awslabs / awslabs/aws-deployment-framework

[Bug]: Terraform pipeline get accounts script error

Open
#744 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
699
Forks
235
Avg merge
20h 53m
Merged PRs (30d)
7

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

Terraform pipeline returns the following error where running get_accounts.py script

`
[Container] 2024/07/08 21:29:23.374503 Running command python adf-build/helpers/terraform/get_accounts.py
--
34 | INFO:__main__:Management Account ID: 222
35 | Traceback (most recent call last):
36 | File "adf-build/helpers/terraform/get_accounts.py", line 190, in
37 | main()
38 | File "adf-build/helpers/terraform/get_accounts.py", line 31, in main
39 | accounts = get_accounts()
40 | File "adf-build/helpers/terraform/get_accounts.py", line 70, in get_accounts
41 | organizations = get_boto3_client(
42 | File "adf-build/helpers/terraform/get_accounts.py", line 145, in get_boto3_client
43 | role = sts.assume_role(
44 | File "/root/.pyenv/versions/3.8.17/lib/python3.8/site-packages/botocore/client.py", line 565, in _api_call
45 | return self._make_api_call(operation_name, kwargs)
46 | File "/root/.pyenv/versions/3.8.17/lib/python3.8/site-packages/botocore/client.py", line 1021, in _make_api_call
47 | raise error_class(parsed_response, operation_name)
48 | botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::111:assumed-role/adf-codebuild-role/AWSCodeBuild-83a8ffad-f4fc-4d89-83a6-9d32d4d83dd2 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::222:role/adf/organizations/adf-organizations-readonly
`

### Expected Behavior

get_accounts.py should ends properly and return the list of target account IDs

### Current Behavior

Terraform apply stage fails with the following error

`
[Container] 2024/07/08 21:29:23.374503 Running command python adf-build/helpers/terraform/get_accounts.py
--
34 | INFO:__main__:Management Account ID: 222
35 | Traceback (most recent call last):
36 | File "adf-build/helpers/terraform/get_accounts.py", line 190, in
37 | main()
38 | File "adf-build/helpers/terraform/get_accounts.py", line 31, in main
39 | accounts = get_accounts()
40 | File "adf-build/helpers/terraform/get_accounts.py", line 70, in get_accounts
41 | organizations = get_boto3_client(
42 | File "adf-build/helpers/terraform/get_accounts.py", line 145, in get_boto3_client
43 | role = sts.assume_role(
44 | File "/root/.pyenv/versions/3.8.17/lib/python3.8/site-packages/botocore/client.py", line 565, in _api_call
45 | return self._make_api_call(operation_name, kwargs)
46 | File "/root/.pyenv/versions/3.8.17/lib/python3.8/site-packages/botocore/client.py", line 1021, in _make_api_call
47 | raise error_class(parsed_response, operation_name)
48 | botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::111:assumed-role/adf-codebuild-role/AWSCodeBuild-83a8ffad-f4fc-4d89-83a6-9d32d4d83dd2 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::222:role/adf/organizations/adf-organizations-readonly
`

### Steps To Reproduce

Run a terraform pipeline

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### ADF Version

4.0.0

### Contributing a fix?

- [ ] Yes, I am working on a fix to resolve this issue

Contributor guide

Open the contributing guide

Research direction

Start with adf-build/helpers/terraform/get_accounts.py, especially get_accounts() and get_boto3_client(), then reproduce the failure by running a Terraform pipeline. Trace the sts.assume_role call and the reported roles for the authorization mismatch. Done means get_accounts.py completes and returns the target account IDs so the Terraform apply stage can proceed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, terraform
Domain
cloud, devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.