Skip to content

feat(aws): Adding CF Template to do full org deployment#10403

Open
jchrisfarris wants to merge 3 commits intoprowler-cloud:masterfrom
jchrisfarris:AWSOrgRoleStacket
Open

feat(aws): Adding CF Template to do full org deployment#10403
jchrisfarris wants to merge 3 commits intoprowler-cloud:masterfrom
jchrisfarris:AWSOrgRoleStacket

Conversation

@jchrisfarris
Copy link
Contributor

@jchrisfarris jchrisfarris commented Mar 19, 2026

Context

Add a CloudFormation Template to do all the necessary things to deploy the role to an AWS Organization

Description

This template will now:

  1. Create the role in the Org Management Account (with permissions to list organization accounts)
  2. Create a Service Managed StackSet in the Org Management Account to deploy to all of the child accounts in the AWS organization.

It can be run to only deploy a role locally, only deploy the stackset, and to deploy from the Org Management account, or from an Delegated Admin account for CloudFormation

Steps to review

Three scenarios to test. Because the role is hard-coded you'll need to delete the stack after each test.

  1. Deploy into org management account with EnableOrganizations=True & DeployStackSet=True & DeployLocalRole=True. This the happy path to getting our org onboarded to Prowler
  2. Deploy into org management account with EnableOrganizations=True & DeployStackSet=False & DeployLocalRole=True - This is the behavior closest to the current role. It deploys only in the management account.
  3. In an account with DelegatedAdmin for CloudFormation, DeployFromDelegatedAdmin=True, EnableOrganizations=True & DeployStackSet=True & DeployLocalRole=False.

Checklist

I don't believe any of these apply.

Community Checklist
  • This feature/issue is listed in here or roadmap.prowler.com
  • Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

SDK/CLI

  • Are there new checks included in this PR? Yes / No
    • If so, do we need to update permissions for the provider? Please review this carefully.

UI

  • All issue/task requirements work as expected on the UI
  • Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
  • Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
  • Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
  • Ensure new entries are added to CHANGELOG.md, if applicable.

API

  • All issue/task requirements work as expected on the API
  • Endpoint response output (if applicable)
  • EXPLAIN ANALYZE output for new/modified queries or indexes (if applicable)
  • Performance test results (if applicable)
  • Any other relevant evidence of the implementation (if applicable)
  • Verify if API specs need to be regenerated.
  • Check if version updates are required (e.g., specs, Poetry, etc.).
  • Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@github-actions github-actions bot added the community Opened by the Community label Mar 19, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Mar 19, 2026

Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

@jchrisfarris jchrisfarris changed the title Adding CF Template to do full org deployment feat(aws) Adding CF Template to do full org deployment Mar 19, 2026
@jchrisfarris jchrisfarris changed the title feat(aws) Adding CF Template to do full org deployment feat(aws): Adding CF Template to do full org deployment Mar 19, 2026
@jchrisfarris jchrisfarris marked this pull request as ready for review March 19, 2026 20:49
@jchrisfarris jchrisfarris requested a review from a team as a code owner March 19, 2026 20:49
@jfagoagas jfagoagas self-assigned this Mar 20, 2026
@jfagoagas jfagoagas added the provider/aws Issues/PRs related with the AWS provider label Mar 20, 2026
@github-actions github-actions bot removed the provider/aws Issues/PRs related with the AWS provider label Mar 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

community Opened by the Community

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants