search

aws-ia / terraform-aws-control_tower_account_factory

AWS Control Tower Account Factory
Apache License 2.0
604 stars 386 forks source link

Missing VPC endpoint for AWS Organizations #452

Open silvaalbert opened 2 months ago

silvaalbert commented 2 months ago

Expected behavior AFT makes calls to AWS Organizations. There are Interface Endpoints for other services, but not for AWS Organizations.

Additional context AWS Organizations can be tricky, as endpoints can only be created in us-east-1, but AFT can be deployed elsewhere. I suggest the endpoint be added to the solution, with a condition that only deploys if the region is us-east-1.

Furthermore, this behavior should be called out in the documentation, given that deployments in other regions will be sending this traffic through public IP address space, regardless of whether VPC endpoints are enabled for the solution.

snebhu3 commented 1 week ago

@silvaalbert thank you for reaching out. I will create an internal backlog to address this.