AWS Organizations

Stories about AWS Organizations by Teri Radichel

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.

🔒 Related Stories: AWS Organizations | Data Breaches | Governance

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

Get Teri Radichel’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I’ve been working through setting up an AWS Organization from scratch (again). I’ve done this multiple times with and without AWS Control Tower, AWS SSO, etc. I actually wrote a class on AWS Control Tower but never taught it. I even had someone test the labs. But I had too may issues with it (it is a lot better than what some people are doing to manage security in the cloud but wasn’t the solution I wanted) so I ended up moving in a different direction. There are many options for deploying AWS Organizations and resources but these posts will give you some insight into things you might want to think about and gotchas you might face along the way so you can prepare.

Creating an AWS Account

re:Boot ~ Creating an AWS Account

Creating an AWS Organization

Automated AWS Organization Creation

Creating Accounts and Organizational Units for AWS Organizations

Defining AWS Accounts and Organizational Units

Create an AWS Account with CloudFormation

Creating an Organizational Unit (OU) and Service Control Policies (SCPs) with CloudFormation

Governance for DNS on AWS

This is another way to create an AWS account using a Lambda function, but I did not use this approach due to the inability to use AWS CloudFormation drift detection and alignment of code to resources provided by CloudFormation in that it is metadata that clearly describes resources. It also separates the execution of the deployment from what is deployed (depending on how you use it). But this is another option:

Automate AWS Account Creation

Creating an AWS Backup Account

Increase AWS Organizations Account Limit

Risks Associated with AWS Organizations

Risk Associated with the Root User for a New AWS Organizations Account

Risk Associated With The Role Created In New AWS Organizations Accounts

A Safer AWS Organizations Management Role

AWS Organizations Governance and Service Control Policies

Letting Governance Teams Govern

Creating an AWS Governance Account

Delegated Administrator for AWS Organizations

Delegating SCP Management to Governance Team via AWS Organizations

AWS Service Control Policies

Root SCP Fails to Disable Root Actions — Troubleshooting SCPs

Incremental Service Control Policy Rollouts to Prevent Production Outages

Root OU Service Control Policies

Creating an Organizational Unit (OU) and Service Control Policies (SCPs) with CloudFormation

SCP to Allow Closing and Removing AWS Accounts — Part 1

SCP to Allow Closing and Removing AWS Accounts — Part 2

SCP to Allow Closing and Removing AWS Accounts — Part 3

Preventing Ransomware Attacks Using SSE-C in S3 Buckets

IAM for Organizations

IAM Administrator Permissions for An AWS Organization

AWS IAM Architecture for New AWS Accounts

Organizational Root User for Initial Setup on AWS

Cross-Account Access to an Account in an AWS Organization

Assume the Organizations Role in the Sandbox Account

Create an AWS Sandbox Account Administrator

Deploy a Cross Account Role that Requires MFA Using CloudFormation

What is an identity provider (IdP)?

Federating AWS Authentication to Okta with SAML

Okta SAML Integration with AWS IAM Step 2: AWS IAM Identity Provider

Many more posts on related topics in my IAM posts:

AWS IAM

AWS Organizations CloudTrail

Steps to Enable CloudTrail for an AWS Organization

AWS Organizations: Enable All Features

Create A KMS Key for AWS Organizations Trail

Granting AWS CloudTrail and Users Permission to use a KMS Key

S3 Bucket for CloudTrail

S3 Bucket Policy for an Organization CloudTrail Bucket

S3 Server Access Log Bucket Policy

Create an Organization CloudTrail with CloudFormation

Closing and Moving Accounts in Organizations

Closing an AWS account has much improved…just one request…

Closing and Moving An AWS Account Is Much Improved — But One Request

Close an AWS Account in an Organization

Closing An AWS Account Associated With AWS Control Tower

AWS Organizations Close Account Constraint

Move Account from Organization to Another

Enabling Cost and Usage

SCP to Allow Closing and Removing AWS Accounts — Part 1

Analyzing CloudTrail Requests Related to SCPs

KMS Keys for AWS Organizations Environments

Generic Scripts For Deploying an Organizations, Environments, and Applications

Getting the Role Name That Deployed a Resource

Getting the ARN or ID for A Resource Deployed With CloudFormation

Why I Am Not Using AWS Organizational Unit for My Environment Name

Simplifying Deployment Scripts While Maintaining Separation of Duties

BoolIfExists for MFA — Just Say No

Restricting Users to Creation of Their Own MFA Devices

Restricting Users to Changing Their Own Credentials

How to End an Active AWS CLI Assumed Role Session

Preventing Privilege Escalation with an AWS IAM Permission Boundary

AWS IAM Permission Boundaries Versus Service Control Policies

Architecting Administrative Access in an AWS Organization

Deploying the Initial Admin User With Limited Permissions

Deploy an Organization With CloudFormation

Multiple accounts and environments — reworking to support

Getting the ARN or ID for A Resource Deployed With CloudFormation

Why I Am Not Using AWS Organizational Unit for My Environment Name

Aligning Template File Names With Resource Names

A Better Function For Validating Parameters Are Set

Simplifying Deployment Scripts While Maintaining Separation of Duties

BoolIfExists for MFA — Just Say No

Restricting Users to Creation of Their Own MFA Devices

Restricting Users to Changing Their Own Credentials

How to End an Active AWS CLI Assumed Role Session

Preventing Privilege Escalation with an AWS IAM Permission Boundary

AWS IAM Permission Boundaries Versus Service Control Policies

Architecting Administrative Access in an AWS Organization

Deploying the Initial Admin User With Limited Permissions

Deploy an Organization With CloudFormation

Creating an Initial Admin Role Credentials For Automation With MFA

Creating a Common Deployment Container That Requires MFA

AWS Service Endpoints and VPC Endpoints

Using a Deployment Container That Requires MFA to Deploy Resources to an Account In Another AWS…

Resources To Deploy for an AWS Organization Using a Common Deployment Container

Migrating AWS Organization Configuration Code to a Container

Using Session Names to Log Who Deployed What in CloudTrail

Generic Changes to Migrate Scripts From My POC Code Base to the Container Code Base

Why I am not using Dynamic AWS SSM Parameter Store Resolution in CloudFormation

In this post, I use my container that requires MFA for deployments to deploy resources in parallel. In this example I depoy most of the Organizational Units for my AWS Organization.

Parallel Processing for CloudFormation Micro-Templates

Protecting against an SSH vulnerability involving the RSA algorithm

Creating a Service Control Policy To Limit SSH Key Algorithms

Repository Accounts and Administrators

Related for AWS Organizations:

AWS Resources Organization and Naming Conventions

Creating Shared Repositories and Code in an Organization

Enabling Cost and Usage

Assessing Supply Chain Geopolitical Risk

Security Risks Associated with Support Teams

Stories on Cloud Governance

Cloud Governance

Automating Cybersecurity Metrics

Automating Cybersecurity Metrics (ACM)

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab