Hey there. This is Unlimited Leave, the AWS Management and Governance newsletter you could get by without but you've already subscribed so here we are.

And you should be glad you are. I may have stumbled across a premature or accidental blog post about AWS Systems Manager. More 👇

This week's topics

• Organization Shared Service Catalog Portfolio(s)

• Premature Deployment

• A slow drip of Governance Announcements

• Fun resource/tool of the week

Organization Shared Service Catalog Portfolio

If you are in the business of enabling developers to not bother you while you are on vacation or enjoying a nice meal with family, then you are probably utilizing AWS Service Catalog. If you are not using Service Catalog yet, then here is a quick starter for getting going. This is a basic deployment with a single product for a single account.

One of the portfolios I have, I have shared with multiple Organizations so all accounts can get the products and they can be managed from a single location.

There are some prerequisites for the organizational sharing of a portfolio. If you are interested in more specific details, please reply to this email and I will prioritize a post.

The basics are:

• Enabled the services for delegated administration: https://aws.amazon.com/blogs/mt/simplify-sharing-your-aws-service-catalog-portfolios-in-an-aws-organizations-setup/

• Sharing to individual accounts, OUs, or the whole Organization: https://service-catalog-tools-workshop.com/every-day-use/360-aws-organizations-integration/362-sharing-a-portfolio-organizations.html

• Optionally add Principal Sharing: https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing_how-to-share.html#principal-name-share which sadly does not support AWS Identity Center Permission Sets for some reason.

Slow Drip

I'll spare the commentary on all of these announcements for brevity and let the titles do their job. There is finally a little backlog of valuable service announcements or enhancements to aide in your management and compliance initiatives.

Announcements

• AWS Systems Manager announces Patch Policies, enabling cross account and cross Region patching

• Announcing comprehensive controls management with AWS Control Tower

• AWS Systems Manager announces Patch Policies, enabling cross account and cross Region patching

• Validate AWS Serverless Application Model (SAM) templates with CloudFormation Linter to speed up development

• Amazon VPC IP Address Manager (IPAM) now manages IP Addresses in your network outside your AWS Organization

• AWS Systems Manager announces integration of Automation with Change Calendar

• AWS CloudFormation StackSets gives quick access to list of Regions for stack instances of a stack set

• Amazon Detective adds new AWS managed IAM policies to improve secure access for security analysts

Blogs

• How to revoke federated users’ active AWS sessions (security)

• Use AWS Lambda with AWS Control Tower Audit account to inspect your multi-account setup (compliance)

• Automate AWS Config reporting for noncompliant resources that have been non-compliant for a period of time (compliance)

Premature Deployment

You ever get a little excited and spill the beans a little too early?

I can't be certain but this blog post hit my RSS Feed and now the Original URL produces a 404 and the post is nowhere to be found on the Cloud Operations Blog. Thanks to the wonders of technology and Google's rapid caching ability I was able to salvage the post. However, if the cached version of the post gets removed for whatever reason, you can download it here for your viewing pleasure.

I'm not certain there is anything special here or premature. Maybe it just wasn't supposed to be shared. The interesting thing is this was "Part 1" of Unknown. Typically when blog posts like this come out, they are in support of something being made GA. We shall see.

Resource/Tool of the Week

I like this post and tool for (more easily) developing meaningful CloudWatch Dashboards.As if collecting valuable metrics in your accounts isn't hard enough, propagating that information in a nice dashboard is even more difficult (with native service of course). But once you've done it, that beautiful dashboard can be deployed across some or all of your accounts as needed through the power of automation.

Check out this custom tool to build CloudWatch Dashboard from a fellow AWS Community Builder.

Review past issues HERE | Share with others HERE

Disclaimer: The resources and topics shared within this newsletter are for informational use only. Any resources deployed or tools implemented are done so at your own risk. Do your own research and testing prior to the implementation of any resource or service deployed for any workload.