Comments (5)
UPDATE: It seems that the deployment method "stack_set" is incompatible with activating the control rule on the management account.
from aws-control-tower-customizations.
Hi @RoxanaTeodosiu,
The error message provided does not appear to be an issue with CfCT but rather Control Tower itself, e.g. you are attempting to enable a Control against an unenrolled OU:
"Organizational unit ou-xxxx-xxxxxxx is not registered with AWS Control Tower. (Service: AWSControlTower; Status Code: 404; Error Code: ResourceNotFoundException; Request ID: xxxxxxxx; Proxy: null)"
Have you confirmed that the relevant OU is registered with Control Tower?
Additionally, please note that SCP-based preventative controls do not affect the management account. Config-based detective controls should operate as normal.
The root user and any administrators in the management account can perform work that controls would otherwise deny. This exception is intentional. It prevents the management account from entering into an unusable state. All actions taken within the management account continue to be tracked in the logs contained within the log archive account, for purposes of accountability and auditing.
https://docs.aws.amazon.com/controltower/latest/userguide/controls.html#exception-to-controls
from aws-control-tower-customizations.
Hi @stumins,
Thank you for replying!
The OU on which I was searching to enable the recommended control from the CT list is the Security OU created by CT when deploying the landing zone. I have kept the default configuration for testing.
After many tests, I noticed that the error message I was getting on the management account in the Step functions was in fact received from the 2 accounts in the Security OU on which the CfCT solution was deploying the CloudFormation stacks. The problem is that the AWS::ControlTower::EnabledControl is to be made on the management account and not on the accounts in the indicated OU. So, the operation fails as the information it searches for is not available in the child accounts.
So maybe this problem should be taken into account as an enhancement pour allowing the customization (through CloudFormation stacks) of the landing zone also at the management account level. Today the CF stacks are applied on the child accounts.
from aws-control-tower-customizations.
In the snippet you provided, it looks like you are trying to deploy the EnabledControl stack directly to the target accounts using CFCT:
...
- name: stackset-AWS-GR-EC2-VOLUME-INUSE-CHECK
resource_file: example-configuration/templates/enable_controls.template
deploy_method: stack_set
deployment_targets: # accounts property is not supported for SCPs
accounts: # :type: list
- xxxxx
- xxxxx
...
I believe the correct route here is to specify the TargetIdentifier
for the EnabledControl within the stack template, as you did, then to use CFCT to deploy that stack only to the management account. You can use the parameters
feature of CFN + CFCT to have a dynamic TargetIdentifier passed a deploy-time if needed.
To deploy stacks to the CT management account using CFCT, you'll need to create the AWSControlTowerExecutionRole as specified in https://docs.aws.amazon.com/controltower/latest/userguide/cfct-root-ou.html
from aws-control-tower-customizations.
Hi Stu,
Thank you for the reply.
I've tested the workaround and I confirm that by adding the missing AWSControlTowerExecutionRole role and by choosing to target only the managent account, it works.
So maybe this workaround should be integrated in the CfCT deployment stack for this kind of use.
In the meanwhile I've developed a custom solution for dealing with this and more as it turns out, we cannot make more than 10 concurrent calls to CT for enabling controls. If we have a rather longer list of controls we want to apply, we quickly have a limit.
Thanks again for the helping out.
Kind regards
from aws-control-tower-customizations.
Related Issues (20)
- CAPABILITY_NAMED_IAM Error
- It is desirable that not only createManagedAccount, but also the CFCT pipeline starts even when a moveAccount action occurs HOT 4
- Slowness in deploying stacksets for organization with 800+ accounts HOT 2
- Frequent ConcurrentModificationException on running SCP updates HOT 7
- Service Catalog portolfios/products management
- Stacksets concurrency HOT 1
- Remove stacksets from an account in reverse order HOT 2
- Support for Israel(Tel Aviv) Region "il-central-1" HOT 1
- Update CHANGELOG HOT 1
- build-s3-dist.sh fails with pip error HOT 3
- Solution fails [StepFunctions.1] Security Hub control HOT 3
- control-tower-customizations relies on outdated libraries & runtimes and looks abandoned HOT 4
- Running test or build fails HOT 1
- CloudFormation Lambda S3 Error HOT 1
- FeatureRequest: Add External SourceControls - e.g. Github, Gitlab, bitbucket.... HOT 2
- Would like logging added to the stepfunction HOT 1
- IndexError: list index out of range in CustomControlTowerStateMachineLambda lambda function HOT 2
- Python 3.8 End-Of-Life HOT 4
- Enable "Server Access Logging" on the CloudTrail S3 bucket or have an option to enable it HOT 1
- Inspector high severity findings on this solution's Lambdas HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-control-tower-customizations.