Welcome to the AWS Secure Environment Accelerator - Discussions!

[archikierstead]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[louiekwan]

[Brian969]

I am working with a GOC client, and would like to connect someone for a quick q&a session about the accelerator in MS Teams chat or phone chat, Google Chat or etc. I am Ottawa based.

Hi - I've reached out via email so we can align you with the right team within AWS (it will be based on the specific GC dept you are working with and likely not appropriate to post here).

[jesswales]

Hello,
Is there a way to create nested OUs in the config file?
I can see there is an ou-path attribute under the account config but nothing for the OU specification. (We would like them not to all create from root).

[Brian969]

ASEA does support nested OU's, but, it does not offer unique persona's or personality on any level other than the top level. You cannot specify an OU in the ou section of the config file, accounts can simply be located in sub-ou's and things like SCPs manually applied.

[rverma-dev]

We have deleted asea sns topic since it wasn't getting subscribed, now getting error as

ASEA-InitialSetup | 9:06:10 PM | UPDATE_FAILED        | AWS::SNS::Topic                  | Pipeline/MainStateMachineStatusTopic (PipelineMainStateMachineStatusTopic8AFE7FEF) Topic does not exist (Service: AmazonSNS; Status Code: 404; Error Code: NotFound; Request ID: 48cb1f24-2e72-5413-979a-45d7aaf042e2; Proxy: null)

Is there a way we can get the topic recreated? Tried upgrading the ASEA version but that also failed. Thanks

[Brian969]

Hi Rohit,
Easiest way is likely to go into CFN, find the failed stack with the deleted object, select the TEMPLATE tab, copy the CFN template out, edit it, removing the SNS topic, and then update the stack in CFN with the updated template. If you then rerun the SM, it should redeploy the topic. The alternative is to manual create and import the object into the stack. Hopefully one of these two mechanisms works for you.

[para0056]

Given the recent announcement of AWS SSO delegated administration, will the ASEA eventually allow customers to designate an account as a delegated administrator for AWS SSO?

Relevant blog post: https://aws.amazon.com/blogs/security/getting-started-with-aws-sso-delegated-administration/

[Brian969]

Yes, this is possible today - we are recommending customers delegate SSO to the Operations account (some customers call this AWS account Shared Services). This does not have an API and needs to be manually delegated. Existing customer need to be cautious, as the delegated admin account becomes the account with the external directory association - so delegating when using MAD/ADC requires a little more effort and a small outage for your end users.