aws-samples / aws-samples/aws-security-reference-architecture-examples
[BUG] - rMacieOrgLambdaCustomResource timed out because it reached the sra-macie-org Lambda function's 15-minute limit
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 303
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 1
Description
### Describe the bug
[rMacieOrgLambdaCustomResource](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/templates/sra-macie-org-configuration.yaml#L436C3-L436C32) timed out because it reached the [Lambda ](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/templates/sra-macie-org-configuration.yaml#L393) function's 15-minute limit
### To Reproduce
We have over 100 accounts with 10 regions need to enabling Macie / add member through Macie delegated administrator account
And the above lambda function got timed out after 15 minutes
Then the rMacieOrgLambdaCustomResource got failures status
### Expected behavior
Would like to hear any solutions for this.
Should we just remove the rMacieOrgLambdaCustomResource from the templates?
If we remove it, it looks like we will be unable to deliver the S3 object of automated-sensitive-data-discovery results to the centralize [PUBLISHING_DESTINATION_BUCKET_NAME](https://github.com/aws-samples/aws-security-reference-architecture-examples/blob/main/aws_sra_examples/solutions/macie/macie_org/templates/sra-macie-org-configuration.yaml#L450C7-L450C41), which we currently set to a different logs account (not the Macie delegated administrator account).
### Screenshots
N/A
### Deployment Environment (please complete the following information)
- Deployment Framework: Customizations for Control Tower and CloudFormation StackSets
- Deployment Framework Version: 2.8.3
### Additional context
N/A
Contributor guide
Assessment
This issue has not been assessed yet.