AWS Service Catalog AWS Identity Provider Lost Visibility

Question

I previously setup a series of accounts under my organization using Control Tower. I was able to go into Service Catalog and see all of these accounts as provisioned products during this time.

Recently, I changed to an external Identity Provider (Good Workspace) and after syncing, it changed my user-name from something like `user-name` to `email.com`. Now I can't see any provisioned products that were created prior to the SSO change. However, I know they exist because when I go to create a new account with a name and email from a previously incomplete and errored out try, it tells me that account stack exists in teh Service Catalog provisioned products and I should go and delete it.

`AWS Control Tower cannot enroll the account. There's an error in the provisioned product in AWS Service Catalog: A stack named ???-???-??? already exists.`

I have tried looking in Config,  Organizations, hitting the CLI scan-provision-products under an admin and root user, they don't find anything. I only have one region as well.

Any help is appreciated <3

Andrew · Accepted Answer

Found my own answer. The products were there. I needed to change my access level (which is a dropdown on the screen) from User to Account

re:Post Agent · Answer

This situation you're experiencing is related to a change in your identity and access management setup, which has affected your visibility of previously provisioned products in AWS Service Catalog. When you switched to an external Identity Provider (IdP), in this case Good Workspace, it altered your user identity from a username format to an email format. This change has impacted your ability to view the provisioned products that were created before the Single Sign-On (SSO) change.

The error message you're receiving when trying to create a new account suggests that the previously provisioned products still exist in AWS Service Catalog, but you're unable to see them due to the change in your user identity.

To resolve this issue, you should consider the following steps:

1. Check your IAM permissions: Ensure that your new identity (email.com) has the necessary permissions to view and manage AWS Service Catalog products. You may need to update IAM policies to grant the required access to your new user identity.

2. Transfer ownership of provisioned products: If possible, try to transfer the ownership of the provisioned products to your new identity. AWS Service Catalog allows administrators to change the ownership of provisioned products. This feature is particularly useful when team members or responsibilities change.

3. Contact AWS Support: If you're unable to resolve the issue through IAM permissions or ownership transfer, it's advisable to contact AWS Support. They can help you investigate why the provisioned products are not visible and assist in recovering access to them.

4. Review Service Catalog API calls: Try using the AWS CLI or SDK to make direct API calls to Service Catalog using your new identity. This might provide more detailed information about the provisioned products that are not visible in the console.

5. Check CloudTrail logs: Review CloudTrail logs for any events related to the Service Catalog products around the time you changed to the external IdP. This might provide insights into any changes that occurred during the transition.

Remember, it's crucial to maintain consistent access and visibility to your AWS resources, especially when making changes to your identity management setup. In the future, consider planning for such transitions by ensuring that resource ownership and permissions are properly transferred or updated before making significant changes to your identity provider.  
**Sources**  
[AWS Service Catalog enables transfer of provisioned product ownership](https://aws.amazon.com/about-aws/whats-new/2019/10/aws-service-catalog-enables-transfer-of-provisioned-product-ownership/)  
[Managing provisioned products as the administrator - AWS Service Catalog](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/provisioned-products-admin.html)

AWS Service Catalog <> AWS Identity Provider Lost Visibility

Add your answer

Relevant content