AWS services in this solution
| AWS service | Description |
|---|---|
|
Core. This solution uses CloudFront with an Amazon S3 bucket as the origin. This restricts access to the Amazon S3 bucket so that it is not publicly accessible and prevents direct access from the bucket. |
|
|
Core. The solution federates web application authentication through Amazon Cognito to IAM Identity Center using SAML 2.0, and uses IAM Identity Center to manage role-based access to sandbox accounts for solution users. |
|
|
Core. The solution uses an Amazon Cognito user pool (federated to IAM Identity Center using SAML 2.0) to authenticate web application users, and a Cognito identity pool to vend the temporary IAM credentials the web UI uses to sign API requests. |
|
|
Core. The solution uses AWS AppConfig to store the account cleanup configuration used by the account cleaner. This includes the AWS Nuke configuration and the cleanup validator exclusion configuration. |
|
|
Core. The solution uses Resource Explorer to enumerate resources in sandbox accounts before cleanup, after cleanup, and after cooldown — providing post-cleanup validation and resource usage metrics. |
|
|
Core. The solution uses AWS Organizations to centrally manage and govern multiple AWS accounts required by the solution. |
|
|
Core. This solution uses DynamoDB to store state for the solution, including sandbox account, lease, and lease template records, and the solution’s global configuration settings. |
|
|
Core. This solution uses serverless Lambda functions, with Node.js to handle API calls. |
|
|
Core. This solution uses CodeBuild for the account cleanup process. |
|
|
Core. This solution uses Amazon S3 for frontend and backend storage purposes. |
|
|
Core. This solution uses AWS KMS to manage creation and control of encryption keys, required to encrypt various AWS resources used in the solution. |
|
|
Core. This solution uses Amazon SQS to manage message queues. |
|
|
Core. This solution uses AWS Step Functions to orchestrate blueprint deployment workflows, lease assignment processing, and the account tag activation workflow. |
|
|
Supporting. This solution activates account cost allocation tags in AWS Billing and Cost Management so that you can analyze sandbox costs by tag in Cost Explorer, AWS Budgets, and Cost and Usage Reports. |
|
|
Supporting. This solution uses CloudWatch to collect and visualize real-time logs, metrics, and event data in automated cases. Additionally, you can monitor the deployed solution’s resource usage and performance issues. |
|
|
Supporting. This solution uses AWS Systems Manager for solution configuration and sharing cross account/stack parameters using the RAM service. |
|
|
Supporting. This solution uses AWS WAF to protect the Amazon API Gateway from common exploits and bots that can affect availability, compromise security, or consume excessive resources. |
|
|
Supporting. This solution uses AWS Cost Explorer to retrieve cost and usage data for accounts and leases. |
