Account Assessment for AWS Organizations programmatically scans all AWS accounts in an AWS Organization for identity-based and resource-based policies with Organization-based conditions.
Apache License 2.0
25
stars
10
forks
source link
10 character namespace is not usable with regions that have long name #3
Describe the bug
The management stack cannot deploy because the role name is too long.
The solution states that the namespace can be up to 10 characters. The management stack template uses the namespace to create role on line 176:
Namespace 1234567890 in region ap-southeast-2 turns into 1234567890-ap-southeast-2-AccountAssessment-OrgManagementStackRole which results in role name of 66 characters and throws the following error:
1 validation error detected: Value '1234567890-ap-southeast-2-AccountAssessment-OrgManagementStackRole' at 'roleName' failed to satisfy constraint: Member must have length less than or equal to 64 (Service: AmazonIdentityManagement; Status Code: 400; Error Code: ValidationError; Request ID: 84ca7ec9-43c3-44a4-8e5f-1e2ddda7e599; Proxy: null)
To Reproduce
Select a namespace that has 10 characters.
Expected behavior
Management stack should be deployed without validation errors.
Please complete the following information about the solution:
[x] v1.0.1
To get the version of the solution, you can look at the description of the created CloudFormation stack.
For example, "(SO0217) - The AWS CloudFormation hub template for deployment of the Account Assessment for AWS Organisations, Version: v1.0.1".
[x] Region: ap-southeast-2
[x] Was the solution modified from the version published on this repository? No
[x] If the answer to the previous question was yes, are the changes available on GitHub? N/A
[x] Have you checked your service quotas for the sevices this solution uses? N/A
[x] Were there any errors in the CloudWatch Logs? No
groverlalit
commented
1 year ago
Describe the bug The management stack cannot deploy because the role name is too long.
The solution states that the namespace can be up to 10 characters. The management stack template uses the namespace to create role on line 176:
Namespace
1234567890in regionap-southeast-2turns into1234567890-ap-southeast-2-AccountAssessment-OrgManagementStackRolewhich results in role name of66characters and throws the following error:To Reproduce Select a namespace that has 10 characters.
Expected behavior Management stack should be deployed without validation errors.
Please complete the following information about the solution:
To get the version of the solution, you can look at the description of the created CloudFormation stack.
For example, "(SO0217) - The AWS CloudFormation hub template for deployment of the Account Assessment for AWS Organisations, Version: v1.0.1".