account entry not in aft-request-metadata DynamoDB table and no AWSAFTExecution role is created. Any Idea ?

Question

While, Import existing AWS Control Tower accounts to Account Factory for Terraform, i am following these steps:
1. Created aft account request terraform file and pushed the code.
2. Expectation is to see the entry in Code Pipeline of AFT Management account
3. However since the entry was not there, started debugging and realised that in dynamo db, entry is there in aft-request and aft-request-audit table but not in aft-request-metadata table.
4. Also AWSAFTExecution IAM role was not created for the account.

Anyone has any idea on this ??

Answer

There are pre-requisites prior importing an account into AFT , Please check 'Troubleshooting account import in AFT' section in to https://aws.amazon.com/blogs/mt/import-existing-aws-control-tower-accounts-to-account-factory-for-terraform/
Also , check the troubleshooting guide https://docs.aws.amazon.com/controltower/latest/userguide/account-troubleshooting-guide.html and look for relevant GitHub issues on the AFT repository https://github.com/aws-ia/terraform-aws-control_tower_account_factory/issues.

account entry not in aft-request-metadata DynamoDB table and no AWSAFTExecution role is created. Any Idea ?

Contenido relevante