search

awslabs / compliant-framework-for-federal-and-dod-workloads-in-aws-govcloud-us

This solution enables you to quickly deploy a secure, scalable, multi-account environment in AWS GovCloud (US) based on AWS best practices. This solution is architected to follow the Defense Information Systems Agency (DISA) Cloud Computing Security Requirements Guide (SRG) for hosting Impact Level (IL) 4 and 5 workloads in the cloud. Using the Compliant Framework solution, you are able to quickly deploy an architecture baseline that accommodates U.S. federal and Department of Defense (DoD) requirements to rapidly achieve Authority to Operate (ATO). In addition, the Compliant Framework solution is also architected to support Cybersecurity Maturity Model Certification (CMMC) readiness.
https://aws.amazon.com/solutions/implementations/compliant-framework-for-federal-and-dod-workloads-in-aws-govcloud-us/
Apache License 2.0
55 stars 25 forks source link

Guidance on InviteAccounts step #12

Closed cnoble40-netrist closed 2 years ago

cnoble40-netrist commented 2 years ago

I'm stuck. I've got a commercial account and a govcloud account. I have an existing organization setup in the commercial account (which may or may not be the problem -- with the commercial management account as a member). When I launch the stack, it gets all the way through to the InviteAccounts step function and then throws error:

"An error occurred (HandshakeConstraintViolationException) when calling the InviteAccountToOrganization operation: You have exceeded the allowed number of AWS accounts"

I understand what the message says, but from what I understand there can be 10 accounts (default) per organization. So, it really is not making sense to me.

Should I not have any organizations setup before launching the stack? Should I have the govcloud central account be a member of the commercial organization? There's really no mention of the actual prereq for organization structure.

Any help would be great!

hitachiman commented 2 years ago

On the accounts, No run the script first to create the environment then add accounts. govcloud and commercial should not be intermixed.

cnoble40-netrist commented 2 years ago

I appreciate the feedback, but the issue ended up being that when they (AWS) setup my Central GovCloud account, they did not give me enough quota for adding accounts to organizations. Supposed to be 10 by default, but it was set at 2.