fix: Update ACCOUNT_NAME format in tenant-s3-nuke.sh#77
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the tenant S3 cleanup script’s AWS Organizations account name lookup to use a DNS-style account name derived from the tenant portion of the captain domain.
Changes:
- Change
ACCOUNT_NAMEfromtenant-$TENANT_NAMEto$TENANT_NAME.onglueops.rocksfor Organizations account lookup.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ACCOUNT_NAME="tenant-$TENANT_NAME" | ||
| ACCOUNT_NAME="$TENANT_NAME.onglueops.rocks" | ||
| SUB_ACCOUNT_ID=$(aws organizations list-accounts --output json | jq -r --arg ACCOUNT_NAME "$ACCOUNT_NAME" '.Accounts[] | select(.Name==$ACCOUNT_NAME) | .Id') | ||
|
|
There was a problem hiding this comment.
ACCOUNT_NAME is now derived from $TENANT_NAME.onglueops.rocks, which makes the Organizations lookup more brittle. If the computed account name doesn’t exactly match an account, SUB_ACCOUNT_ID becomes empty and the next assume-role call will construct an invalid ARN and fail with a confusing error. Add an explicit check after the list-accounts/jq selection to validate SUB_ACCOUNT_ID is non-empty and exit with a clear message showing the computed ACCOUNT_NAME (and optionally the provided CAPTAIN_DOMAIN_TO_NUKE).
| if [ -z "$SUB_ACCOUNT_ID" ]; then | |
| echo "Error: Could not find AWS account with name '$ACCOUNT_NAME'." | |
| echo " This name was derived from CAPTAIN_DOMAIN_TO_NUKE='$CAPTAIN_DOMAIN_TO_NUKE'." | |
| echo " Please verify the captain domain and the AWS Organizations account names." | |
| exit 1 | |
| fi |
| TENANT_NAME=${ADDR[1]} | ||
|
|
||
| ACCOUNT_NAME="tenant-$TENANT_NAME" | ||
| ACCOUNT_NAME="$TENANT_NAME.onglueops.rocks" |
There was a problem hiding this comment.
This change hard-codes the account naming suffix to .onglueops.rocks. Since the script accepts an arbitrary CAPTAIN_DOMAIN_TO_NUKE, passing a domain with a different base (or an extra subdomain level) will still compute ACCOUNT_NAME with .onglueops.rocks, likely causing the account lookup to fail. Consider deriving the base domain from CAPTAIN_DOMAIN (e.g., everything after the tenant label) or explicitly validating that the input ends with .onglueops.rocks before constructing ACCOUNT_NAME.
No description provided.