Deployment into delegated administrator account does not work

awslabs / cid-framework

Apache License 2.0

23 stars 24 forks source link

Deployment into delegated administrator account does not work #126

Open snowiow opened 5 months ago

snowiow commented 5 months ago

Hi, I'm currently trying to deploy your deploy-data-read-permissions.yaml template to our delegated administrator for CloudFormation. When trying to deploy we get this error:

You must be the management account or delegated admin account of an organization before operating a SERVICE_MANAGED stack set

I think the reason why this is failing, is because this CallAs field is not configured to be set to DELEGATED_ADMIN when deployed from a delegated admin in the template.

iakov-aws commented 3 months ago

Today we do not support deployment in a Delegated Admin for CFN. The stack requires not only CFN but also a bunch of other permissions and not all can be delegated.

It is potentially possible for a portion of functionality. I will keep this issue open as enhancement request. Contributions are welcome.