Skip to content

PLACEHOLDERS.md

Latest commit

 

History

History
71 lines (47 loc) · 3.85 KB

PLACEHOLDERS.md

File metadata and controls

71 lines (47 loc) · 3.85 KB
Raw

Generated by Merlin Studio (https://app.merlin-studio.cloud). Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0).

AWS Placeholders

The generated configuration contains placeholder tokens that must be replaced with real AWS identifiers before tofu apply or CDK cdk deploy. The wizard could not infer these values automatically.

Replace each token below with the real value from your AWS Organizations setup, then re-run the generator or edit the files in place.

ACCOUNT_ID

AWS account ID (12 digits). Replace with the actual account number created by AWS Organizations.

Token Files
PLACEHOLDER_ACCOUNT_ID_Audit aws-lza/iam-config.yaml
PLACEHOLDER_ACCOUNT_ID_LogArchive aws-lza/kms/central-logs-key-policy.json
PLACEHOLDER_ACCOUNT_ID_Management aws-lza/iam-config.yaml, aws-lza/kms/central-logs-key-policy.json

CLOUDHSM_KEY_STORE_ID

AWS KMS Custom Key Store ID (cks-xxxxxxxx) backed by an AWS CloudHSM cluster. Required for HSM-backed CMKs (FIPS 140-2 Level 3) when the wizard's 'Use HSM-backed KMS keys' toggle (or per-key hsm: true) is set — FedRAMP High / EUCS High territory. Pre-deploy steps: create a CloudHSM cluster (2 HSMs for HA), create a custom key store linked to it, and connect the store. Then replace this token with the resulting Custom Key Store ID. See https://docs.aws.amazon.com/kms/latest/developerguide/create-cmk-keystore.html

Token Files
PLACEHOLDER_CLOUDHSM_KEY_STORE_ID aws-lza/security-config.yaml, HSM_SETUP.md

DX_CONNECTION_ID

AWS Direct Connect connection ID (dxcon-xxxxxxxx). Direct Connect was enabled in the wizard (section 05), but the physical cross-connect must be ordered out of band from the colocation provider — Terraform cannot move fiber. Order the dedicated/hosted connection at the chosen DX location, then replace this token with the resulting connection ID so the virtual interface can bind. See aws directconnect describe-connections.

Token Files
PLACEHOLDER_DX_CONNECTION_ID aws-lza/network-config.yaml

EMAIL

Operator-owned email address. AWS Organizations requires a globally-unique email per account; replace with a real mailbox you control.

Token Files
PLACEHOLDER_EMAIL_Audit aws-lza/accounts-config.yaml
PLACEHOLDER_EMAIL_LogArchive aws-lza/accounts-config.yaml
PLACEHOLDER_EMAIL_Network aws-lza/accounts-config.yaml
PLACEHOLDER_EMAIL_SharedServices aws-lza/accounts-config.yaml

ORG_ID

AWS Organizations ID (o-xxxxxxxxxx). Visible in AWS Organizations console or via aws organizations describe-organization --query Organization.Id.

Token Files
PLACEHOLDER_ORG_ID aws-lza/kms/central-logs-key-policy.json, aws-lza/vpc-endpoint-policies/default.json

PRODUCT_NAME

Service Catalog product name. The wizard captured a portfolio (e.g. approved-vpc-templates) but no product was attached to it. LZA's portfolio schema requires at least one product, so a placeholder ships in customizations-config.yaml to keep the YAML valid. Replace this token with the actual product name (e.g. vpc-hub-spoke, eks-baseline) before the LZA pipeline run, or remove the empty portfolio from 16_resource_management.

Token Files
PLACEHOLDER_PRODUCT_NAME_approved_vpc_templates aws-lza/customizations-config.yaml

PRODUCT_TEMPLATE

Path to the CloudFormation template the Service Catalog product uses. Paired with PRODUCT_NAME above. Convention: place the templates under aws-lza/service-catalog/<portfolio>/<product>/v<version>.yaml and reference them here. The placeholder portfolio above will not actually deploy a product until this path resolves to a real CFN template.

Token Files
PLACEHOLDER_PRODUCT_TEMPLATE_approved_vpc_templates aws-lza/customizations-config.yaml