Skip to content

Fix account bootstrap on OU move #539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sbkok merged 1 commit into from
Oct 7, 2022
Merged

Fix account bootstrap on OU move #539

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 24 additions & 4 deletions src/template.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1049,7 +1049,7 @@ Resources:
- MoveAccount
Targets:
- Arn: !Ref AccountBootstrappingStateMachine
RoleArn: !GetAtt StatesExecutionRole.Arn
RoleArn: !GetAtt AccountBootstrapStartExecutionRole.Arn
Id: CreateStackLinkedAccountV1

CodeCommitRole:
Expand Down Expand Up @@ -1428,8 +1428,6 @@ Resources:
- Effect: "Allow"
Principal:
Service:
- events.amazonaws.com
- lambda.amazonaws.com
- states.amazonaws.com
Action: "sts:AssumeRole"
Path: "/aws-deployment-framework/account-bootstrapping/"
Expand All @@ -1441,7 +1439,6 @@ Resources:
- Effect: Allow
Action:
- "lambda:InvokeFunction"
- "states:StartExecution"
Resource:
- !GetAtt DetermineEventFunction.Arn
- !GetAtt CrossAccountExecuteFunction.Arn
Expand All @@ -1450,6 +1447,29 @@ Resources:
- !GetAtt RoleStackDeploymentFunction.Arn
- !GetAtt UpdateResourcePoliciesFunction.Arn

AccountBootstrapStartExecutionRole:
Type: "AWS::IAM::Role"
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service:
- events.amazonaws.com
Action: "sts:AssumeRole"
Path: "/aws-deployment-framework/account-bootstrapping/"
Policies:
- PolicyName: "adf-start-state-machine"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- "states:StartExecution"
Resource:
- !Ref AccountBootstrappingStateMachine

AccountBootstrappingStateMachine:
Type: "AWS::StepFunctions::StateMachine"
Properties:
Expand Down