What do you know about AWS Control Tower with CDK? Setting up access to AWS accounts may seem straightforward, but using CDK can introduce unexpected challenges. At K3, we break down the setup process and show you how to configure AWS account access with IAM Identity Center smoothly and correctly.

When setting up access to your AWS accounts governed by AWS Control Tower, you have two options:

• Allow Control Tower to configure account access with IAM Identity Center.

• Configure IAM Identity Center or another access method yourself.

If you decide to let Control Tower manage account access with IAM Identity Center, the setup process can be straightforward or complex, depending on your Control Tower configuration. For instance, using CDK can make the process less smooth.

IAM Identity Center configuration using the console

As shown in the image below, configuring IAM Identity Center through the console is as simple as selecting an option. AWS Control Tower will handle:

• Enabling IAM Identity Center if it isn’t already enabled.

• Creating a preconfigured directory with user groups and permission sets.

• Setting up essential user groups and permission sets.

Naturally, we expected the same streamlined experience with CDK—but this wasn’t exactly the case.

IAM Identity Center Configuration When Deploying Control Tower with CDK

First of all, CDK currently lacks an L2 construct for Control Tower (AWS CDK documentation). This means you’ll need to use an L1 construct instead. If you’re unfamiliar with CDK constructs, refer to the constructs documentation.

Basically, L1 constructs map directly to individual AWS CloudFormation resources, so you’ll need to reference CloudFormation resources and configure properties accordingly.

Let’s review the Control Tower Landing Zone CloudFormation reference:

Among the properites, Manifest and Version are required. The Manifest property specifies the Landing Zone configuration, but there’s little documentation explaining the necessary configurations for it.

To be honest, we had a hard time finding clear documentation on the manifest file. This page was all we found, but it lacks a detailed explanation of each property. For instance, it’s not immediately clear that the accessManagement.enable property enables IAM Identity Center.

Below is an example of the Landing Zone CDK resource configuration:

Setting accessManagement.enable to true instructs Control Tower to create the user groups and permission sets, but it doesn’t actually enable IAM Identity Center. This resulted in the following error:

This means we needed to enable IAM Identity Center first.

Enabling IAM Identity Center

Since we were using CDK, our initial approach was to create an IAM Identity Center instance in our CDK stack. However, we had to abandon this idea quickly. The documentation for AWS: :SSO: :Instance states that you can only create an instance for a standalone AWS account that isn’t managed by AWS Organizations or a member account within an organization—clearly, not my case. We looked for alternative ways to enable IAM Identity Center without using the console, as we wanted to avoid manual steps, but had no luck. According to the documentation here:

Thus, it appears the console is the only option.

To enable it, go to the IAM Identity Center dashboard and click on Eanble. It only takes a few seconds.

Once enabled, you’ll notice no user groups or permission sets are yet available. But no worries, Control Tower will create them.

Now that IAM Identity Center is enabled, we could proceed with deploying Control Tower. The deployment succeeded, and we can confirmed that IAM Identity Center was enabled in the Landing Zone settings.

Returning to the IAM Identity Center dashboard, I saw that Control Tower created:

• The AWS Control Tower Admin user.

• 8 user groups.

• 6 permission sets.

Conclusion

Automating Control Tower deployment is convenient but presents some integration challenges with IAM Identity Center. Today, we reviewed ways to address these limitations.

The Deployment of Control Tower is the core of our K3 CloudWise service.

With CloudWise you can focus on your core business while we take care of the proactive management of your AWS Organization (Control Tower). We handle everything from performance optimization and security updates to cost control. As an extension of your team, we continuously identify opportunities for improvement and provide insights into how your cloud environment can be optimized for best results.

This article was originally published on The-indie-coder.