Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(uninstallation): ignore accounts scheduled for closure #726

Open
wants to merge 1 commit into
base: release/v1.11.2
Choose a base branch
from

Conversation

richardkeit
Copy link
Contributor

@richardkeit richardkeit commented Feb 21, 2025

Closes #727

If accounts are SUSPENDED, uninstallation fails with the below:

2025-02-21 11:50:29.039 | info | accelerator-tool | Building stack list for: XXXXX in region us-east-1
AccessDenied: User: arn:aws:sts::YYYYYY:assumed-role/AWSReservedSSO_AWSAdministratorAccess_a32d1507e4705a0f/richard.keit.lza.2.sso is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::XXXXXXXX:role/AWSControlTowerExecution
    at throwDefaultError (/Users/richardkeit/git/versent/landing-zone-accelerator-on-aws/source/node_modules/@smithy/smithy-client/dist-cjs/index.js:846:20)
    at /Users/richardkeit/git/versent/landing-zone-accelerator-on-aws/source/node_modules/@smithy/smithy-client/dist-cjs/index.js:855:5
    at de_CommandError (/Users/richardkeit/git/versent/landing-zone-accelerator-on-aws/source/node_modules/@aws-sdk/client-sts/dist-cjs/index.js:476:14)
    at processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async /Users/richardkeit/git/versent/landing-zone-accelerator-on-aws/source/node_modules/@smithy/middleware-serde/dist-cjs/index.js:35:20
    at async /Users/richardkeit/git/versent/landing-zone-accelerator-on-aws/source/node_modules/@smithy/core/dist-cjs/index.js:165:18
    at async /Users/richardkeit/git/versent/landing-zone-accelerator-on-aws/source/node_modules/@smithy/middleware-retry/dist-cjs/index.js:320:38
    at async /Users/richardkeit/git/versent/landing-zone-accelerator-on-aws/source/node_modules/@aws-sdk/middleware-logger/dist-cjs/index.js:34:22 {
  '$fault': 'client',
  '$metadata': {
    httpStatusCode: 403,
    requestId: '30ac5f18-12c6-4fb2-b434-3dfd36c42fa8',
    extendedRequestId: undefined,
    cfId: undefined,
    attempts: 1,
    totalRetryDelay: 0
  },
  Type: 'Sender',
  Code: 'AccessDenied'
}

The change will ignore accounts already slated for closure:

2025-02-21 11:52:13.544 | info | accelerator-tool | Reading file: reference/policies/iam-policies/platform-teams-policy.json
2025-02-21 11:52:14.811 | error | accelerator-tool | Account Testing-Workload (<account_email>) is suspended, will not be cleaned up
2025-02-21 11:52:14.812 | error | accelerator-tool | Account workloads-prod-public-website-prod (<account_email>) is suspended, will not be cleaned up
2025-02-21 11:52:14.812 | error | accelerator-tool | Account SharedServices (<account_email>) is suspended, will not be cleaned up

@richardkeit richardkeit marked this pull request as ready for review February 21, 2025 01:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[BLOCKING][Test Environments] Suspended accounts block cleanup of solution
2 participants