Build fails if OU has no accounts - please reopen about aws-control-tower-customizations HOT 5 CLOSED

@budgreen619 Thanks for sharing your use case with us. If any of the OUs have at least 1 valid account ID other than the Org master account the pipeline should succeed (workaround). The reason we raise this exception to avoid pipeline to fail after the stack set API will fail since there will be no valid account ids in the API call. Note: Version 1.2 only support self-managed stack sets.

Would it be acceptable to execute the pipeline successfully if there are no accounts in the OU and stack set state machine will not be executed?

from aws-control-tower-customizations.

@groverlalit thanks very much for the response. yes, for my use case it would be perfectly fine to skip any cloudformation resources in manifest.yaml which have OUs without any accounts in them, and not executing the state machine for that specific resource. this would also cover the scenario where a customer might be retiring accounts or moving accounts around which could result in a situation where a there could be empty OUs and thus break the whole pipeline.

my customer will always use CodePipeline as the first location to view the status of CFCT, if the pipeline fails, then they would start drilling down into CodeBuild history, Step Functions, and Cloudformation for further details.

from aws-control-tower-customizations.

@budgreen619 Thanks for the confirmation. We have added this to our backlog and will review before the next release. Appreciate the feedback.

from aws-control-tower-customizations.

We are also experiencing this issue. Since Control Tower does not allow for nested OU's we have to create a new OU for each customer, and in order to apply guardrails in a timely fashion they need to be applied to the empty OU before the account is placed in there.

At any rate, having an empty OU is a common use case. Please fix

from aws-control-tower-customizations.

v2.0.0 now supports adding the OU name that does not contain any accounts in the manifest.yaml for the stack set resource.

from aws-control-tower-customizations.