AWS Account creator

accountCreator.ts

import { AccountOrder, EnvironmentType } from "../types";
import { ServiceCatalog } from "aws-sdk";

# Get this ID from the AWS console (Service Catalog Product)
# https://eu-central-1.console.aws.amazon.com/servicecatalog/home?region=eu-central-1#products
const { AWS_CONTROL_TOWER_SC_PRODUCT_ID } = process.env;

if (!AWS_CONTROL_TOWER_SC_PRODUCT_ID) {
  throw new Error("AWS_CONTROL_TOWER_SC_PRODUCT_ID must be set");
}

const getManagedOUIdentifierFromEnvironmentType = (type: EnvironmentType) => {
  switch (type) {
    case EnvironmentType.PRODUCTION:
      return `${EnvironmentType.PRODUCTION} (ou-REDACTED)`;
    case EnvironmentType.STAGING:
      return `${EnvironmentType.STAGING} (ou-REDACTED)`;
    case EnvironmentType.SANDBOX:
      return `${EnvironmentType.SANDBOX} (ou-REDACTED)`;
    case EnvironmentType.SHARED:
      return `${EnvironmentType.SHARED} (ou-REDACTED)`;
    default:
      return undefined;
  }
};

export const requestAccountFromControlTower = async (
  serviceCatalogClient: ServiceCatalog,
  accountAlias: string,
  order: AccountOrder
) => {
  return serviceCatalogClient
    .provisionProduct({
      ProductId: AWS_CONTROL_TOWER_SC_PRODUCT_ID,
      ProvisioningArtifactName: "AWS Control Tower Account Factory",
      # the following two parameters need an unique value, in that case accountAlias is unique
      ProvisionToken: accountAlias,
      ProvisionedProductName: accountAlias,
      ProvisioningParameters: [
        {
          Key: "AccountEmail",
          Value: `${accountAlias}@example.com`,
        },
        {
          Key: "AccountName",
          Value: accountAlias,
        },
        # This user will be granted admin permissions and is going to be created in AWS Identity center (formerly: AWS SSO)
        {
          Key: "SSOUserFirstName",
          Value: "Test",
        },
        {
          Key: "SSOUserLastName",
          Value: "AVM",
        },
        {
          Key: "SSOUserEmail",
          Value: "aws@example.com",
        },
        # Put the account under the corresponding OU 
        {
          Key: "ManagedOrganizationalUnit",
          Value: getManagedOUIdentifierFromEnvironmentType(
            order.environment_type
          ),
        },
      ],
    })
    .promise();
};