Skip to content

Deploy: Let RosettaHub Create Your Accounts

One command. Automate only, and only where you want RosettaHub creating cloud accounts on your behalf.

This is the shortest deployment there is. You run a single template on your management account, leave the functional account IDs empty, and RosettaHub creates everything below it.

Automate with Lifecycle only

Creating accounts requires the Lifecycle grant, which exists only in the Admin template family. On Observe or Govern, RosettaHub cannot create accounts and you bring your own -- see Deploy: Everything on the Management Account or Deploy: With Separate Functional Accounts.

Granting Lifecycle also means RosettaHub holds the root address on every account it creates. Read Account Access and Scopes before deciding.

Before starting you need your UserUid and ApiKey from the RosettaHub onboarding email. See Onboarding Your Organization if you do not have them yet.

Set your variables

BASE=https://com-rosettahub-public-code.s3.eu-west-1.amazonaws.com/cloudformation/2.0.0
USER_UID=<from your email>
API_KEY=<from your email>
REGION=eu-west-1            # must be one of the four -- see Regions below

The one command

aws cloudformation create-stack \
    --stack-name RosettaOpsManagement \
    --template-url $BASE/RosettaOpsAdminManagement.yaml \
    --parameters ParameterKey=UserUid,ParameterValue=$USER_UID \
                 ParameterKey=ApiKey,ParameterValue=$API_KEY \
                 ParameterKey=EnableLifecycle,ParameterValue=true \
                 ParameterKey=EnableDestroy,ParameterValue=true \
                 ParameterKey=EnableFederation,ParameterValue=true \
                 ParameterKey=EnableMetacloud,ParameterValue=false \
                 ParameterKey=FinopsAccountId,ParameterValue="" \
                 ParameterKey=AuditAccountId,ParameterValue="" \
                 ParameterKey=LogArchiveAccountId,ParameterValue="" \
    --capabilities CAPABILITY_NAMED_IAM \
    --region $REGION

aws cloudformation wait stack-create-complete \
    --stack-name RosettaOpsManagement --region $REGION

That is the deployment.

What the empty values do

Leaving a role account ID empty is the instruction to create that account. On the other paths it would be a mistake; here it is the point.

Parameter Value Effect
FinopsAccountId (empty) RosettaHub creates the FinOps account
AuditAccountId (empty) RosettaHub creates the audit account
LogArchiveAccountId (empty) RosettaHub creates the log-archive account

Set any of them to self or to an account number instead, and RosettaHub uses that account rather than creating one. You can mix: create some, supply others.

Other parameter Notes
EnableLifecycle true. Without it, account creation is refused and empty IDs fail
EnableDestroy true to allow cleanup, autostop, and account recycling. This is the grant that attaches AdministratorAccess
EnableFederation true for single sign-on into the cloud console. Included at no extra charge, and can be switched per account later
EnableMetacloud true only if you have RosettaCloud. It turns on self-service provisioning in the account
CreateControlRole Leave at its default of true. Nothing deploys before this stack, so it creates the control role itself
CreateOrganizationIfMissing true only if this account is not yet in an AWS Organization. It will become the payer of a new one
BillingBucketName Optional. Empty means the platform creates the CUR bucket

Member accounts

You do not deploy a StackSet on this path. Once the organization is registered, RosettaHub provisions member accounts itself as users and projects need them -- vended from a pool, sandboxed, and cleaned up on return.

Bringing existing accounts in as well

The member template exists for accounts you already have and want governed. If you have both -- some accounts RosettaHub creates, some you are bringing across -- deploy the member StackSet over the existing ones exactly as described in step 2 of the payer-only runbook, substituting RosettaOpsAdmin.yaml for the Governance template.

Accounts RosettaHub creates need no StackSet. They are set up at creation.

Optional -- narrow the bootstrap trust

Every account RosettaHub creates gets an AWS-planted OrganizationAccountAccessRole that RosettaHub uses to bootstrap. Once setup on an account is verified, you can close that path:

aws cloudformation create-stack \
    --stack-name RosettaOpsOrgAccessRoleTrust \
    --template-url $BASE/RosettaOpsOrgAccessRoleTrust.yaml \
    --capabilities CAPABILITY_NAMED_IAM \
    --region $REGION

RosettaHub cannot reopen it: nothing it holds grants permission to rewrite that role's trust policy. Applied before setup is verified, it leaves the account unreachable until recovered. See Account Access and Scopes for the caveats and the recovery route.

Regions

The management template deploys a setup Lambda whose code bucket must live in the function's own region, so it is limited to:

us-east-1    us-west-2    eu-west-1    ap-southeast-1

The same constraint applies to the member template if you later deploy one.

Next