Skip to content

Commit 65ba130

Browse files
andywick-awsandywick-aws
authored
Merge pull request #90 from aws-samples/bugfix/graviton-region-support
Bugfix/graviton region support
2 parents b993ad0 + e0b4d1b commit 65ba130

File tree

16 files changed

+215
-16
lines changed

16 files changed

+215
-16
lines changed

‎CHANGELOG.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2022-04-04](#2022-04-04)
67
- [2022-03-29](#2022-03-29)
78
- [2022-03-16](#2022-03-16)
89
- [2022-03-14](#2022-03-14)
@@ -23,6 +24,16 @@ All notable changes to this project will be documented in this file.
2324

2425
---
2526

27+
## 2022-04-04
28+
29+
### Changed<!-- omit in toc -->
30+
31+
- Updated the [DOWNLOAD-AND-STAGE-SOLUTIONS.md](aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md) document to change the order of the steps to have the authenticate step before deploying the staging S3 bucket.
32+
33+
### Fixed<!-- omit in toc -->
34+
35+
- Fixed all solution templates that deploy Lambda functions to include a condition that determines if the region supports Graviton (arm64) architecture.
36+
2637
## 2022-03-29
2738

2839
### Changed<!-- omit in toc -->

‎aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,14 @@ Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-
1414
cd $HOME/aws-sra-examples
1515
```
1616

17-
3. In the `management account (home region)`, launch an AWS CloudFormation **Stack** using the [sra-common-prerequisites-staging-s3-bucket.yaml](../solutions/common/common_prerequisites/templates/sra-common-prerequisites-staging-s3-bucket.yaml)
17+
3. [Authenticate to the AWS management account](#authenticate-to-the-aws-management-account).
18+
4. In the `management account (home region)`, launch an AWS CloudFormation **Stack** using the [sra-common-prerequisites-staging-s3-bucket.yaml](../solutions/common/common_prerequisites/templates/sra-common-prerequisites-staging-s3-bucket.yaml)
1819
template file as the source.
1920

2021
```bash
2122
aws cloudformation deploy --template-file $HOME/aws-sra-examples/aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-staging-s3-bucket.yaml --stack-name sra-common-prerequisites-staging-s3-bucket --capabilities CAPABILITY_NAMED_IAM
2223
```
2324

24-
4. [Authenticate to the AWS management account](#authenticate-to-the-aws-management-account).
2525
5. Package and stage all the AWS SRA example solutions. For more information see [Staging script details](#staging-script-details).
2626
<!-- markdownlint-disable-next-line MD031 -->
2727

‎aws_sra_examples/solutions/cloudtrail/cloudtrail_org/templates/sra-cloudtrail-org.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,17 @@ Conditions:
195195
cCreateCloudTrailLogGroup: !Equals [!Ref pCreateCloudTrailLogGroup, true]
196196
cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
197197
cLambdaCloudWatchLogsUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
198+
cUseGraviton: !Or
199+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
200+
- !Equals [!Ref 'AWS::Region', ap-south-1]
201+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
202+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
203+
- !Equals [!Ref 'AWS::Region', eu-central-1]
204+
- !Equals [!Ref 'AWS::Region', eu-west-1]
205+
- !Equals [!Ref 'AWS::Region', eu-west-2]
206+
- !Equals [!Ref 'AWS::Region', us-east-1]
207+
- !Equals [!Ref 'AWS::Region', us-east-2]
208+
- !Equals [!Ref 'AWS::Region', us-west-2]
198209

199210
Resources:
200211
rCloudTrailCloudWatchLogGroupRole:
@@ -378,7 +389,10 @@ Resources:
378389
comment: Environment variables are not sensitive
379390
Properties:
380391
Description: Creates an Organization CloudTrail
381-
Architectures: [arm64]
392+
Architectures: !If
393+
- cUseGraviton
394+
- [arm64]
395+
- !Ref AWS::NoValue
382396
FunctionName: !Ref pCloudTrailLambdaFunctionName
383397
Handler: app.lambda_handler
384398
Role: !GetAtt rCloudTrailLambdaRole.Arn

‎aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-management-account-parameters.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,17 @@ Conditions:
112112
cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
113113
cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
114114
cUseSRAStagingS3BucketNameSSMParameter: !Equals [!Ref pSRAStagingS3BucketName, '']
115+
cUseGraviton: !Or
116+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
117+
- !Equals [!Ref 'AWS::Region', ap-south-1]
118+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
119+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
120+
- !Equals [!Ref 'AWS::Region', eu-central-1]
121+
- !Equals [!Ref 'AWS::Region', eu-west-1]
122+
- !Equals [!Ref 'AWS::Region', eu-west-2]
123+
- !Equals [!Ref 'AWS::Region', us-east-1]
124+
- !Equals [!Ref 'AWS::Region', us-east-2]
125+
- !Equals [!Ref 'AWS::Region', us-west-2]
115126

116127
Resources:
117128
rManagementAccountParametersLambdaCustomResource:
@@ -142,7 +153,10 @@ Resources:
142153
Properties:
143154
FunctionName: !Ref pManagementAccountParametersLambdaFunctionName
144155
Description: Creates Control Tower account SSM Parameters in the Management Account
145-
Architectures: [arm64]
156+
Architectures: !If
157+
- cUseGraviton
158+
- [arm64]
159+
- !Ref AWS::NoValue
146160
Handler: app.lambda_handler
147161
Role: !GetAtt rManagementAccountParametersLambdaRole.Arn
148162
Runtime: python3.9

‎aws_sra_examples/solutions/common/common_prerequisites/templates/sra-common-prerequisites-staging-s3-bucket.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,17 @@ Conditions:
128128
- !Condition cCreateCustomResource
129129
- !Condition cCreateLambdaLogGroup
130130
cUsingKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
131+
cUseGraviton: !Or
132+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
133+
- !Equals [!Ref 'AWS::Region', ap-south-1]
134+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
135+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
136+
- !Equals [!Ref 'AWS::Region', eu-central-1]
137+
- !Equals [!Ref 'AWS::Region', eu-west-1]
138+
- !Equals [!Ref 'AWS::Region', eu-west-2]
139+
- !Equals [!Ref 'AWS::Region', us-east-1]
140+
- !Equals [!Ref 'AWS::Region', us-east-2]
141+
- !Equals [!Ref 'AWS::Region', us-west-2]
131142

132143
Resources:
133144
rOrgIdLambdaCustomResource:
@@ -158,7 +169,10 @@ Resources:
158169
Properties:
159170
FunctionName: !Ref pOrgIdLambdaFunctionName
160171
Description: Get AWS Organization ID
161-
Architectures: [arm64]
172+
Architectures: !If
173+
- cUseGraviton
174+
- [arm64]
175+
- !Ref AWS::NoValue
162176
Handler: index.lambda_handler
163177
Role: !GetAtt rOrgIdLambdaRole.Arn
164178
Runtime: python3.9

‎aws_sra_examples/solutions/common/common_register_delegated_administrator/templates/sra-common-register-delegated-administrator-ssm.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,17 @@ Parameters:
131131
Conditions:
132132
cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
133133
cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
134+
cUseGraviton: !Or
135+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
136+
- !Equals [!Ref 'AWS::Region', ap-south-1]
137+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
138+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
139+
- !Equals [!Ref 'AWS::Region', eu-central-1]
140+
- !Equals [!Ref 'AWS::Region', eu-west-1]
141+
- !Equals [!Ref 'AWS::Region', eu-west-2]
142+
- !Equals [!Ref 'AWS::Region', us-east-1]
143+
- !Equals [!Ref 'AWS::Region', us-east-2]
144+
- !Equals [!Ref 'AWS::Region', us-west-2]
134145

135146
Resources:
136147
rRegisterDelegatedAdminLambdaLogGroup:
@@ -223,7 +234,10 @@ Resources:
223234
FunctionName: !Ref pRegisterDelegatedAdminLambdaFunctionName
224235
Description: Enable service access and register delegated admin account
225236
Role: !GetAtt rRegisterDelegatedAdminLambdaRole.Arn
226-
Architectures: [arm64]
237+
Architectures: !If
238+
- cUseGraviton
239+
- [arm64]
240+
- !Ref AWS::NoValue
227241
Handler: app.lambda_handler
228242
Runtime: python3.9
229243
Timeout: 300

‎aws_sra_examples/solutions/common/common_register_delegated_administrator/templates/sra-common-register-delegated-administrator.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,17 @@ Parameters:
128128
Conditions:
129129
cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
130130
cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
131+
cUseGraviton: !Or
132+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
133+
- !Equals [!Ref 'AWS::Region', ap-south-1]
134+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
135+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
136+
- !Equals [!Ref 'AWS::Region', eu-central-1]
137+
- !Equals [!Ref 'AWS::Region', eu-west-1]
138+
- !Equals [!Ref 'AWS::Region', eu-west-2]
139+
- !Equals [!Ref 'AWS::Region', us-east-1]
140+
- !Equals [!Ref 'AWS::Region', us-east-2]
141+
- !Equals [!Ref 'AWS::Region', us-west-2]
131142

132143
Resources:
133144
rRegisterDelegatedAdminLambdaLogGroup:
@@ -220,7 +231,10 @@ Resources:
220231
FunctionName: !Ref pRegisterDelegatedAdminLambdaFunctionName
221232
Description: Enable service access and register delegated admin account
222233
Role: !GetAtt rRegisterDelegatedAdminLambdaRole.Arn
223-
Architectures: [arm64]
234+
Architectures: !If
235+
- cUseGraviton
236+
- [arm64]
237+
- !Ref AWS::NoValue
224238
Handler: app.lambda_handler
225239
Runtime: python3.9
226240
Timeout: 300

‎aws_sra_examples/solutions/config/config_management_account/templates/sra-config-management-account-update-aggregator.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,17 @@ Parameters:
144144
Conditions:
145145
cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
146146
cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
147+
cUseGraviton: !Or
148+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
149+
- !Equals [!Ref 'AWS::Region', ap-south-1]
150+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
151+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
152+
- !Equals [!Ref 'AWS::Region', eu-central-1]
153+
- !Equals [!Ref 'AWS::Region', eu-west-1]
154+
- !Equals [!Ref 'AWS::Region', eu-west-2]
155+
- !Equals [!Ref 'AWS::Region', us-east-1]
156+
- !Equals [!Ref 'AWS::Region', us-east-2]
157+
- !Equals [!Ref 'AWS::Region', us-west-2]
147158

148159
Resources:
149160
rConfigUpdateAggregatorLambdaCustomResource:
@@ -176,7 +187,10 @@ Resources:
176187
Properties:
177188
FunctionName: !Ref pConfigUpdateAggregatorLambdaFunctionName
178189
Description: Update Config Aggregator Accounts in the Control Tower audit account.
179-
Architectures: [arm64]
190+
Architectures: !If
191+
- cUseGraviton
192+
- [arm64]
193+
- !Ref AWS::NoValue
180194
Handler: app.lambda_handler
181195
Role: !GetAtt rConfigUpdateAggregatorLambdaRole.Arn
182196
Runtime: python3.9

‎aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption/templates/sra-ec2-default-ebs-encryption.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,17 @@ Parameters:
169169
Conditions:
170170
cIsUsingKmsKey: !Not [!Equals [!Ref pEC2DefaultEBSEncryptionLambdaLogGroupKmsKey, '']]
171171
cIsCreateEC2DefaultEBSEncryptionLambdaLogGroup: !Equals [!Ref pCreateEC2DefaultEBSEncryptionLambdaLogGroup, 'true']
172+
cUseGraviton: !Or
173+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
174+
- !Equals [!Ref 'AWS::Region', ap-south-1]
175+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
176+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
177+
- !Equals [!Ref 'AWS::Region', eu-central-1]
178+
- !Equals [!Ref 'AWS::Region', eu-west-1]
179+
- !Equals [!Ref 'AWS::Region', eu-west-2]
180+
- !Equals [!Ref 'AWS::Region', us-east-1]
181+
- !Equals [!Ref 'AWS::Region', us-east-2]
182+
- !Equals [!Ref 'AWS::Region', us-west-2]
172183

173184
Resources:
174185
# Trigger Lambda after account is vended by AWS Control Tower
@@ -296,7 +307,10 @@ Resources:
296307
Properties:
297308
FunctionName: !Ref pEC2DefaultEBSEncryptionLambdaFunctionName
298309
Description: SRA Set the EC2 Default EBS encryption account setting
299-
Architectures: [arm64]
310+
Architectures: !If
311+
- cUseGraviton
312+
- [arm64]
313+
- !Ref AWS::NoValue
300314
Handler: app.lambda_handler
301315
Role: !GetAtt rEC2DefaultEBSEncryptionLambdaRole.Arn
302316
MemorySize: 2048

‎aws_sra_examples/solutions/firewall_manager/firewall_manager_org/templates/sra-firewall-manager-org-delegate-admin.yaml

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,17 @@ Parameters:
124124
Conditions:
125125
cUseKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
126126
cCreateLambdaLogGroup: !Equals [!Ref pCreateLambdaLogGroup, 'true']
127+
cUseGraviton: !Or
128+
- !Equals [!Ref 'AWS::Region', ap-northeast-1]
129+
- !Equals [!Ref 'AWS::Region', ap-south-1]
130+
- !Equals [!Ref 'AWS::Region', ap-southeast-1]
131+
- !Equals [!Ref 'AWS::Region', ap-southeast-2]
132+
- !Equals [!Ref 'AWS::Region', eu-central-1]
133+
- !Equals [!Ref 'AWS::Region', eu-west-1]
134+
- !Equals [!Ref 'AWS::Region', eu-west-2]
135+
- !Equals [!Ref 'AWS::Region', us-east-1]
136+
- !Equals [!Ref 'AWS::Region', us-east-2]
137+
- !Equals [!Ref 'AWS::Region', us-west-2]
127138

128139
Resources:
129140
rFirewallManagerDelegateAdminLambdaLogGroup:
@@ -148,6 +159,12 @@ Resources:
148159
reason: Actions require wildcard in resource
149160
- id: W28
150161
reason: The role name is defined
162+
checkov:
163+
skip:
164+
- id: CKV_AWS_109
165+
comment: Actions require wildcard in resource or condition provides constraints.
166+
- id: CKV_AWS_111
167+
comment: Actions require wildcard in resource or condition provides constraints.
151168
Properties:
152169
RoleName: !Ref pFirewallManagerDelegateAdminLambdaRoleName
153170
AssumeRolePolicyDocument:
@@ -258,7 +275,10 @@ Resources:
258275
Properties:
259276
FunctionName: !Ref pFirewallManagerDelegateAdminLambdaFunctionName
260277
Description: Delegates an administrator account for Firewall Manager
261-
Architectures: [arm64]
278+
Architectures: !If
279+
- cUseGraviton
280+
- [arm64]
281+
- !Ref AWS::NoValue
262282
Handler: app.lambda_handler
263283
Role: !GetAtt rFirewallManagerDelegateAdminLambdaRole.Arn
264284
Runtime: python3.9

0 commit comments

Comments
 (0)