README.md

# sample-cf
A sample AWS CloudFormation template

## control-tower-client-vpc.yaml
Example of VPC template to replace default VPC created by Control Tower. This is
loosely based on the VPC template used by the Landing Zones solution. It creates
one public and two private subnets, each divided between two AZs, as well as an 
Internet Gateway for the public subnet and a VPC Flow Log. Actual VPC CIDR 
assignment and subnet IPs are parameterized. This is intended for use as a StackSet
to deploy to multiple client accounts, wherein each client account gets a different
parameter set to define it's VPC IP range.

## GuardDutyMasterExecutionRole.yml
For deployment into all accounts that will run GuardDuty and report findings back
to the Master account. This can be deployed via StackSets from the Master (assuming
you have the necessary StackSet execution roles created on Master and client accounts).
This allows the GuardyDuty setup script to assume role into the client accounts through
the Master account in order to enable GuardDuty in the clients and accept the 
invitation from the Master.

## EventBridgeRulesAndSNSTopics.yml
This CFN template creates two Event rules and associated SNS topics. It is intended
for deployment in the Master Organization account. One rule captures
a 'CreateAccountResult' event from an Organization, which happens shortly after a 
new account is created in the Org. It sends the Event JSON to SNS, where it can then be 
accessed by a Lambda function for further action. In the Control Tower context, the
'MoveAccount' event is more useful, as it happens further along in the account
provisioning sequence, and the event it generates can be used to determine 
OU-based provisioning items, such as applying different Config Rules depending on
which OU an account is moved into.