Deployment Accounts<\/li>\n<\/ul>\n\n\n\nMaster account<\/h5>\n\n\n\n The Master Account is the only account enabled to contact the AWS Organization APIs. Therefore it is the only one that can create accounts and organizational units. The process of creating an account starts from the repository that we find within the Master account. Browsing the AWS CodeCommit service in the us-east-1 region, we will find the aws-deployment-framework-bootstrap repository. At this point, we will have to write the code necessary to create the multi-account scenario.<\/p>\n\n\n\n
A pipeline of the AWS CodePipeline service is invoked for deployment, which calls the Organization APIs to create the accounts previously defined in the repository. The pipeline steps provide the creation of the account and its move from the root organization to the Organizational unit indicated in the repository.<\/p>\n\n\n\n
Using the AWS CloudWatch event service, ADF intercepts the event of type MoveAccount and invokes an AWS Step Function that creates or updates the basic CloudFormation stacks of the newly created account and those we will create. Finally, another Step Function is invoked within the Deployment account. We will analyze it in the next paragraph. <\/p>\n\n\n\n
Deployment Account<\/h5>\n\n\n\n ADF creates the deployment account during setup. It is the one who takes care of the deployment of all the services and resources within our Organization. For the deployment account to manage child accounts, it needs IAM roles that are federated with it, allowing the assume role action. When ADF creates a new account, it will invoke an AWS Step Function to enable cross-account logins. <\/p>\n\n\n\n
It updates\/creates the roles used by ADF to access that account. Being a deployment framework, you should have already understood that this account is central since, from this point, we will be able to create countless pipelines in just a few clicks; these pipelines are created by ADF using an AWS CodeCommit repository and an AWS CodePipeline.<\/p>\n\n\n\n
Inside the repository, we will find a deployment_map folder with the definitions of the pipelines configured and implemented in the Deployment account. Once the commits containing the deployment_maps have been pushed, a pipeline will start, creating other pipelines that will mirror the deployment maps in the repository: basically a pipeline of pipelines. Usage examples<\/p>\n\n\n\n
Account Creation<\/h1>\n\n\n\n As we said earlier, to create an account via ADF, we will need to work on the master account of the Organization, as it is the only one allowed to call the Organization’s APIs. Once on the master account of the Organization, in the us-east-1 region and on the CodeCommit service, we will need to clone the code repository called “aws-deployment-framework-bootstrap” and insert inside the adf-accounts folder a file similar to the following:<\/p>\n\n\n\n
accounts:\n - account_full_name: deployment\n organizational_unit_path: \/deployment\n email: adf@proud2becloud.com\n alias: deployment\n tags:\n - created_by: adf<\/code><\/pre>\n\n\n\nOnce this template is pushed, the pipeline will pull the code, run the tests, and call the Organization APIs in order to: <\/p>\n\n\n\n
\nCreate the account with name and alias deployment<\/em><\/li>\n\n\n\nPut it inside the Deployment<\/em> OU <\/li>\n\n\n\nAnd pass it adf@proud2becloud.com <\/em>as notification mail<\/li>\n<\/ul>\n\n\n\nAs soon as this procedure is complete, the Step Function will start creating the basic CloudFormation stacks and invoke the Step Function within the deployment account to enable cross-account access from child accounts.<\/p>\n\n\n\n
This mechanism makes it possible to ensure that as few people\/services as possible have access to the master account, according to the least privilege and zero-trust principles.<\/p>\n\n\n\n
Once this step function is completed, it will launch all the pipelines related to the organizational unit deployment. <\/p>\n\n\n\n
In this way, ADF will automate not only the creation of an account, but also the configuration of the services within it. <\/p>\n\n\n\n
Creating a pipeline<\/h1>\n\n\n\n Let’s say we need a pipeline that creates a VPC in all accounts within the organization unit deployment. To do so, we will have to go to the deployment account on the aws-deployment-framework-pipeline repository, enter the deployment_maps subfolder, and create a file similar to the following:<\/p>\n\n\n\n
pipelines:\n - name: vpc\n default_providers:\n source:\n provider: codecommit\n properties:\n account_id: 111111111111 # account con repository di codice\n build:\n provider: codebuild\n properties:\n environment_variables:\n CONTAINS_TRANSFORM: True\n deploy:\n provider: cloudformation\n properties:\n action: replace_on_failure\n params:\n notification_endpoint: adf+deployment@proud2becloud.com\n targets:\n - path: \/deploymnet\n regions: eu-west-1<\/code><\/pre>\n\n\n\nThis is the definition of an ADF pipeline where you’ll only need to specify which account will find the repository (source), which type of deployment to use (deploy), and which account to deploy (target). When the push of the configuration file occurs, the ADF pipeline will start. It will create the pipeline on the deployment account starting from this configuration file. If the VPC repository is not in the account identified by its id (e.g. 111111111111), then the pipeline will create it. Once done, it will push into the newly created repository with the code, i.e., the CloudFormation template and parameters. The CloudFormation template is standard, while the parameters can be written using a YAML language (unlike the regular use of CloudFormation).<\/p>\n\n\n\n
Parameters:\n VpcCidr: 10.0.0.0\/16\n DeployNat: true <\/code><\/pre>\n\n\n\nOne crucial thing about parameters is the filename since ADF uses the account name and the region we want to deploy to, to compose the parameters filename.<\/p>\n\n\n\n
Let’s say one of the accounts inside the organization unit is called adf-dev, and we want to deploy in Ireland; the parameter file should be called adf-dev_eu-west-1.yml. Once the deployment is complete, every account in the \/deployment organization unit will have the VPC stack, even after the first deployment.<\/p>\n\n\n\n
To Conclude<\/h1>\n\n\n\n The AWS Deployment Framework is a pretty new tool that can revolutionize the way resources, services, and infrastructures are managed and deployed within Landing Zones on AWS.<\/p>\n\n\n\n
We have tested it far and wide in recent months in different scenarios with different complexities: from infrastructures with only a few accounts, to Landing Zones with hundreds of accounts distributed across multiple regions. We came up with numerous thoughts about the pros and cons we need to keep in mind when choosing the perfect tool according to our use case. <\/p>\n\n\n\n
It is important to remember that there is no absolute best solution: it is always necessary to carry out a thorough analysis of each specific case. We hope that our point of view will make it easier for you!<\/p>\n\n\n\n
Have you already used ADF within your Landing Zone? Tell us about your experience in the comments! See you in 14 days on Proud2beCloud for a new article<\/p>\n\n\n\n
\n\n\n\nAbout Proud2beCloud<\/h4>\n\n\n\n Proud2beCloud is a blog by beSharp<\/a>, an Italian APN Premier Consulting Partner expert in designing, implementing, and managing complex Cloud infrastructures and advanced services on AWS. Before being writers, we are Cloud Experts working daily with AWS services since 2007. We are hungry readers, innovative builders, and gem-seekers. On Proud2beCloud, we regularly share our best AWS pro tips, configuration insights, in-depth news, tips&tricks, how-tos, and many other resources. Take part in the discussion!<\/p>\n","protected":false},"excerpt":{"rendered":"Over the years, the cloud world has moved towards an increasingly Infrastructure-as-Code oriented approach bringing enormous advantages such as replicability […]<\/p>\n","protected":false},"author":25,"featured_media":5342,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[242],"tags":[584,580,566,582],"class_list":["post-5284","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops-en","tag-cloud-adoption","tag-governance-compliance","tag-landing-zone","tag-multi-account-strategy"],"yoast_head":"\n
Deployment within a Landing Zone with AWS Deployment Framework (ADF) - Proud2beCloud Blog<\/title>\n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n \n \n \n\t \n\t \n\t \n