By using AWS re:Post, you agree to the AWS re:Post Terms of Use

Is it possible to deploy stack (using stack-set) to root/management account using root unique id (r-xxxxx)

0

I have an organisations account with delegated administration for stack operations. This account manages cloudformation stackset deployments for multiple OUs, and includes the root account under the root OU. [But we haven't created any stacksets for root account]

When I create a StackSet targeting the root OU (r-xxxx) intersecting root-account-id, the stack-set is created, but no stack instances are provisioned for root account and no stacks are created in root account. Is this the default behavior, and is it possible to create a stack in the root account from an organization account?

This is to deploy aws cloudintelligence dashboard to fetch aggregated CUR from root account.

1 Answer
1
Accepted Answer

Hi, Are you currently using service-managed permissions[1]? "The target accounts must be members of the AWS Organizations managed by the management account or delegated admin account."[3]. Try using self-managed permissions instead. You will need to create the execution IAM role in the root account yourself[2].

References

  1. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html
  2. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html
  3. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/service-managed-import.html
AWS
answered 3 months ago
profile picture
EXPERT
reviewed 3 months ago
profile picture
EXPERT
reviewed 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions