aws-samples / aws-samples/aws-security-reference-architecture-examples

[BUG] Terraform Common Solution incorrectly detects Control Tower home region, causing deployment failure

Open
#304 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
1.2k
Forks
303
Avg merge
3d 9h
Merged PRs (30d)
1

Description

### Describe the bug

The SRA Common Solution is not correctly detecting my Control Tower home region. My Control Tower home region is eu-west-2, but the solution incorrectly defaults to eu-west-1, causing the deployment to fail with the following error:

```
[ERROR] ValueError: See the details in CloudWatch Log Stream: '/aws/lambda/sra-management-account-parameters'
Error Message: An error occurred (StackSetNotFoundException) when calling the DescribeStackSet operation:
StackSet AWSControlTowerBP-BASELINE-CONFIG not found
```

### To Reproduce

Steps to reproduce the behavior:

1. Cloned the repository.

2. Exported temporary AWS credentials (via IAM Identity Center, using the AWSAdministratorAccess permission set).

3. Ran terraform apply to deploy the common solution.

Note: The terminal session did not have the AWS_REGION environment variable set, nor any region configuration via CLI or environment.

It appears the data.aws_region.current resource used [here](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/terraform/common/ssm_parameters/data.tf#L8) is not reliably identifying the Control Tower home region. This automatic detection appears flawed in my set up.

Suggested Fix
Introduce a new Terraform variable, e.g. aws_home_region, that allows users to explicitly specify the Control Tower home region. This is more robust than relying on inferred defaults which may vary between environments.

Additionally, update the documentation to highlight that:

AWS_REGION or the new aws_home_region variable should be explicitly set before deployment.

Without setting the correct region, deployments may fail silently or with misleading errors.

Expected Behavior
The Common Solution should reliably deploy in the Control Tower home region. It should not assume or infer the region without a way for users to override it. Providing a configurable region variable will improve reliability and user experience.

Contributor guide

Open the contributing guide

Research direction

Start with aws_sra_examples/terraform/common/ssm_parameters/data.tf, especially the data.aws_region.current reference, and trace how the region reaches the Common Solution deployment. Check the Terraform variables and deployment documentation mentioned in the issue. Done means the Control Tower home region can be explicitly supplied, AWS_REGION behavior is documented, and deployment no longer relies only on inferred region data.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, terraform
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.