Unable to init from cli about org-formation-reference HOT 5 CLOSED

It's not in the instructions, but I logged in as the SSO user, in which I clumsily added AdministratorAccess, but now it complains of OrganizationFormationBuildAccessRole... where does that come from?

(ins)hendry-tw-mbp~/orgtest/org-formation-reference$ npx org-formation update ./src/organization.yml --profile AdministratorAccess-381831929214 --verbose
WARN: ======================================
WARN: Hi there!
WARN: You just ran into an error when assuming the role OrganizationFormationBuildAccessRole in account 381831929214.
WARN: Possibly, this is due a breaking change in org-formation v0.9.15.
WARN: From v0.9.15 onwards the org-formation cli will assume a role in every account it deploys tasks to.
WARN: This will make permission management and SCPs to deny / allow org-formation tasks easier.
WARN: More information: https://github.com/org-formation/org-formation-cli/tree/master/docs/0.9.15-permission-change.md
WARN: Thanks!
WARN: ======================================
ERROR: error: AccessDenied, aws-request-id: 7835fcc5-0fa4-4e54-afc3-3734ae8f77c8
ERROR: User: arn:aws:sts::381831929214:assumed-role/AWSReservedSSO_AdministratorAccess_a6e0c532b831eac0/hendry is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::381831929214:role/OrganizationFormationBuildAccessRole

from org-formation-reference.

Hi, the first error was indeed because being logged in as the root user doesn't allow you to assume roles.

The second and the third error seem very similar: both are users that exist in the account "381831929214" that try to assume a role on that same account.

the error reads "is not authorized to perform", which to me would suggest that the user doesn't have the right permissions. though Administrator should (obviously) be more than enough.

would you be able to check:

1. whether the role OrganizationFormationBuildAccessRole exists
2. what the assume role policy is on this role
3. whether there are SCPs that would prevent you from assuming this role?

thanks in advance

from org-formation-reference.

That role doesn't exist, this is a fresh AWS account btw 😅

from org-formation-reference.

just rereading the steps:

• you have gone through all steps up to "5-initialize-org-formation"
• you got the error above on step 5.2 running https://github.com/org-formation/org-formation-reference#5-initialize-org-formation

it seems that you are missing the role that is created in step 5.3? maybe these step should be inverted?

from org-formation-reference.

To move forward, my colleague and I basically ignored this repo and went to https://github.com/org-formation/org-formation-cli#getting-started

We init and init-bootstrap using root credentials, and that's how we managed to get org-formation going.

from org-formation-reference.