A command line tool for managing accounts within an AWS organization. Easy to integrate into AWS Deployment Framework
Multi-Account management in AWS Organizations
!IMPORTANT! - The code has not been tested properly yet in production and no unit/integration testing have been implemented. Use at your own risk.
This repository contains code that manages the process around AWS account creation. It assumes you are working with the AWS Deployment Framework for managing deployments in a multi-account AWS organization.
- Create new AWS accounts within existing AWS Organization
- Move accounts to the organizational unit defined in config files
- Optionally remove default VPC resources on accounts
- Create and update account aliasses
- Account tagging
- Optional protection from moving accounts directly between organizational units (Related to AWS Deployment Framework)
Not supported due to AWS Organization API limitations
- Updating account names
- Updating account email addresses
- Removing accounts
- Handling root account credentials and MFA
Installation & Configuration
Note we are only supporting python3.6 and up, I really like my f-strings..
Install the package using pip
pip3 install awsaccountmgr
Next define configuration files for the accounts you would like to manage. You can have multiple configuration files for logical separation. The script will iterate and validate each file before sequentially creating/updating the defined accounts.
Here is an example file
Accounts: # Account with only mandatory parameters - AccountFullName: playgroundaccount OrganizationalUnitPath: playground/ Email: email@example.com # Delete the default VPC for this account - AccountFullName: usdevaccount OrganizationalUnitPath: us/dev Email: firstname.lastname@example.org DeleteDefaultVPC: True # Account with all available parameters - AccountFullName: myrootaccount OrganizationalUnitPath: / Email: email@example.com DeleteDefaultVPC: True AllowDirectMoveBetweenOU: True Alias: IDontWantMyAliasToBeTheSameAsTheAccountFullName AllowBilling: False Tags: - CostCenter: 123456789
To create new accounts or move accounts to a different OU you only have to update the relevant account configuration file and re-run the script.
The OU name is the name of the direct parent of the account. If you want to move an account to the root you can provide the AWS organization id (eg "r-abc1"). If you are dealing with nested organizational units you can seperate them with a / (see examples above).
Once the configuration files are defined you can start the script locally with:
awsaccountmgr <root_ou_id> <config folder path>
You will have to have AWS credentials stored (using AWS CLI or environment variables) on your machine. If the assumed role is not resided in the master account the script will try to assume the OrganizationAccountAccessRole role in the master account. This is useful for people using the AWS Deployment Framework to run this script from a pipeline in the deployment account.
To see all available command line options, run
TODO: Describe how you can setup the AWS Deployment Framework pipeline to run this on updates and scheduled time. Quick summary:
- Create cc-buildonly ADF pipeline
- add buildspec.yml similar to example-buildspec.yml
- Update the ADF global.yml files to ensure the deployment account is able to do organizations related stuff in the master account
- TIP: If you add a schedule to the ADF pipeline you can reasonably ensure the accounts are configured as defined in the yaml files.
- TIP2: perhaps this module can be used in combination with a lambda triggered by cloudwatch events related to relevant organizations actions. This will immediately correct any changes someone does to accounts to whats being defined in the configuration files.
- FIX: Retrying subnet and IGW describe calls. Sometimes they are not yet available after a new account creation.
- FIX: AllowDirectMoveBetweenOU parameter now works as intended
- FIX: Using pagination when listing Org Units
- setup.py now includes dependency libraries
- FIX: describe_vpcs call sometimes failed on creating new account
- Configuration files now support '/' to target root
- FIX: Removing VPCs through threads working properly
- Retrieving master_account_id from API
- Deleting VPCs now using threads
- Removing default VPCs in all regions
- config_directory is now a mandatory parameter
Thanks to @deltagarrett for testing!
- Initial version
Release history Release notifications | RSS feed
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
|Filename, size||File type||Python version||Upload date||Hashes|
|Filename, size awsaccountmgr-0.0.10-py3-none-any.whl (13.3 kB)||File type Wheel||Python version py3||Upload date||Hashes View|
|Filename, size awsaccountmgr-0.0.10.tar.gz (12.9 kB)||File type Source||Python version None||Upload date||Hashes View|
Hashes for awsaccountmgr-0.0.10-py3-none-any.whl