LZA Pipeline Stuck on Finalize Stage Due to SCP Update Failure about landing-zone-accelerator-on-aws HOT 4 CLOSED

Hello @bhkhatri221 , thank you for response. The pipeline was able to complete successfully by following the workaround steps above. I also had no issues as well after removing the environmental variable and gave the pipeline a dry run. Thanks again for your assistance.

from landing-zone-accelerator-on-aws.

Hello @adeolaolawuyi, thank you for filing an issue with the Landing Zone Accelerator team!

The issue you're facing could be due to the policy being deleted and recreated, which generated a different ID, causing the Finalize stack to become unsynchronized. A similar issue has been reported before.

To better assist you with this issue, please provide the following information:

• Did this issue start during the upgrade process?
• What versions of the solution are you upgrading from and to?
• Were there any manual modifications of SCPs ?

Thanks, and we look forward to hearing back from you!

from landing-zone-accelerator-on-aws.

Hi @bhkhatri221, thank you for your response.

Just to confirm the issue did not start during the LZA upgrade process.

The Accounts stack was failing to update and could not rollback. Then I tried to delete the stack, which could not delete because of the SCP resources, the SCP resources was skipped but it still ended up deleting the SCPs as part of the process. A rerun of the Accounts stage recreated the stack and the SCP resources again.

The current version we are using is v.1.8.1 and there was no manual modifications to SCPs.

from landing-zone-accelerator-on-aws.

Hello @adeolaolawuyi , thank you for additional information.

LZA expects the policy to have been created in a previous execution. The solution creates a hash of the policy files and only create or update the policies if the policy has changed. Since the policy hasn't changed, the custom resource that would create the policy is not being called in the accounts stack. To force the policy to be created or updated, you can add an environment variable to the CodeBuild project, which will force the custom resource to be executed. Here are the steps to create the environment variable:

• Navigate to CodeBuild and go to the Build projects.
• Find the project where the name ends in 'ToolkitProject'.
• Select the project and click on the 'Edit' button.
• Scroll down to the Environment section and expand the 'Additional configuration' section.
• The name of the variable will be 'ACCELERATOR_FORCED_UPDATE' set the value to 'true'.
• Scroll down and click on the 'Update project' button.

Once the environment variable has been added. release the LZA pipeline. After the pipeline has executed successfully the environment variable can be removed or set the value to 'false'.

I hope this was helpful ! Let us know if this workaround works for you and if you have any further questions.

from landing-zone-accelerator-on-aws.