AWS Organisation: IAM openid idp for all accounts in OU?

Question

I want to add our VCS as openId IdP for deploys. Is it possible to add this at the organisation level so all accounts in an OU automatically get that connection?

Or is it preferable to set this on an account level?

Thanks in advance!

Answer

Hi,

Yes you can create a CloudFormation template that includes the given IAM role, and setup a CloudFormation StackSet. The deployment can be controlled by child account or a specific Organizational Unit inside your organization. Here is a link to the documentation available to setup it [1].

If you want to assure every new account provisioned by Control Tower have this new IAM role, you can use Customizations for Control Tower [2]. This solution will allows you to setup templates or SCP across your organization, and have integration with Control Tower events, that will assure you can manage the versioning and targets of your deployment.

[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html

[2] https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/

AWS Organisation: IAM openid idp for all accounts in OU?

Relevant content