aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
355 stars 205 forks source link

After moving account to from Level 1 OU to level 2 OU under a different Level 1 OU CfCt deletes stacksets deployed to account #118

Closed greenaussie closed 2 years ago

greenaussie commented 2 years ago

After moving accounts to from Level 1 OU to level 2 OU under a different Level 1 OU CfCt deletes (or attempt to delete) stacksets deployed to account

  1. To reproduce create and enroll an account using Account factory in a level 1 OU as shown. Use CfCT to deploy a stack within the account, using its parent OU as a deployment target.
  2. Move the account to a level 2 OU as shown in diagram.
  3. Ensure all OUs and accounts are registered with CT
  4. Execute CfCT pipeline.
  5. Review logs - search for Router FunctionName: delete_stack_instances, Deleting Stack Instance: CustomControlTower-<stacket name>
Root OU
|
+- Source Level 1 OU (CfCT stackset deployment target)
|  |
|  +- Account position before move
|
+- Dest Level 1 OU (CfCT stackset deployment target)
   |
   +- Dest Level 2 OU
      |
      + Account position after move

Expected behavior is the stack deployed within the account is not deleted because at all times it remains under a deployment target.

Please complete the following information about the solution:

To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0089) - customizations-for-aws-control-tower Solution. Version: v1.0.0". You can also find the version from releases

greenaussie commented 2 years ago

Closing this. I noticed the docs now require OUs to be addressed directly like

dest-ou-level-1:dest-ou-level-2

Thus specifying only the level OU won't work, and inheritance doesn't seem to work https://docs.aws.amazon.com/controltower/latest/userguide/cfct-nested-ou.html