Interface IIamConfig

IamConfig

Description

IAM configuration

interface IIamConfig {
    groupSets?: IGroupSetConfig[];
    homeRegion?:
        | "af-south-1"
        | "ap-east-1"
        | "ap-east-2"
        | "ap-northeast-1"
        | "ap-northeast-2"
        | "ap-northeast-3"
        | "ap-south-1"
        | "ap-south-2"
        | "ap-southeast-1"
        | "ap-southeast-2"
        | "ap-southeast-3"
        | "ap-southeast-4"
        | "ap-southeast-5"
        | "ap-southeast-7"
        | "ca-central-1"
        | "ca-west-1"
        | "cn-north-1"
        | "cn-northwest-1"
        | "eu-central-1"
        | "eu-central-2"
        | "eu-north-1"
        | "eu-south-1"
        | "eu-south-2"
        | "eu-west-1"
        | "eu-west-2"
        | "eu-west-3"
        | "eu-isoe-west-1"
        | "il-central-1"
        | "me-central-1"
        | "me-south-1"
        | "mx-central-1"
        | "sa-east-1"
        | "us-east-1"
        | "us-east-2"
        | "us-gov-west-1"
        | "us-gov-east-1"
        | "us-iso-east-1"
        | "us-isob-east-1"
        | "us-iso-west-1"
        | "us-isof-south-1"
        | "us-isof-east-1"
        | "us-west-1"
        | "us-west-2";
    identityCenter?: IIdentityCenterConfig;
    managedActiveDirectories?: IManagedActiveDirectoryConfig[];
    policySets?: IPolicySetConfig[];
    providers?: ISamlProviderConfig[];
    roleSets?: IRoleSetConfig[];
    userSets?: IUserSetConfig[];
}

Properties

groupSets? homeRegion? identityCenter? managedActiveDirectories? policySets? providers? roleSets? userSets?

Properties

Optional ReadonlygroupSets

groupSets?: IGroupSetConfig[]

Group set configuration

Remarks

To configure IAM group named Administrators into Root and Infrastructure organizational units, you need to provide following values for this parameter.

Example

groupSets:
  - deploymentTargets:
      organizationalUnits:
        - Root
    groups:
      - name: Administrators
        policies:
          awsManaged:
            - AdministratorAccess

See

IamConfig / GroupSetConfig

Optional ReadonlyhomeRegion

homeRegion?:
    | "af-south-1"
    | "ap-east-1"
    | "ap-east-2"
    | "ap-northeast-1"
    | "ap-northeast-2"
    | "ap-northeast-3"
    | "ap-south-1"
    | "ap-south-2"
    | "ap-southeast-1"
    | "ap-southeast-2"
    | "ap-southeast-3"
    | "ap-southeast-4"
    | "ap-southeast-5"
    | "ap-southeast-7"
    | "ca-central-1"
    | "ca-west-1"
    | "cn-north-1"
    | "cn-northwest-1"
    | "eu-central-1"
    | "eu-central-2"
    | "eu-north-1"
    | "eu-south-1"
    | "eu-south-2"
    | "eu-west-1"
    | "eu-west-2"
    | "eu-west-3"
    | "eu-isoe-west-1"
    | "il-central-1"
    | "me-central-1"
    | "me-south-1"
    | "mx-central-1"
    | "sa-east-1"
    | "us-east-1"
    | "us-east-2"
    | "us-gov-west-1"
    | "us-gov-east-1"
    | "us-iso-east-1"
    | "us-isob-east-1"
    | "us-iso-west-1"
    | "us-isof-south-1"
    | "us-isof-east-1"
    | "us-west-1"
    | "us-west-2"

Accelerator home region name.

Example

homeRegion: &HOME_REGION us-east-1

Optional ReadonlyidentityCenter

identityCenter?: IIdentityCenterConfig

Identity Center configuration

Remarks

To configure Identity Center, you need to provide following values for this parameter.

Example

identityCenter:
 name: identityCenter1
 delegatedAdminAccount: Audit
 identityCenterPermissionSets:
   - name: PermissionSet1
     policies:
       awsManaged:
         - arn:aws:iam::aws:policy/AdministratorAccess
         - PowerUserAccess
       customerManaged:
         - ResourceConfigurationCollectorPolicy
       acceleratorManaged:
         - AcceleratorManagedPolicy01
         - AcceleratorManagedPolicy02
       inlinePolicy: iam-policies/sso-permissionSet1-inline-policy.json
       permissionsBoundary:
         customerManagedPolicy:
           name: AcceleratorManagedPolicy
           path: /
         awsManagedPolicyName: PowerUserAccess
     sessionDuration: 60
  identityCenterAssignments:
    - name: Assignment1
      permissionSetName: PermissionSet1
      principals:
        - type: USER
          name: accelerator
        - type: GROUP
          name: admin
      deploymentTargets:
        accounts:
          - LogArchive

See

IamConfig / IdentityCenterConfig

Optional ReadonlymanagedActiveDirectories

managedActiveDirectories?: IManagedActiveDirectoryConfig[]

Description

Managed active directory configuration

Remarks

To configure AWS Microsoft managed active directory of enterprise edition, along with accelerator provisioned EC2 instance to pre configure directory users. group, you need to provide following values for this parameter.

Example

managedActiveDirectories:
 - name: AcceleratorManagedActiveDirectory
   type: AWS Managed Microsoft AD
   account: Network
   region: us-east-1
   dnsName: example.com
   netBiosDomainName: example
   description: Example managed active directory
   edition: Enterprise
   resolverRuleName: example-com-rule
   vpcSettings:
     vpcName: ManagedAdVpc
     subnets:
       - subnet1
       - subnet2
   secretConfig:
     account: Audit
     region: us-east-1
     adminSecretName: admin
   sharedOrganizationalUnits:
     organizationalUnits:
       - Root
     excludedAccounts:
       - Management
   logs:
     groupName: /aws/directoryservice/AcceleratorManagedActiveDirectory
     retentionInDays: 30
   activeDirectoryConfigurationInstance:
     instanceType: t3.large
     vpcName: MyVpc
     subnetName: subnet
     imagePath: /aws/service/ami-windows-latest/Windows_Server-2016-English-Full-Base
     securityGroupInboundSources:
       - 10.0.0.0/16
     instanceRole: EC2-Default-SSM-AD-Role
     enableTerminationProtection: false
     userDataScripts:
       - scriptName: JoinDomain
         scriptFilePath: ad-config-scripts/Join-Domain.ps1
       - scriptName: InitializeRDGW ## Do not Need
         scriptFilePath: ad-config-scripts/Initialize-RDGW.ps1
       - scriptName: AWSQuickStart
         scriptFilePath: ad-config-scripts/AWSQuickStart.psm1
       - scriptName: ADGroupSetup
         scriptFilePath: ad-config-scripts/AD-group-setup.ps1
       - scriptName: ADUserSetup
         scriptFilePath: ad-config-scripts/AD-user-setup.ps1
       - scriptName: ADUserGroupSetup
         scriptFilePath: ad-config-scripts/AD-user-group-setup.ps1
       - scriptName: ADGroupGrantPermissionsSetup
         scriptFilePath: ad-config-scripts/AD-group-grant-permissions-setup.ps1
       - scriptName: ADConnectorPermissionsSetup
         scriptFilePath: ad-config-scripts/AD-connector-permissions-setup.ps1
       - scriptName: ConfigurePasswordPolicy
         scriptFilePath: ad-config-scripts/Configure-password-policy.ps1
     adGroups:
       - aws-Provisioning
       - aws-Billing
     adPerAccountGroups:
       - "*-Admin"
       - "*-PowerUser"
       - "*-View"
     adConnectorGroup: ADConnector-grp
     sharedAccounts:
       - Management
       - Audit
       - LogArchive
     adPasswordPolicy:
       history: 24
       maximumAge: 90
       minimumAge: 1
       minimumLength: 14
       complexity: true
       reversible: false
       failedAttempts: 6
       lockoutDuration: 30
       lockoutAttemptsReset: 30
     adUsers:
       - name: adconnector-usr
         email: example-adconnector-usr@example.com
         groups:
           - ADConnector-grp
       - name: user1
         email: example-user1@example.com
         groups:
           - aws-Provisioning
           - "*-View"
           - "*-Admin"
           - "*-PowerUser"
           - AWS Delegated Administrators
       - name: user2
         email: example-user2@example.com
         groups:
           - aws-Provisioning
           - "*-View"

See

IamConfig / ManagedActiveDirectoryConfig

Optional ReadonlypolicySets

policySets?: IPolicySetConfig[]

Policy set configuration.

To configure IAM policy named Default-Boundary-Policy with permission boundary defined in iam-policies/boundary-policy.json file, you need to provide following values for this parameter.

Example

policySets:
  - deploymentTargets:
      organizationalUnits:
        - Root
    identityCenterDependency: false
    policies:
      - name: Default-Boundary-Policy
        policy: iam-policies/boundary-policy.json

See

IamConfig / PolicySetConfig

Optional Readonlyproviders

providers?: ISamlProviderConfig[]

SAML provider configuration To configure SAML configuration, you need to provide the following values for this parameter. Replace provider name and metadata document file. Document file must be in config repository

Example

providers:
 - name: <PROVIDER_NAME>
   metadataDocument: <METADATA_DOCUMENT_FILE>

See

IamConfig / SamlProviderConfig

Optional ReadonlyroleSets

roleSets?: IRoleSetConfig[]

Role sets configuration

Remarks

To configure EC2-Default-SSM-AD-Role role to be assumed by ec2 service into Root and Infrastructure organizational units, you need to provide following values for this parameter. This role will have AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess and CloudWatchAgentServerPolicy policy with permission boundary defined by Default-Boundary-Policy

Example

roleSets:
  - deploymentTargets:
      organizationalUnits:
        - Root
    roles:
      - name: EC2-Default-SSM-AD-Role
        assumedBy:
          - type: service
            principal: ec2.amazonaws.com
        policies:
          awsManaged:
            - AmazonSSMManagedInstanceCore
            - AmazonSSMDirectoryServiceAccess
            - CloudWatchAgentServerPolicy
        boundaryPolicy: Default-Boundary-Policy

See

IamConfig / RoleSetConfig

Optional ReadonlyuserSets

userSets?: IUserSetConfig[]

User set configuration

Remarks

To configure breakGlassUser01 user into Administrators in Management account, you need to provide following values for this parameter.

Example

userSets:
  - deploymentTargets:
      accounts:
        - Management
    users:
      - username: breakGlassUser01
        group: Administrators
        boundaryPolicy: Default-Boundary-Policy

See

IamConfig / UserSetConfig

Settings

Member Visibility

On This Page

Properties