search

idealo / terraform-provider-controltower

Use AWS Control Tower from Terraform
https://registry.terraform.io/providers/idealo/controltower
Mozilla Public License 2.0
21 stars 10 forks source link

Request policy/role to create accounts #204

Closed GrantAnt closed 9 months ago

GrantAnt commented 9 months ago

Hi there,

I don't want to report a bug but ask for a certain permission. I want to integrate terraform code in an Azure DevOps pipeline. Therefore I am using an IAM User with long-term credentials (don't mix up with IAM Identity User). Creating an aws control tower account with terraform apply does actually fail. AWS CLI does return an empty response for

aws servicecatalog search-products --filters FullTextSearch="AWS Control Tower Account Factory"

But when executing locally with an SSO user (IAM Identity User), I can execute terraform apply successfully for the terraform code above.

Can someone point out the specific role/permissions that the IAM user needs for aws cli request above?

GrantAnt commented 9 months ago

Control Tower creates an entry in service catalog. Within "Portfolio" you can grant access to the IAM User. image