Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GlobalConfig: ISnsConfig inconsistent documentation / functionality for snsTopics property #700

Open
6 tasks done
Flojolomo opened this issue Jan 24, 2025 · 2 comments
Open
6 tasks done
Labels
bug Something isn't working

Comments

@Flojolomo
Copy link

Flojolomo commented Jan 24, 2025

Describe the bug
The JSON Schema of global config does not define snsTopcis.topics as required. When deploying the configuration with snsTopics defined, but topics not set, validation fails.

snsTopics:
  deploymentTargets:
    organizationalUnits:
      - Root
  # topics:
  #   - name: Security
  #     emailAddresses:
  #       - dummy@test.com

To Reproduce

  • Change configuration of snsTopics to not include the property topics
homeRegion: &HOME_REGION eu-west-1
enabledRegions:
  - *HOME_REGION
managementAccountAccessRole: AWSControlTowerExecution
cloudwatchLogRetentionInDays: 30
terminationProtection: true
cdkOptions:
  centralizeBuckets: true
  useManagementAccessRole: true
snsTopics:
  deploymentTargets:
    organizationalUnits:
      - Root
  # This section causes the validation to fail
  # topics:
  #   - name: Security
  #     emailAddresses:
  #       - user@company.com
controlTower:
  enable: true
  landingZone:
    version: '3.3'
    logging:
      loggingBucketRetentionDays: 30
      accessLoggingBucketRetentionDays: 365
      organizationTrail: true
    security:
      enableIdentityCenterAccess: false
logging:
  account: LogArchive
  cloudtrail:
    enable: true
    organizationTrail: true
    organizationTrailSettings:
      multiRegionTrail: true
      globalServiceEvents: true
      managementEvents: true
      s3DataEvents: false
      lambdaDataEvents: false
      sendToCloudWatchLogs: true
      apiErrorRateInsight: false
      apiCallRateInsight: false
    accountTrails: []
  sessionManager:
    sendToCloudWatchLogs: false
    sendToS3: false
    lifecycleRules: []
  • Validate you configuration, either in the pipeline or locally
  • Validation fails
Image

Expected behavior

  • JSON Schema matches the actual validation
  • Validation fails with a helpful message to track down the root cause

Please complete the following information about the solution:

  • Version: release/v1.11.0
  • Region: eu-west-1 & eu-central-1
  • Was the solution modified from the version published on this repository? No
  • If the answer to the previous question was yes, are the changes available on GitHub?
  • Have you checked your service quotas for the services this solution uses? Not relevant
  • Were there any errors in the CloudWatch Logs? Warnings as part of the cloud build run

Screenshots
See screenshot above to reproduce the issue

@Flojolomo
Copy link
Author

Flojolomo commented Jan 24, 2025

#701 provides a fix of the schema. This will present a user friendly error message to users in case of failed validation.

Image

This improves the efficiency on tracking down the wrong configuration. One more doubt about the schema is that the property deploymentTargets is also optional. (See here)

If the property is not set, the validation succeeds but that leads to a failed deployment on the Logging & the Security_Resources actions.

@fdjahnke
Copy link
Contributor

fdjahnke commented Feb 4, 2025

Hello @Flojolomo , thank you for filing an issue with the Landing Zone Accelerator team! We are currently looking into the issue you've reported and will provide a status update as soon as possible.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants