How to Handle Account Alias Collision in account-settings Component Without Changing Short Code?

[trungie]

We're deploying the account-settings component from the reference architecture..

atmos terraform deploy account-settings -s core-gbl-audit

We encountered the following error:

Error: creating account alias with name 'fb-core-gbl-audit': operation error IAM: CreateAccountAlias, https response error StatusCode: 409, RequestID: ..., EntityAlreadyExists: The account alias fb-core-gbl-audit already exists.

Context:

• We have manually verified across all our AWS accounts that this alias is not in use.
• It seems someone else outside our org (possibly using the same reference architecture or default config) already claimed it.

Questions:

1. Is there a way to override the default alias with a custom one, such as adding a suffix (e.g. -2), while keeping the rest of the component behavior intact?
2. If overriding is not possible, can we disable alias creation altogether? If so, what downstream impacts should we be aware of—especially regarding cost and billing naming, where I believe the alias might be used?
3. Would introducing a variable like alias_suffix (or a toggle) make sense in this module for multi-tenant scenarios like ours?

Thanks!

[Benbentwo]

So for the alias problem, I haven't been able to find an instance where we actually require it just yet. I'll keep investigating and see if someone else on the team knows. So this shouldn't be a problem immediately. The hiccup though is account settings are used for quotas and some other nice to haves.

Is there a way to override the default alias with a custom one, such as adding a suffix (e.g. -2), while keeping the rest of the component behavior intact?

Yes! Since the account settings module (what creates the account alias) is using module.this.id attributes, a part of our null-label. The null label module is our naming convention which is how everything gets it's name built and calculated.

I think you should be able to add an attribute like

components:
  terraform:
    account-settings:
      vars:
        attributes:
          - "foo"

This should append foo on the end.
These docs might help explain the null label a bit more.

If overriding is not possible, can we disable alias creation altogether? If so, what downstream impacts should we be aware of—especially regarding cost and billing naming, where I believe the alias might be used?

Let me look a bit more into this, I don't see any datasources of account alias but maybe theres some references some other way.

Would introducing a variable like alias_suffix (or a toggle) make sense in this module for multi-tenant scenarios like ours?

The attributes should work but if it doesn't then modifying the submodule that creates the alias is our best bet to allow overrides.
cloudposse/terraform-aws-iam-account-settings

[trungie]

I might try the attribute approach, thanks!