![\"\"](\"https:\/\/artem.services\/wp-content\/uploads\/2018\/11\/AWS-Logo.png\"){kind=logo}
<\/p>\n<\/p>\n
To automatically generate a "Sign-in URL<\/strong>" to a newly added Control Tower<\/strong> account, you will need the following:<\/span><\/span><\/span><\/p>\n <\/p>\n <\/p>\n Where "XXXXXXXXXXXX<\/strong>" —\u00a0master account ID<\/strong><\/span><\/span><\/span><\/p><\/blockquote>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n Where "r-xxx<\/strong>" — your organization ID<\/strong><\/span><\/span><\/span>, and "ou-xxx-yyyyyyyy<\/strong>" — OU ID<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":" To automatically generate a "Sign-in URL" to a newly added Control Tower account, you will need the following: create a Lambda function on the master account (the region must be us-east-1 — Virginia, so we will use CloudTrail as a trigger); create a policy that allows you to assign a role and attach it to … \u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u0442\u044c \u0447\u0438\u0442\u0430\u0442\u044c "\u00a0AWS Organization — Automatic adding Sign-in URL for new accounts"<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[599],"tags":[1875,543,1439,1877,885,1747,1879,1881],"_links":{"self":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/2308"}],"collection":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2308"}],"version-history":[{"count":2,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/2308\/revisions"}],"predecessor-version":[{"id":2310,"href":"https:\/\/artem.services\/index.php?rest_route=\/wp\/v2\/posts\/2308\/revisions\/2310"}],"wp:attachment":[{"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/artem.services\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
StackSet:<\/h3>\n
\r\nAWSTemplateFormatVersion: 2010-09-09\r\nDescription: 'Template create IAM Roles and Policies for access from Control Tower master account'\r\n\r\nResources:\r\n ControlTowerMaster:\r\n Type: 'AWS::IAM::Role'\r\n Properties:\r\n RoleName: 'ControlTower-Master'\r\n AssumeRolePolicyDocument:\r\n Version: 2012-10-17\r\n Statement:\r\n - Effect: Allow\r\n Principal:\r\n AWS:\r\n - "arn:aws:iam::XXXXXXXXXXXX:root"\r\n Action:\r\n - 'sts:AssumeRole'\r\n Policies:\r\n - PolicyName: 'ControlTower-Master'\r\n PolicyDocument:\r\n Version: 2012-10-17\r\n Statement:\r\n - Effect: Allow\r\n Action:\r\n - 'iam:CreateAccountAlias'\r\n Resource: '*'\r\n MaxSessionDuration: 3600\r\n Path: \/\r\n<\/pre>\n
Lambda:<\/h3>\n
\r\nimport boto3\r\nimport re\r\n\r\ndef get_account_name(account_id):\r\n account_name = boto3.client('organizations').describe_account(AccountId = account_id).get('Account').get('Name')\r\n create_account_alias(account_id, account_name)\r\n\r\ndef create_account_alias(account_id, account_name):\r\n account_name = re.sub('[^A-Za-z0-9]+', '-', account_name)\r\n sts_client = boto3.client('sts')\r\n\r\n response = sts_client.assume_role(\r\n RoleArn = "arn:aws:iam::" + str(account_id) + ":role\/AIT-ControlTower-Master",\r\n RoleSessionName = 'assume_role_session'\r\n )\r\n\r\n iam_client = boto3.client(\r\n 'iam',\r\n aws_access_key_id = response['Credentials']['AccessKeyId'],\r\n aws_secret_access_key = response['Credentials']['SecretAccessKey'],\r\n aws_session_token = response['Credentials']['SessionToken']\r\n )\r\n\r\n # Create an account alias\r\n iam_client.create_account_alias(\r\n AccountAlias = account_name.lower()\r\n )\r\n\r\ndef main(event, context):\r\n account_id = (event["detail"]["requestParameters"]["accountId"])\r\n get_account_name(account_id)\r\n \r\nif __name__ == '__main__':\r\n main()\r\n<\/pre>\nLambda Policy:<\/h3>\n
\r\n{\r\n "Version": "2012-10-17",\r\n "Statement": {\r\n "Effect": "Allow",\r\n "Action": "sts:AssumeRole",\r\n "Resource": "*"\r\n }\r\n}\r\n<\/pre>\nCloudWatch Event Rule:<\/h3>\n
\r\n{\r\n "source": [\r\n "aws.organizations"\r\n ],\r\n "detail-type": [\r\n "AWS API Call via CloudTrail"\r\n ],\r\n "detail": {\r\n "eventSource": [\r\n "organizations.amazonaws.com"\r\n ],\r\n "eventName": [\r\n "MoveAccount"\r\n ],\r\n "requestParameters": {\r\n "sourceParentId": [\r\n "r-xxx"\r\n ],\r\n "destinationParentId": [\r\n "ou-xxx-yyyyyyyy"\r\n ]\r\n }\r\n }\r\n}\r\n<\/pre>\n