Open jesperalmstrom opened 4 weeks ago
hi @jesperalmstrom , thanks sharing this info. As a security best practice, it is strongly recommended to keep this S3 bucket storing Inspector report encrypted and also only accept TLS connection.
In the case of Control Tower, during the deployment or making changes to this solution, please consider to add an temporary exception to the SCP policy causing this issue. After the change is complete, please revert back to the guardrail, so that it won't cause Control Tower drift.
To get it to work we had to uncomment the following
Otherwise we got a Access Denied on the bucket creation because of Control Tower have default GuardRails for changing bucket encryption. After a lot of searching we found this: https://github.com/aws-amplify/amplify-hosting/issues/3014 It lead us in the right direction finding the cause.