Why Did the AWS Sub-Account Connection Script Fail?
PreviousHow Long Does It Take for Changes to My AWS Resources to Reflect in Archera?NextDoes Archera Support Multiple AWS Accounts in a Consolidated Billing Family?
Last updated
Was this helpful?
If the Bash script generated to help you connect your AWS sub-accounts to Archera using the role fails with an error message such as:
An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::000000000...The most likely issue is that the AWS sub-account was Invited to the AWS Organization and not created within the organization.
When an account is invited (as opposed to created), AWS does not automatically provide the pre-generated OrganizationAccountAccessRole that would allow the Master billing account to have permissions to assume a role in that account.
To fix this you will need to skip the Script and manually go through the process of connecting each sub-account by creating a custom IAM role in each sub-account that the Master account can assume.
Please reach out to our support team if you need additional help with this process.
Last updated
Was this helpful?
Was this helpful?