Principal not found

[petabook]

I'm deploying for the first time on actual AWS.
Did deploy/organization deploy/accounts and deploy/account-settings.
Got this error, fixed it and now I'm getting this:

$ atmos workflow deploy -f baseline
...
...
...
OpenTofu will perform the following actions:

  # module.ecr.aws_ecr_repository_policy.name["quanthealthlabs/system-cloud-aws"] will be created
  + resource "aws_ecr_repository_policy" "name" {
      + id          = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = [
                          + "ecr:ListTagsForResource",
                          + "ecr:ListImages",
                          + "ecr:GetRepositoryPolicy",
                          + "ecr:GetLifecyclePolicyPreview",
                          + "ecr:GetLifecyclePolicy",
                          + "ecr:GetDownloadUrlForLayer",
                          + "ecr:DescribeRepositories",
                          + "ecr:DescribeImages",
                          + "ecr:DescribeImageScanFindings",
                          + "ecr:BatchGetImage",
                          + "ecr:BatchCheckLayerAvailability",
                        ]
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::979433137235:root",
                              + "arn:aws:iam::877030647336:root",
                              + "arn:aws:iam::762723916032:root",
                              + "arn:aws:iam::612830574267:root",
                            ]
                        }
                      + Sid       = "ReadonlyAccess"
                    },
                  + {
                      + Action    = "ecr:*"
                      + Effect    = "Allow"
                      + Principal = {
                          + AWS = [
                              + "arn:aws:iam::218289152745:role/qh-core-gbl-identity-devops",
                              + "arn:aws:iam::218289152745:role/qh-core-gbl-identity-developers",
                              + "arn:aws:iam::103975338231:role/qh-core-gbl-auto-poweruser",
                              + "arn:aws:iam::103975338231:role/qh-core-gbl-auto-admin",
                            ]
                        }
                      + Sid       = "FullAccess"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + registry_id = (known after apply)
      + repository  = "quanthealthlabs/system-cloud-aws"
    }

Plan: 1 to add, 0 to change, 0 to destroy.
...
...
...
│ Error: putting ECR Repository Policy (quanthealthlabs/system-cloud-aws): operation error ECR: SetRepositoryPolicy, https response error StatusCode: 400, RequestID: 09521819-f1c9-425e-9b10-60b92c596728, InvalidParameterException: Invalid parameter at 'PolicyText' failed to satisfy constraint: 'Principal not found'
│ 
│   with module.ecr.aws_ecr_repository_policy.name["quanthealthlabs/system-cloud-aws"],
│   on .terraform/modules/ecr/main.tf line 232, in resource "aws_ecr_repository_policy" "name":
│  232: resource "aws_ecr_repository_policy" "name" {
│ 

[petabook]

Indeed the roles do not exist.

[milldr]

As a tip, we updated the order of operations a bit to improve this deployment. Primarily there were 2 issues:

1. First ECR had a few requirements for its policy, such as the AWS team roles, so we moved it to later on in the process.

See docs PR for reference and make this change to your workflow:

dont forget to change the environment to your default

# stacks/workflows/baseline.yaml
       - command: workflow vendor -f baseline
       - command: workflow init/tfstate -f baseline
       - command: workflow deploy/tfstate -f baseline
-      - command: workflow deploy -f baseline
+      - command: workflow deploy/cloudtrail -f baseline
+      - command: workflow deploy/ecr -f baseline
 
   vendor:
     description: Vendor baseline layer components.
 @@ -36,9 +37,13 @@ workflows:
     steps:
       - command: terraform deploy tfstate-backend --stack core-use1-root
 
-  deploy:
+  deploy/cloudtrail:
     description: Start AWS Cloudtrail in audit and root accounts to track changes across the org.
     steps:
       - command: terraform deploy cloudtrail-bucket -s core-use1-audit
       - command: terraform deploy cloudtrail -s core-gbl-root
 
+  deploy/ecr:
+    description: Deploy ECR in the artifacts account to use as our container registry
+    steps:
       - command: terraform deploy ecr -s core-use1-artifacts

here's the whole thing

workflows:
  all:
    description: run all workflows
    steps:
      - command: workflow vendor -f baseline
      - command: workflow init/tfstate -f baseline
      - command: workflow deploy/tfstate -f baseline
      - command: workflow deploy/cloudtrail -f baseline
      - command: workflow deploy/ecr -f baseline

  vendor:
    description: Vendor baseline layer components.
    steps:
      - command: vendor pull --component account
      - command: vendor pull --component account-map
      - command: vendor pull --component account-quotas
      - command: vendor pull --component account-settings
      - command: vendor pull --component cloudtrail
      - command: vendor pull --component cloudtrail-bucket
      - command: vendor pull --component ecr
      - command: vendor pull --component tfstate-backend

  init/tfstate:
    description: Provision Terraform State Backend for initial deployment.
    steps:
      - command: terraform deploy tfstate-backend -var=access_roles_enabled=false --stack core-use1-root --auto-generate-backend-file=false
      - command: until aws s3 ls acme-core-use1-root-tfstate; do sleep 5; done
        type: shell
      - command: terraform deploy tfstate-backend -var=access_roles_enabled=false --stack core-use1-root --init-run-reconfigure=false

  deploy/tfstate:
    description: >-
      Deploy Terraform State Backend.

      Finalize Terraform State Backend access, which requires AWS Teams to be deployed first.
    steps:
      - command: terraform deploy tfstate-backend --stack core-use1-root

  deploy/cloudtrail:
    description: Start AWS Cloudtrail in audit and root accounts to track changes across the org.
    steps:
      - command: terraform deploy cloudtrail-bucket -s core-use1-audit
      - command: terraform deploy cloudtrail -s core-gbl-root

  deploy/ecr:
    description: Deploy ECR in the artifacts account to use as our container registry
    steps:
      - command: terraform deploy ecr -s core-use1-artifacts

2. Second, we use the GitHub OIDC provider later on with GitHub Actions for Atmos + Terraform but may not have the provider deployed yet. So any policy the enabled github action roles will fail until the provider is deployed

There are a few places where the policy is enabled, but in particular:

# stacks/catalog/aws-teams.yaml
components:
  terraform:
    aws-teams:
      settings:
        github:
          actions_enabled: false
      vars:
        #
        # Uncomment the following to enable GitOps for the GitHub Actions workflow.
        # This requires the `github-oidc-provider` to be deployed.
        # Please see https://docs.cloudposse.com/layers/gitops/setup/#-authentication-prerequisites
        #
        # trusted_github_repos:
        #   gitops:
        #   - "cloudposse-examples/example_repo_eks_argocd_gitops_compliance:main"
        #   planners:
        #     - "cloudposse-examples/example_repo_eks_argocd_gitops_compliance"
...

Plus eks/cluster and ecr will also refer to the GitHub OIDC provider when github_actions_iam_role_enabled: true, but with the updated order of operations, the provider should be ready by the time you deploy these 2 components.