fix: assume role on added member account (#434)

awslabs · Apr 8, 2021 · baa19f8 · baa19f8
1 parent 9aafaff
commit baa19f8
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,11 @@
 All notable changes to this project will be documented in this file.
 
 
+## [2.1.5] - 2021-04-08
+
+### Added
+- fix: assume role on added member account
+
 ## [2.1.4] - 2021-04-06
 
 ### Added

diff --git a/main/solution/backend/config/infra/cloudformation.yml b/main/solution/backend/config/infra/cloudformation.yml
@@ -426,8 +426,8 @@ Resources:
               - 'arn:aws:iam::*:role/SC-*'
               - 'arn:aws:iam::*:role/swb-*'
               - 'arn:aws:iam::*:role/analysis-*'
-              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
-              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*-xacc-env-mgmt'
+              - !Sub 'arn:aws:iam::*:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
+              - !Sub 'arn:aws:iam::*:role/*-xacc-env-mgmt'
           - Effect: Allow
             Action:
               - logs:CreateLogGroup
@@ -582,8 +582,8 @@ Resources:
               - 'arn:aws:iam::*:role/SC-*'
               - 'arn:aws:iam::*:role/analysis-*'
               - 'arn:aws:iam::*:role/swb-*'
-              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
-              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/*-xacc-env-mgmt'
+              - !Sub 'arn:aws:iam::*:role/*-cross-account-role' # This is required since when users onboard the main account as a member account, the onboard CFN stack would also reside there
+              - !Sub 'arn:aws:iam::*:role/*-xacc-env-mgmt'
           - Effect: Allow
             Action:
               - logs:CreateLogGroup