[Bug]: Service managed stacksets with delegated admin not working

[popsicleslayer]

Terraform Core Version

1.4.6

AWS Provider Version

5.6.2

Affected Resource(s)

aws_cloudformation_stack_set, aws_cloudformation_stack_set_instance

Expected Behavior

The StackSets should be deployed in the account that is the delegated admin for CloudFormation. Deploying the same StackSet (without the call_as = "DELEGATED_ADMIN") in the root account of the organization deploys these resources without any problem.

Actual Behavior

Terraform throws an error: You must be the management account or delegated admin account of an organization before operating a SERVICE_MANAGED stack set

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

resource "aws_cloudformation_stack_set_instance" "xxx" {
  deployment_targets {
    organizational_unit_ids = [local.organization.ou.xxx_id]
  }
  region         = data.aws_region.current.name
  stack_set_name = aws_cloudformation_stack_set.xxx.name
}

resource "aws_cloudformation_stack_set" "xxx" {
  name             = "xxx"
  description      = "xxx"
  permission_model = "SERVICE_MANAGED"
  template_body    = file("./files/CloudFormation.yaml")
  call_as          = "DELEGATED_ADMIN"
  capabilities = [
    "CAPABILITY_NAMED_IAM",
    "CAPABILITY_IAM"
  ]
  auto_deployment {
    enabled = true
  }
  parameters = {
    Route53Id   = local.zone_id
    Route53Name = local.zone_name
    DynamoDBName        = local.dynamodb_table_name
    RoleArn           = local.ole_arn
  }
  # Related issue: https://github.com/hashicorp/terraform-provider-aws/issues/23464
  lifecycle {
    ignore_changes = [
      administration_role_arn
    ]
  }
}

Steps to Reproduce

Deploy the CloudFormation StackSet resources to an account that is a delegated admin for CloudFormation.

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @popsicleslayer 👋 Thanks for taking the time to raise this! I suspect that this error may be coming from the AWS API directly, and may be related to the credentials that you're using for Terraform, however, I can't be certain at this time. Are you able to supply debug logs (redacted as necessary)?

[popsicleslayer]

Hi @justinretzolk! Unfortunately, I can't provide any logs. If this is any help the Terraform code is deployed using GitHub Actions, there's no jump host in this deployment and we use this approach to connect to AWS. I also found a similar issue with a comment that has what looks like exactly the same problem here.

[ewbankkit]

@popsicleslayer Thanks for raising this issue 👏
Have you tried adding call_as = "DELEGATED_ADMIN" to the aws_cloudformation_stack_set_instance resource configuration?

[MichaelAicher]

Thats what solved it for me! Thanks a ton!

@popsicleslayer Thanks for raising this issue 👏 Have you tried adding call_as = "DELEGATED_ADMIN" to the aws_cloudformation_stack_set_instance resource configuration?

[gdavison]

Hi @popsicleslayer. Are you still seeing this error using an updated version of the AWS Provider? We're currently on version 5.46.0. If so, can you include the whole error message, please? It looks like the error is coming from the aws_cloudformation_stack_set, so the aws_cloudformation_stack_set_instance is not tried.

I've tried reproducing the error locally, and I'm not seeing it, unless I don't have the account registered as a delegated administrator.

As an example, my Organization root account is 123456789012 and my delegated administrator is 987654321012. When I run the configuration

resource "aws_cloudformation_stack_set" "example" {
  name             = "example"
  permission_model = "SERVICE_MANAGED"
  call_as          = "DELEGATED_ADMIN"

  auto_deployment {
    enabled                          = true
    retain_stacks_on_account_removal = false
  }

  template_body = <<TEMPLATE
...
TEMPLATE

  lifecycle {
    ignore_changes = [administration_role_arn]
  }
}

in account 987654321012, it completes successfully.

However, if I remove 987654321012 as delegated administrator and run Terraform in 987654321012, I get the error

Error: creating CloudFormation StackSet (example): ValidationError: Account used is not a delegated administrator

Are you using Terraform to configure the account as a delegated administrator? If so, try adding depends_on = [aws_organizations_delegated_administrator.<resource name>] to your aws_cloudformation_stack_set. Otherwise, the account may not be registered by the time the aws_cloudformation_stack_set is tried.

The error may also occur if the user or role used does not have the permission organizations:ListDelegatedAdministrators in addition to the stack sets permissions.

[github-actions]

Warning

This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v5.47.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.