0

I have multi-account AWS environment (set up using AWS Landing Zone) and I need to copy a specific security group to all the accounts. I do have a CFT written, but it's too much of a repetitive task to do this one by one.

The security group is in the central (shared-services) account, which has access to all the other accounts. It's better if there's a way to integrate this to Account Vending Machine (AVM) in order to avoid future tasks of exporting the SG to newly spawned accounts.

matsev
  • 32,104
  • 16
  • 121
  • 156
Udara Jayawardana
  • 1,073
  • 2
  • 14
  • 27

5 Answers5

2

You should use CloudFormation Stacksets. StackSets is a feature of cloudformation in which you have a master account in which you create/update/remove the stackset, and you have children accounts. In the stackset, you configure your children aws accounts you want to deploy the CF template and the region as well.

From your comment, your master account is going to be the shared-services and the rest of your accounts, the children ones. You will need to deploy a couple of IAM roles to allow cross-account access, but after that, you will be able to deploy all your templates in up to 500 aws accounts automatically and update them as well.

More information here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html

AGL
  • 536
  • 2
  • 7
1

You can export Security Group and other configuration with CloudFormation using CloudFormer, which creates a template from the existing account configuration. Check the steps in this guide https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-cloudformer.html It will upload the template on S3 and you can reuse it or some of its parts.

Yann
  • 2,426
  • 1
  • 16
  • 33
  • As I stated in the question, I built the SG using a CloudFormation template. But I really don't want to run it in all the accounts manually. I'm looking for an automated solution – Udara Jayawardana Apr 22 '19 at 16:14
0

Since you are using AWS Landing Zone, you can add the security group to the aws_baseline templates, either as a new template or added to one of the existing files. When submitted, AWS Landing Zone uses Step Functions and AWS Stack Sets to deploy your SG to all existing and future accounts. If you choose to create the security group in a new file, you must add a reference to it in the manifest.yaml file (compare with how the other templates are referenced).

matsev
  • 32,104
  • 16
  • 121
  • 156
0

I was able to do this via the Account Vending Machine. But AGL's Stacksets should be a good alternative too.

Udara Jayawardana
  • 1,073
  • 2
  • 14
  • 27
0

To copy AWS Security Gp from one account of any region to other AWS account to any region is required lots of scripting(coding) in aws cli or boto3. But one thing i done which is feasible to my usecase(Whitelist 14 IPs for HTTPS) is write a bash script Here prior i create a blank SG on other AWS account(or u may use aws cli to create that too), `

Region1=

SGFromCopy=

profilefromcopy=

Region2=

SGToCopy=

profiletocopy=

for IP in $(aws ec2 describe-security-groups --region $Region1 --group-id=$SGFromCopy --profile $profilefromcopy --query SecurityGroups[].IpPermissions[].IpRanges[].CidrIp --output text) ;

do  

aws ec2 authorize-security-group-ingress --group-id=$SGToCopy --ip-permissions IpProtocol=TCP,FromPort=443,ToPort=443,IpRanges=[{CidrIp=$IP}] --profile $profiletocopy --region $Region2;

done ;

`
U may modify script if u have csv formated of SG and then just had iterated in while loop


BONUS
To get desire output you have to alter output in file or some where else
> aws ec2 describe-security-groups --region $Region1 --group-id $SGFromCopy --profile $profilefromcopy --query SecurityGroups[].IpPermissions[] --output text
adg
  • 99
  • 6