Working with solution-specific variables

This section provides information about working with variables.

Policy replacement variables

This solution supports the concept of environment variables in policy documents. These variables are processed at CDK application runtime and are replaced with contextual values based on the runtime environment and, if applicable, user-defined configurations.

The following policy types support variable replacements:

The following policy sample shows how you can implement the variables:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAllAWSServicesExceptBreakglassRoles",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "ArnNotLike": {
          "aws:PrincipalArn": [
            "arn:${PARTITION}:iam::*:role/${MANAGEMENT_ACCOUNT_ACCESS_ROLE}",
            "arn:${PARTITION}:iam::*:role/aws*",
            "arn:${PARTITION}:iam::*:role/${ACCELERATOR_PREFIX}*",
            "arn:${PARTITION}:iam::*:role/cdk-accel-*"
          ]
        }
      }
    }
  ]
}

Parameter Store reference variables

This solution provides dynamic lookups from the Parameter Store within configuration files. This feature primarily meets two customer needs:

You can leverage this pattern by creating an additional, optional configuration file in the configuration repository named replacements-config.yaml.

 globalReplacements:
  - key: SnsEmail
    path: /accelerator/replacements/SnsEmailAddress

In the above example, we have a single replacement defined:

You must explicitly create the Systems Manager parameter /accelerator/replacements/SnsEmailHigh. Create this Systems Manager parameter with an appropriate replacement value through Landing Zone Accelerator on AWS or by following this guide.

 aws ssm put-parameter \
     --name "/accelerator/replacements/SnsEmailAddress" \
     --value "example_email@example.com" \
     --type String \

After you create the Systems Manager parameter, you can reference the value from within the configuration files. For example, we might create a new Amazon SNS topic in the global-config.yaml file where the email address value uses the replacement previously defined:

  snsTopics:
    topics:
     - name: SampleTopic
        emailAddresses:
          - {{SnsEmail}}

This feature also includes functionality to look up account IDs based on the account name without the use of Systems Manager parameters:

  parameters:
   - name: TrustedAccounts
     value: {{account Management}}

The double-curly brace notation is reserved for usage in the LZA configuration files by LZA replacements and SSM dynamic references. Any instances of this syntax that do not follow the SSM dynamic reference syntax or exist in the replacements-config.yaml file will throw an error during configuration validation.

If you must use this syntax in your configuration files, you can skip static configuration validation by setting cdkOptions.skipStaticValidation to true in the global-config.yaml file.

$ACCEL_LOOKUP reference variable

This solution supports the concept of referencing variables within configuration files. This lookup is processed at CDK application runtime and are replaced with contextual values based on the runtime environment and, if applicable, user-defined configurations. These variables are used in specific cases within the configuration files for dynamically looking up specific values and are scoped to only the following use cases:

Systems Manager automation document variables

The following variables allow for defining Systems Manager Automation documents in the solution security-config.yaml:

Launch template variables

The following variable allow for referencing local or public image IDs for Amazon EC2 launch templates in the solution customization-config.yaml:

Amazon EC2 firewall configuration variables

As of v1.5.0 of this solution, the following variables are available when deploying a custom third-party Amazon EC2 firewall in the solution customization-config.yaml. These variables require your firewall vendor to support bootstrapping the instance using a configuration file from an S3 bucket. For more information on the specific implementation, see the Ec2FirewallInstanceConfig or Ec2FirewallAutoScalingGroupConfig references.

Hostname replacement

Use this variable to lookup up the name of the firewall instance as defined in customization-config.yaml.

${ACCEL_LOOKUP::EC2:INSTANCE:HOSTNAME}

VPC replacements

Use these variables to look up metadata about the VPC that the firewall is deployed to.

Example usage: ${ACCEL_LOOKUP::EC2:VPC:CIDR_0} – translates to the primary CIDR range of the VPC.

Subnet replacements

Use these variables to look up metadata about subnets in the VPC the firewall is deployed to.

Example usage: ${ACCEL_LOOKUP::EC2:SUBNET:CIDR:firewall-subnet-a} – translates to the CIDR range of a subnet named firewall-subnet-a in the VPC.

Network interface IP replacements

Use these variables to look up public and private IP addresses assigned to the firewall network interfaces.

Example usage: ${ACCEL_LOOKUP::EC2:ENI_0:PRIVATEIP_0} – translates to the primary private IP address of the primary network interface.

Network interface subnet replacements

Use these variables to look up metadata about the subnet that a network interface is deployed to.

${ACCEL_LOOKUP::EC2:ENI_<ENI_INDEX>:SUBNET_<METADATA_TYPE>} - <ENI_INDEX> is the device index of the network interface as defined in the firewall launch template and <METADATA_TYPE> is a type listed below. Index numbering is zero-based, so the primary interface of the instance is 0.

Example usage: ${ACCEL_LOOKUP::EC2:ENI_0:SUBNET_CIDR} - translates to the subnet CIDR range of the primary network interface.

Site-to-Site VPN replacements

Use these variables to look up metadata about site-to-site VPNs that are created between a firewall network interface and AWS gateway.

Example usage: ${ACCEL_LOOKUP::EC2:VPN:AWS_OUTSIDEIP_0:accelerator-vpn} - translates to the AWS-side public IP of the primary VPN tunnel for a VPN named accelerator-vpn.

Firewall configuration S3 bucket replacement

To support the above dynamic configuration replacements, the solution creates an S3 bucket in the target account from which the Amazon EC2 firewall can read the resulting configuration file. To dynamically target this bucket in your Amazon EC2 firewall user data script, you may use the following variable:

${ACCEL_LOOKUP::S3:BUCKET:firewall-config}

Customer gateway IP replacement

To support the previous dynamic Amazon EC2 firewall customer gateway and site-to-site VPN connection creation, use the following variable as the CustomerGatewayConfig ipAddress property:

${ACCEL_LOOKUP::EC2:ENI_<ENI_INDEX>:<FIREWALL_INSTANCE_NAME>}, where <ENI_INDEX> is the device index of the network interface as defined in the firewall launch template and <FIREWALL_INSTANCE_NAME> is the name of the firewall instance as defined in EC2FirewallInstanceConfig. Index numbering is zero-based, so the primary interface of the instance is 0.

Example usage: ${ACCEL_LOOKUP::EC2:ENI_0:accelerator-firewall} - translates to the primary public IP address of the primary network interface of a firewall named accelerator-firewall.