search

aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
360 stars 205 forks source link

Is it possible to deploy stack to accounts without stack_set? #100

Closed akefirad closed 2 years ago

akefirad commented 2 years ago

Is your feature request related to a problem? Please describe. To prevent XY problem, here's my use case. I'm trying to manage CDK bootstrap stacks for all accounts in CfCT. But the problem is that CDK needs to know the bootstrap stack name. There are ways to give the name while running the command, but I think it gets too complicated when it comes to cross-account deployment. Now, the current implementation of CfCT uses stack-sets to deploy stacks to accounts (correct me if I'm wrong). And AFAIK, this way, it's not possible to set a proper name for stack instances.

Describe the feature you'd like To be able to deploy stacks to accounts with a custom name.

Thanks.

balltrev commented 2 years ago

Hey @akefirad, Customizations for Control Tower has a hard dependency on StackSets, and the CloudFormation Stacks deployed follow a naming scheme of "StackSet-CustomControlTower-$STACKNAME-$GUID" where $STACKNAME is defined by the value to the name key in the manfiest for a resource. Are you looking for further customization here?

akefirad commented 2 years ago

Well the requirement on CDK side is to name the bootstrap stack exactly CDKToolkit, otherwise you have to always give the stack name every time you run a CDK command. There might be a way to set this globally but the GUID thingy makes it impossible. So ideally I want to name the stack exactly CDKToolkit, if not possible, drop the GUID. If not possible then I guess it's not possible to manage CDK bootstrap stack using CfCT. Any thought? Thanks.

balltrev commented 2 years ago

Since CfCT relies on StackSets to deploy, dropping GUIDs is not possible with the current implementation.

CDK manages the lifecycle of it's bootstrap stacks as updates are published, currently it is not recommend to use CfCT to manage the CDK bootstrap stacks as it doesn't account for the updates of these stacks. I would recommend opening a feature request with AWS CDK

akefirad commented 2 years ago

Interestingly I tried this setup (CDK bootstrap stack managed by CfCT) and managed to deploy the application stack (via CDK cross account pipeline). I just needed to set tookitStackName (of the CDK stack in the CICD account) in cdk.json of the project. It seems the pipeline doesn't need to know anything about the CDK stack in the workload account. I'll reach out to CDK team and see what's their recommendation. Thanks.

balltrev commented 2 years ago

Just to clarify, CfCT doesn't explicitly prevent management of the CDK Bootstrap stacks, and as you noted it should work. The issue becomes management of the lifecycle of those stacks. Going to go ahead and close this issue for now, thanks @akefirad!

akefirad commented 2 years ago

Just for record, here's an excerpt from the AWS CDK documentation (emphasis mine):

Thus, you can bootstrap in one of two ways:

  1. Use the AWS CDK Toolkit's cdk bootstrap command. This is the simplest method and works well if you have only a few environments to bootstrap.
  2. Deploy the template provided by the AWS CDK Toolkit using another AWS CloudFormation deployment tool. This lets you use AWS CloudFormation Stack Sets or AWS Control Tower as well as the AWS CloudFormation console or the AWS CLI. You can even make small modifications to the template before deployment. This approach is more flexible and is suitable for large-scale deployments.