├── terraform ├── modules │ └── aft-account-request │ │ ├── versions.tf │ │ ├── variables.tf │ │ └── ddb.tf ├── aft-providers.jinja └── backend.jinja ├── CODE_OF_CONDUCT.md ├── LICENSE ├── CONTRIBUTING.md └── README.md /terraform/modules/aft-account-request/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 0.15.0" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 3.15" 8 | } 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | ## Code of Conduct 2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 4 | opensource-codeofconduct@amazon.com with any additional questions or comments. 5 | -------------------------------------------------------------------------------- /terraform/aft-providers.jinja: -------------------------------------------------------------------------------- 1 | ## Auto generated providers.tf ## 2 | ## Updated on: {{ timestamp }} ## 3 | 4 | provider "aws" { 5 | region = "{{ provider_region }}" 6 | assume_role { 7 | role_arn = "{{ aft_admin_role_arn }}" 8 | } 9 | default_tags { 10 | tags = { 11 | managed_by = "AFT" 12 | } 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /terraform/backend.jinja: -------------------------------------------------------------------------------- 1 | ## Auto generated backend.tf ## 2 | ## Updated on: {{ timestamp }} ## 3 | 4 | {% if tf_distribution_type == "oss" -%} 5 | terraform { 6 | required_version = ">= 0.15.0" 7 | backend "s3" { 8 | region = "{{ region }}" 9 | bucket = "{{ bucket }}" 10 | key = "{{ key }}" 11 | dynamodb_table = "{{ dynamodb_table }}" 12 | encrypt = "true" 13 | kms_key_id = "{{ kms_key_id }}" 14 | role_arn = "{{ aft_admin_role_arn }}" 15 | } 16 | } 17 | {% else -%} 18 | terraform { 19 | backend "remote" { 20 | organization = "{{ terraform_org_name }}" 21 | workspaces { 22 | name = "{{ terraform_workspace_name }}" 23 | } 24 | } 25 | } 26 | {% endif %} 27 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | 3 | Permission is hereby granted, free of charge, to any person obtaining a copy of 4 | this software and associated documentation files (the "Software"), to deal in 5 | the Software without restriction, including without limitation the rights to 6 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 7 | the Software, and to permit persons to whom the Software is furnished to do so. 8 | 9 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 10 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 11 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 12 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 13 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 14 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 15 | 16 | -------------------------------------------------------------------------------- /terraform/modules/aft-account-request/variables.tf: -------------------------------------------------------------------------------- 1 | variable "account-request-table" { 2 | type = string 3 | description = "name of account-request-table" 4 | default = "aft-request" 5 | } 6 | 7 | variable "account-request-table-hash" { 8 | type = string 9 | description = "name of account-request-table hash key" 10 | default = "id" 11 | } 12 | 13 | variable "control_tower_parameters" { 14 | type = object({ 15 | AccountEmail = string 16 | AccountName = string 17 | ManagedOrganizationalUnit = string 18 | SSOUserEmail = string 19 | SSOUserFirstName = string 20 | SSOUserLastName = string 21 | }) 22 | } 23 | 24 | variable "change_management_parameters" { 25 | type = object({ 26 | change_requested_by = string 27 | change_reason = string 28 | }) 29 | } 30 | 31 | variable "account_tags" { 32 | type = map(any) 33 | description = "map of account-level tags" 34 | } 35 | 36 | variable "custom_fields" { 37 | type = map(any) 38 | description = "map of custom fields defined by the customer" 39 | default = {} 40 | } 41 | 42 | variable "account_customizations_name" { 43 | type = string 44 | default = "" 45 | description = "The name of the account customizations to apply" 46 | } 47 | -------------------------------------------------------------------------------- /terraform/modules/aft-account-request/ddb.tf: -------------------------------------------------------------------------------- 1 | resource "aws_dynamodb_table_item" "account-request" { 2 | table_name = var.account-request-table 3 | hash_key = var.account-request-table-hash 4 | 5 | item = jsonencode({ 6 | id = { S = lookup(var.control_tower_parameters, "AccountEmail") } 7 | control_tower_parameters = { M = { 8 | AccountEmail = { S = lookup(var.control_tower_parameters, "AccountEmail") } 9 | AccountName = { S = lookup(var.control_tower_parameters, "AccountName") } 10 | ManagedOrganizationalUnit = { S = lookup(var.control_tower_parameters, "ManagedOrganizationalUnit") } 11 | SSOUserEmail = { S = lookup(var.control_tower_parameters, "SSOUserEmail") } 12 | SSOUserFirstName = { S = lookup(var.control_tower_parameters, "SSOUserFirstName") } 13 | SSOUserLastName = { S = lookup(var.control_tower_parameters, "SSOUserLastName") } 14 | } 15 | } 16 | change_management_parameters = { M = { 17 | change_reason = { S = lookup(var.change_management_parameters, "change_reason") } 18 | change_requested_by = { S = lookup(var.change_management_parameters, "change_requested_by") } 19 | } 20 | } 21 | account_tags = { S = jsonencode(var.account_tags) } 22 | account_customizations_name = { S = var.account_customizations_name } 23 | custom_fields = { S = jsonencode(var.custom_fields) } 24 | }) 25 | } 26 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing Guidelines 2 | 3 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional 4 | documentation, we greatly value feedback and contributions from our community. 5 | 6 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary 7 | information to effectively respond to your bug report or contribution. 8 | 9 | 10 | ## Reporting Bugs/Feature Requests 11 | 12 | We welcome you to use the GitHub issue tracker to report bugs or suggest features. 13 | 14 | When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already 15 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful: 16 | 17 | * A reproducible test case or series of steps 18 | * The version of our code being used 19 | * Any modifications you've made relevant to the bug 20 | * Anything unusual about your environment or deployment 21 | 22 | 23 | ## Contributing via Pull Requests 24 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: 25 | 26 | 1. You are working against the latest source on the *main* branch. 27 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. 28 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted. 29 | 30 | To send us a pull request, please: 31 | 32 | 1. Fork the repository. 33 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. 34 | 3. Ensure local tests pass. 35 | 4. Commit to your fork using clear commit messages. 36 | 5. Send us a pull request, answering any default questions in the pull request interface. 37 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. 38 | 39 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and 40 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/). 41 | 42 | 43 | ## Finding contributions to work on 44 | Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start. 45 | 46 | 47 | ## Code of Conduct 48 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 49 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 50 | opensource-codeofconduct@amazon.com with any additional questions or comments. 51 | 52 | 53 | ## Security issue notifications 54 | If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. 55 | 56 | 57 | ## Licensing 58 | 59 | See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. 60 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ## aft-sample-account-request 2 | 3 | Sample repository and customization for AWS Control Tower Account Factory for Terraform (AFT). 4 | 5 | This repository is part of AFT lab. For detailed walkthrough, please check the lab in [AWS Control Tower Workshop](https://catalog.workshops.aws/control-tower/en-US/customization/aft). 6 | 7 | ## How to use 8 | 9 | There are four repository, to help you get started: 10 | - [aft-sample-account-provisioning-customizations](https://github.com/aws-samples/aft-sample-account-provisioning-customizations) 11 | - [aft-sample-account-customizations](https://github.com/aws-samples/aft-sample-account-provisioning-customizations) 12 | - [aft-sample-global-customizations](https://github.com/aws-samples/aft-sample-global-customizations) 13 | - [aft-sample-account-request](https://github.com/aws-samples/aft-sample-account-request) 14 | 15 | Refer to instruction on [AWS Control Tower Workshop](https://catalog.workshops.aws/control-tower/en-US/customization/aft/) for detailed walkthrough. 16 | 17 | ## How to use 18 | 19 | This is sample repository for `aft-account-request`. 20 | 21 | For the labs in the workshop we deploy AFT using GitHub as our vcs provider. 22 | - Open the `aft-sample-account-request` in your browser 23 | - Click on the **Fork** button, 24 | - Edit the name of repository to be `aft-account-request`. 25 | - Ensure **Copy the main branch only** is checked. 26 | - Select **Create fork** 27 | - Check that the repository you've created is marked as **Private** 28 | 29 | If you are doing AFT for production use, you may select on of the other [VCS providers supported by AFT](https://docs.aws.amazon.com/controltower/latest/userguide/aft-alternative-vcs.html). 30 | - If you would rather create an entirely isolated repository (rather than forking), then you can down load the content in a zip file and then unpack it into the equivolent repository in you environment. 31 | - Open the `aft-sample-account-request` in your browser 32 | - Click **Code**, **Download ZIP** 33 | - note where your browser saved the download it will be named something like `aft-sample-account-request-main.zip` 34 | - Create the repository in you environment `aft-account-request` 35 | - If necessary clone the repository to a system from which you can commit and push to the repository. 36 | - unpack the zip downloaded above into the local repository. 37 | - Follow you normal processes for committing changes to a repository in your environment. 38 | 39 | It is an AWS best practice to have multiple environments for workloads/applications to allow though testing before making changes to your production environment. This also applies to AWS Control Tower and Account Facotry for Terraform (AFT). So it is worth thinking about how you different environments are going to be connected to their repositories. 40 | 41 | Will you use separate branches and merge requests to promote changes between environments? 42 | 43 | or 44 | 45 | Will you have non-production repositories forked from your production ones and use a pull request approach? 46 | 47 | With either strategy, it is unlikely you would want to replicate all of the accounts you require in your production environment in your testing one. For this reason is is recommended you have an instance of `aft-sample-account-request` per environment. 48 | 49 | For example: 50 | - `aft-account-request-sandbox` 51 | - `aft-account-request-production` 52 | 53 | 54 | ## Security 55 | 56 | See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information. 57 | 58 | ## License 59 | 60 | This library is licensed under the MIT-0 License. See the LICENSE file. 61 | --------------------------------------------------------------------------------