Support the SERVICE_MANAGED permission model for CloudFormation StackSets

[srikanthchelluri]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Currently, only the SELF_MANAGED permission model is supported by the aws_cloudformation_stack_set resource (it is the default). However, the SERVICE_MANAGED permission model is helpful when using StackSets to manage resources across an AWS Organization since it allows StackSet instances to target organizational units. But before changing the aws_cloudformation_stack_set_instance resource, the aws_cloudformation_stack_set resource needs to be updated to support the SERVICE_MANAGED permission model and configure AutoDeployment parameters.

New or Affected Resource(s)

• aws_cloudformation_stack_set

Potential Terraform Configuration

resource "aws_cloudformation_stack_set" "accept_guardduty" {
  provider = aws.us-east-1

  name             = "AcceptGuardDuty"
  description      = "Creates an AWS::GuardDuty::Detector resource and optionally an AWS::GuardDuty::Master resource in a set of accounts and regions."
  permission_model = "SERVICE_MANAGED"
  template_body    = local.stack_set_accept_guardduty_template_body

  auto_deployment {
    enabled                          = true
    retain_stacks_on_account_removal = false
  }

  parameters = {
    MasterId = local.infosec_aws_account_id
  }
}

References

• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-enable-trusted-access.html
• https://docs.aws.amazon.com/sdk-for-go/api/service/cloudformation/#CreateStackSetInput

[gespinoza22]

any word on when someone will get assigned to this?

[piersf]

@gespinoza22 CloudFormation released support for this last month if you happen to use also CloudFormation.

[chrisjaimon2012]

Any updates on this?

[rclark]

I found a workaround that helps while there's not direct terraform support: Use terraform to create a cloudformation stack in the organization's management account (terraform docs). This stack defines an AWS::CloudFormation::StackSet with SERVICE_MANAGED permissions model (cloudformation docs).

This launches the stack set indirectly via terraform apply, using only credentials in the management account, without the need for concern over how #12423 would need additional modification of the aws_cloudformation_stack_set_instance terraform resource.

[ghost]

This has been released in version 3.35.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!