Management account as a StackSet target
It appears that StackSet ignores the management account when deployed in SERVICE_MANAGED mode.
However, I do not see this being a documented behaviour, although there are confirmations from others observing the same.
Is it possible to clarify this?
Is there a way for a StackSet to be deployed to the management account?
- Topics
- Management & Governance
- Language
- English
asked 2 years ago1.2K views
- Newest
- Most votes
- Most comments
This is possible. Enter the Management account ID as a StackSet target
There doesn't seem to be any way to do this through the SERVICE_MANAGED mode. The root OU ID cannot be used as it has invalid length, and the account cannot be specified directly. Not sure if there's a work around unless we can somehow import it into our managed stackset?
answered 2 years ago
as per documentation: Before you create a stack set with service-managed permissions, consider the following:
( ----)
StackSets doesn't deploy stack instances to the organization's management account, even if the management account is in your organization or in an OU in your organization.
(----)
If you need to deploy a stack to the management account, you would need to:
- Either use SELF_MANAGED permissions mode instead of SERVICE_MANAGED
- Or deploy the stack directly to the management account as a regular CloudFormation stack rather than through StackSets
answered 2 years ago
I do not have the option to deploy to accounts, only to Org or Org OU.
do you see "AccountFilterType" (INTERSECTION, DIFFERENCE, UNION, NONE) ?
INTERSECTION: StackSets deploys to the accounts specified in Accounts parameter.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudformation-stackset-deploymenttargets.html#aws-properties-cloudformation-stackset-deploymenttargets-properties
Yes, I do see those options, and I have tried them. It does not affect the management account; it works for every other account in the organization.