Does it not create an OU automatically?

awslabs / landing-zone-accelerator-on-aws

Deploy a multi-account cloud foundation to support highly-regulated workloads and complex compliance requirements.

https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/

Apache License 2.0

541 stars 431 forks source link

Does it not create an OU automatically? #3

Closed deepend-dev closed 2 years ago

deepend-dev commented 2 years ago

Describe the bug The accelerator pipeline not able to create infrastructure OU on first run.

To Reproduce Pipeline runs the first time

Expected behavior Infrastructure OU is automatically created.

Please complete the following information about the solution:

[ x ] Version: [e.g. v1.0.1]
[ x ] Region: ap-south-1
[ x ] Was the solution modified from the version published on this repository? No
[ x ] If the answer to the previous question was yes, are the changes available on GitHub?
[ x ] Have you checked your service quotas for the sevices this solution uses? yes
[ x ] Were there any errors in the CloudWatch Logs? Nope

Screenshots If applicable, add screenshots to help explain your problem (please DO NOT include sensitive information).

Additional context Add any other context about the problem here.

ninjaducloud commented 2 years ago

I have exactly the same problem. To fix it, I added the Infrastructure OU manually through AWS Control Tower.

However, I get another error

Screen Shot 2022-07-11 at 12 20 22 PM

Screen Shot 2022-07-11 at 12 23 46 PM

I use the default configuration files, those present in CodeCommit. I'm using ca-central-1 rather than ap-south-1

ninjaducloud commented 2 years ago

@deepend-dev If you take a look at the sample file organization-config.yaml, they say

If using AWS Control Tower, ensure that all the specified Organizational Units (OU) have been created and enrolled as the accelerator will verify that the OU layout matches before continuing to execute the deployment pipeline.

My comprehension is that you need to manage your OUs with Control Tower and not LZA.

deepend-dev commented 2 years ago

Okay so the OU needs to be created through GUI and then added to org file ... @ninjaducloud

My concern is why the need of org file at all if we have to create OU from console. Is there anyway to automate this ?

rgd11 commented 2 years ago

That is correct, when using the Landing Zone Accelerator on AWS with AWS Control Tower, you will need to ensure that the OU is added and properly enrolled with Control Tower.

The definitions within the organization configuration file allow references to the OUs that are listed, such as specifying which OUs to deploy a resource to using the deploymentTargets