ministryofjustice / aws-root-account

Terraform for the Ministry of Justice AWS root account

AWS Root Account

This repository holds infrastructure as code for the Ministry of Justice AWS Organizations root account, and two supporting accounts: organisation-security, and organisation-logging.

AWS Organizations

All accounts defined here form part of the MOJ's AWS Organization, allowing us to use certain services for organisational audit, governance, security, and cost optimisation.

Services

Service	Infrastructure as Code	Managed centrally	Method
Alternate contact information	yes	〰️ partially (SECURITY contact only)	Trusted access
Artifact (security and compliance reports)	no	✅ yes	no
Audit Manager	no	❌ no	no
Backup	no	❌ no	Delegated to teams
CloudFormation Stacksets	no	❌ no	no
CloudTrail (Organisational trail)	no	❌ no	Delegated to teams
CloudWatch Events	no	❌ no	Delegated to teams
Compute Optimizer	yes	✅ yes	Trusted access
Config - Multi-account setup	no	❌ no	Delegated to teams
Config - Multi-region, multi-account aggregation	yes	✅ yes	Trusted access with a delegated administrator
Control Tower	no	❌ no	no
Detective	partially	〰️ partially	Trusted access with a delegated administrator
DevOps Guru	no	❌ no	no
Directory Service	no	❌ no	no
Firewall Manager	yes	〰️ partially (delegated administrator)	Trusted access with a delegated administrator
GuardDuty	yes	✅ yes	Trusted access with a delegated administrator
Health (Organisational view)	yes	✅ yes	Trusted access
IAM Access Analyzer (Organisational zone of trust)	yes	✅ yes	Trusted access with a delegated administrator
IAM	no	❌ no	no
Inspector	partially	✅ yes	Trusted access with a delegated administrator
License Manager	yes	✅ yes	Trusted access with a delegated administrator
Macie	no	❌ no	no
Marketplace (License management)	yes	❌ no	Trusted access
Organizations: AI services opt-out policies	yes	✅ yes	Inheritance
Organizations: Service Control Policies	yes	✅ yes	Inheritance
Organizations: Tagging policies	yes	✅ yes	Inheritance
Resource Access Manager (RAM): Organisational sharing	yes	✅ yes	Trusted access
S3 Storage Lens	yes	✅ yes	Trusted access
Security Hub	yes	〰️ partially	Trusted access with a delegated administrator
Service Catalog	no	❌ no	no
Service Quotas	no	❌ no	no
Single Sign-On (SSO)	yes	✅ yes	Trusted access
Systems Manager	no	❌ no	no
Trusted Advisor (Organisational overview)	yes	✅ yes	Trusted access
VPC IP Address Manager (IPAM)	yes	✅ yes	Trusted access with a delegated administrator

aws-root-account's Issues

A branch protection setting is not enabled: codeowners require reviews

Hi there
The default branch protection setting called codeowners require review is not enabled for this repository
This option affects a pull request, i.e a PR will need to be reviewed and approved by a CODEOWNER before it can be merged.
See repository settings/Branches/Branch protection rules
Either add a new Branch protection rule or edit the existing branch protection rule and select the Require review from Code Owners option
Create a .github/CODEOWNERS file
Add a or multiple entries of @ministryofjustice/team_name to the CODEOWNERS file
The team_name shall be a team from within the MoJ teams: https://github.com/orgs/ministryofjustice/teams
See GH Codeowners documentation: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
See the repository standards: https://github.com/ministryofjustice/github-repository-standards
See the report: https://operations-engineering-reports.cloud-platform.service.justice.gov.uk/github_repositories
Please contact Operations Engineering on Slack #ask-operations-engineering, if you need any assistance

Investigate enabling central configuration in security hub

Central configuration is now available in security hub - https://aws.amazon.com/about-aws/whats-new/2023/11/aws-security-hub-central-configuration/
We should look into the benefits of enabling this.

Collaborator review date expires soon for user emileswarts

Hi there

The user @emileswarts has its access for this repository maintained in code here: https://github.com/ministryofjustice/github-collaborators

The review_after date is due to expire within one month, please update this via a PR if they still require access.

If you have any questions, please post in #ask-operations-engineering on Slack.

Failure to update the review_date will result in the collaborator being removed from the repository via our automation.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

This user had Direct Member access to this repository and access via a team.

Access is now only via a team.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

This user had Direct Member access to this repository and access via a team.

Access is now only via a team.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

This user had Direct Member access to this repository and access via a team.

Access is now only via a team.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

This user had Direct Member access to this repository and access via a team.

Access is now only via a team.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

Please define outside collaborators in code

Hi there

We now have a process to manage github collaborators in code:
https://github.com/ministryofjustice/github-collaborators/blob/main/README.md#github-outside-collaborators

Please follow the procedure described there to grant @pasipa2 access to this repository.

If you have any questions, please post in #ask-operations-engineering on Slack.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

Please define outside collaborators in code

Hi there

We now have a process to manage github collaborators in code:
https://github.com/ministryofjustice/github-collaborators/blob/main/README.md#github-outside-collaborators

Please follow the procedure described there to grant @enyambudzi access to this repository.

If you have any questions, please post in #ask-operations-engineering on Slack.

Should this repo be open to the public?

This seems like it should be set to private.

Collaborator review date expires soon for user bjpirt

Hi there

The user @bjpirt has its access for this repository maintained in code here: https://github.com/ministryofjustice/github-collaborators

The review_after date is due to expire within one month, please update this via a PR if they still require access.

If you have any questions, please post in #ask-operations-engineering on Slack.

Failure to update the review_date will result in the collaborator being removed from the repository via our automation.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user bjpirt had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user emileswarts had Direct Member access to this repository and access via a team.

Access is now only via a team.

You may have less access it is dependant upon the teams access to the repo.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

The user davidkelliott either had direct member access to the repository or had direct member access and access via a team.

Access is now only via a team.

If the user was already in a team, then their direct access to the repository has been removed.

If the user was not in a team, then the user will have been added to an automated generated team named repository-name-<read|write|maintain|admin>-team and their direct access to the repository has been removed.

The list of Org teams can be found at https://github.com/orgs/ministryofjustice/teams or https://github.com/orgs/moj-analytical-services/teams.

The user will have the same level of access to the repository via the team.

The first user added to a team is made a team maintainer, this enables that user to manage the users within the team.

Users with admin access are added to the admin team as a team maintainer.

If you have any questions, please contact us in #ask-operations-engineering on Slack.

This issue can be closed.

User access removed, access is now via a team

Hi there

This user had Direct Member access to this repository and access via a team.

Access is now only via a team.

If you have any questions, please post in #ask-operations-engineering on Slack.

This issue can be closed.