Control Tower dependency to other regions?

0

My customer wanted to launch the Control Tower in eu-west-1 but the launch failed. After he went through the support case, the identified problem was that the customer has disabled STS (in IAM) for all regions except eu-west-1 and the global one (us-east-1). He needed to additionally enable us-east-2 and us-west-2 regions.

He is asking why he needs to enable us-east-2 and us-west-2 for Control Tower when he is not using these regions? Is there some dependency that Control Tower has to these regions?

Thanks

已提問 4 年前檢視次數 539 次
1 個回答
0
已接受的答案

Control tower rolls out Guard rails in these 4 regions.

You can see this e.g. when you look at the Cloudformation StackSets in the CT payer account, like AWSControlTowerBP-BASELINE-CONFIG. This StackSet contains stack instances for every managed accounts in these 4 regions.

If STS is disabled in these regions then CloudFormation cannot assume the right role to deploy the template and therefore your account deployment / baselining will fail.

專家
已回答 4 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南