Enable default policies across accounts and Regions - Amazon EBS
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Enable default policies across accounts and Regions

Using Amazon CloudFormation StackSets, you can enable Amazon Data Lifecycle Manager default policies across multiple accounts and Amazon Regions with a single operation.

You can use stack sets to enable default policies in one of the following ways:

  • Across an Amazon organization — Ensures that default policies are enabled and configured consistently across an entire Amazon organization or specific organizational units in an organization. This is done using service-managed permissions. Amazon CloudFormation StackSets creates the required IAM roles on your behalf.

  • Across specific Amazon accounts — Ensures that default policies are enabled and configured consistently across specific target accounts. This requires self-managed permissions. You create the IAM roles required to establish the trust relationship between the stack set administrator account and the target accounts.

For more information, see Permission models for stack sets in the Amazon CloudFormation User Guide.

Use the following procedures to enable Amazon Data Lifecycle Manager default policies across an entire Amazon organization, across specific OUs, or across specific target accounts.

Prerequisites

Do one of the following, depending on how you are enabling the default policies:

Console
To enable default policies across an Amazon organization or across specific target accounts

  1. Open the Amazon CloudFormation console at https://console.amazonaws.cn/cloudformation.

  2. In the navigation pane, choose StackSets, then choose Create StackSet.

  3. For Permissions, do one of the following, depending on how you are enabling the default policies:

    • (Across an Amazon organization) Choose Service-managed permissions.

    • (Across specific target accounts) Choose Self-service permissions. Then, for IAM admin role ARN, select the IAM service role that that you created for the administrator account, and for IAM execution role name, enter the name of the IAM service role that you created in the target accounts.

  4. For Prepare template, choose Use a sample template.

  5. For Sample templates, do one of the following:

    • (Default policy for EBS snapshots) Select Create Amazon Data Lifecycle Manager default policies for EBS Snapshots.

    • (Default policy for EBS-backed AMIs) Select Create Amazon Data Lifecycle Manager default policies for EBS-backed AMIs.

  6. Choose Next.

  7. For StackSet name and StackSet description, enter a descriptive name and brief description.

  8. In the Parameters section, configure the default policy settings as needed.

    Note

    For critical workloads, we recommend CreateInterval = 1 day and RetainInterval = 7 days.

  9. Choose Next.

  10. (Optional) For Tags, specify tags to help you identify the StackSet and stack resources.

  11. For Managed execution, choose Active.

  12. Choose Next.

  13. For Add stacks to stack set, choose Deploy new stacks.

  14. Do one of the following, depending on how you are enabling the default policies:

    • (Across Amazon organization) For Deployment targets choose one of the following options:

      • To deploy across an entire Amazon organization, choose Deploy to organization.

      • To deploy to specific organizational units (OU), choose Deploy to organizational units, and then for OU ID, enter the OU ID. To add additional OUs, choose Add another OU.

    • (Across specific target accounts) For Accounts, do one of the following:

      • To deploy to specific target accounts, choose Deploy stacks in accounts, and then for Account numbers, enter the IDs of the target accounts.

      • To deploy to all accounts in a specific OU, choose Deploy stack to all accounts in an organizational unit, and then for Organization numbers, enter the ID of the target OU.

  15. For Automatic deployment, choose Activated.

  16. For Account removal behavior, choose Retain stacks.

  17. For Specify regions, select specific Regions in which to enable default policies, or choose Add all Regions to enable default policies in all Regions.

  18. Choose Next.

  19. Review the stack set settings, select I acknowledge that Amazon CloudFormation might create IAM resources, and then choose Submit.

Amazon CLI
To enable default policies across an Amazon organization

  1. Create the stack set. Use the create-stack-set command.

    For --permission-model, specify SERVICE_MANAGED.

    For --template-url, specify one of the following template URLs:

    • (Default policies for EBS-backed AMIs) https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/DataLifecycleManagerAMIDefaultPolicy.yaml

    • (Default policies for EBS snapshots) https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/DataLifecycleManagerEBSSnapshotDefaultPolicy.yaml

    For --parameters, specify the settings for the default policies. For supported parameters, parameter descriptions, and valid values, download the template using the URL and then view the template using a text editor.

    For --auto-deployment, specify Enabled=true, RetainStacksOnAccountRemoval=true.

    $ aws cloudformation create-stack-set \
--stack-set-name stackset_name \
--permission-model SERVICE_MANAGED \
--template-url template_url \
--parameters "ParameterKey=param_name_1,ParameterValue=param_value_1" "ParameterKey=param_name_2,ParameterValue=param_value_2" \
--auto-deployment "Enabled=true, RetainStacksOnAccountRemoval=true"

  2. Deploy the stack set. Use the create-stack-instances command.

    For --stack-set-name, specify the name of the stack set you created in the previous step.

    For --deployment-targets OrganizationalUnitIds, specify the ID of the root OU to deploy to an entire organization, or OU IDs to deploy to specific OUs in the organization.

    For --regions, specify the Amazon Regions in which to enable the default policies.

    $ aws cloudformation create-stack-instances \
--stack-set-name stackset_name \
--deployment-targets OrganizationalUnitIds='["root_ou_id"]' | '["ou_id_1", "ou_id_2]' \
--regions '["region_1", "region_2"]'
To enable default policies across specific target accounts

  1. Create the stack set. Use the create-stack-set command.

    For --template-url, specify one of the following template URLs:

    • (Default policies for EBS-backed AMIs) https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/DataLifecycleManagerAMIDefaultPolicy.yaml

    • (Default policies for EBS snapshots) https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/DataLifecycleManagerEBSSnapshotDefaultPolicy.yaml

    For --administration-role-arn, specify the ARN of the IAM service role that you previously created for the stack set administrator.

    For --execution-role-name, specify the name of IAM service role that you created in the target accounts.

    For --parameters, specify the settings for the default policies. For supported parameters, parameter descriptions, and valid values, download the template using the URL and then view the template using a text editor.

    For --auto-deployment, specify Enabled=true, RetainStacksOnAccountRemoval=true.

    $ aws cloudformation create-stack-set \
--stack-set-name stackset_name \
--template-url template_url \
--parameters "ParameterKey=param_name_1,ParameterValue=param_value_1" "ParameterKey=param_name_2,ParameterValue=param_value_2" \
--administration-role-arn administrator_role_arn \
--execution-role-name target_account_role \									
--auto-deployment "Enabled=true, RetainStacksOnAccountRemoval=true"

  2. Deploy the stack set. Use the create-stack-instances command.

    For --stack-set-name, specify the name of the stack set you created in the previous step.

    For --accounts, specify the IDs of the target Amazon accounts.

    For --regions, specify the Amazon Regions in which to enable the default policies.

    $ aws cloudformation create-stack-instances \
--stack-set-name stackset_name \
--accounts '["account_ID_1","account_ID_2"]' \
--regions '["region_1", "region_2"]'