Setting up the Enterprise Blueprint Factory

To fork the GitHub repositories

1. Log in to GitHub.

2. Navigate to the Configuration repo GitHub repository.

3. Choose Fork.

4. On the Create a new fork page, in the Repository name box, enter ServiceCatalog-ConfigRepo.

5. (Optional) Enter a description.

6. Select Copy the main branch only.

7. Choose Create fork.

8. Repeat these steps to fork the Code repo GitHub repository. Enter the name ServiceCatalog-CodeRepo for this repository.

9. Repeat these steps to fork the Product repo GitHub repository. Enter the name ServiceCatalog-BlueprintProductRepo for this repository.

To create the CodeConnections connection

1. In the AWS CLI, enter the following command to create an CodeConnections connection to GitHub:

   aws codeconnections create-connection --provider-type GitHub --connection-name <MyConnection>

2. Use the AWS Developer Tools console to complete the connection. For more information, see Update a pending connection.

To clone the forked repositories

• Enter the following commands to clone the GitHub repositories to your local workstation:

  git clone git@github.com:<user>/aws-enterprise-blueprint-factory-config-repo ServiceCatalog-ConfigRepo
  git clone git@github.com:<user>/aws-enterprise-blueprint-factory-blueprint-repo ServiceCatalog-BlueprintProductRepo
  git clone git@github.com:<user>/aws-enterprise-blueprint-factory-code-repo ServiceCatalog-CodeRepo

To set up the roles

1. In the Blueprint Developer's account, create the following trust policy, and then save it as sc-enduserrole-trust-policy.json:

   { 
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": {
         "AWS": "arn:aws:iam::123456789012:role/ServiceCatalogEndUserRole"
       },
       "Action": "sts:AssumeRole"
     }
   }

2. Enter the following command to create the ServiceCatalogEndUserRole IAM role:

   aws iam create-role \
   --role-name ServiceCatalogEndUserRole \
   --assume-role-policy-document file://sc-enduserrole-trust-policy.json  
   aws iam attach-role-policy \
   --policy-arn arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess \
   -- role-name ServiceCatalogEndUserRole

   Note

   Developers use the ServiceCatalogEndUserRole role to provision the Service Catalog product. This role does not need permissions to create the resources defined in the blueprint. This follows the best practices of least privileged permissions and segregation of duties.

3. Create the following trust policy and then save it as sc-launchconstraintrole-trust-policy.json:

   { 
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": {
         "Service": "servicecatalog.amazonaws.com"
       },
       "Action": "sts:AssumeRole"
     }
   }

4. Enter the following command to create the ServiceCataloglogLaunchConstraintRole IAM role:

   aws iam create-role \
   --role-name ServiceCataloglogLaunchConstraintRole \
   --assume-role-policy-document file://sc-launchconstraintrole-trust-policy.json  
   aws iam attach-role-policy \
   --policy-arn arn:aws:iam::aws:policy/AmazonSNSFullAccess \
   --role-name ServiceCataloglogLaunchConstraintRole
   aws iam attach-role-policy \
   --policy-arn arn:aws:iam::aws:policy/AWSCloudFormationFullAccess \
   --role-name ServiceCataloglogLaunchConstraintRole

5. Add the following policy to the ServiceCataloglogLaunchConstraintRole IAM role. Include any other permissions that are required for the product resources, as described in Configuring a Launch Role in the Service Catalog documentation:

   {
             "Statement":[
         {
            "Effect":"Allow",
            "Action":[
               "s3:GetObject"
            ],
            "Resource":"*",
            "Condition":{
               "StringEquals":{
                  "s3:ExistingObjectTag/servicecatalog:provisioning":"true"
               }
            }
      ]
   }

   Note

   Service Catalog uses this role to deploy the CloudFormation stack as a product in Service Catalog. The trust policy for this role makes sure that only Service Catalog can assume it. Other users or services cannot assume this role. This follows the best practice of segregation of duties.

6. Create the following trust policy, and then save it as sc-codebuild-trust-policy.json:

   { 
     "Version": "2012-10-17",
     "Statement": {
       "Effect": "Allow",
       "Principal": {
         "Service": "codebuild.amazonaws.com"
       },
       "Action": "sts:AssumeRole"
     }
   }

7. Enter the following command to create the codebuild-servicecatalog-admin-role IAM role:

   aws iam create-role \
   --role-name codebuild-servicecatalog-admin-role \
   --assume-role-policy-document file://sc-codebuild-trust-policy.json  
   aws iam attach-role-policy \
   --policy-arn arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess \
   --role-name codebuild-servicecatalog-admin-role

   Note

   The CodeBuild jobs in the config pipeline use this role.

To set up the Amazon S3 bucket

• To create an Amazon Simple Storage Service (Amazon S3) bucket that is used to store the CodePipeline artifacts, follow the instructions in Creating a bucket in the Amazon S3 documentation. Follow the Security best practices for Amazon S3.

To set up the AWS Systems Manager parameters

• Follow the instructions in Creating Parameter Store parameters in Systems Manager in order to create the Systems Manager parameters in the following table. These parameters are used in the CloudFormation template that deploys the configuration pipeline.

  Parameter name	Type	Description
  /blueprints/resources/vpc_id	String	Parameter that stores the ID of the target virtual private cloud (VPC).
  /blueprints/resources/subnets	StringList	Parameter that stores the IDs of the target subnets.
  /blueprints/resources/securitygroups	StringList	Parameter that stores the IDs of the target security groups.
  /blueprints/resources/artifacts-bucket-name	String	Parameter that stores the Amazon S3 bucket name that is used for CodePipeline artifacts.
  /blueprints/resources/BlueprintRepo	String	Parameter that stores the GitHub repo where the Enterprise Blueprint Factory blueprints are stored. The default value is <user>/aws-enterprise-blueprint-factory-blueprint-repo.
  /blueprints/resources/CodeRepo	String	Parameter that stores the GitHub repo where the Enterprise Blueprint Factory configuration pipeline code and the Bootstrapping-Admin-Product code are stored. The default value is <user>/aws-enterprise-blueprint-factory-code-repo.
  /blueprints/resources/ConfigRepo	String	Parameter that stores the GitHub repo where the Enterprise Blueprint Factory configuration files are stored. The default value is <user>/aws-enterprise-blueprint-factory-config-repo.

To update the CloudFormation templates

1. In the code repository (ServiceCatalog-CodeRepo), open the ServiceCatalog-Pipeline.yml file.

2. Edit the default values for the following parameters in this file:

   • ConfigRepositoryName is the Systems Manager parameter that stores the GitHub repo where the Enterprise Blueprint Factory configuration files are stored. The default value is /blueprints/resources/ConfigRepo.

   • CodeRepositoryName is the Systems Manager parameter that stores the GitHub repo where the Enterprise Blueprint Factory configuration pipeline code and the Bootstrapping-Admin-Product code are stored. The default value is /blueprints/resources/CodeRepo.

   • BlueprintRepositoryName is the Systems Manager parameter that stores the GitHub repo where the Enterprise Blueprint Factory blueprints are stored. The default value is /blueprints/resources/BlueprintRepo.

   • BranchName is the branch of the config repository where the config file is stored. The default value is main.

   • VPCID is the Systems Manager parameter that stores the ID of the target VPC. The default value is /blueprints/resources/vpc_id.

   • Subnets is the Systems Manager parameter that stores the IDs of the target subnets. The default value is /blueprints/resources/subnets.

   • SecurityGroupIds is the Systems Manager parameter that stores the IDs of the target security groups. The default value is /blueprints/resources/securitygroups.

   • IamRoleName is the name of the IAM role that the CodeBuild jobs use. The default value is codebuild-servicecatalog-admin-role.

   • EnvironmentType is the environment where you are deploying the Enterprise Blueprint Factory. The default value is DEV.

   • ArtifactBucket is the Systems Manager parameter that stores the Amazon S3 bucket where CodePipeline stores artifacts. The default value is /blueprints/resources/artifacts-bucket-name.

   • CodeConnectionArn is the Amazon Resource Name (ARN) of the CodeConnections connection to GitHub.

3. Save and close the ServiceCatalog-Pipeline.yml file.

4. Enter the following commands to merge the changes into the code repository:

   cd ServiceCatalog-CodeRepo
   git add ServiceCatalog-Pipeline.yml
   git commit -m "<description of change>"
   git push origin main

5. In the configuration repository (ServiceCatalog-ConfigRepo), open the bp_config.yml file.

6. Update the values in the portfolio section as needed for your organization. For example, update the portfolio_access_roles and share_to_ou attributes. For more information, see Configuration file in this guide.

7. Save and close the bp_config.yml file.

8. Enter the following commands to merge the changes into the code repository:

   cd ServiceCatalog-ConfigRepo
   git add bp_config.yml
   git commit -m "<description of change>"
   git push origin main

To deploy the CloudFormation stack

1. Sign in to the Enterprise Blueprint Factory administrative account.

2. Switch to an IAM role that has administrative permissions.

3. Open the CloudFormation console.

4. On the navigation bar at the top of the screen, choose the target AWS Region.

5. On the Stacks page, choose Create stack at top right, and then choose With new resources (standard).

6. For Prepare template, choose Template is ready.

7. Under Specify template, choose Upload a template file.

8. Choose Choose File, navigate to the ServiceCatalog-CodeRepo folder, and then choose ServiceCatalog-Pipeline.yml.

9. Choose Next to continue and to validate the template.

10. For Stack name, enter a name for the stack.

11. In the Parameters section, do not change the default values.

12. Choose Next.

13. On the Configure stack options page, do not change the default values, and then choose Next.

14. On the Review and create page, verify the template and stack details, and then choose Submit.

15. Monitor the progress of the stack deployment. For more information, see the CloudFormation documentation.

16. Wait for the status to change to CREATE_COMPLETE.

To validate the deployment

1. Open the AWS Service Catalog console.

2. In the navigation pane, choose Products.

3. Confirm that ServiceCatalog-Pipeline is available in the list of products.

4. Open the AWS CodePipeline console.

5. In Name, choose the configuration pipeline. By default, the pipeline name is ServiceCatalog-Pipeline.

6. Choose View history.

7. View the status of the pipeline and stage execution. For more information about the status, see View execution status in the CodePipeline documentation.

8. Wait until the configuration pipeline status is Succeeded.

9. Open the Service Catalog console.

10. In the navigation pane, choose Products.

11. Confirm that the BP-S3-Product and BP-SNS-Product products are available. This indicates that the product release pipelines for the sample blueprints completed successfully.

12. If you want to delete the sample blueprints that you deployed when setting up the Enterprise Blueprint Factory, follow the instructions in Deleting a blueprint.

To delete the resources

1. Enter the following commands to delete the IAM roles that were deployed in the Enterprise Blueprint Factory administrative account:

   aws iam detach-role-policy \
   --policy-arn arn:aws:iam::aws:policy/AWSServiceCatalogEndUserFullAccess \
   --role-name ServiceCatalogEndUserRole
   aws iam delete-role --role-name ServiceCatalogEndUserRole
   aws iam detach-role-policy \
   --policy-arn arn:aws:iam::aws:policy/AmazonSNSFullAccess \
   --role-name ServiceCataloglogLaunchConstraintRole
   aws iam delete-role --role-name ServiceCataloglogLaunchConstraintRole

2. Delete the CloudFormation stack for the Enterprise Blueprint Factory. For instructions, see Delete a stack from the CloudFormation console or Delete a stack from the AWS CLI.

3. Delete the Amazon S3 bucket that is used to store the CodePipeline artifacts. For instructions, see Deleting a bucket in the Amazon S3 documentation.

4. Delete the following Systems Manager parameters from Parameter Store:

   • /blueprints/resources/vpc_id

   • /blueprints/resources/subnets

   • /blueprints/resources/securitygroups

   • /blueprints/resources/artifacts-bucket-name

   • /blueprints/resources/BlueprintRepo

   • /blueprints/resources/CodeRepo

   • /blueprints/resources/ConfigRepo

   For instructions, see Deleting parameters from Parameter Store in the Systems Manager documentation.