IamConfig | Landing Zone Accelerator on AWS

IAM configuration

Hierarchy

IamConfig

Implements

TypeOf<typeof iamConfig>

Index

Constructors

constructor

Properties

Methods

Constructors

constructor

new IamConfig(values?: { groupSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; groups: { ...; }[]; }[]; identityCenter: undefined | { name: string; identityCenterPermissionSets: { name: string; policies: { awsManaged: string[] | undefined; customerManaged: string[] | undefined; } | undefined; sessionDuration: number | undefined; }[] | undefined; identityCenterAssignments: { ...; }[] | undefined; }; managedActiveDirectories: undefined | { name: string; account: string; region: "af-south-1" | "ap-east-1" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-southeast-1" | "ap-southeast-2" | ... 19 more ... | "us-isob-east-1"; ... 10 more ...; activeDirectoryConfigurationInstance: { ...; } | undefined; }[]; policySets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; policies: { ...; }[]; }[]; providers: undefined | { name: string; metadataDocument: string; }[]; roleSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; path: string | undefined; roles: { ...; }[]; }[]; userSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; users: { ...; }[]; }[] }): IamConfig

Parameters
- Optional values: { groupSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; groups: { ...; }[]; }[]; identityCenter: undefined | { name: string; identityCenterPermissionSets: { name: string; policies: { awsManaged: string[] | undefined; customerManaged: string[] | undefined; } | undefined; sessionDuration: number | undefined; }[] | undefined; identityCenterAssignments: { ...; }[] | undefined; }; managedActiveDirectories: undefined | { name: string; account: string; region: "af-south-1" | "ap-east-1" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-southeast-1" | "ap-southeast-2" | ... 19 more ... | "us-isob-east-1"; ... 10 more ...; activeDirectoryConfigurationInstance: { ...; } | undefined; }[]; policySets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; policies: { ...; }[]; }[]; providers: undefined | { name: string; metadataDocument: string; }[]; roleSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; path: string | undefined; roles: { ...; }[]; }[]; userSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; users: { ...; }[]; }[] }
  - groupSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; groups: { ...; }[]; }[]
  - identityCenter: undefined | { name: string; identityCenterPermissionSets: { name: string; policies: { awsManaged: string[] | undefined; customerManaged: string[] | undefined; } | undefined; sessionDuration: number | undefined; }[] | undefined; identityCenterAssignments: { ...; }[] | undefined; }
  - managedActiveDirectories: undefined | { name: string; account: string; region: "af-south-1" | "ap-east-1" | "ap-northeast-1" | "ap-northeast-2" | "ap-northeast-3" | "ap-south-1" | "ap-southeast-1" | "ap-southeast-2" | ... 19 more ... | "us-isob-east-1"; ... 10 more ...; activeDirectoryConfigurationInstance: { ...; } | undefined; }[]
  - policySets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; policies: { ...; }[]; }[]
  - providers: undefined | { name: string; metadataDocument: string; }[]
  - roleSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; path: string | undefined; roles: { ...; }[]; }[]
  - userSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; users: { ...; }[]; }[]
Returns IamConfig

Properties

Readonly groupSets

groupSets: GroupSetConfig[] = []

Group set configuration

To configure IAM group named Administrators into Root and Infrastructure organizational units, you need to provide following values for this parameter.

example

groupSets:
  - deploymentTargets:
      organizationalUnits:
        - Root
    groups:
      - name: Administrators
        policies:
          awsManaged:
            - AdministratorAccess

Readonly identityCenter

identityCenter: undefined | IdentityCenterConfig = undefined

Identity Center configuration

To configure Identity Center, you need to provide following values for this parameter.

example

idetityCenterPermissionSets:
  - deploymentTargets:
      organizationalUnits:
        - Root
    groups:
      - name: Administrators
        policies:
          awsManaged:
            - AdministratorAccess

Readonly managedActiveDirectories

managedActiveDirectories: undefined | ManagedActiveDirectoryConfig[] = undefined

Managed active directory configuration

To configure AWS Microsoft managed active directory of enterprise edition, along with LZA provisioned EC2 instance to pre configure directory users. group, you need to provide following values for this parameter.

example

managedActiveDirectories:
 - name: AcceleratorManagedActiveDirectory
   type: AWS Managed Microsoft AD
   account: Network
   region: us-east-1
   dnsName: example.com
   netBiosDomainName: example
   description: Example managed active directory
   edition: Enterprise
   adminSecret:
     name: admin-secret
     account: Audit
     region: us-east-1
   resolverRuleName: example-com-rule
   vpcSettings:
     vpcName: MyVpc
     subnets:
       - subnet1
       - subnet2
   logs:
     logGroupName: /aws/directoryservice/AcceleratorManagedActiveDirectory
     retentionInDays: 30
   activeDirectoryConfigurationInstance:
     instanceType: t3.large
     vpcName: MyVpc
     subnetName: subnet
     imagePath: /aws/service/ami-windows-latest/Windows_Server-2016-English-Full-Base
     securityGroupInboundSources:
       - 10.0.0.0/16
     instanceRole: EC2-Default-SSM-AD-Role
     userDataScripts:
       - scriptName: JoinDomain
         scriptFilePath: ad-config-scripts/Join-Domain.ps1
       - scriptName: InitializeRDGW ## Do not Need
         scriptFilePath: ad-config-scripts/Initialize-RDGW.ps1
       - scriptName: AWSQuickStart
         scriptFilePath: ad-config-scripts/AWSQuickStart.psm1
       - scriptName: ADGroupSetup
         scriptFilePath: ad-config-scripts/AD-group-setup.ps1
       - scriptName: ADUserSetup
         scriptFilePath: ad-config-scripts/AD-user-setup.ps1
       - scriptName: ADUserGroupSetup
         scriptFilePath: ad-config-scripts/AD-user-group-setup.ps1
       - scriptName: ADGroupGrantPermissionsSetup
         scriptFilePath: ad-config-scripts/AD-group-grant-permissions-setup.ps1
       - scriptName: ADConnectorPermissionsSetup
         scriptFilePath: ad-config-scripts/AD-connector-permissions-setup.ps1
       - scriptName: ConfigurePasswordPolicy
         scriptFilePath: ad-config-scripts/Configure-password-policy.ps1
     adGroups:
       - aws-Provisioning
       - aws-Billing
     adPerAccountGroups:
       - "*-Admin"
       - "*-PowerUser"
       - "*-View"
     adConnectorGroup: ADConnector-grp
     sharedAccounts:
       - Management
       - Audit
       - LogArchive
     adPasswordPolicy:
       history: 24
       maximumAge: 90
       minimumAge: 1
       minimumLength: 14
       complexity: true
       reversible: false
       failedAttempts: 6
       lockoutDuration: 30
       lockoutAttemptsReset: 30
     adUsers:
       - name: adconnector-usr
         email: example-adconnector-usr@example.com
         groups:
           - ADConnector-grp
       - name: user1
         email: example-user1@example.com
         groups:
           - aws-Provisioning
           - "*-View"
           - "*-Admin"
           - "*-PowerUser"
           - AWS Delegated Administrators
       - name: user2
         email: example-user2@example.com
         groups:
           - aws-Provisioning
           - "*-View"

Readonly policySets

policySets: PolicySetConfig[] = []

Policy set configuration.

To configure IAM policy named Default-Boundary-Policy with permission boundary defined in iam-policies/boundary-policy.json file, you need to provide following values for this parameter.

example

policySets:
  - deploymentTargets:
      organizationalUnits:
        - Root
    policies:
      - name: Default-Boundary-Policy
        policy: iam-policies/boundary-policy.json

Readonly providers

providers: SamlProviderConfig[] = []

SAML provider configuration To configure SAML configuration, you need to provide the following values for this parameter. Replace provider name and metadata document file. Document file must be in config repository

example

providers:
 - name: <PROVIDER_NAME>
   metadataDocument: <METADATA_DOCUMENT_FILE>

Readonly roleSets

roleSets: RoleSetConfig[] = []

Role sets configuration

To configure EC2-Default-SSM-AD-Role role to be assumed by ec2 service into Root and Infrastructure organizational units, you need to provide following values for this parameter. This role will have AmazonSSMManagedInstanceCore, AmazonSSMDirectoryServiceAccess and CloudWatchAgentServerPolicy policy with permission boundary defined by Default-Boundary-Policy

example

roleSets:
  - deploymentTargets:
      organizationalUnits:
        - Root
    roles:
      - name: EC2-Default-SSM-AD-Role
        assumedBy:
          - type: service
            principal: ec2.amazonaws.com
        policies:
          awsManaged:
            - AmazonSSMManagedInstanceCore
            - AmazonSSMDirectoryServiceAccess
            - CloudWatchAgentServerPolicy
        boundaryPolicy: Default-Boundary-Policy

Readonly userSets

userSets: UserSetConfig[] = []

User set configuration

To configure breakGlassUser01 user into Administrators in Management account, you need to provide following values for this parameter.

example

userSets:
  - deploymentTargets:
      accounts:
        - Management
    users:
      - username: breakGlassUser01
        group: Administrators
        boundaryPolicy: Default-Boundary-Policy

Static Readonly FILENAME

FILENAME: "iam-config.yaml" = 'iam-config.yaml'

A name for the iam config file in config repository

default: iam-config.yaml

Methods

getManageActiveDirectoryAdminSecretName

getManageActiveDirectoryAdminSecretName(directoryName: string): string

Parameters
- directoryName: string
Returns string

getManageActiveDirectorySecretAccountName

getManageActiveDirectorySecretAccountName(directoryName: string): string

Parameters
- directoryName: string
Returns string

getManageActiveDirectorySecretRegion

getManageActiveDirectorySecretRegion(directoryName: string): string

Parameters
- directoryName: string
Returns string

getManageActiveDirectorySharedAccountNames

getManageActiveDirectorySharedAccountNames(directoryName: string, configDir: string): string[]

Parameters
- directoryName: string
- configDir: string
Returns string[]

Static load

load(dir: string): IamConfig

Load from config file content

Parameters
- dir: string
Returns IamConfig

Static loadFromString

loadFromString(content: string): undefined | IamConfig

Load from string content

Parameters
- content: string
Returns undefined | IamConfig

Hierarchy

Implements

Index

Constructors

Properties

Methods

Constructors

constructor

Parameters

groupSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; groups: { ...; }[]; }[]

identityCenter: undefined | { name: string; identityCenterPermissionSets: { name: string; policies: { awsManaged: string[] | undefined; customerManaged: string[] | undefined; } | undefined; sessionDuration: number | undefined; }[] | undefined; identityCenterAssignments: { ...; }[] | undefined; }

policySets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; policies: { ...; }[]; }[]

providers: undefined | { name: string; metadataDocument: string; }[]

roleSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; path: string | undefined; roles: { ...; }[]; }[]

userSets: undefined | { deploymentTargets: { organizationalUnits: string[] | undefined; accounts: string[] | undefined; excludedRegions: string[] | undefined; excludedAccounts: string[] | undefined; }; users: { ...; }[]; }[]

Returns IamConfig

Properties

Readonly groupSets

Readonly identityCenter

Readonly managedActiveDirectories

Readonly policySets

Readonly providers

Readonly roleSets

Readonly userSets

Static Readonly FILENAME

Methods

getManageActiveDirectoryAdminSecretName

Parameters

directoryName: string

Returns string

getManageActiveDirectorySecretAccountName

Parameters

directoryName: string

Returns string

getManageActiveDirectorySecretRegion

Parameters

directoryName: string

Returns string

getManageActiveDirectorySharedAccountNames

Parameters

directoryName: string

configDir: string

Returns string[]

Static load

Parameters

dir: string

Returns IamConfig

Static loadFromString

Parameters

content: string

Returns undefined | IamConfig