[BUG] control tower version 4.0 - Config + Security Hub not deployable in new landing zones

[HeikoMR]

Describe the bug

With Control Tower version 4.0 aws moved out the config logs into it's own bucket in the audit account.
And the cloudtrail logs in a specific bucket for cloudtrail logs.
The old bucket with its naming does not exist anymore for new landing zones.

Config is required in the management account for SecurityHub to deploy successfull via sra.

With that deployments via SRA fails:

No such s3 bucket with name 'aws-controltower-logs-123456789012-eu-central-1'

To Reproduce

Steps to reproduce the behavior:

1. CFCT
2. Deploy SRA and enable config
3. wait for deployment
4. See error

Expected behavior

Deployment successful

Deployment Environment (please complete the following information)

• Control Tower 4.0
• CFCT
• SRA

Additional context

Workaround would be to deploy Config manually in the management account...

On a sidenote, the templates are not up to date.
Like maximum Cis standard available is 1.4.0 but we already have 3.0.0 and 5.0.0 in place

[muakvik]

Hello,

Thanks for submitting the bug. Yes, AWS Control Tower Landing Zone 4.0 introduces significant architectural changes that require updates to the AWS Security Reference Architecture (SRA) code library.

You need to update the Config management account solution
Location: aws_sra_examples/solutions/config/config_management_account/

You have to update the cloudofmration template - sra-config-management-account.yaml and replace the hardcoded bucket name: aws-controltower-logs-{LogArchiveAccountId}-{HomeRegion} with you CT generated bucket for config logs (
CT 4.0 uses: aws-controltower-config-logs-{LogArchiveAccountId}-{suffix} )

This should unblock the Config for management account deployment and then you can deploy the Security Hub solution. You can also use CT 4.0 to deploy organization config across your entire AWS region. Do let us know if you are still facing issues.

[HeikoMR]

Hey,
thanks for your answer.
I think it needs to be the audit account thought. Will check it out.
Hope to see it soon in a release though.

[janahockenberger]

Would it be possible to include this in the next version? I consider this a fundamental issue, as the solution is currently unusable. In my opinion, a tool called “Security Reference Architecture” should always be up to date. The new version of Control Tower was released in November last year which was 4 months ago.

[muakvik]

Hi Jana, we are working through it.