Automate account creation by using the Landing Zone Accelerator on AWS

In the Landing Zone Accelerator on AWS code repository, create a file named customizations-config.yaml. You use this file to define customizations for the core solution. For more information, see Customizing the solution.

In the customizations-config.yaml file, create a section called cloudFormationStacks.

Download the account-creation-validation-role.yaml file from GitHub.

Save the file to the location that is indicated in the templates section of the customizations-config.yaml file.

Open the customizations-config.yaml file.

In the cloudFormationStacks section, add the following code. Update the target AWS Region as needed for your landing zone:

        - deploymentTargets:
            organizationalUnits:
              - Root
            excludedAccounts:
              - Management              
          description: IAM Role to allow Account Validation
          name: lza-account-creation-validation
          regions:
            - us-east-1
          template: cloudformation/account-creation-validation-role.yaml
          runOrder: 1 
          terminationProtection: true
          parameters:
            - name: pManagementAccountId
              value: "{{ account Management }}"

Save and close the customizations-config.yaml file.

Download the account-tagging-to-ssm-parameter-role.yaml file from GitHub.

Save the file to the location that is indicated in the templates section of the customizations-config.yaml file.

Open the customizations-config.yaml file.

In the cloudFormationStacks section, add the following code. Update the target AWS Region as needed for your landing zone:

        - deploymentTargets:
            organizationalUnits:
              - Root
            excludedAccounts:
              - Management
          description: IAM Role to create SSM Parameters based on Account Tagging
          name: lza-account-tagging-to-ssm-parameter
          regions:
            - us-east-1
          template: cloudformation/account-tagging-to-ssm-parameter-role.yaml
          runOrder: 1 
          terminationProtection: true          
          parameters:
            - name: pManagementAccountId
              value: "{{ account Management }}"

Save and close the customizations-config.yaml file.

Download the config-log-validation-role.yaml file from GitHub.

Save the file to the location that is indicated in the templates section of the customizations-config.yaml file.

Open the customizations-config.yaml file.

In the cloudFormationStacks section, add the following code. Update the target AWS Region as needed for your landing zone:

        - deploymentTargets:
            accounts:
              - LogArchive
          description: IAM Role to validate Config and Logs
          name: lza-config-log-validation-role
          regions:
            - us-east-1
          template: cloudformation/config-log-validation-role.yaml
          runOrder: 1 
          terminationProtection: true          
          parameters:
            - name: pManagementAccountId
              value: "{{ account Management }}"

Save, close, and commit the changes made to the customizations-config.yaml file.

In the Microsoft Entra ID admin center, register the create_aws_account application. For instructions, see Register an application in the Microsoft documentation.

Follow the instructions in Update an app's requested permissions in the Microsoft documentation to configure the following Microsoft Graph permissions for the create_aws_account application:

In the Microsoft Entra ID admin center, navigate to App registrations, and then choose create_aws_account.

In the left pane, choose Overview.

On the Overview page, make note of the following values:

In the left pane, under Manage, choose Certificates & secrets.

On the Certificates & secrets page, choose the Client secrets tab, and then make note of the following values:

In the Microsoft Entra ID admin center, navigate to Enterprise applications, and then choose LZA2.

In the left pane, choose Overview.

On the Overview page, make note of the following values:

In the left pane, under Manage, choose Manifest.

In the JSON file, in the appRoles section, locate the app role named User.

Make note of the id value for this app role.

In the AWS CLI, enter the following command to create the variables. Use the values that you retrieved for the create_aws_account and LZA2 applications:

# Variables for create_aws_account app
  TENANT_ID='<Directory ID>'
  CLIENT_ID='<Application ID>'
  SECRET_ID='<Client secret ID>'
  SECRET_VALUE='<Client secret value>'

# Variables for LZA2 app
  OBJECT_ID='<Object ID>'
  APP_ROLE_ID='<App role ID>'
  ENTERPRISE_APP_NAME='<Name>'

Enter the following command to create a secret named GraphApiSecret in AWS Secrets Manager:

aws secretsmanager create-secret \
  --name GraphApiSecret \
  --secret-string "{\"client_id\": \"${CLIENT_ID}\", \"tenant_id\": \"${TENANT_ID}\", \"object_id\": \"${OBJECT_ID}\", \"app_role_id\": \"${APP_ROLE_ID}\", \"secret_value\": \"${SECRET_VALUE}\", \"secret_id\": \"${SECRET_ID}\"}"

If you need to update the secret in the future, you can update the variables and run the following command:

aws secretsmanager update-secret \
  --secret-id GraphApiSecret \
  --secret-string "{\"client_id\": \"${CLIENT_ID}\", \"tenant_id\": \"${TENANT_ID}\", \"object_id\": \"${OBJECT_ID}\", \"app_role_id\": \"${APP_ROLE_ID}\", \"secret_value\": \"${SECRET_VALUE}\", \"secret_id\": \"${SECRET_ID}\"}"

Enter the following command to clone the lza-account-creation-workflow repository:

git clone https://github.com/aws-samples/lza-account-creation-workflow

Enter the following command to navigate into the config directory of the cloned repository:

cd lza-account-creation-workflow/config

Open the deploy-config.yaml file.

Review the template and update the values as needed for deployment in your AWS environment. For example, update values for the following:

If you're integrating with Microsoft Entra ID, do the following:

Save and close the deploy-config.yaml file.

Enter the following command:

cdk bootstrap <account-number>/<Region>

For more information, see Bootstrapping in the AWS CDK documentation.

Enter the following command to synthesize the CloudFormation template:

cdk synth

For more information, see Configure and perform AWS CDK stack synthesis in the AWS CDK documentation.

Enter the following command to deploy the solution.

cdk deploy

For more information, see Deploy AWS CDK applications in the AWS CDK documentation.

Enter the following command to navigate into the cloned repository:

cd lza-account-creation-workflow

Run the Python script that initiates the Step Functions workflow. The following is an example command that includes sample arguments and values:

python ./run-stepfunction.py \
  --account-name "lza-test-01" \
  --support-dl "johnsmith@example.com" \
  --managed-org-unit "Workloads/Workload-1" \
  --purpose "Testing new micro service" \
  --force-update true \
  --ad-integration "{\"CustomerAccountAdmin\": \"platform-admin\", \"CustomerAccountDev\": \"workload1-app1\"}" \
  --bypass-creation true \
  --tags APPLICATION=TestingMicroService

Wait until you receive a notification that the account has been successfully created.

Enter the following command to navigate into the source code directory:

cd lza-account-creation-workflow

Enter the following command to set the AWS access key variables. You can copy the variables from the AWS access portal and then paste them into a shell. The following is an example:

export AWS_ACCESS_KEY_ID="<id>"
export AWS_SECRET_ACCESS_KEY="<key>"
export AWS_SESSION_TOKEN="<token>"

Enter the following command to set the AWS Region for API calls:

export AWS_REGION=$(aws configure get region)

Enter the following command to retrieve the API Gateway endpoint from the lza-account-creation-workflow-application CloudFormation output:

export API_GATEWAY_ENDPOINT=$(aws cloudformation describe-stacks --stack-name "lza-account-creation-workflow-application" --query 'Stacks[*].Outputs[?OutputKey==`oApiGatewayCreateAccountEndpoint`].OutputValue' --output text)

In the root folder of the cloned repository, open the api_example.json file.

Update the parameters with your configuration values:

{
    "account_name": "lza-test-01",
    "account_email": "johnsmith+lzatest01@example.com",
    "support_dl": "johnsmith@example.com",
    "managed_org_unit": "Workloads/Workload-1",
    "ad_integration": [
        {
            "PermissionSetName": "CustomerAccountAdmin",
            "ActiveDirectoryGroupName": "platform-admin"
        },
        {
            "PermissionSetName": "CustomerAccountDev",
            "ActiveDirectoryGroupName": "workload1-app1"
        }
    ],
    "force_update": "true",
    "bypass_creation": "false",
    "account_tags": [
        {
            "Key": "Environment",
            "Value": "Dev"
        }, {
            "Key": "DeploymentMethod",
            "Value": "ApiGateway"
        }
    ]
}

Save and close the api_example.json file.

Enter the following command to initiate the Step Functions workflow:

awscurl --service execute-api \
    --data @api-example.json \
    --region ${AWS_REGION} \
    --access_key ${AWS_ACCESS_KEY_ID} \
    --secret_key ${AWS_SECRET_ACCESS_KEY} \
    --security_token ${AWS_SESSION_TOKEN} \
    -X POST ${API_GATEWAY_ENDPOINT}execute

In the output from the previous command, make note of the Step Functions execution Amazon Resource Name (ARN).

If you want to check the status of the Step Functions workflow, enter the following command. Replace <STEP_FUNCTION_EXECUTION_NAME> with the Step Functions execution ARN or name:

awscurl --service execute-api \
  --region ${AWS_REGION} \
  --access_key ${AWS_ACCESS_KEY_ID} \
  --secret_key ${AWS_SECRET_ACCESS_KEY} \
  --security_token ${AWS_SESSION_TOKEN} \
  -X GET ${API_GATEWAY_ENDPOINT}get_execution_status?execution=<STEP_FUNCTION_EXECUTION_NAME>

Wait until you receive a notification that the account has been successfully created.