Using aws controltower with infra

Question

Pulumi · Accepted Answer

When using AWS Control Tower, you're essentially looking to set up and govern a secure, multi-account AWS environment based on best practices. AWS Control Tower automates the process of setting up your environment by establishing a landing zone, which is a well-architected, multi-account baseline that follows AWS best practices.

Below, you will find a Pulumi program written in TypeScript, which demonstrates how to use AWS Control Tower with Pulumi infrastructure as code. The program leverages the `aws-native.controltower.LandingZone` resource, which will create a new AWS Control Tower landing zone.

First, ensure you have Pulumi set up and configured to access your AWS account. Also, ensure you have the required AWS permissions to create a Control Tower landing zone. If you don't, the Pulumi program will not be able to provision the resources.

Here is the Pulumi program:

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

// Create a new AWS Control Tower Landing Zone
const landingZone = new aws_native.controltower.LandingZone("myLandingZone", {
    tags: [{
        key: "Environment",
        value: "Production",
    }],
    // Specify the version of the landing zone
    version: "2.0",
    // The manifest is a JSON or YAML configuration file that defines the landing zone configuration
    // This is a simplified example. You'll need to provide your own manifest according to AWS specifications.
    manifest: {
        "regions": ["us-west-2"],
        "resourceFile": "resources.yaml", // Actual YAML should be structured per AWS Control Tower specifications
    },
});

// Export the landing zone ARN so we know where to find it
export const landingZoneArn = landingZone.arn;
```

In the above program, we are creating a resource of type `aws-native.controltower.LandingZone`. We assign it a name (`myLandingZone`) and pass configuration options such as tags and the version of the landing zone. The `manifest` property is where you define the specifics of your landing zone; this will need to be fleshed out as per your requirements and AWS Control Tower's manifest schema.

Please note that the `manifest` and `resourceFile` in the example are placeholders for the actual configuration that you need to provide. The manifest configuration file should be formatted according to AWS Control Tower's specifications.

Once you have your landing zone set up, you can start structuring your environment by adding organizational units (OUs), accounts, and guardrails using other AWS Control Tower or AWS services programmatically with Pulumi.

After creating the landing zone, we export the ARN (Amazon Resource Name) of the landing zone. This ARN can be used to further interact with the landing zone or reference it in other parts of your infrastructure code.

You would typically place this code into a file named `index.ts` and then run `pulumi up` to preview and provision the resources defined in the code. Pulumi automates the deployment process and outputs the ARN of the created landing zone after successful deployment.