awslabs / awslabs/aws-deployment-framework

[Bug]: adf-account-management fails with AccessDeniedException on account:ListRegion action

Open
#764 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
699
Forks
235
Avg merge
20h 53m
Merged PRs (30d)
7

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

Starting from version 4.0.0, the "adf-account-management" State Machine has a new node called "ConfigureAccountRegions" that enables opt-in regions. The node calls the account:ListRegion action, that requires that the support for AWS Account Management in AWS Organization services is enabled.

### Expected Behavior

The "adf-account-management" state machine runs correctly

### Current Behavior

If the trusted access to "AWS Account Management" service isn't enabled, the state machine fails like this:

`AccessDeniedException: An error occurred (AccessDeniedException) when calling the ListRegions operation: User: arn:aws:sts::xxxxxxxxxxxx:assumed-role/serverlessrepo-aws-deplo-AccountRegionConfigFunctio-KUolRd9e1eAc/adf-account-management-config-region is not authorized to perform: account:ListRegions (Your organization must first enable trusted access with AWS Account Management.)`

### Steps To Reproduce

1. Upgrade or install from scratch ADF 4.0.0
2. Configure a new account in the bootstrap repository
3. Observe the failure in the AWS State Machine ""adf-account-management

### Possible Solution

This requirement should be at least specified in the installation document, even better it should be enabled during the bootstrap pipeline, as it happens for other Organization features.

### Additional Information/Context

_No response_

### ADF Version

4.0.0

### Contributing a fix?

- [ ] Yes, I am working on a fix to resolve this issue

Contributor guide

Open the contributing guide

Research direction

Start with the adf-account-management state machine, especially the ConfigureAccountRegions node, then inspect the bootstrap repository and pipeline handling other AWS Organizations features. Determine whether trusted access for AWS Account Management should be enabled during bootstrap or documented in the installation document. Done means the state machine runs successfully for accounts where the prerequisite was previously absent, or the installation requirement is explicit.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.