aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
355 stars 205 forks source link

StackSet not deployed into accounts inside OU #107

Closed jo-koe closed 2 years ago

jo-koe commented 2 years ago

Describe the bug StackSet defined in manifest.yaml is not deployed into accounts inside the provided organizational_units.

To Reproduce We have the following OU/Accounts structure which is fully enrolled into Control Tower. root -> Projects (OU) -> Production (OU) -> Project_A, Project_B, Project_C I would like to deploy a StackSet into all accounts under Production OU. So I've configured the following deployment target in manifest.yaml:

  - name: ssm
    resource_file: templates/ssm.yaml
    parameter_file: parameters/ssm.json
    deploy_method: stack_set
    deployment_targets:
      organizational_units:
        - Production
    regions:
      - eu-central-1

Expected behavior The StackSets are deployed into all accounts under the specified OU.

Please complete the following information about the solution:

Screenshots N/A

Additional context

This is what I can see in the CodeBuild logs:

{"time_stamp": "2022-04-25 09:36:45,264","log_level": "INFO","log_message": >>> Accounts: [] in OUs: ['Production']}

{"time_stamp": "2022-04-25 09:36:45,264","log_level": "INFO","log_message": >>>>>> ACCOUNT LIST}

{"time_stamp": "2022-04-25 09:36:45,264","log_level": "INFO","log_message": []}

{"time_stamp": "2022-04-25 09:36:45,264","log_level": "INFO","log_message": []}

{"time_stamp": "2022-04-25 09:36:45,264","log_level": "INFO","log_message": Print Updated Manifest Account List}

{"time_stamp": "2022-04-25 09:36:45,264","log_level": "INFO","log_message": []}

{"time_stamp": "2022-04-25 09:36:45,264","log_level": "INFO","log_message": Print merged account list - accounts in manifest + account under OU in manifest}

{"time_stamp": "2022-04-25 09:36:45,265","log_level": "INFO","log_message": []}
balltrev commented 2 years ago

Hey @jo-koe I believe the format you're using for the nested OU you're deploying to is incorrect. You can find the documentation here that explains how to properly refer to a nested OU in the manifest.

jo-koe commented 2 years ago

Works. Thanks!