The AWS Deployment Framework (ADF) is an extensive and flexible framework to manage and deploy resources across multiple AWS accounts and regions based on AWS Organizations.
Apache License 2.0
668
stars
226
forks
source link
Fix missing deployment_account_id and initial deployment global IAM bootstrap #686
When installing ADF the first time, the global IAM bootstrap stack that gets deployed is sourced from the adf-bootstrap/global-iam.yml.
The reason for this behaviour is the absence of the global-iam.yml file in the deployment OU bootstrap folder
(adf-bootstrap/deployment/global-iam.yml).
It iterates to the parent directory until it finds a global-iam.yml to deploy. Hence, when the adf-bootstrap/global-iam.yml gets deployed in the deployment account, it was looking for the deployment_account_id SSM parameter. That did not get deployed in the deployment account.
What?
Add the creation of the deployment_account_id in the deployment account, so if the global IAM bootstrap stack failed to deploy before, it will work in the next release. This would be the case if the previous deployment failed but the same aws-deployment-framework-bootstrap repository is used in the upgrade.
When installing the first time, it creates the bootstrap repository. At the time of creation, it will copy the adf-bootstrap/deployment/example-global-iam.yml to adf-bootstrap/deployment/global-iam.yml. The same logic as how ADF creates the initial adf-bootstrap/global-iam.yml.
By submitting this pull request, I confirm that you can use, modify, copy, and
redistribute this contribution, under the terms of your choice.
Why?
Issues: #659 and #594.
When installing ADF the first time, the global IAM bootstrap stack that gets deployed is sourced from the
adf-bootstrap/global-iam.yml
.The reason for this behaviour is the absence of the
global-iam.yml
file in the deployment OU bootstrap folder (adf-bootstrap/deployment/global-iam.yml
).It iterates to the parent directory until it finds a
global-iam.yml
to deploy. Hence, when theadf-bootstrap/global-iam.yml
gets deployed in the deployment account, it was looking for thedeployment_account_id
SSM parameter. That did not get deployed in the deployment account.What?
deployment_account_id
in the deployment account, so if the global IAM bootstrap stack failed to deploy before, it will work in the next release. This would be the case if the previous deployment failed but the sameaws-deployment-framework-bootstrap
repository is used in the upgrade.adf-bootstrap/deployment/example-global-iam.yml
toadf-bootstrap/deployment/global-iam.yml
. The same logic as how ADF creates the initialadf-bootstrap/global-iam.yml
.By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.