awslabs / landing-zone-accelerator-on-aws

Deploy a multi-account cloud foundation to support highly-regulated workloads and complex compliance requirements.
https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/
Apache License 2.0
541 stars 431 forks source link

Landing Zone Accelerator Does Not Deploy Outside of US-EAST-1 #18

Closed bmadden-arch closed 1 year ago

bmadden-arch commented 2 years ago

Hi,

I'm trying to deploying the Landing Zone Accelerator in EU-WEST-1. During the CodePipeline Account stage it fails as it is looking for a CDK folder in US-EAST-1. There are only 4 regions listed in the GlobalRegionMap section of the template.

To Reproduce Deploy in any region other than US-EAST-1, US-GOV-WEST-1, US-ISOB-EAST-1 or US-ISO-EAST-1 which are all listed.

Expected behavior Expect LZA to deploy all resources in my EU-WEST-1 not split across EU-WEST-1 and US-EAST-1.

Please complete the following information about the solution:

Screenshots If applicable, add screenshots to help explain your problem (please DO NOT include sensitive information).

LZABug1Mappings

Additional context Add any other context about the problem here.

LZACodePipelineError
bmadden-arch commented 2 years ago

I have just modified the template to just have EU-WEST-1 in the GlobalRegionMap and it is running successful now. Suggest you add section to READ.ME and AWS Pages that you need to modify template for the region you want to deploy to if not US-EAST-1, US-GOV-WEST-1, US-ISOB-EAST-1, US-ISO-EAST-1.

bmadden-arch commented 2 years ago

With the change in region I get as far as the Accounts Stage in CodePipeline without any issue. It fails here looking for us-east-1 again.

I noticed that only the 4 US Regions are listed in this file. https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.2.0/source/packages/%40aws-accelerator/installer/lib/installer-stack.ts

Suspect this also needs to be updated to include EU-WEST-1

LZAPipelineErrorEU

CodeBuild Logs

LZACodeBuildLog
fanq10 commented 1 year ago

Hi @bmadden-arch,

I have figured out how to deploy the solution in another region other than us-east-1.

Changes need to be made, for example, I use ap-southeast-2 for my use-case, you can replace them with eu-west-1

  1. source/packages/@aws-accelerator/installer/lib/installer-stack.ts - ln136

    -          regionName: 'us-east-1',
    +         regionName: 'ap-southeast-2',
  2. source/packages/@aws-accelerator/config/lib/global-config.ts - ln656

    -  readonly homeRegion: string = '';
    + readonly homeRegion: string = 'ap-southeast-2';
  3. source/packages/@aws-accelerator/accelerator/lib/accelerator.ts - ln248

    -    let globalRegion = 'us-east-1';
    +    let globalRegion = 'ap-southeast-2';
  4. source/packages/@aws-accelerator/accelerator/bin/app.ts - ln120

    -    let globalRegion = 'us-east-1';
    +    let globalRegion = 'ap-southeast-2';
  5. Update global-config.yaml on CodeCommit repo: aws-accelerator-config:

    homeRegion: &HOME_REGION ap-southeast-2
    enabledRegions:
    - *HOME_REGION
rgd11 commented 1 year ago

@fanq10 @bmadden-arch

It is recommended to not modify the installer template or the underlying deployment code (.ts files) and interact with the solution primarily through the configuration files.

globalRgion is used to specify the region that is used by clients such as Organizations which is a global service, and should not be modified as they are tied to the AWS partition in use.

Simply, set your homeRegion to the desired region you want to have the solution installed into.

jfan9 commented 1 year ago

@fanq10 @bmadden-arch

It is recommended to not modify the installer template or the underlying deployment code (.ts files) and interact with the solution primarily through the configuration files.

globalRgion is used to specify the region that is used by clients such as Organizations which is a global service, and should not be modified as they are tied to the AWS partition in use.

Simply, set your homeRegion to the desired region you want to have the solution installed into.

Thanks @rgd11, also, I reckon it's good to update the LZA document showing which file(s) on which part(s) should be changed.

0arko commented 6 months ago

@rgd11 if you use an external pipeline account and therefore an existing repo to host the config files e.g global-config.yaml etc (otherwise the pipeline fails due to the pipeline account being unrecognised) and input this to the CFN parameter Existing Config Repository Name then the homeRegion parameter is set before the bootstrap stage, meaning that the us-east-1 s3 asset bucket doesnt get created, and we see the above error (No bucket named XXX. is account XXX bootstrapped?) How do we get round this issue without editing the installer files?