In this video, you’ll see how to automate Cloud Foundational Services for Compliance in AWS.
With this risk management solution, you can automate deployments of
a custom AWS Config conformance pack, AWS Systems Manager remediation runbooks,
and a custom AWS Config conformance pack with remediations in your AWS Organization.
Before we begin, let’s review the prerequisites as outlined in our 'AWS Cloud Compliance and
Assurance Reference Solution' GitHub repo.
These prerequisites and more can be viewed at the link in the description below this video.
This link takes us to the setup steps.
Step one is to enable AWS Config in an AWS Organization.
AWS Config evaluates configuration changes
in your AWS resources against the configurations you specify.
We can enable AWS Config using CloudFormation StackSets,
or by using Systems Manager Quick Setup.
The second step is to register a delegated administrator account for AWS Config.
The third step is to set up an Amazon Simple Storage Service (Amazon S3) delivery bucket
in the delegated administrator account for conformance pack artifacts.
For demonstration purposes, we have already completed the prerequisites.
Let’s take a look.
We enabled AWS Config in our organization using AWS Systems Manager Quick Setup.
We have set up an Amazon S3 bucket with the prefix “awsconfigconforms,” which is required
by AWS Config to store conformance pack artifacts.
To limit bucket access to only accounts in the organization,
we used Principal ID and Principal ARN conditions in the bucket policy.
We have configured a delegated administrator account
from which we will be deploying our organizational conformance packs.
The repo also provides a template that provisions custom AWS Systems Manager
remediation runbooks for several Payment Card Industry (PCI) Config rules.
As you can see, several SSM runbooks
are packaged in this AWS CloudFormation template.
We have deployed this template as a CloudFormation StackSet with service
managed permissions across all accounts in our AWS Organization, as shown.
Now, based on the instructions outlined in Step 1 in our repo, let’s deploy a custom
AWS Config conformance pack in our AWS Organization.
We’ll use this custom AWS Config conformance pack,
which contains some PCI-related Config rules.
We have already uploaded this custom conformance pack to an S3 bucket
that will be used in our deployment template.
Now let’s quickly review the deployment template-aws-pci-custom-confpack-org
that we will use to automate the deployment of this custom
Config conformance pack in our AWS Organization.
The template contains a resource of type ‘AWS::Config::OrganizationConformancePack’
that enables the custom Config conformance pack in its TemplateS3Uri
parameter to be deployed in an AWS Organization.
Let’s navigate to the CloudFormation console in our delegated administrator account.
Here, we’ll create a stack by deploying the
aws-pci-custom-confpack-org template file from our repo.
We’ll provide a name for this stack and the name of the custom conformance pack.
We’ll also ensure that the TemplateS3Uri parameter points to the
S3 URI of our uploaded custom conformance pack.
We’ll keep everything else as it is and create the stack.
The stack has been successfully provisioned.
Let’s go to the AWS Config console and confirm that
the custom conformance pack has deployed successfully.
We can see that deployment has completed.
We can also check the successful deployment of our custom conformance
pack using the AWS configservice command-line interface (CLI).
Let’s navigate back to our repo and follow the instructions in Step 2
to deploy a custom Config conformance pack with remediations.
Let’s review our updated custom Config conformance pack template with remediations.
The template has been modified where Config remediations that use our provisioned
Systems Manager runbooks have been associated with several of the PCI Config rules.
Let’s navigate to the AWS Systems Manager console.
On the Owned by me tab, we can view the deployed runbooks that are used as Config remediations
in our custom Config conformance pack template with remediations.
These runbooks were provisioned in the prerequisite step
as a StackSet throughout our AWS Organization.
Let’s follow the same steps as earlier to deploy the custom
conformance packs with remediations from the CloudFormation console.
We'll provide the stack name, which we'll name the same as the custom conformance pack,
and ensure that the TemplateS3Uri parameter points to the S3 URI of our
uploaded custom conformance pack with remediations template.
Let’s continue and create the stack.
We can see that the CloudFormation stack corresponding to our custom
conformance pack has been successfully provisioned.
By navigating to the AWS Config console, we can confirm that the
custom conformance pack has been successfully deployed.
We can also check the successful deployment of our custom conformance
pack with remediations using the configservice CLI.
You’ve just seen how to automate Cloud Foundational Services for Compliance in AWS.
You can learn more about this topic in the description and links for this video.
Thanks for watching. Now it’s your turn to try.