Serviced Managed Stacksets Not Working

[ifunky]

Hi,

I have a delegated admin account (security) and when I'm trying to create stacksets via aws_cloudformation_stack_set I receive the following error:

Error: error creating CloudFormation StackSet (Sec-Hub-SHARR-Members-Role): ValidationError: You must be the master or delegated admin account of an organization before operating a SERVICE_MANAGED stack set status code: 400,

Example Code

resource "aws_cloudformation_stack_set" "sec_hub_sharr_members_role" {
    name                    = "Sec-Hub-SHARR-Members-Role"

    permission_model = "SERVICE_MANAGED"
    auto_deployment {
        enabled = true
        retain_stacks_on_account_removal = false
    }

    template_url = "https://solutions-reference.s3.amazonaws.com/aws-security-hub-automated-response-and-remediation/latest/aws-sharr-member-roles.template"
}

If I create the exact same stack via the console it works.

Any ideas please?

Thanks

Dan

[justinretzolk]

Hey @ifunky 👋 Thank you for taking the time to raise this. If you feel this is a bug, can you update the issue description with the additional information requested in the bug template? Alternatively, if you don't feel that this is a bug, and is instead something that you just have a question on, the AWS Provider Discuss forum may also be a good place to ask.

[albertorm95]

You will need this:

• add call_as support for stackset #22440
  https://github.com/hashicorp/terraform-provider-aws/releases/tag/v4.1.0

[justinretzolk]

Hey @ifunky 👋 Given the comment above, can you test this again with version 4.1.0 of the provider?

[michael-ullrich-1010]

Hi @justinretzolk,
I use aws v4.25.0 and still have the issue
Kind regards
Michael

[ifunky]

Hello,

Sorry for the delay @justinretzolk !

I'm using the latest as of today (v4.31.0) and still receive the same error.

Thanks

Dan

[michael-ullrich-1010]

Hi @ifunky ,
this setting worked for me:
auto_deployment {
enabled = true
}
permission_model = "SERVICE_MANAGED"
call_as = "DELEGATED_ADMIN"

Regards
Michael

[justinretzolk]

Hey @ifunky, no worries! After upgrading, did you add the new call_as argument set to DELEGATED_ADMIN, as was mentioned above?

[ifunky]

Good Afternoon,

Thanks @michael-ullrich-1010 and @justinretzolk the stacks are running now from the delegated admin account :-)

Cheers

Dan

[ifunky]

Hi @justinretzolk,

Actually I thought the delegated functionality was working but it's not, if you take the example below it runs from my management account but not from my delegated security account:

resource "aws_cloudformation_stack_set" "enable_guardduty" {
    name                    = "Enable-Guardduty"

    permission_model = "SERVICE_MANAGED"
    call_as          = "DELEGATED_ADMIN"  # SELF

    auto_deployment {
        enabled = true
        retain_stacks_on_account_removal = false
    }

    capabilities = ["CAPABILITY_NAMED_IAM"]

    parameters     = {
      MasterId = "123456789012"
    }

    template_url = "https://cloudformation-stackset-sample-templates-us-east-1.s3.us-east-1.amazonaws.com/EnableAWSGuardDuty.yml"
}


resource "aws_cloudformation_stack_set_instance" "enable_guardduty" {
  deployment_targets {
    organizational_unit_ids = ["r-sk85"]
  }

  region         = var.region
  stack_set_name = aws_cloudformation_stack_set.enable_guardduty.name
}

ERROR
Error: error waiting for CloudFormation StackSet Instance () creation: error creating CloudFormation StackSet (Enable-Guardduty) Instance: StackSetNotFoundException: StackSet Enable-Guardduty not found
│ status code: 404, request id: b36b194f-ac7f-4721-be01-7ed541f52ffc
│
│ with aws_cloudformation_stack_set_instance.enable_guardduty,
│ on cf_stackset_enable_guardduty.tf line 24, in resource "aws_cloudformation_stack_set_instance" "enable_guardduty":
│ 24: resource "aws_cloudformation_stack_set_instance" "enable_guardduty" {

Thanks

Dan

[aleksk24]

@ifunky Try including call_as = "DELEGATED_ADMIN" parameter to the aws_cloudformation_stack_set_instance. enable_guardduty resource. For me this helped.

[popsicleslayer]

Hi!
I ran into the same problem.
Tried with call_as = "DELEGATED_ADMIN" and it didn't help. When deployed manually the same template works perfectly in the account that is the delegated admin. Unfortunately, we had to deploy from the root account which solved the problem, but is not a desired solution. I hope there is going to be a solution to this soon :)