aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
356 stars 205 forks source link

Stepfunction not detecting changes to nested stacks #70

Closed yogiwiz closed 2 years ago

yogiwiz commented 2 years ago

Describe the bug

We had our initial implementation using 1.2 of control tower customisations and moved to 2.1 recently. We use cloud formation nested stacks to deploy specific things to target OUs and accounts. In our of recent update, we realised that step function is not picking up any changes to child stack in a nested stack. Looking through the customisation code, we realised this was due to an improvement introduced in 2.0 to optimise the flow by comparing cloudformation templates using filecmp here.

To Reproduce

Deploy a nested stack to a target OU or account using CT customisation flow. Introduce an update to one of the child stacks in the nested stack. As part of customisation execution, step functions will not detect the change and hence no stackset update will be triggered

Expected behavior

Updates should be detected by CT customisation step function and changes should be pushed using stackset updates

Please complete the following information about the solution:

Additional context If this issue is not getting prioritised, please update the documentation so that it is a known limitation with nested stacks and CT customisation

groverlalit commented 2 years ago

The support to analyze the nested stacks is not supported. The template (file or remote path) in the manifest is only file is compared with the deployed stack set template.

yogiwiz commented 2 years ago

@groverlalit Can we please have documentation updated to reflect this? Especially for teams who were using older version and upgrading to latest?

groverlalit commented 2 years ago

Hi @yogiwiz The code you referred to in ticket was shipped in v1.1. It has been always only comparing the templates (top-level) in the manifest and not the nested stacks. Thanks.