OrgMain account not affected by root.all? about aws-iam-identity-center-extensions HOT 4 CLOSED

PR #41 fixes the missing documentation, and since the functionality originates from a hard restriction on the service API, I am going ahead and closing the issue for now @allquixotic .

At a later time, when AWS SSO does allow operating permission sets/account assignments through API on org main account, then we would adapt the code to handle this. For reference, this is a single if condition that would be commented out, and the solution would then start treating org main account as any other account.

from aws-iam-identity-center-extensions.

Hi @allquixotic ,

This is a limitation with not our solution but AWS SSO admin API. Using AWS SSO admin API, you can't programmatically assign/remove a permission set to OrgMain account. The API does not allow this operation, as it's a fail safe implemented by the service directly.

This is why our solution skips OrgMain account in any root scope type operations. With regards to override ability, since the API does not allow this , we don't have any way to implement this.

Please let me know if you need any other details.

from aws-iam-identity-center-extensions.

Thanks for the information. I am good with closing this issue, but my only suggestion might be to mention this prominently in README.md. I'll leave it open in case you want to reference this issue in a doc change PR.

Thanks again!

from aws-iam-identity-center-extensions.

Thank you for the feedback @allquixotic , we will reference this in the doc updates PR

from aws-iam-identity-center-extensions.