[AWS] Feedback on AWS Control Tower Account Factory(for Terraform)

DevOps
#21

Actually just start with that then let me look at the docs again

#22

Iirc 1 is about right

#23

Do you have to manually trigger stuff in CodeStar or w/e

#24

Watched some YT video and the guy made it seem weirdly manual inside the console for some steps

#25

There is a lot that’s manual

#26

The api isn’t terribly well instrumented ime

#27

Still better than how we are doing it now haha

#28

It is really nice for containing people who know enough to be dangerous

#29

The first six parameters are required. As a prerequisite, I need to pass the ID of four AWS accounts in my AWS organization:
• ct_management_account_id – AWS Control Tower management account
• log_archive_account_id – Log Archive account
• audit_account_id – Audit account
• aft_management_account_id – AFT management account

#30

Did you have to make four different aws accounts at first just to set this up?

#31

Example has it all as different accounts

#32

AWS needs an account factory account factory

#33

I get that you need at least one account, but can those values all be the same account?

#34

https://aws.amazon.com/blogs/aws/new-aws-control-tower-account-factory-for-terraform/

#35 
  source = "git@github.com:aws-ia/terraform-aws-control_tower_account_factory.git"

  # Required Parameters
  ct_management_account_id    = "123412341234"
  log_archive_account_id      = "234523452345"
  audit_account_id            = "345634563456"
  aft_management_account_id   = "456745674567"
  ct_home_region              = "us-east-1"
  tf_backend_secondary_region = "us-west-2"
}```
#36

What kind of mad lad is making 4 accounts for this :smile:

#37

Yes you need all those

#38

Think of it this way - in a single account you wouldn’t have the ability to limit the base role from accessing information that is considered “sensitive”

#39

The idea being that each of the seperate accounts creates privilege isolation necessary

#40

Because the only role that will be in those is effectively something akin to the root account