Pipeline times out at AuditManagerEnableOrganizationAdminAccount on eu-west-3 about landing-zone-accelerator-on-aws HOT 6 OPEN

Also deleting the stack takes ages, I suppose again because there is no AWS Audit manager in eu-west-3?

from landing-zone-accelerator-on-aws.

I tried a workaround to exclude Paris region from the audit Manager in security-config.yaml, but no luck:

  auditManager:
    enable: true
    excludeRegions:
      - eu-west-3

I also tried exclude Paris from the awsConfig using the following:

awsConfig:
  excludeRegions:
    - eu-west-3

But got the following error in the pipeline in Security_Resources stage and the stack AWSAccelerator-SecurityResourcesStack-xxxxx-eu-west-3

"Invalid request provided: NoAvailableConfigurationRecorder"

from landing-zone-accelerator-on-aws.

I tried a workaround to exclude Paris region from the audit Manager in security-config.yaml, but no luck:

  auditManager:
    enable: true
    excludeRegions:
      - eu-west-3

I also tried exclude Paris from the awsConfig using the following:

awsConfig:
  excludeRegions:
    - eu-west-3

But got the following error in the pipeline in Security_Resources stage and the stack AWSAccelerator-SecurityResourcesStack-xxxxx-eu-west-3

"Invalid request provided: NoAvailableConfigurationRecorder"

I can't say regarding the main issue, but we also ran into the NoAvailableConfigurationRecorder. This was mainly due to enabling a new region in Control Tower but not updating enrolled accounts. This leads to AWS Config in the new regions to not be initialized. The fix was to simply update enrolled accounts through Control Tower.

from landing-zone-accelerator-on-aws.

Hello, any update here?
@ye-yng how do you update de enrolled accounts to the new region?
could you share de steps here?

from landing-zone-accelerator-on-aws.

We are having the same problem with version 1.9.1 when enabling a secondary region.

This helped us but is not the expected behavior: #517 (comment)

AWSAccelerator-SecurityResourcesStack-3111XXXXXXXX-us-west-2 |  0/89 | 9:38:02 PM | CREATE_FAILED        |
AWS::Config::ConfigRule               | AcceleratorEc2InstanceDetailedMonitoringEnabled
(AcceleratorEc2InstanceDetailedMonitoringEnabled9F032168) Resource handler returned message: "Invalid request provided:
NoAvailableConfigurationRecorder" (RequestToken: XXXXXXXX-dee3-ee84-d6cb-7d8268aXXXXX, HandlerErrorCode:
InvalidRequest)

from landing-zone-accelerator-on-aws.

Hello, any update here? @ye-yng how do you update de enrolled accounts to the new region? could you share de steps here?

Hi, I don't quite recall the details regarding our specific error, but updating enrolled accounts in Control Tower did solve it.

Assuming you enabled new regions in your Control Tower Landing Zone, perform the following steps to update enrolled accounts:

1. Go to Control Tower > Organization
2. If you enabled new regions in Control Tower you should see your accounts (other than the mandatory ones) with an Update Available Baseline State
3. Update the accounts one by one

I couldn't find a more efficient solution at the time but this solved our issues.

from landing-zone-accelerator-on-aws.