You specified an unrecognized service principal: stacksets.cloudformation.amazonaws.com

[dannysteenman]

When I try enabling trusted access with AWS CloudFormation Stacksets: https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-cloudformation.html

organization.enableAwsServiceAccess('stacksets.cloudformation.amazonaws.com');

I get the following error in cloudformation:

Received response status [FAILED] from custom resource. Message returned: You specified an unrecognized service principal. (RequestId: c1fee8a1-15d0-4521-8519-26c9cf0dda6b)

[martinjlowm]

Hey Danny - try member.org.stacksets.cloudformation.amazonaws.com

[dannysteenman]

yes it works, thanks @martinjlowm!

[dannysteenman]

the deploy succeeds but it doesn't provide the management account access to deploy stacksets. I got this issue when I try to deploy the stackset:

Resource handler returned message: "You must enable organizations access to operate a service managed stack set (Service: CloudFormation, Status Code: 400, Request ID: ceb2bfdf-8536-45ec-9698-55ddc53e5144)" (RequestToken: 4c550b38-dd1c-4262-5cb9-65b2b2b83e9d, HandlerErrorCode: InvalidRequest)

CloudFormation references the following docs:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html

I fixed it by deploying the following custom resource to activate the stackset trusted access:

    new cr.AwsCustomResource(this, 'TrustedAccessCloudFormationStackSets', {
      policy: cr.AwsCustomResourcePolicy.fromStatements([
        new iam.PolicyStatement({
          actions: [
            'cloudformation:ActivateOrganizationsAccess',
            'cloudformation:DeactivateOrganizationsAccess',
            'iam:CreateServiceLinkedRole',
            'iam:GetRole',
            'organizations:DescribeOrganization',
            'organizations:DisableAWSServiceAccess',
            'organizations:EnableAWSServiceAccess',
            'organizations:ListAWSServiceAccessForOrganization',
          ],
          resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
        }),
      ]),
      onUpdate: {
        service: 'CloudFormation',
        action: 'activateOrganizationsAccess',
        physicalResourceId: cr.PhysicalResourceId.of('trusted-access-cloudformation-stacksets'),
      },
      onDelete: {
        service: 'CloudFormation',
        action: 'deactivateOrganizationsAccess',
        physicalResourceId: cr.PhysicalResourceId.of('trusted-access-cloudformation-stacksets'),
      },
    });