Deploy and manage AWS Control Tower controls by using Terraform

Created by Iker Reina Fuente (AWS) and Ivan Girardi (AWS)

Summary

This pattern describes how to use AWS Control Tower controls, HashiCorp Terraform, and infrastructure as code (IaC) to implement and administer preventive, detective, and proactive security controls. A control (also known as a guardrail) is a high-level rule that provides ongoing governance for your overall AWS Control Tower environment. For example, you can use controls to require logging for your AWS accounts and then configure automatic notifications if specific security-related events occur.

AWS Control Tower helps you implement preventive, detective, and proactive controls that govern your AWS resources and monitor compliance across multiple AWS accounts. Each control enforces a single rule. In this pattern, you use a provided IaC template to specify which controls you want to deploy in your environment.

AWS Control Tower controls apply to an entire organizational unit (OU), and the control affects every AWS account within the OU. Therefore, when users perform any action in any account in your landing zone, the action is subject to the controls that govern the OU.

Implementing AWS Control Tower controls helps establish a strong security foundation for your AWS landing zone. By using this pattern to deploy the controls as IaC through Terraform, you can standardize the controls in your landing zone and more efficiently deploy and manage them.

To deploy AWS Control Tower controls as IaC, you can also use AWS Cloud Development Kit (AWS CDK) instead of Terraform. For more information, see Deploy and manage AWS Control Tower controls by using AWS CDK and AWS CloudFormation.

Intended audience

This pattern is recommended for users who have experience with AWS Control Tower, Terraform, and AWS Organizations.

Prerequisites and limitations

Prerequisites

Limitations

Product versions

Architecture

This section provides a high-level overview of this solution and the architecture established by the sample code. The following diagram shows controls deployed across the various accounts in the OU.

AWS Control Tower controls are categorized according to their behavior and their guidance.

There are three primary types of control behaviors:

Control guidance is the recommended practice for how to apply each control to your OUs. AWS Control Tower provides three categories of guidance: mandatory, strongly recommended, and elective. The guidance of a control is independent of its behavior. For more information, see Control behavior and guidance.

Tools

AWS services

Other tools

Code repository

The code for this pattern is available in the GitHub Deploy and manage AWS Control Tower controls by using Terraform repository.

Best practices

Epics

git clone https://github.com/aws-samples/aws-control-tower-controls-terraform.git

$ terraform destroy -var-file="variables.tfvars"

Troubleshooting

Related resources

AWS documentation

Other resources

Additional information

Example variables.tfvars file

The following is an example of an updated variables.tfvars file. This sample enables the AWS-GR_ENCRYPTED_VOLUMES control (global ID: 503uicglhjkokaajywfpt6ros) and the AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED control (global ID: 50z1ot237wl8u1lv5ufau6qqo). For a list of global IDs, see All global identifiers in the AWS Control Tower documentation.

controls = [
    {
        control_names = [
            "503uicglhjkokaajywfpt6ros",
            ...
        ],
        organizational_unit_ids = ["ou-1111-11111111", "ou-2222-22222222"...],
    },
    {
        control_names = [
            "50z1ot237wl8u1lv5ufau6qqo",
            ...
        ],
        organizational_unit_ids = ["ou-1111-11111111"...],
    },
] 

Least privilege permissions for the IAM role

This pattern requires that you assume an IAM role in the management account. Best practice is to assume a role with temporary permissions and limit the permissions according to the principle of least privilege. The following sample policy allows the minimum actions required to enable or disable AWS Control Tower controls.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "controltower:EnableControl",
                "controltower:DisableControl",
                "controltower:GetControlOperation",
                "controltower:ListEnabledControls",
                "organizations:AttachPolicy",
                "organizations:CreatePolicy",
                "organizations:DeletePolicy",
                "organizations:DescribeOrganization",
                "organizations:DetachPolicy",
                "organizations:ListAccounts",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListChildren",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListParents",
                "organizations:ListPoliciesForTarget",
                "organizations:ListRoots",
                "organizations:UpdatePolicy"
            ],
            "Resource": "*"
        }
    ]
}