Open apenney opened 6 months ago
check if you have the following in deny-unsupported-regions.yml
Type: Community::Organizations::Policy
and if yes then switch to
Type: AWS::Organizations::Policy
surprised how it allowed you to create any scp for that matter
let us know if that worked?
I did, and changing it has moved me forward:
Properties validation failed for resource Scp with message: #: required key [Type] not found #: required key [Content] not found #: extraneous key [PolicyType] is not permitted #: extraneous key [PolicyDocument] is not permitted
I'll dig into this and see if I can figure out the changes, then fire a PR up once I get it working!
indeed so you need to change it to Content and also PolicyType to Type and PolicyName to Name. it will work then and will have to make those changes for rest of SCPs
Resources: Scp: Type: AWS::Organizations::Policy Properties: Description: Restricts the use of unsupported regions Name: DenyUnsupportedRegions Type: SERVICE_CONTROL_POLICY TargetIds: !Ref targetIds Content: Version: "2012-10-17" Statement:
thanks both, for the issue and the fix. i merged the branch into main.
a common issue, when managing SCPs in cloudformation templates, is that the DenyUnsupportedRegions will often update after other templates (in this case: regional templates from within the 005-types
folder.
if a region is unsupported, and then you would like to start supporting this, that would cause your build to fail. a solution to this is to add the SCPs to the organization.yml file.
Hi,
I'm hoping someone can help me. I'm running into an issue where I can't create the SCP to block regions, when it runs it looks like:
I see the same thing in the console, with a failure and:
I tried looking through CloudTrail but I see nothing useful in there. I then tried making an SCP by hand (well, the policy) with the same regions just to make sure there wasn't anything obvious. That worked.
The params for this template look like:
My manually created SCP was just the policy part, I didn't try to attach it to the target. Not sure if that's part of the issue. I'm not really sure what to troubleshoot next, I'm feeling a bit lost on this one!