Account Vending - Automated Account Creation and Bootstrapping

Overview

The Account Vending module provides automated AWS account creation and bootstrapping with baseline configurations. This enables teams to quickly provision new AWS accounts with consistent security, networking, and operational baselines.

Features
Architecture
Quick Start
Configuration
Bootstrapping Details
Adding New Accounts
Cost Considerations
Security
Troubleshooting
Best Practices

Features

Account Management

✅ Automated AWS account creation
✅ Placement in specified Organizational Units
✅ Unique email address per account
✅ Cross-account access role configuration
✅ Account tagging and metadata

Network Bootstrapping

✅ VPC with public and private subnets
✅ Multi-AZ deployment (2-3 AZs)
✅ NAT Gateways for private subnet internet access
✅ Internet Gateway for public subnets
✅ VPC Flow Logs for network monitoring
✅ Route tables and associations
✅ Optional VPN Gateway

Security Bootstrapping

✅ Baseline security groups
✅ IAM roles (Admin, ReadOnly, Developer, Terraform)
✅ GuardDuty threat detection
✅ Security Hub compliance monitoring
✅ AWS Config resource tracking
✅ Access Analyzer for IAM policies
✅ KMS encryption

Operational Bootstrapping

✅ CloudWatch Log Groups
✅ VPC Flow Logs
✅ S3 buckets (logs, backups, data)
✅ SSM Parameter Store configuration
✅ SNS notifications integration

Extensibility

✅ Fully extensible account list
✅ Per-account customization
✅ Optional bootstrapping
✅ Idempotent operations

Architecture

┌─────────────────────────────────────────────────────────────┐
│                    Management Account                        │
│                                                              │
│  ┌────────────────────────────────────────────────────────┐ │
│  │         Account Vending Module (Terraform)             │ │
│  │                                                        │ │
│  │  1. Create AWS Account                                │ │
│  │  2. Wait for account provisioning (60s)               │ │
│  │  3. Assume OrganizationAccountAccessRole              │ │
│  │  4. Bootstrap account:                                │ │
│  │     ├── Create VPC                                    │ │
│  │     ├── Create Security Groups                        │ │
│  │     ├── Create IAM Roles                              │ │
│  │     ├── Enable Security Services                      │ │
│  │     ├── Configure Logging                             │ │
│  │     └── Create S3 Buckets                             │ │
│  │  5. Store configuration in SSM                        │ │
│  └────────────────────────────────────────────────────────┘ │
│                                                              │
└──────────────────────────┬───────────────────────────────────┘
                           │
                           │ Creates & Bootstraps
                           │
        ┌──────────────────┴──────────────────┐
        │                                     │
┌───────▼────────┐                   ┌────────▼───────┐
│  NonProd OU    │                   │   Prod OU      │
│                │                   │                │
│  ┌──────────┐  │                   │  ┌──────────┐  │
│  │   Dev    │  │                   │  │   Prod   │  │
│  │ Account  │  │                   │  │ Account  │  │
│  │          │  │                   │  │          │  │
│  │ VPC      │  │                   │  │ VPC      │  │
│  │ SGs      │  │                   │  │ SGs      │  │
│  │ IAM      │  │                   │  │ IAM      │  │
│  │ Security │  │                   │  │ Security │  │
│  │ Logging  │  │                   │  │ Logging  │  │
│  │ S3       │  │                   │  │ S3       │  │
│  └──────────┘  │                   │  └──────────┘  │
│                │                   │                │
│  ┌──────────┐  │                   └────────────────┘
│  │   Test   │  │
│  │ Account  │  │
│  │          │  │
│  │ VPC      │  │
│  │ SGs      │  │
│  │ IAM      │  │
│  │ Security │  │
│  │ Logging  │  │
│  │ S3       │  │
│  └──────────┘  │
│                │
└────────────────┘

Quick Start

1. Add Account Vending Module to Main Configuration

# main.tf

module "account_vending" {
  source = "./modules/account-vending"

  management_account_id  = data.aws_caller_identity.current.account_id
  home_region            = var.home_region
  enable_bootstrapping   = true
  
  central_log_bucket     = module.logging.log_bucket_id
  kms_key_id             = module.security.kms_key_id
  security_sns_topic_arn = aws_sns_topic.security_notifications.arn

  accounts = {
    dev = {
      name               = "Development"
      email              = "aws-dev@example.com"
      ou_id              = module.organizational_units.ou_ids["nonprod"]
      environment        = "dev"
      role_name          = "OrganizationAccountAccessRole"
      vpc_cidr           = "10.1.0.0/16"
      availability_zones = ["ap-southeast-2a", "ap-southeast-2b"]
      enable_nat_gateway = true
      single_nat_gateway = true
      enable_vpn_gateway = false
      allowed_ssh_cidrs  = ["10.0.0.0/8"]
      allowed_https_cidrs = ["0.0.0.0/0"]
      enable_admin_role     = true
      enable_readonly_role  = true
      enable_developer_role = true
      enable_guardduty       = true
      enable_securityhub     = true
      enable_config          = true
      enable_access_analyzer = true
      create_data_bucket     = true
      tags = { CostCenter = "Engineering" }
    }
  }

  tags = {
    ManagedBy = "Terraform"
  }
}

2. Deploy

# Initialize Terraform
terraform init

# Review plan
terraform plan

# Apply (account creation takes 5-10 minutes per account)
terraform apply

3. Access New Account

# Assume role in new account
aws sts assume-role \
  --role-arn arn:aws:iam::<ACCOUNT-ID>:role/OrganizationAccountAccessRole \
  --role-session-name terraform

# Export credentials
export AWS_ACCESS_KEY_ID=<AccessKeyId>
export AWS_SECRET_ACCESS_KEY=<SecretAccessKey>
export AWS_SESSION_TOKEN=<SessionToken>

# Verify access
aws sts get-caller-identity

Configuration

Account Object Structure

account_key = {
  # Required Fields
  name        = string  # Account name (e.g., "Development")
  email       = string  # Unique email (e.g., "aws-dev@example.com")
  ou_id       = string  # OU ID where account will be created
  environment = string  # Environment tag (e.g., "dev", "prod")
  role_name   = string  # Cross-account access role name

  # VPC Configuration
  vpc_cidr           = string       # VPC CIDR block (e.g., "10.1.0.0/16")
  availability_zones = list(string) # AZs (e.g., ["ap-southeast-2a", "ap-southeast-2b"])
  enable_nat_gateway = bool         # Enable NAT Gateway (true/false)
  single_nat_gateway = bool         # Use single NAT (true for cost savings)
  enable_vpn_gateway = bool         # Enable VPN Gateway (true/false)

  # Security Configuration
  allowed_ssh_cidrs   = list(string) # CIDRs for SSH access
  allowed_https_cidrs = list(string) # CIDRs for HTTPS access

  # IAM Roles
  enable_admin_role     = bool # Enable admin role
  enable_readonly_role  = bool # Enable read-only role
  enable_developer_role = bool # Enable developer role

  # Security Services
  enable_guardduty       = bool # Enable GuardDuty
  enable_securityhub     = bool # Enable Security Hub
  enable_config          = bool # Enable AWS Config
  enable_access_analyzer = bool # Enable Access Analyzer

  # S3 Buckets
  create_data_bucket = bool # Create data bucket

  # Custom Tags
  tags = map(string) # Additional tags
}

Example Configurations

Development Account (Cost-Optimized)

dev = {
  name               = "Development"
  email              = "aws-dev@example.com"
  ou_id              = module.organizational_units.ou_ids["nonprod"]
  environment        = "dev"
  role_name          = "OrganizationAccountAccessRole"
  vpc_cidr           = "10.1.0.0/16"
  availability_zones = ["ap-southeast-2a", "ap-southeast-2b"]
  enable_nat_gateway = true
  single_nat_gateway = true  # Single NAT for cost savings
  enable_vpn_gateway = false
  allowed_ssh_cidrs  = ["10.0.0.0/8"]
  allowed_https_cidrs = ["0.0.0.0/0"]
  enable_admin_role     = true
  enable_readonly_role  = true
  enable_developer_role = true
  enable_guardduty       = true
  enable_securityhub     = false  # Disable for cost savings
  enable_config          = false  # Disable for cost savings
  enable_access_analyzer = true
  create_data_bucket     = true
  tags = { CostCenter = "Engineering", Purpose = "Development" }
}

Production Account (High Availability)

prod = {
  name               = "Production"
  email              = "aws-prod@example.com"
  ou_id              = module.organizational_units.ou_ids["prod"]
  environment        = "prod"
  role_name          = "OrganizationAccountAccessRole"
  vpc_cidr           = "10.10.0.0/16"
  availability_zones = ["ap-southeast-2a", "ap-southeast-2b", "ap-southeast-2c"]
  enable_nat_gateway = true
  single_nat_gateway = false  # NAT per AZ for HA
  enable_vpn_gateway = true   # VPN for on-premises
  allowed_ssh_cidrs  = ["10.0.0.0/8"]
  allowed_https_cidrs = ["0.0.0.0/0"]
  enable_admin_role     = true
  enable_readonly_role  = true
  enable_developer_role = false  # No developer access in prod
  enable_guardduty       = true
  enable_securityhub     = true
  enable_config          = true
  enable_access_analyzer = true
  create_data_bucket     = true
  tags = { CostCenter = "Operations", Purpose = "Production", Compliance = "SOC2" }
}

Bootstrapping Details

Bootstrap Modules

The account vending module includes six bootstrap submodules that configure baseline resources: