Solved

Issue with Lucidscale cloudformation import with an AWS Org with multiple OU's

Forum|Forum|1 year ago
June 20, 2025
12 replies
279 views

i’m trying to run the cloudformation ‘configure permissions with cloudformation’ to deploy the necessary resources in my AWS organization. I have a single account as the master payer and then over 30 accounts in various OU’s. I need to be able to use Lucidscale to create documentation of each account in these multiple OU’s.

I’m getting a failure on the deployment of this initial stackset. “Properties validation failed for resource MemberRoleStackSet with message: [#/StackInstancesGroup/0/DeploymentTargets/OrganizationalUnitIds/0: string [usedmyorgnazitional ID] does not match pattern ^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})$]

I need to discover all accounts which reside in multiple OU’s. Nothing i’ve tried has helped with this. Any help? What should go in the parameters for

BastionRootOrOrganizationalUnitId\
MembersRootOrOrganizationalUnitId

Best answer by Humas1985

Hi @sean.kaminsk

The error sounds from an invalid or missing IAM role principal in the trust policy.

Kindly ensure the referenced role exists in the correct account, has fully propagated, and that trust relationships are configured according to Lucidscale’s workflow rules listed.

This is a usual us what i see with in multi-account, multi-OU AWS Organization setups.

Best Regards

Show previous replies

Nicolas S.

Hi Sean, we also used a workaround. We use YAML for our CloudFormation deployments so we had to recreate everything (LucidOrgImportMemberAccountStackSet, BastionRoleStackSet, MemberRoleStackSet and the ResourcePolicy stack).

Seems like the problem is in the array containing the principal, indeed.

The YAMLs are adapted to our pipelines. They work, but need more parameters.

Import

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  LucidAccountId:
    Description: The Lucid AWS account that will assume the role for resource imports
    Type: String
  LucidExternalId:
    Description: The externalId generated by Lucid
    Type: String
  BastionRootOrOrganizationalUnitId:
    Description: The id of the organizational unit or root containing the bastion account.
    Type: String
  MembersRootOrOrganizationalUnitId:
    Description: The id of the organizational unit or root containing the member accounts.
    Type: String
  BastionAccountId:
    Description: The account acting as the main entrypoint for cloud import
    Type: String
  BastionRoleName:
    Description: The name of the role that will be assumed in the bastion account
    Type: String
    Default: lucid-import-bastion-role
  MemberRoleName:
    Description: The name of the role that will be assumed in member accounts
    Type: String
    Default: lucid-import-account-role
  ArtifactsUrl:
    Type: String
    Description: '(Required) The URL for the artifacts source'
    AllowedPattern: "https?:\\/\\/(([a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.){0,}([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9]){1,}(:[0-9]{1,5})?((\\/[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9]))*"
  Release:
    Type: String
    Description: Release identifier
    AllowedPattern: "(develop|master)|(((feat\\/)|((((rls\\/rc?_)|(hf\\/)|(mnto\\/))([0-9]+\\.){1,2}[0-9])+_?))([A-Za-z0-9_\\-]+)?)"
    ConstraintDescription: 'Must specity release identifier, for example: master, develop, 1.0.5-rc, 1.0.5 or 1.0.5.1'
Resources:
  BastionRoleStackSet:
    Type: AWS::CloudFormation::StackSet
    DeletionPolicy: Retain
    Properties:
      StackSetName: !Sub 'LucidOrgImportBastionAccountStackSet-${Release}'
      Description: Lucid stackset for importing resources from multiple AWS accounts in an organization.
      PermissionModel: SERVICE_MANAGED
      Capabilities:
        - CAPABILITY_NAMED_IAM
      CallAs: DELEGATED_ADMIN
      AutoDeployment:
        Enabled: true
        RetainStacksOnAccountRemoval: true
      StackInstancesGroup:
        - DeploymentTargets:
            OrganizationalUnitIds:
              - !Ref BastionRootOrOrganizationalUnitId
            AccountFilterType: INTERSECTION
            Accounts:
              - !Ref BastionAccountId
          Regions:
            - us-east-1
      ManagedExecution:
        Active: true
      Tags:
        - Key: Lucid
          Value: CloudImport
      Parameters:
        - ParameterKey: LucidAccountId
          ParameterValue: !Ref LucidAccountId
        - ParameterKey: LucidExternalId
          ParameterValue: !Ref LucidExternalId
        - ParameterKey: BastionRoleName
          ParameterValue: !Ref BastionRoleName
        - ParameterKey: MemberRoleName
          ParameterValue: !Ref MemberRoleName
      TemplateURL: !Sub '${ArtifactsUrl}/AWS_Lucidscale/${Release}/cloudformation/bastion.yaml'
  MemberRoleStackSet:
    Type: AWS::CloudFormation::StackSet
    DeletionPolicy: Retain
    DependsOn: BastionRoleStackSet
    Properties:
      StackSetName: !Sub 'LucidOrgImportMemberAccountStackSet-${Release}'
      Description: Lucid stackset set for importing resources from multiple AWS accounts in an organization.
      PermissionModel: SERVICE_MANAGED
      Capabilities:
        - CAPABILITY_NAMED_IAM
      CallAs: DELEGATED_ADMIN
      AutoDeployment:
        Enabled: true
        RetainStacksOnAccountRemoval: true
      StackInstancesGroup:
        - DeploymentTargets:
            OrganizationalUnitIds:
              - !Ref MembersRootOrOrganizationalUnitId
          Regions:
            - us-east-1
      ManagedExecution:
        Active: true
      Tags:
        - Key: Lucid
          Value: CloudImport
      Parameters:
        - ParameterKey: BastionAccountId
          ParameterValue: !Ref BastionAccountId
        - ParameterKey: BastionRoleName
          ParameterValue: !Ref BastionRoleName
        - ParameterKey: MemberRoleName
          ParameterValue: !Ref MemberRoleName
      TemplateURL: !Sub '${ArtifactsUrl}/AWS_Lucidscale/${Release}/cloudformation/member.yaml'

Bastion

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  LucidAccountId:
    Description: The Lucid AWS account that will assume the role for resource imports
    Type: String
  LucidExternalId:
    Description: The externalId generated by Lucid
    Type: String
  BastionRoleName:
    Description: The name of the role that will be assumed in the bastion account
    Type: String
    Default: lucid-import-bastion-role
  MemberRoleName:
    Description: The name of the role that will be assumed in member accounts
    Type: String
    Default: lucid-import-account-role
Resources:
  BastionAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref BastionRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AssumeRolePolicy
            Effect: Allow
            Principal:
              AWS: !Ref LucidAccountId
            Action: 'sts:AssumeRole'
            Condition:
              StringEquals:
                'sts:ExternalId': !Ref LucidExternalId
      Path: '/'
  BastionAccountRolePolicy:
    Type: AWS::IAM::Policy
    DependsOn: BastionAccountRole
    Properties:
      PolicyName: LucidImportBastionPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'organizations:DescribeAccount'
              - 'organizations:DescribeOrganization'
              - 'organizations:DescribeOrganizationalUnit'
              - 'organizations:ListAccounts'
              - 'organizations:ListAccountsForParent'
              - 'organizations:ListChildren'
              - 'organizations:ListOrganizationalUnitsForParent'
              - 'organizations:ListParents'
              - 'organizations:ListRoots'
            Resource: '*'
          - Effect: Allow
            Action:
              - 'sts:AssumeRole'
            Resource: !Sub 'arn:aws:iam::*:role/${MemberRoleName}'
      Roles:
        - !Ref BastionRoleName

Member

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BastionAccountId:
    Description: The account acting as the main entrypoint for cloud import
    Type: String
  BastionRoleName:
    Description: The name of the role that will be assumed in the bastion account
    Type: String
  MemberRoleName:
    Description: The name of the role that will be assumed in member accounts
    Type: String
    Default: lucid-import-account-role
Resources:
  MemberAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref MemberRoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AssumeRolePolicy
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${BastionAccountId}:role/${BastionRoleName}'
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/ReadOnlyAccess'
      Path: '/'

Policy

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BastionAccountId:
    Description: The account acting as the main entrypoint for cloud import
    Type: String
Resources:
  ResourcePolicy:
    DeletionPolicy: Retain
    Type: AWS::Organizations::ResourcePolicy
    Properties:
      Content:
        Version: '2012-10-17'
        Statement:
          - Sid: DelegatedOrganizationsRead
            Effect: Allow
            Principal:
              AWS: !Sub 'arn:aws:iam::${BastionAccountId}:root'
            Action:
              - 'organizations:ListAccounts'
              - 'organizations:ListAccountsForParent'
              - 'organizations:ListChildren'
              - 'organizations:ListParents'
              - 'organizations:ListRoots'
              - 'organizations:DescribePolicy'
              - 'organizations:DescribeOrganizationalUnit'
              - 'organizations:DescribeOrganization'
              - 'organizations:DescribeAccount'
              - 'organizations:ListOrganizationalUnitsForParent'
            Resource: '*'

Leianne C

Lucid support team

Hi @sean.kaminsk @Nicolas S., thank you for taking the time to share your workarounds. We have passed this information on to our engineering team and will update this thread if we have any additional information.

Please let us know if you have any questions in the meantime -- we are happy to help!

Create an account in the community

Log in to the community