awslabs / landing-zone-accelerator-on-aws

Deploy a multi-account cloud foundation to support highly-regulated workloads and complex compliance requirements.
https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/
Apache License 2.0
538 stars 430 forks source link

Sub OUs not deploying as expected, failure at Prepare stage #570

Open Godtrilla opened 3 weeks ago

Godtrilla commented 3 weeks ago

Describe the bug Creating SUB-OUs seems to fail. Parent OU already exists. Attempting to create sub-OUs under the parent OU. As pictured in LZA config.

The following OUs were already deployed: organizationalUnits:

Attempting to create:

Pipeline stage failure: Prepare stage

To Reproduce Steps to reproduce the behavior.

Deploy multiple OUs with sub OUs via LZA config.

Run LZA Pipeline and an error occurs.

Remove those same OUs and that solves the error but unable to deploy new sub-OUs

Expected behavior The expected behavior is that new sub-OUs are deployed via the LZA config. The code-pipeline is started and the OUs are deployed via the code-pipeline.

Please complete the following information about the solution:

To get the version of the solution, you can look at the description of the created AWS CloudFormation stack used to install the LZA (AWSAccelerator-InstallerStack). For example, "(SO0199) Landing Zone Accelerator on AWS. Version 1.5.1.". If the description does not contain the version information, you can look at the Parameters of the stack for the RepositoryBranchName as that should contain the version number.

Screenshots If applicable, add screenshots to help explain your problem (please DO NOT include sensitive information). screenshot_image

Additional context Add any other context about the problem here.

turqual commented 3 weeks ago

We manually recreated the OUs and had the pipeline register them with control tower. Now we are getting the following error in the prepare stage...

2024-09-16 16:59:52.681 | info | index | The organization unit "Architecture/Sandbox" already exists in AWS Organizations, create organizational operation skipped.
2024-09-16 16:59:52.922 | info | index | The organizational unit "Architecture/Sandbox" is not registered into AWS Control Tower, it will be registered now.
2024-09-16 17:00:00.591 | info | index | Enabling baseline for "Organizational Unit "Sandbox" with id "ou-yyax-*****mz7" for parent "Architecture". Baseline version is "4.0" and baseline identifier is "arn:aws:controltower:eu-west-1::baseline/17BSJV3IGJ2*****".
2024-09-16 17:00:01.182 | error | runner | This baseline is already enabled on this target. To resolve any enablement failures or drift, call ResetEnabledBaseline. To update the baseline version or parameters, call UpdateEnabledBaseline.
ValidationException: This baseline is already enabled on this target. To resolve any enablement failures or drift, call ResetEnabledBaseline. To update the baseline version or parameters, call UpdateEnabledBaseline.
    at de_ValidationExceptionRes (/codebuild/output/src1540/src/s3/00/source/node_modules/@aws-sdk/client-controltower/dist-cjs/index.js:1298:21)
    at de_CommandError (/codebuild/output/src1540/src/s3/00/source/node_modules/@aws-sdk/client-controltower/dist-cjs/index.js:1192:19)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async /codebuild/output/src1540/src/s3/00/source/node_modules/@smithy/middleware-serde/dist-cjs/index.js:35:20
    at async /codebuild/output/src1540/src/s3/00/source/node_modules/@smithy/core/dist-cjs/index.js:165:18
    at async /codebuild/output/src1540/src/s3/00/source/node_modules/@smithy/middleware-retry/dist-cjs/index.js:320:38
    at async /codebuild/output/src1540/src/s3/00/source/node_modules/@aws-sdk/client-controltower/node_modules/@aws-sdk/middleware-logger/dist-cjs/index.js:33:22 {
  '$fault': 'client',
  '$metadata': {
    httpStatusCode: 400,
    requestId: 'c5387b70-7932-46ba-a27c-c8f2a39f1322',
    extendedRequestId: undefined,
    cfId: undefined,
    attempts: 1,
    totalRetryDelay: 0
  },
  level: 'error',
  mainLabel: 'accelerator',
  [Symbol(level)]: 'error'
}
error Command failed with exit code 1.