs such as audit logs for access, configuration changes, and billing events. You can also collect Amazon CloudWatch Logs from multiple accounts and AWS Regions. The following sections discuss the types of logs that are centralized and the mechanisms used by the accelerator to centralize them.

Supported Log Types

• ELB Logs
• VPC Flow Logs
• Macie Reports
• Cost and Usage Reports
• Config History
• Config Snapshots
• GuardDuty Findings
• CloudWatch Logs
• CloudTrail Digest
• CloudTrail Insights
• CloudTrail Logs
• CloudTrail S3 Access Logs / S3 Access Logs
• SSM Inventory
• SSM Session Manager
• Security Hub Findings

Log Centralization Methods

• S3 Replication - Logs are stored in account specific S3 buckets and have bucket replication enabled to replicate logs to Centralized Logging S3 Bucket in Central Logging Account.
• Service-Native - The AWS Service writes directly to the centralized logging bucket in the central-logging account.
• Log Streaming - Some services do not support native centralized-logging capability and do not allow writing directly to S3 in a centralized account. In order to enable this functionality, the accelerator utilizes CloudWatch and native log forwarding capabilities via the following workflow:
  • Log Group is created in CloudWatch.
  • A subscription filter is added to the CloudWatch Log Group.
  • The subscription filter points to a Log Destination.
  • The Log Destination is a region specific Kinesis Stream in the Central Logging Account.
    • Each enabled region has its own Kinesis Stream in the Central Logging Account.
  • The Kinesis Streams are forwarded into a Kinesis Firehose in the same specific region.
  • The logs are processed by a Lambda function and written to the Central Logging S3 Bucket in the Home Region.

Package Structure

@aws-accelerator/accelerator

A CDK Application. The core of the accelerator solution. Contains all the stack definitions and deployment pipeline for the accelerator. This also includes the CDK Toolkit orchestration.

@aws-accelerator/config

A pure typescript library containing modules to manage the accelerator config files.

@aws-accelerator/constructs

Contains L2/L3 constructs that have been built to support accelerator actions, such as creating an AWS Organizational Unit or VPC. These constructs are intended to be fully reusable, independent of the accelerator, and do not directly access the accelerator configuration files. Example: CentralLogsBucket, an S3 bucket that is configured with a CMK with the proper key and bucket policies to allow services and accounts in the organization to publish logs to the bucket.

@aws-accelerator/installer

Contains a CDK Application that defines the accelerator Installer stack.

@aws-accelerator/ui (future)

A web application that utilizes the aws-ui-components library to present a console to configure the accelerator

@aws-accelerator/utils

Contains common utilities and types that are needed by @aws-accelerator/* packages. For example, throttling and backoff for AWS SDK calls

@aws-cdk-extensions/cdk-extensions

Contains L2 constructs that extend the functionality of the CDK repo. The CDK repo is an actively developed project. As the accelerator team identifies missing features of the CDK, those features will be initially developed locally within this repo and submitted to the CDK project as a pull request.

@aws-cdk-extensions/tester

Accelerator tester CDK app. This package creates AWS Config custom rules for every test cases defined in test case manifest file.

--- |

Creating an Installer Stack

The Installer Stack, a CDK Application, can be deployed through a CloudFormation template produced by your CLI by navigating to the directory for the installer and running a CDK synthesis. The template can either be deployed directly via the AWS CLI or console. Below are the commands for completing the deployment of the Installer stack.

1. Build the Installer stack for deployment

• Install dependencies for the Installer stack

- [Node](https://nodejs.org/en/)
- [AWS CDK](https://aws.amazon.com/cdk/)
- [Yarn](https://yarnpkg.com/)
- [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)

• Install project dependencies

cd <rootDir>/source
yarn install && yarn lerna link

• To run the CDK synthesis

cd <rootDir>/source/packages/@aws-accelerator/installer
yarn build && yarn cdk synth

After running these commands, the Installer stack template will be saved to <rootDir>/source/packages/@aws-accelerator/installer/cdk.out/AWSAccelerator-InstallerStack.template.json

2. Create a GitHub personal access token

Follow the instructions on GitHub Docs to create a personal access token (Classic).

When creating the token select public_repo for the selected scope.

3. Store Token in Secrets Manager

Store the personal access token in Secrets Manager.

1. In the AWS Management Console, navigate to Secrets Manager
2. Click Store a new secret
3. On the Choose secret type step select Other type of secret
4. Select the Plaintext tab
5. Completely remove the example text and paste your secret with no formatting no leading or trailing spaces
6. Select the aws/secretsmanager encryption key
7. Click Next
8. On the Configure secret step set the Secret name to accelerator/github-token
9. On the Configure rotation step click Next
10. On the Review step click Store

4. Deploy the Installer stack

• Configure the AWS CLI CloudFormation command for the Installer stack

• Create an S3 bucket and copy the generated template file.

cd <rootDir>/source/packages/@aws-accelerator/installer
aws s3 mb s3://<bucket name>
aws s3 cp ./cdk.out/AWSAccelerator-InstallerStack.template.json s3://<bucket name>

• Create the Installer stack with AWS CLI command:

aws cloudformation create-stack --stack-name AWSAccelerator-InstallerStack --template-body https://<bucket name>.s3.<region>.amazonaws.com/AWSAccelerator-InstallerStack.template.json \
--parameters ParameterKey=RepositoryName,ParameterValue=<Repository_Name> \
ParameterKey=RepositoryBranchName,ParameterValue=<Branch_Name> \
ParameterKey=ManagementAccountEmail,ParameterValue=<Management_Email> \
ParameterKey=LogArchiveAccountEmail,ParameterValue=<LogArchive_Email> \
ParameterKey=AuditAccountEmail,ParameterValue=<Audit_Email> \
ParameterKey=EnableApprovalStage,ParameterValue=Yes \
ParameterKey=ApprovalStageNotifyEmailList,ParameterValue=comma-delimited-notify-emails \
ParameterKey=ControlTowerEnabled,ParameterValue=Yes \
--capabilities CAPABILITY_IAM

• Alternate deployment of CloudFormation via AWS console:

- From your Management account, navigate to CloudFormation page in the AWS console
- Select ‘Create Stack’ and from the dropdown pick ‘with new resources (standard)’
- For the prerequisite template, select ‘Template is ready’
- When specifying the template, select ‘Upload a template file’
- Ensure that you select the correct file ‘AWSLandingZoneAccelerator-InstallerStack.template.json’
- Fill out the required parameters in the UI, and create the stack once the parameters are inputted.

Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

Licensed under the Apache License Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at

http://www.apache.org/licenses/

or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions and limitations under the License.