Skip to content

Deploy: Everything on the Management Account

Two commands. Use this page when you are bringing existing accounts, and FinOps, audit and the log archive all live on your management (payer) account.

Which template and flags for your edition

Every command below uses the Governance template. If you bought Automate, substitute the Admin template and its flags throughout:

Edition Template Flags
Observe RosettaOpsGovernance* EnablePermissions=false
Govern RosettaOpsGovernance* EnablePermissions=true
Automate RosettaOpsAdmin* EnableDestroy, EnableFederation, EnableMetacloud, EnableLifecycle -- EnablePermissions does not exist, it is always on

Before starting you need your UserUid and ApiKey from the RosettaHub onboarding email. See Onboarding Your Organization if you do not have them yet.

flowchart LR
    A["1 &nbsp; Management template<br/><i>payer</i>"] --> B["2 &nbsp; Member accounts<br/><i>StackSet</i>"]

    style A fill:#fff9c4,stroke:#f9a825,color:#000
    style B fill:#e8f5e9,stroke:#2e7d32,color:#000

Set your variables

BASE=https://com-rosettahub-public-code.s3.eu-west-1.amazonaws.com/cloudformation/2.0.0
PAYER=111111111111          # your management account number
MEMBER_OU=ou-xxxx-xxxxxxxx  # the OU holding the accounts you want governed
USER_UID=<from your email>
API_KEY=<from your email>
REGION=eu-west-1            # must be one of the four -- see Regions below

1. The management template, on the payer

aws cloudformation create-stack \
    --stack-name RosettaOpsManagement \
    --template-url $BASE/RosettaOpsGovernanceManagement.yaml \
    --parameters ParameterKey=UserUid,ParameterValue=$USER_UID \
                 ParameterKey=ApiKey,ParameterValue=$API_KEY \
                 ParameterKey=EnablePermissions,ParameterValue=true \
                 ParameterKey=FinopsAccountId,ParameterValue=self \
                 ParameterKey=AuditAccountId,ParameterValue=self \
                 ParameterKey=LogArchiveAccountId,ParameterValue=self \
    --capabilities CAPABILITY_NAMED_IAM \
    --region $REGION

aws cloudformation wait stack-create-complete \
    --stack-name RosettaOpsManagement --region $REGION

This one stack registers your organization with the platform, creates the control role RosettaHub assumes, and attaches the FinOps, audit, and log-archive policies to the payer itself.

Parameter Notes
EnablePermissions true for Govern, false for Observe
FinopsAccountId, AuditAccountId, LogArchiveAccountId self means this account plays that role
CreateControlRole Leave at its default of true. It is what makes this a single command
CreateOrganizationIfMissing true only if this account is not yet in an AWS Organization. It will become the payer of a new one
BillingBucketName Optional. Empty means the platform creates the CUR bucket

Do not leave the role IDs empty

An empty role account ID asks RosettaHub to create that account, which needs the Lifecycle grant and is therefore Automate only. On Observe or Govern, set each to self.

2. The member accounts

aws cloudformation create-stack-set \
    --stack-set-name RosettaOpsMembers \
    --template-url $BASE/RosettaOpsGovernance.yaml \
    --parameters ParameterKey=ManagementAccountId,ParameterValue=$PAYER \
                 ParameterKey=ApiKey,ParameterValue=$API_KEY \
                 ParameterKey=EnablePermissions,ParameterValue=true \
    --permission-model SERVICE_MANAGED \
    --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false \
    --capabilities CAPABILITY_NAMED_IAM \
    --region $REGION

aws cloudformation create-stack-instances \
    --stack-set-name RosettaOpsMembers \
    --deployment-targets OrganizationalUnitIds=$MEMBER_OU \
    --regions $REGION \
    --region $REGION

Every member account takes the same parameters, so this targets the OU directly with no per-instance overrides. Each instance registers its own account against the organization created in step 1, and with --auto-deployment Enabled=true, accounts added to that OU later onboard themselves with no further action.

RegType, LoginPrefix and LoginSuffix are optional and control how platform logins are generated for imported accounts.

That is the whole deployment.

Optional -- narrow the bootstrap trust

Only for accounts RosettaHub created for you, and only once setup on each is verified. It narrows the trust on AWS's own OrganizationAccountAccessRole so RosettaHub can no longer assume it.

aws cloudformation create-stack \
    --stack-name RosettaOpsOrgAccessRoleTrust \
    --template-url $BASE/RosettaOpsOrgAccessRoleTrust.yaml \
    --capabilities CAPABILITY_NAMED_IAM \
    --region $REGION

Applied before RosettaHubAccessRole exists on that account, it leaves the account unreachable by RosettaHub until recovered. See Account Access and Scopes for the caveats and the StackSet recovery route.

Regions

Both templates on this page deploy a setup Lambda whose code bucket must live in the function's own region, so both are limited to:

us-east-1    us-west-2    eu-west-1    ap-southeast-1

Anywhere else fails at mapping lookup. This constrains the member StackSet's --regions exactly as it constrains the payer's stack.

Next