Closed julian-price closed 2 months ago
I have code to fix this @julian-price; also know you are not the only one with this bug :) I will get this resolved ASAP for you (and others). thank you for submitting and sorry for the late reply (been super busy 'round here)
Describe the bug
This bug is apparent only when a new region is enabled for Control Tower (e.g. ap-southeast-4 in Nov 2023) and that region is to be brought under Control Tower governance. The issue arises because the
get_enabled_regions
method in the sra-common-prerequisites lambda contains a hardcoded region list -default_available_regions
- which is written to the /sra/regions/enabled-regions ssm parameter and also used to write SRA ssm parameters to each region in the list. If a region is not in the hardcoded list in the lambda, then the SSM parameters are not written to that region in the master account, even though the new region does get written to the /sra/regions/customer-control-tower-regions SSM parameter.To Reproduce
Steps to reproduce the behavior:
default_available_regions
list in the sra-common-prerequisites Python lambda code (e.g. ap-southeast-4).Expected behavior
The SRA solution should dynamically determine what regions are available for Control Tower, or at minimum for the inclusion of every region contained in the /sra/regions/customer-control-tower-regions SSM parameter into the /sra/regions/enabled-regions parameter.
Additional context
While the need to enable a new region in Control Tower may not be a frequent activity, AWS does bring new regions on-line quite often and this bug might be a barrier to organisations in those regions looking to adopt the SRA.