Class GlobalConfig

Accelerator global configuration

Hierarchy

GlobalConfig

Implements

IGlobalConfig

Constructors

constructor

new GlobalConfig(props: {
    controlTower: {
        enable: boolean;
        landingZone?: ControlTowerLandingZoneConfig;
    };
    homeRegion: string;
    managementAccountAccessRole: string;
}, values?: IGlobalConfig): GlobalConfig
Parameters
- props: {
      controlTower: {
          enable: boolean;
          landingZone?: ControlTowerLandingZoneConfig;
      };
      homeRegion: string;
      managementAccountAccessRole: string;
  }
  - controlTower: {
    enable: boolean;
    landingZone?: ControlTowerLandingZoneConfig;
    }
    - enable: boolean
    - Optional landingZone?: ControlTowerLandingZoneConfig
  - homeRegion: string
  - managementAccountAccessRole: string
- Optional values: IGlobalConfig
Returns GlobalConfig

Properties

`Readonly` acceleratorMetadata

acceleratorMetadata: undefined | AcceleratorMetadataConfig = undefined

Accelerator Metadata Configuration Creates a bucket in the logging account to enable accelerator metadata collection

Example

acceleratorMetadata:
  enable: true
  account: Logging

`Readonly` acceleratorSettings

acceleratorSettings: undefined | AcceleratorSettingsConfig = undefined

Accelerator Settings Configuration Allows setting additional properties for accelerator

Example

acceleratorSettings:
 maxConcurrentStacks: 250

`Readonly` backup

backup: undefined | BackupConfig = undefined

Backup Vaults Configuration

To generate vaults, you need to provide below value for this parameter.

Example

backup:
  vaults:
    - name: MyBackUpVault
      deploymentTargets:
        organizationalUnits:
          - Root

`Readonly` cdkOptions

cdkOptions: cdkOptionsConfig = ...

AWS CDK options configuration. This lets you customize the operation of the CDK within LZA, specifically:

centralizeBuckets: Enabling this option modifies the CDK bootstrap process to utilize a single S3 bucket per region located in the management account for CDK assets generated by LZA. Otherwise, CDK will create a new S3 bucket in every account and every region supported by LZA. useManagementAccessRole: Enabling this option modifies CDK operations to use the IAM role specified in the managementAccountAccessRole option in global-config.yaml rather than the default roles created by CDK. Default CDK roles will still be created, but will remain unused. Any stacks previously deployed by LZA will retain their associated execution role. For more information on these roles, please see here.

Example

cdkOptions:
  centralizeBuckets: true
  useManagementAccessRole: true

`Readonly` centralizeCdkBuckets

centralizeCdkBuckets: undefined | centralizeCdkBucketsConfig = undefined

Deprecated

NOTICE: The configuration of CDK buckets is being moved to cdkOptions in the Global Config. This block is deprecated and will be removed in a future release

See

cdkOptionsConfig

To indicate workload accounts should utilize the cdk-assets S3 buckets in the management account, you need to provide below value for this parameter.

Example

centralizeCdkBuckets:
  enable: true

`Readonly` cloudwatchLogRetentionInDays

cloudwatchLogRetentionInDays: 3653 = 3653

Global CloudWatch Logs retention in days configuration.

Remarks

This retention setting will be applied to all CloudWatch log groups created by the accelerator. Additionally, this retention setting will be applied to any CloudWatch log groups that already exist in the target environment if the log group's retention setting is LOWER than this configured value.

`Readonly` controlTower

controlTower: ControlTowerConfig = ...

AWS Control Tower Landing Zone configuration

To indicate environment has control tower enabled, you need to provide below value for this parameter.

Example

controlTower:
  enable: true

`Readonly` enabledRegions

List of AWS Region names where accelerator will be deployed. Home region must be part of this list.

To add us-west-2 along with home region for accelerator deployment, you need to provide below value for this parameter.

Example

enabledRegions:
  - *HOME_REGION
  - us-west-2

`Readonly` externalLandingZoneResources

externalLandingZoneResources: undefined | externalLandingZoneResourcesConfig = undefined

ExternalLandingZoneResourcesConfig.

Example

externalLandingZoneResources:
  importExternalLandingZoneResources: false

`Readonly` homeRegion

homeRegion: string = ''

Accelerator home region name. The region where accelerator pipeline deployed.

To use us-east-1 as home region for the accelerator, you need to provide below value for this parameter. Note: Variable HOME_REGION created for future usage of home region in the file

Example

homeRegion: &HOME_REGION us-east-1

iamRoleSsmParameters

iamRoleSsmParameters: {
    account: string;
    parametersByPath: {
        [key: string]: string;
    };
    region: string;
}[] = []

SSM IAM Role Parameters to be loaded for session manager policy attachments

`Readonly` lambda

lambda: undefined | LambdaConfig = undefined

AWS Lambda Function environment variables encryption configuration options.

Remarks

You can decide to use AWS KMS CMK or AWS managed key for Lambda function environment variables encryption. When this property is undefined, the solution will deploy AWS KMS CMK to encrypt function environment variables. You can use deploymentTargets to control target accounts and regions for the given useCMK configuration.

For more information please see here

Example

lambda:
  encryption:
   useCMK: true
   deploymentTargets:
     organizationalUnits:
       - Root

`Readonly` limits

limits: undefined | ServiceQuotaLimitsConfig[] = undefined

AWS Service Quota - Limit configuration

To enable limits within service quota, you need to provide below value for this parameter.

Example

limits:
  - serviceCode: lambda
    quotaCode: L-2ACBD22F
    desiredValue: 2000
    deploymentTargets:
      organizationalUnits:
        - Infrastructure

`Readonly` logging

logging: LoggingConfig = ...

Accelerator logging configuration

To enable organization trail and session manager logs sending to S3, you need to provide below value for this parameter.

Example

logging:
  account: LogArchive
  cloudtrail:
    enable: false
    organizationTrail: false
    cloudtrailInsights:
      apiErrorRateInsight: true
      apiCallRateInsight: true
  sessionManager:
    sendToCloudWatchLogs: false
    sendToS3: true
  cloudwatchLogs:
    dynamicPartitioning: logging/dynamic-partition.json

`Readonly` managementAccountAccessRole

managementAccountAccessRole: string = ''

This role trusts the management account, allowing users in the management account to assume the role, as permitted by the management account administrator. The role has administrator permissions in the new member account.

Examples:

AWSControlTowerExecution
OrganizationAccountAccessRole

`Readonly` reports

reports: undefined | ReportConfig = undefined

Report configuration

To enable budget report along with cost and usage report, you need to provide below value for this parameter.

Example

reports:
  costAndUsageReport:
    compression: Parquet
    format: Parquet
    reportName: accelerator-cur
    s3Prefix: cur
    timeUnit: DAILY
    refreshClosedReports: true
    reportVersioning: CREATE_NEW_REPORT
  budgets:
    - name: accel-budget
      timeUnit: MONTHLY
      type: COST
      amount: 2000
      includeUpfront: true
      includeTax: true
      includeSupport: true
      includeSubscription: true
      includeRecurring: true
      includeOtherSubscription: true
      includeDiscount: true
      includeCredit: false
      includeRefund: false
      useBlended: false
      useAmortized: false
      unit: USD
      notifications:
      - type: ACTUAL
        thresholdType: PERCENTAGE
        threshold: 90
        comparisonOperator: GREATER_THAN
        subscriptionType: EMAIL
        address: myemail+pa-budg@example.com

`Readonly` s3

s3: undefined | S3GlobalConfig = undefined

AWS S3 global configuration options.

Remarks

You can decide to create AWS KMS CMK for AWS S3 server side encryption. When this property is undefined, the solution will deploy AWS KMS CMK to encrypt AWS S3 bucket. You can use deploymentTargets to control target accounts and regions for the given createCMK configuration. This configuration is not applicable to LogArchive's central logging region, because the solution deployed CentralLogs bucket always encrypted with AWS KMS CMK. This configuration is not applicable to the Management account Asset bucket in the home region. This bucket will always have a key generated and applied to the bucket if it is created. This configuration is not applicable to the assets S3 bucket if the bucket is created. This bucket will always have a key generated and applied.

For more information please see here

Example

s3:
  createCMK: true
  deploymentTargets:
    organizationalUnits:
      - Root

`Readonly` snsTopics

snsTopics: undefined | SnsConfig = undefined

SNS Topics Configuration

To send CloudWatch Alarms and SecurityHub notifications you will need to configure at least one SNS Topic For SecurityHub notification you will need to set the deployment target to Root in order to receive notifications from all accounts

Example

snsTopics:
  deploymentTargets:
    organizationalUnits:
      - Root
  topics:
    - name: Security
      emailAddresses:
        - SecurityNotifications@example.com

`Readonly` ssmInventory

ssmInventory: undefined | SsmInventoryConfig = undefined

SSM Inventory Configuration

EC2 prerequisites Connectivity prerequisites

Example

ssmInventory:
  enable: true
  deploymentTargets:
    organizationalUnits:
      - Infrastructure

`Readonly` ssmParameters

ssmParameters: undefined | SsmParametersConfig[]

SSM parameter configurations

Create SSM parameters through the LZA. Parameters can be deployed to Organizational Units or Accounts using deploymentTargets

Example

ssmParameters:
  - deploymentTargets:
      organizationalUnits:
        - Workloads
    parameters:
      - name: WorkloadParameter
        path: /my/custom/path/variable
        value: 'MySSMParameterValue'

`Readonly` tags

tags: Tag[] = []

Custom Tags for all resources created by Landing Zone Accelerator that can be tagged.

Example

tags:
  - key: Environment
    value: Dev
  - key: ResourceOwner
    value: AcmeApp
  - key: CostCenter
    value: '123'

`Readonly` terminationProtection

terminationProtection: true = true

Whether to enable termination protection for this stack.

`Static` `Readonly` FILENAME

FILENAME: "global-config.yaml" = 'global-config.yaml'

Global configuration file name, this file must be present in accelerator config repository

Methods

`Private` downloadASEAStacksAndResources

downloadASEAStacksAndResources(props: {
    mapping: ASEAMappings;
    mappingBucket: string;
    s3Client: S3;
    tempDirectory: string;
}): Promise<string[]>
Parameters
- props: {
      mapping: ASEAMappings;
      mappingBucket: string;
      s3Client: S3;
      tempDirectory: string;
  }
  - mapping: ASEAMappings
  - mappingBucket: string
  - s3Client: S3
  - tempDirectory: string
Returns Promise<string[]>

`Private` downloadFile

downloadFile(props: {
    bucket: string;
    relativePath: string;
    s3Client: S3;
    tempDirectory: string;
}): Promise<string>
Parameters
- props: {
      bucket: string;
      relativePath: string;
      s3Client: S3;
      tempDirectory: string;
  }
  - bucket: string
  - relativePath: string
  - s3Client: S3
  - tempDirectory: string
Returns Promise<string>

`Private` findUniqueNonSuspendedAccounts

findUniqueNonSuspendedAccounts(accountsConfig: AccountsConfig, uniqueAccountsFromMapping: string[]): Promise<string[]>
Parameters
- accountsConfig: AccountsConfig
- uniqueAccountsFromMapping: string[]
Returns Promise<string[]>

`Private` getCrossAccountSsmClient

getCrossAccountSsmClient(region: string, assumeRoleCredential: AssumeRoleCommandOutput): SSMClient
Parameters
- region: string
- assumeRoleCredential: AssumeRoleCommandOutput
Returns SSMClient

`Private` getParametersByPath

getParametersByPath(path: string, ssmClient: SSMClient): Promise<{
[key: string]: string;
}>
Parameters
- path: string
- ssmClient: SSMClient
Returns Promise<{
[key: string]: string;
}>

`Private` getS3Object

getS3Object(props: {
    bucket: string;
    objectKey: string;
    s3Client?: S3;
}): Promise<undefined | {
    body: string;
    path: string;
}>
Parameters
- props: {
      bucket: string;
      objectKey: string;
      s3Client?: S3;
  }
  - bucket: string
  - objectKey: string
  - Optional s3Client?: S3
Returns Promise<undefined | {
body: string;
path: string;
}>

getSnsTopicNames

getSnsTopicNames(): string[]
Returns string[]

loadExternalMapping

loadExternalMapping(accountsConfig: AccountsConfig): Promise<void>
Parameters
- accountsConfig: AccountsConfig
Returns Promise<void>

loadIAMRoleSSMParameters

loadIAMRoleSSMParameters(region: string, partition: string, prefix: string, accounts: string[], managementAccountId: string, isOrgEnabled: boolean): Promise<void>
Parameters
- region: string
- partition: string
- prefix: string
- accounts: string[]
- managementAccountId: string
- isOrgEnabled: boolean
Returns Promise<void>

`Private` loadIAMRoleSSMParametersByEnv

loadIAMRoleSSMParametersByEnv(ssmPath: string, account: string, region: string, partition: string, managementAccountId: string): Promise<{
    account: string;
    parametersByPath: {
        [key: string]: string;
    };
    region: string;
}>
Parameters
- ssmPath: string
- account: string
- region: string
- partition: string
- managementAccountId: string
Returns Promise<{
    account: string;
    parametersByPath: {
        [key: string]: string;
    };
    region: string;
}>

loadJsonFromDisk

loadJsonFromDisk(filePath: string): any
Parameters
- filePath: string
Returns any

loadLzaResources

loadLzaResources(partition: string, prefix: string): Promise<void>
Parameters
- partition: string
- prefix: string
Returns Promise<void>

`Private` loadRegionLzaResources

loadRegionLzaResources(region: string, partition: string, prefix: string, accounts: string[]): Promise<void>
Parameters
- region: string
- partition: string
- prefix: string
- accounts: string[]
Returns Promise<void>

`Private` readJsonFromDisk

readJsonFromDisk(mappingFilePath: string): Promise<any>
Parameters
- mappingFilePath: string
Returns Promise<any>

saveAseaResourceMapping

saveAseaResourceMapping(resources: AseaResourceMapping[]): Promise<void>
Parameters
- resources: AseaResourceMapping[]
Returns Promise<void>

`Static` load

load(dir: string, replacementsConfig?: ReplacementsConfig): GlobalConfig
Load from file in given directory

Returns
Parameters
- dir: string
- Optional replacementsConfig: ReplacementsConfig
Returns GlobalConfig

`Static` loadFromString

loadFromString(content: string): undefined | GlobalConfig
Load from string content
Parameters
- content: string
Returns undefined | GlobalConfig

`Static` loadRawGlobalConfig

loadRawGlobalConfig(dir: string): GlobalConfig
Loads the file raw with default replacements placeholders just to get the management account access role. This is required to get the Role name that can be assumed to load the replacements, so cannot be done using the normal loading method. This is abstracted away so that this method of loading is not accidentally used to partially load config files.
Parameters
- dir: string
Returns GlobalConfig

Class GlobalConfig

Hierarchy

Implements

Index

Constructors

Properties

Methods

Constructors

constructor

Parameters

props: { controlTower: { enable: boolean; landingZone?: ControlTowerLandingZoneConfig; }; homeRegion: string; managementAccountAccessRole: string; }

controlTower: { enable: boolean; landingZone?: ControlTowerLandingZoneConfig; }

enable: boolean

Optional landingZone?: ControlTowerLandingZoneConfig

homeRegion: string

managementAccountAccessRole: string

Optional values: IGlobalConfig

Returns GlobalConfig

Properties

Readonly acceleratorMetadata

Example

Readonly acceleratorSettings

Example

Readonly backup

Example

Readonly cdkOptions

Example

Readonly centralizeCdkBuckets

See

Example

Readonly cloudwatchLogRetentionInDays

Remarks

Readonly controlTower

Example

Readonly enabledRegions

Example

Readonly externalLandingZoneResources

Example

Readonly homeRegion

Example

iamRoleSsmParameters

Readonly lambda

Remarks

Example

Readonly limits

Example

Readonly logging

Example

Readonly managementAccountAccessRole

Readonly reports

Example

Readonly s3

Remarks

Example

Readonly snsTopics

Example

Readonly ssmInventory

Example

Readonly ssmParameters

Example

Readonly tags

Example

Readonly terminationProtection

Static Readonly FILENAME

Methods

Private downloadASEAStacksAndResources

Parameters

props: { mapping: ASEAMappings; mappingBucket: string; s3Client: S3; tempDirectory: string; }

mapping: ASEAMappings

mappingBucket: string

s3Client: S3

tempDirectory: string

Returns Promise<string[]>

Private downloadFile

Parameters

props: { bucket: string; relativePath: string; s3Client: S3; tempDirectory: string; }

bucket: string

relativePath: string

s3Client: S3

tempDirectory: string

props: {
controlTower: {
enable: boolean;
landingZone?: ControlTowerLandingZoneConfig;
};
homeRegion: string;
managementAccountAccessRole: string;
}

controlTower: {
enable: boolean;
landingZone?: ControlTowerLandingZoneConfig;
}

`Optional` landingZone?: ControlTowerLandingZoneConfig

`Optional` values: IGlobalConfig

`Readonly` acceleratorMetadata

`Readonly` acceleratorSettings

`Readonly` backup

`Readonly` cdkOptions

`Readonly` centralizeCdkBuckets

`Readonly` cloudwatchLogRetentionInDays

`Readonly` controlTower

`Readonly` enabledRegions

`Readonly` externalLandingZoneResources

`Readonly` homeRegion

`Readonly` lambda

`Readonly` limits

`Readonly` logging

`Readonly` managementAccountAccessRole

`Readonly` reports

`Readonly` s3

`Readonly` snsTopics

`Readonly` ssmInventory

`Readonly` ssmParameters

`Readonly` tags

`Readonly` terminationProtection

`Static` `Readonly` FILENAME

`Private` downloadASEAStacksAndResources

props: {
mapping: ASEAMappings;
mappingBucket: string;
s3Client: S3;
tempDirectory: string;
}

`Private` downloadFile

props: {
bucket: string;
relativePath: string;
s3Client: S3;
tempDirectory: string;
}

`Private` findUniqueNonSuspendedAccounts

`Private` getCrossAccountSsmClient

`Private` getParametersByPath

Returns Promise<{
[key: string]: string;
}>

`Private` getS3Object

props: {
bucket: string;
objectKey: string;
s3Client?: S3;
}

`Optional` s3Client?: S3

Returns Promise<undefined | {
body: string;
path: string;
}>

`Private` loadIAMRoleSSMParametersByEnv

Returns Promise<{
account: string;
parametersByPath: {
[key: string]: string;
};
region: string;
}>

`Private` loadRegionLzaResources

`Private` readJsonFromDisk