AWSControlTowerExecution role is needed in management account to deploy StackSet

[jo-koe]

Describe the bug As mentioned in the docs we can now deploy StackSets also to the management account. But this doesn't work as the management account doesn't have the AWSControlTowerExecution role. Error message in Cloudformation:

Account *** should have 'AWSControlTowerExecution' role with trust relationship to Role 'service-role/AWSControlTowerStackSetRole'.

To Reproduce Deploy a StackSet to the Management account.

Expected behavior Deployment works.

Please complete the following information about the solution:

• [x] Version: v2.3.0
• [x] Region: all
• [x] Was the solution modified from the version published on this repository? No
• [x] If the answer to the previous question was yes, are the changes available on GitHub? No
• [x] Have you checked your service quotas for the sevices this solution uses? Yes
• [x] Were there any errors in the CloudWatch Logs? See above

Screenshots N/A

Additional context N/A

[balltrev]

Hey @jo-koe, this is actually the intended behavior, in the documentation we call out why this is.

As per AWS Control Tower best practices, the management account is intended only to manage member accounts and for billing purposes. Do not run production workloads in the AWS Control Tower management account.

In accordance with best practices guidance, AWS Control Tower deployment puts the management account under the Root OU, so that it has full access and does not run additional resources. For this reason, the AWSControlTowerExecutionRole role is not deployed to the management account.

We recommend that you follow these best practices for the management account. If you have a specific use case that requires you to deploy stacksets in the management account, include accounts as a deployment target and specify the management account. Otherwise, do not include accounts as a deployment target. You must create the missing resources, including required IAM roles, in the management account.

[jo-koe]

Okay thanks for the clarification.