Deploying StackSets to OUs with nested OUs

Question

Hi. I'm trying to deploy a StackSet from the browser console. One target is an OU with a nested OU and an account. It works with no problem, the account in the nested OU is traversed and the stack is deployed to both accounts: the shallow one and the nested one in the child OU. 
But when I try to deploy it to an OU that has only OUs as children and no accounts it says that the Accounts list is empty. 
As there is defintely existing functionality to traverse nested OU accounts, the second case behaviour looks like a bug. Can it be fixed? Thanks

Answer

Hello there!

I have tested the use-case that you mentioned where deployments are made on an OU having only OUs as children but no accounts. However, I haven’t received any errors as such by doing so. Moreover if one or more child OUs are actually empty in the specified OU, there will be no errors thrown by CloudFormation and deploys to OUs that have accounts. (If auto deployment is enabled, for any new accounts added to the empty OUs targeted by the StackSets, a CREATE stack instance operation will be initiated).

Finally you can make use of [Account Filter Type] while deploying to have a much better control on deployments to limit deployment targets to individual accounts or include additional accounts with provided AWS Organizations units (OUs) with your Create, Update, or Delete operations.

[Account Filter Type]: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/account-level-targets.html#accountfiltertype

Deploying StackSets to OUs with nested OUs

関連するコンテンツ