Skip to content

Commit 3169235

Browse files
author
AWS
committed
Release: 1.5.2
1 parent b0c5bdc commit 3169235

File tree

82 files changed

+337
-206
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+337
-206
lines changed

‎README.md

+6-4
Original file line numberDiff line numberDiff line change
@@ -60,14 +60,15 @@ Now that you have configured and deployed AWS Control Tower Account Factory for
6060

6161
| Name | Version |
6262
|------|---------|
63-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.1 |
64-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72, < 4.0.0 |
63+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.15.1, < 2.0.0 |
64+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9.0, < 5.0.0 |
6565

6666
## Providers
6767

6868
| Name | Version |
6969
|------|---------|
70-
| <a name="provider_local"></a> [local](#provider\_local) | 2.1.0 |
70+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.9.0, < 5.0.0 |
71+
| <a name="provider_local"></a> [local](#provider\_local) | n/a |
7172

7273
## Modules
7374

@@ -88,6 +89,7 @@ Now that you have configured and deployed AWS Control Tower Account Factory for
8889

8990
| Name | Type |
9091
|------|------|
92+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
9193
| [local_file.version](https://registry.terraform.io/providers/hashicorp/local/latest/docs/data-sources/file) | data source |
9294

9395
## Inputs
@@ -103,7 +105,7 @@ Now that you have configured and deployed AWS Control Tower Account Factory for
103105
| <a name="input_aft_feature_cloudtrail_data_events"></a> [aft\_feature\_cloudtrail\_data\_events](#input\_aft\_feature\_cloudtrail\_data\_events) | Feature flag toggling CloudTrail data events on/off | `bool` | `false` | no |
104106
| <a name="input_aft_feature_delete_default_vpcs_enabled"></a> [aft\_feature\_delete\_default\_vpcs\_enabled](#input\_aft\_feature\_delete\_default\_vpcs\_enabled) | Feature flag toggling deletion of default VPCs on/off | `bool` | `false` | no |
105107
| <a name="input_aft_feature_enterprise_support"></a> [aft\_feature\_enterprise\_support](#input\_aft\_feature\_enterprise\_support) | Feature flag toggling Enterprise Support enrollment on/off | `bool` | `false` | no |
106-
| <a name="input_aft_framework_repo_git_ref"></a> [aft\_framework\_repo\_git\_ref](#input\_aft\_framework\_repo\_git\_ref) | Git branch from which the AFT framework should be sourced from | `string` | `"main"` | no |
108+
| <a name="input_aft_framework_repo_git_ref"></a> [aft\_framework\_repo\_git\_ref](#input\_aft\_framework\_repo\_git\_ref) | Git branch from which the AFT framework should be sourced from | `string` | `null` | no |
107109
| <a name="input_aft_framework_repo_url"></a> [aft\_framework\_repo\_url](#input\_aft\_framework\_repo\_url) | Git repo URL where the AFT framework should be sourced from | `string` | `"https://github.com/aws-ia/terraform-aws-control_tower_account_factory.git"` | no |
108110
| <a name="input_aft_management_account_id"></a> [aft\_management\_account\_id](#input\_aft\_management\_account\_id) | AFT Management Account ID | `string` | n/a | yes |
109111
| <a name="input_aft_vpc_cidr"></a> [aft\_vpc\_cidr](#input\_aft\_vpc\_cidr) | CIDR Block to allocate to the AFT VPC | `string` | `"192.168.0.0/22"` | no |

‎VERSION

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.5.1
1+
1.5.2

‎data.tf

+2
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,5 @@
44
data "local_file" "version" {
55
filename = "${path.module}/VERSION"
66
}
7+
8+
data "aws_partition" "current" {}

‎modules/aft-account-provisioning-framework/data.tf

+1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Copyright Amazon.com, Inc. or its affiliates. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33
#
4+
data "aws_partition" "current" {}
45
data "aws_region" "aft_management" {}
56
data "aws_caller_identity" "aft_management" {}
67
data "aws_iam_policy" "AWSLambdaBasicExecutionRole" {

‎modules/aft-account-provisioning-framework/iam.tf

+6
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework_va
1919
name = "aft-lambda-invoke-aft-account-provisioning-framework-validate-request-policy"
2020
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_validate_request.id
2121
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-account-provisioning-framework.tpl", {
22+
data_aws_partition_current_partition = data.aws_partition.current.partition
2223
data_aws_region_aft-management_name = data.aws_region.aft_management.name
2324
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
2425
aft_sns_topic_arn = var.aft_sns_topic_arn
@@ -43,6 +44,7 @@ resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework_ge
4344
name = "aft-lambda-invoke-aft-account-provisioning-framework-get-account-info-policy"
4445
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_get_account_info.id
4546
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-account-provisioning-framework.tpl", {
47+
data_aws_partition_current_partition = data.aws_partition.current.partition
4648
data_aws_region_aft-management_name = data.aws_region.aft_management.name
4749
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
4850
aft_sns_topic_arn = var.aft_sns_topic_arn
@@ -67,6 +69,7 @@ resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework_cr
6769
name = "aft-lambda-invoke-aft_account_provisioning_framework-create-role-policy"
6870
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_create_role.id
6971
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-account-provisioning-framework.tpl", {
72+
data_aws_partition_current_partition = data.aws_partition.current.partition
7073
data_aws_region_aft-management_name = data.aws_region.aft_management.name
7174
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
7275
aft_sns_topic_arn = var.aft_sns_topic_arn
@@ -91,6 +94,7 @@ resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework_ta
9194
name = "aft-lambda-invoke-aft-account-provisioning-framework-tag-account-policy"
9295
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_tag_account.id
9396
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-account-provisioning-framework.tpl", {
97+
data_aws_partition_current_partition = data.aws_partition.current.partition
9498
data_aws_region_aft-management_name = data.aws_region.aft_management.name
9599
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
96100
aft_sns_topic_arn = var.aft_sns_topic_arn
@@ -115,6 +119,7 @@ resource "aws_iam_role_policy" "aft_invoke_aft_account_provisioning_framework_pe
115119
name = "aft-lambda-invoke-aft-account-provisioning-framework-persist-metadata-policy"
116120
role = aws_iam_role.aft_lambda_aft_account_provisioning_framework_persist_metadata.id
117121
policy = templatefile("${path.module}/iam/role-policies/lambda-aft-account-provisioning-framework.tpl", {
122+
data_aws_partition_current_partition = data.aws_partition.current.partition
118123
data_aws_region_aft-management_name = data.aws_region.aft_management.name
119124
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
120125
aft_sns_topic_arn = var.aft_sns_topic_arn
@@ -135,6 +140,7 @@ resource "aws_iam_role_policy" "aft_states" {
135140
role = aws_iam_role.aft_states.id
136141

137142
policy = templatefile("${path.module}/iam/role-policies/iam-aft-states.tpl", {
143+
data_aws_partition_current_partition = data.aws_partition.current.partition
138144
data_aws_region_aft-management_name = data.aws_region.aft_management.name
139145
data_aws_caller_identity_aft-management_account_id = data.aws_caller_identity.aft_management.account_id
140146
})

‎modules/aft-account-provisioning-framework/iam/role-policies/iam-aft-states.tpl

+5-5
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,15 @@
1111
{
1212
"Effect": "Allow",
1313
"Action": "states:StartExecution",
14-
"Resource": "arn:aws:states:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:stateMachine:aft-*"
14+
"Resource": "arn:${data_aws_partition_current_partition}:states:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:stateMachine:aft-*"
1515
},
1616
{
1717
"Effect": "Allow",
1818
"Action": [
1919
"lambda:InvokeFunction"
2020
],
2121
"Resource": [
22-
"arn:aws:lambda:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:function:aft-*"
22+
"arn:${data_aws_partition_current_partition}:lambda:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:function:aft-*"
2323
]
2424
},
2525
{
@@ -28,7 +28,7 @@
2828
"sns:Publish"
2929
],
3030
"Resource": [
31-
"arn:aws:sns:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:aft-*"
31+
"arn:${data_aws_partition_current_partition}:sns:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:aft-*"
3232
]
3333
},
3434
{
@@ -39,7 +39,7 @@
3939
"codebuild:BatchGetBuilds"
4040
],
4141
"Resource": [
42-
"arn:aws:codebuild:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:project/aft-*"
42+
"arn:${data_aws_partition_current_partition}:codebuild:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:project/aft-*"
4343
]
4444
},
4545
{
@@ -50,7 +50,7 @@
5050
"events:DescribeRule"
5151
],
5252
"Resource": [
53-
"arn:aws:events:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:rule/StepFunctionsGetEventForCodeBuildStartBuildRule"
53+
"arn:${data_aws_partition_current_partition}:events:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:rule/StepFunctionsGetEventForCodeBuildStartBuildRule"
5454
]
5555
}
5656
]

‎modules/aft-account-provisioning-framework/iam/role-policies/lambda-aft-account-provisioning-framework.tpl

+4-4
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,14 @@
1313
"dynamodb:Scan"
1414
],
1515
"Resource" : [
16-
"arn:aws:dynamodb:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:table/aft*"
16+
"arn:${data_aws_partition_current_partition}:dynamodb:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:table/aft*"
1717
]
1818
},
1919
{
2020
"Effect" : "Allow",
2121
"Action" : "ssm:GetParameter",
2222
"Resource" : [
23-
"arn:aws:ssm:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:parameter/aft/*"
23+
"arn:${data_aws_partition_current_partition}:ssm:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:parameter/aft/*"
2424
]
2525
},
2626
{
@@ -29,7 +29,7 @@
2929
"sts:AssumeRole"
3030
],
3131
"Resource" : [
32-
"arn:aws:iam::${data_aws_caller_identity_aft-management_account_id}:role/AWSAFTAdmin"
32+
"arn:${data_aws_partition_current_partition}:iam::${data_aws_caller_identity_aft-management_account_id}:role/AWSAFTAdmin"
3333
]
3434
},
3535
{
@@ -56,7 +56,7 @@
5656
],
5757
"Resource" : [
5858
"${aws_kms_key_aft_arn}",
59-
"arn:aws:kms:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:alias/aws/sns"
59+
"arn:${data_aws_partition_current_partition}:kms:${data_aws_region_aft-management_name}:${data_aws_caller_identity_aft-management_account_id}:alias/aws/sns"
6060
]
6161
}
6262
]

‎modules/aft-account-provisioning-framework/states.tf

+4-3
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
locals {
55
state_machine_source = "${path.module}/states/aft_account_provisioning_framework.asl.json"
66
replacements_map = {
7+
current_partition = data.aws_partition.current.partition
78
validate_request_function_name = aws_lambda_function.validate_request.function_name
89
get_account_info_function_name = aws_lambda_function.get_account_info.function_name
910
create_role_function_name = aws_lambda_function.create_role.function_name
@@ -12,9 +13,9 @@ locals {
1213
account_metadata_ssm_function_name = aws_lambda_function.account_metadata_ssm.function_name
1314
aft_notification_arn = var.aft_sns_topic_arn
1415
aft_failure_notification_arn = var.aft_failure_sns_topic_arn
15-
aft_account_provisioning_customizations_state_machine_arn = "arn:aws:states:${data.aws_region.aft_management.name}:${data.aws_caller_identity.aft_management.account_id}:stateMachine:${var.aft_account_provisioning_customizations_sfn_name}"
16-
customizations_trigger_state_machine_arn = "arn:aws:states:${data.aws_region.aft_management.name}:${data.aws_caller_identity.aft_management.account_id}:stateMachine:${var.trigger_customizations_sfn_name}"
17-
aft_account_provisioning_framework_aft_features_state_machine_arn = "arn:aws:states:${data.aws_region.aft_management.name}:${data.aws_caller_identity.aft_management.account_id}:stateMachine:${var.aft_features_sfn_name}"
16+
aft_account_provisioning_customizations_state_machine_arn = "arn:${data.aws_partition.current.partition}:states:${data.aws_region.aft_management.name}:${data.aws_caller_identity.aft_management.account_id}:stateMachine:${var.aft_account_provisioning_customizations_sfn_name}"
17+
customizations_trigger_state_machine_arn = "arn:${data.aws_partition.current.partition}:states:${data.aws_region.aft_management.name}:${data.aws_caller_identity.aft_management.account_id}:stateMachine:${var.trigger_customizations_sfn_name}"
18+
aft_account_provisioning_framework_aft_features_state_machine_arn = "arn:${data.aws_partition.current.partition}:states:${data.aws_region.aft_management.name}:${data.aws_caller_identity.aft_management.account_id}:stateMachine:${var.aft_features_sfn_name}"
1819
}
1920
}
2021

‎modules/aft-account-provisioning-framework/states/aft_account_provisioning_framework.asl.json

+11-11
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
"aft_account_provisioning_framework_validate": {
55
"Next": "aft_account_provisioning_framework_get_account_info",
66
"Type": "Task",
7-
"Resource": "arn:aws:states:::lambda:invoke",
7+
"Resource": "arn:${current_partition}:states:::lambda:invoke",
88
"ResultPath": "$.validated",
99
"ResultSelector": {"Success.$":"$.Payload"},
1010
"Parameters": {
@@ -25,7 +25,7 @@
2525
"aft_account_provisioning_framework_get_account_info": {
2626
"Next": "aft_account_provisioning_framework_persist_metadata",
2727
"Type": "Task",
28-
"Resource": "arn:aws:states:::lambda:invoke",
28+
"Resource": "arn:${current_partition}:states:::lambda:invoke",
2929
"ResultPath": "$.account_info",
3030
"ResultSelector": {"account.$":"$.Payload"},
3131
"Parameters": {
@@ -46,7 +46,7 @@
4646
"aft_account_provisioning_framework_persist_metadata": {
4747
"Next": "aft_account_provisioning_framework_create_role",
4848
"Type": "Task",
49-
"Resource": "arn:aws:states:::lambda:invoke",
49+
"Resource": "arn:${current_partition}:states:::lambda:invoke",
5050
"ResultPath": "$.persist_metadata",
5151
"ResultSelector": {"StatusCode.$":"$.StatusCode"},
5252
"Parameters": {
@@ -67,7 +67,7 @@
6767
"aft_account_provisioning_framework_create_role": {
6868
"Next": "aft_account_provisioning_framework_tag_account",
6969
"Type": "Task",
70-
"Resource": "arn:aws:states:::lambda:invoke",
70+
"Resource": "arn:${current_partition}:states:::lambda:invoke",
7171
"ResultPath": "$.role",
7272
"ResultSelector": {"Arn.$":"$.Payload"},
7373
"Parameters": {
@@ -96,7 +96,7 @@
9696
"aft_account_provisioning_framework_tag_account": {
9797
"Next": "aft_account_provisioning_framework_account_metadata_ssm",
9898
"Type": "Task",
99-
"Resource": "arn:aws:states:::lambda:invoke",
99+
"Resource": "arn:${current_partition}:states:::lambda:invoke",
100100
"ResultPath": "$.account_tags",
101101
"ResultSelector": {"StatusCode.$":"$.StatusCode"},
102102
"Parameters": {
@@ -118,7 +118,7 @@
118118
"aft_account_provisioning_framework_account_metadata_ssm": {
119119
"Next": "aft_account_provisioning_framework_aft_features",
120120
"Type": "Task",
121-
"Resource": "arn:aws:states:::lambda:invoke",
121+
"Resource": "arn:${current_partition}:states:::lambda:invoke",
122122
"ResultPath": "$.account_metadata_ssm",
123123
"ResultSelector": {"StatusCode.$":"$.StatusCode"},
124124
"Parameters": {
@@ -140,7 +140,7 @@
140140
"aft_account_provisioning_framework_aft_features": {
141141
"Next": "aft_account_provisioning_customizations",
142142
"Type": "Task",
143-
"Resource": "arn:aws:states:::states:startExecution.sync:2",
143+
"Resource": "arn:${current_partition}:states:::states:startExecution.sync:2",
144144
"Parameters": {
145145
"StateMachineArn": "${aft_account_provisioning_framework_aft_features_state_machine_arn}",
146146
"Input.$": "$"
@@ -149,7 +149,7 @@
149149
"aft_account_provisioning_customizations": {
150150
"Next": "run_create_pipeline?",
151151
"Type": "Task",
152-
"Resource": "arn:aws:states:::states:startExecution.sync:2",
152+
"Resource": "arn:${current_partition}:states:::states:startExecution.sync:2",
153153
"Parameters": {
154154
"StateMachineArn": "${aft_account_provisioning_customizations_state_machine_arn}",
155155
"Input.$": "$.Input"
@@ -175,7 +175,7 @@
175175
"aft_account_provisioning_framework_create_pipeline": {
176176
"Next": "aft_account_provisioning_framework_notify_success",
177177
"Type": "Task",
178-
"Resource": "arn:aws:states:::codebuild:startBuild.sync",
178+
"Resource": "arn:${current_partition}:states:::codebuild:startBuild.sync",
179179
"Parameters": {
180180
"ProjectName": "aft-create-pipeline",
181181
"EnvironmentVariablesOverride": [
@@ -201,7 +201,7 @@
201201
},
202202
"aft_account_provisioning_framework_notify_success": {
203203
"Type": "Task",
204-
"Resource": "arn:aws:states:::sns:publish",
204+
"Resource": "arn:${current_partition}:states:::sns:publish",
205205
"Parameters": {
206206
"TopicArn": "${aft_notification_arn}",
207207
"Message.$": "$"
@@ -210,7 +210,7 @@
210210
},
211211
"aft_account_provisioning_framework_notify_error": {
212212
"Type": "Task",
213-
"Resource": "arn:aws:states:::sns:publish",
213+
"Resource": "arn:${current_partition}:states:::sns:publish",
214214
"Parameters": {
215215
"TopicArn": "${aft_failure_notification_arn}",
216216
"Message.$": "$.Cause"

‎modules/aft-account-request-framework/data.tf

+2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Copyright Amazon.com, Inc. or its affiliates. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33
#
4+
data "aws_partition" "current" {}
5+
46
data "aws_region" "aft-management" {}
57

68
data "aws_caller_identity" "aft-management" {}

0 commit comments

Comments
 (0)