CfCT - error when enabling recommended controls about aws-control-tower-customizations HOT 5 CLOSED

UPDATE: It seems that the deployment method "stack_set" is incompatible with activating the control rule on the management account.

from aws-control-tower-customizations.

Hi @RoxanaTeodosiu,

The error message provided does not appear to be an issue with CfCT but rather Control Tower itself, e.g. you are attempting to enable a Control against an unenrolled OU:

"Organizational unit ou-xxxx-xxxxxxx is not registered with AWS Control Tower. (Service: AWSControlTower; Status Code: 404; Error Code: ResourceNotFoundException; Request ID: xxxxxxxx; Proxy: null)"

Have you confirmed that the relevant OU is registered with Control Tower?

Additionally, please note that SCP-based preventative controls do not affect the management account. Config-based detective controls should operate as normal.

The root user and any administrators in the management account can perform work that controls would otherwise deny. This exception is intentional. It prevents the management account from entering into an unusable state. All actions taken within the management account continue to be tracked in the logs contained within the log archive account, for purposes of accountability and auditing.

https://docs.aws.amazon.com/controltower/latest/userguide/controls.html#exception-to-controls

from aws-control-tower-customizations.

Hi @stumins,

Thank you for replying!
The OU on which I was searching to enable the recommended control from the CT list is the Security OU created by CT when deploying the landing zone. I have kept the default configuration for testing.

After many tests, I noticed that the error message I was getting on the management account in the Step functions was in fact received from the 2 accounts in the Security OU on which the CfCT solution was deploying the CloudFormation stacks. The problem is that the AWS::ControlTower::EnabledControl is to be made on the management account and not on the accounts in the indicated OU. So, the operation fails as the information it searches for is not available in the child accounts.

So maybe this problem should be taken into account as an enhancement pour allowing the customization (through CloudFormation stacks) of the landing zone also at the management account level. Today the CF stacks are applied on the child accounts.

from aws-control-tower-customizations.

In the snippet you provided, it looks like you are trying to deploy the EnabledControl stack directly to the target accounts using CFCT:

...
- name: stackset-AWS-GR-EC2-VOLUME-INUSE-CHECK
    resource_file: example-configuration/templates/enable_controls.template
    deploy_method: stack_set
    deployment_targets: # accounts property is not supported for SCPs
      accounts: # :type: list
        - xxxxx
        - xxxxx
...

I believe the correct route here is to specify the TargetIdentifier for the EnabledControl within the stack template, as you did, then to use CFCT to deploy that stack only to the management account. You can use the parameters feature of CFN + CFCT to have a dynamic TargetIdentifier passed a deploy-time if needed.

To deploy stacks to the CT management account using CFCT, you'll need to create the AWSControlTowerExecutionRole as specified in https://docs.aws.amazon.com/controltower/latest/userguide/cfct-root-ou.html

from aws-control-tower-customizations.

Hi Stu,

Thank you for the reply.
I've tested the workaround and I confirm that by adding the missing AWSControlTowerExecutionRole role and by choosing to target only the managent account, it works.
So maybe this workaround should be integrated in the CfCT deployment stack for this kind of use.

In the meanwhile I've developed a custom solution for dealing with this and more as it turns out, we cannot make more than 10 concurrent calls to CT for enabling controls. If we have a rather longer list of controls we want to apply, we quickly have a limit.

Thanks again for the helping out.
Kind regards

from aws-control-tower-customizations.