aws-samples / aws-samples/aws-security-reference-architecture-examples
[BUG] IAM Access Analyzer solution does not fully deploy to all enabled regions in the management account
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 303
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 1
Description
### Describe the bug
When deploying the solution to a multi-region org, the access analyzer is only deployed to the home region of the management account, rather than to all enabled regions. This is because the `sra-iam-access-analyzer-account.yaml` template is deployed via a Stack rather than a StackSet. Accounts other than the Organization management account have the `sra-iam-access-analyzer-account.yaml` template deployed via a Stacket, so all regions get included.
### To Reproduce
1. Set up an Organization with multiple regions enabled - e.g. us-east-1 and ca-central-1
2. Deploy the SRA IAM Access Analyzer solution via StackSets (I used the CfCT) in the Org management home region (e.g. us-east-1)
3. Verify that an Access Analyzer has been deployed in all region for accounts other than the management accoutn
4. Verify that an Access Analyzer has only been deployed to us-east-1 for the management account (this will also get flagged by SecurityHub CSPM, if enabled
### Expected behavior
An Access Analyzer should be deployed to all enabled regions for the Org managment account.
### Deployment Environment (please complete the following information)
- Deployment Framework: CfCT
- Deployment Framework Version: version 2.8.1
### Additional context
I worked around this by customising my own `sra-iam-access-analyzer-main-ssm.yaml` to use a StackSet:
```(yaml)
rIAMAccessAnalyzerMgmtAccountStackSet:
Type: AWS::CloudFormation::StackSet
Properties:
StackSetName: sra-iam-access-analyzer-mgmt-account
AdministrationRoleARN: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${pStackSetAdminRole}
ExecutionRoleName: !Ref pStackExecutionRole
CallAs: SELF
Capabilities:
- CAPABILITY_NAMED_IAM
Description: !Sub ${pSRASolutionVersion} - Deploys an account level IAM Access Analyzer to all management account regions
ManagedExecution:
Active: true
OperationPreferences:
FailureTolerancePercentage: 100
MaxConcurrentPercentage: 100
RegionConcurrencyType: PARALLEL
PermissionModel: SELF_MANAGED
StackInstancesGroup:
- DeploymentTargets:
Accounts:
- !Sub ${AWS::AccountId}
Regions: !Ref pAccessAnalyzerRegionsToEnable
TemplateURL: !Sub https://${pSRAStagingS3BucketName}.s3.${AWS::Region}.${AWS::URLSuffix}/${pSRASolutionName}/templates/sra-iam-access-analyzer-account.yaml
Parameters:
- ParameterKey: pAccessAnalyzerNamePrefix
ParameterValue: !Ref pAccessAnalyzerNamePrefix
Tags:
- Key: sra-solution
Value: !Ref pSRASolutionName
```
Contributor guide
Research direction
Start with sra-iam-access-analyzer-main-ssm.yaml and compare its management-account deployment with the StackSet workaround in the issue; inspect sra-iam-access-analyzer-account.yaml and the enabled-region parameter. Deploy through CfCT in an organization with multiple enabled regions, then verify the management account has an Access Analyzer in every selected region.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100