In this video, you’ll see how to deploy and apply the Customizations for AWS Control Tower solution.
With this solution, you can easily add customizations to your AWS Control Tower landing zone, manage deployment of your custom templates
across your Control Tower environment, and automate resource deployment for new accounts created by the AWS Control Tower account factory.
To get started, let’s navigate to the Control Tower Workshop for the solution.
This public site is accessible through a link below this video.
It provides an overview of the Customizations for AWS Control Tower solution and a link to the solution itself.
This comprehensive implementation guide discusses the considerations and configuration steps for deploying the solution.
Let’s take a quick look at the architecture.
The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly available, trusted AWS services
to help you quickly set up a secure, multi-account AWS environment using AWS best practices.
The solution includes an AWS CloudFormation template you deploy in your AWS account
that launches all the components necessary to build the workflows that enable you to customize your AWS Control Tower landing zone.
This solution is deployed and configured by processing a configuration package through AWS CodePipeline.
You can access the developer guide from here.
Let’s go back to the workshop to launch the solution.
From here, we can launch a preconfigured stack with the click of a button.
This only needs to be done once before customizing our Control Tower environment.
Let’s retain these default settings and proceed.
We’ll use AWS CodeCommit as the CodePipeline source provider.
Let’s retain the rest of the defaults.
Now we’ll acknowledge the message regarding Identity and Access Management (IAM) resource creation and create the stack.
The stack has been created.
Let’s take a look at its resources.
Let’s return to the workshop to see how to deploy our customizations from the CodeCommit repository.
For this example, we’ll be deploying using a Cloud9 environment.
Let’s check the instructions.
We’ll need the URL link for our CodeCommit repo, so let’s find it in the CodeCommit console.
We’ll copy the URL and then open the Cloud9 environment.
First, we need to install git.
Now let’s clone our CodeCommit repo using the URL we copied and navigate into it.
Next, let’s return to the workshop and copy the manifest file.
Now we’ll go back to the repo and replace the sample manifest.yaml file with what we just copied.
Let’s save and close the file.
Next, we’ll check our git status, and then add the changes, commit the changes, and then push those changes onto our CodeCommit repo.
Next, let’s navigate to CodePipeline to confirm that our deployment is reflected there.
Here’s our Custom Control Tower CodePipeline.
Let’s take a look at it.
As you can see, the pipeline process has successfully completed.
Next, let’s return to our Cloud9 environment to customize our deployment.
Let’s add the us-east-1 region to the manifest, save the file, and then publish the changes onto our CodeCommit repo.
Now let’s go back to CodePipeline to make sure this change is reflected.
As you can see, CodeCommit recognized that a new commit has been made and triggered our pipeline.
Now that we know our pipeline has succeeded, let's check out our newly deployed customizations.
First, let's look at the additional preventative guardrail.
To do so, we’ll navigate to our Organizations Policies page in our management account.
From here, we’ll navigate to AWS Accounts and select the organizational unit we deployed the guardrail to.
We can see the new guardrail on the Policies tab.
Next, we’ll switch to our provisioned account, where we can find the customized and newly deployed IAM role.
Lastly, let's go to the Config console to find the newly deployed config rule.
You’ve just seen how to deploy and apply the Customizations for AWS Control Tower solution.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it’s your turn to try.