Skip to content

CDK fails to deploy SCP without a description #1613

@hertzsprung

Description

@hertzsprung

Trying to CDK deploy a Service Control Policy without a description gives an error "You must provide a value for the parameter." An SCP description is documented as "Required: Yes" but also "optional" at the same time. Presumably cdk-organizations needs to replace a null description value with an empty string?

For example (in Java):

Organization organization = Organization.Builder.create(this, "Organization").build();

Policy accountBaselineSCP = Policy.Builder.create(this, "AccountBaseline")
        .policyType(PolicyType.SERVICE_CONTROL_POLICY)
        .policyName("AccountBaseline")
        .content("""
                      {
                      "Version": "2012-10-17",
                      "Statement": [
                        {
                          "Effect": "Deny",
                          "Action": [
                            "organization:*",
                            "account:*"
                          ],
                          "Resource": "*"
                        }
                      ]
                    }""")
        //.description("Deny changes to baseline account configuration") // TODO: uncomment to allow CDK deploy to succeed
        .build();
organization.getRoot().attachPolicy(accountBaselineSCP);

Fairly sure we need to modify policy.ts to use Description: description ?? "" instead of Description: description, but I'll test locally before raising an MR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions