Open k-paulius opened 7 months ago
I can confirm this is happening. I can see the trail created in all the member accounts. I can also state that if you use a CMK, you will have the exact same thing happen but the error will be about the CMK KMS key not existing. Once you delete the stack, these trails also stay in the accounts.
My workaround was to deploy everything in the delegated admin account / logging account, then manually create the CloudTrail in the delegated admin account. This worked fine.
Name of the resource
AWS::CloudTrail::Trail
Resource Name
No response
Issue Description
I am trying to create an organization CloudTrail from a CloudTrail delegated administrator account, but it fails during deployment.
My setup contains a management account with id
111111111111
and another account222222222222
that is registered as a delegated CloudTrail administrator account. CloudFormation template is being deployed in account222222222222
and trail is namedorg-cloudtrail
.During deployment Cfn calls
CreateTrail
and receives a successful response. Trail is created in the management account, as expected, with Arn:arn:aws:cloudtrail:us-east-1:111111111111:trail/org-cloudtrail
. Cfn then invokesStartLogging
, using the trail name valueorg-cloudtrail
as thename
parameter instead of an Arn for CloudTrail. This call fails withTrailNotFoundException
and Cfn then proceeds to roll-back the deployment.Cfn resource:
Expected Behavior
Deploying Cfn template in the CloudTrail delegated administrator account should successfully create CloudTrail in the management account.
When invoking
StartLogging
Cfn needs to pass Arn instead of name of the trail as thename
parameter.CLI commands executed as
222222222222
:Observed Behavior
Organization trail is successfully created, but CloudFormation encounters an error when calling
StartLogging
and rolls back the deployment.Test Cases
Other Details
This is also reported as CDK issue: https://github.com/aws/aws-cdk/issues/26840