aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[Resource Type] - [Enhancement] - Allow CloudFormation Stackset to Queue Conflicting Operations When Accounts Are Moved from One OU to Another

Open
#2,427 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::CloudFormation::StackSet

### Resource name

_No response_

### Description

When using AWS CloudFormation StackSets with service-managed permissions and automatic deployment enabled, moving accounts between organizational units (OUs) triggers both DELETE operations in the source OU and CREATE operations in the destination OU. In some edge cases(moving the same account quickly from destination OU back to source OU), these operations occur simultaneously, causing failures when the same-named IAM roles or resources are being deployed across multiple StackSets. The CREATE operations fail with "already exists" errors because the DELETE operations from the previous OU haven't completed yet.

### Other Details

Current Workaround:
Users have to use a time-consuming two-step process. They first move accounts to a temporary "staging" OU and wait for all the DELETE operations to finish. Only then can they move these accounts to their actual target OU to trigger the CREATE operations. This workaround is especially frustrating when moving multiple accounts at once, as it adds unnecessary steps and management overhead to what should be a straightforward process.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or code entry points are identified. Start by reviewing CloudFormation StackSets with service-managed permissions and automatic deployment, then reproduce rapid account moves between OUs. Done means conflicting DELETE and CREATE operations are queued or coordinated so deployments complete without already-exists failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.