[BUG] [SM] Custom role creation failure on accounts with similar names

[cccssk]

Bug reports which fail to provide the required information will be closed without action.

Required Basic Info

• Accelerator Version: 1.5.1-a
• Install Type: Resource Add
• Upgrade from version: N/A
• Which State did the Main State Machine Fail in: Deploy Phase 1

Describe the bug
A custom role is created through the ASEA config.json in account stage. The role is created successfully. The same role is added to an account with the name like stage-03 and when run the state machine fails stating that the role already exists within the account.
No errors were observed when adding this same role to an account with a different name (ie stage to dev) only when the account names were similar (ie stage to stage-03). Also no errors were observed when adding the same role with only a different name to the same stage-03 account.

Failure Info

• What error messages have you identified, if any:
  Error: There is already a Construct with name 'IAM-Role-RoleName-AccountDev---' in IamAssets [IAM Assets-AccountDev_--]

• What symptoms have you identified, if any: likely due to the ASEA not using the full account name in the build phase

Required files

• If a CodeBuild step failed-
  buildlog-phase1-sanitized.txt

Steps To Reproduce

1. Create a custom IAM role through the ASEA config.json by running the state machine
2. Add that same role to account that has a similar name (ie stage and stage-03) in the config.json
3. Rerun the state machine which will fail on deploy phase 1

Expected behavior
The custom role to be created in the specified account

Additional context
Narrow context and likely will not effect many people depending on account and role names

[cccssk]

After further investigation it seems to be related to the OU's and you are not allowed to have roles with the same name in the same OU even if accounts are different

[Brian969]

In summary you are stating - 2 accounts, in the same ou, which have similar account-keys (which is typically identical to the account name), which have identical roles defined at the account level in the config file - then role creation fails?

• i.e. the default config file has identical roles defined at the account level, for accounts in the same OU, but their account names are clearly unique, and the issue does not exist.

Please confirm?

• Is the only difference between account-keys a dash, or is it a dash and a number, or when one contains the other: i.e. Dev-01 versus Dev01 or Dev to Dev01 or even Dev1 to Dev2?

Can you clarify the EXACT account names that you've confirmed to have the issue?

Thanks!

[cccssk]

I am now unsure if that account names matter, based on further testing and issues.

But yes 2 accounts in the same OU, which then have identical roles defined at the account level in the config, only one account is allowed to create the defined role. The role permissions do not matter only the role name.

Example:
Account-1 in OU central
Account-2 in OU central
Account-3 in OU Dev

All three accounts get the same role definition, only accounts 1 and 3 will be allowed to create that role with the state machine failing on the phase 1 build step. If accounts 1 and 2 have the same role permissions defined but slightly different names for the role then there will be no error and the state machine will complete and create all the roles.

I had thought I had tested OU's before but turns out I hadn't and they seem to be the actual root cause of the issue.