Cross-account `smus` deploy fails in DataZone v2 domain config handler due to insufficient IAM auth after recent AWS service update

[sonorone]

Description
During a cross-account MDAA deployment the smus module fails when the DataZone v2 domain config custom resource runs.

Details

• The failing module is smus from @aws-mdaa/sagemaker.
• The error occurs in the CloudFormation custom resource Custom::DomainConfig inside domainconfig-handler.
• The Lambda fails with:
  • AccessDeniedException
  • ListDomainUnitsForParent
  • User is not permitted to perform operation: ListDomainUnitsForParent

Error

Stack: abc-dev-data-gov-smus-<TARGET_ACCOUNT_ID>
Changeset ARN: arn:aws:cloudformation::<TARGET_ACCOUNT_ID>:changeSet/cdk-deploy-change-set/<CHANGESET_ID>
Failure event:
CREATE_FAILED | Custom::DomainConfig | domainconfigparser...inConfigcr
Lambda error:
Error: An error occurred (AccessDeniedException) when calling the ListDomainUnitsForParent operation: User is not permitted to perform operation: ListDomainUnitsForParent
Lambda log path: /aws/lambda/abc-dev-data-gov-smus-domainconfig-handler

What this means

• The cross-deployment DataZone v2 domain config handler lambda does not have the required IAM permissions.
• It also appears not to have the correct authorization/auth context for the cross-account DataZone domain API call.

Reproduction

1. Run MDAA deploy with mdaa.yaml configured for hub account <HUB_ACCOUNT_ID> and additional_stacks: [{"account":"<TARGET_ACCOUNT_ID>"}]
2. Deploy module smus in domain <DOMAIN_NAME>
3. Observe failure during npx cdk deploy --all for the target account stack

Expected

• The DataZone domain config custom resource should succeed.
• The lambda should have permission to call ListDomainUnitsForParent and proper DataZone auth for cross-account deployment.

Notes

• This is code worked up unil mid-May. after some recent DataZone V2 service deployment.

mdaa.yaml

...
  data-gov:
    environments:
      dev:
        account: "{{context:hub_account}}"
        modules:
          # SageMaker Unified Studio domain
          smus:
            module_path: "@aws-mdaa/sagemaker"
            module_configs:
              - ./tsd-dg/smus-domain.yaml
            additional_accounts:
              - "{{context:pr_dae_account}}"

          smus-prof:
            module_path: "@aws-mdaa/sagemaker-project"
            module_configs:
              - ./tsd-dg/smus-project-profiles.yaml
...

smus-domain.ymal

domains:
  root:
    description: "SageMaker Unified Studio Hub"
    userAssignment: MANUAL
    dataAdminRole:
      id: ssm-org:/tsd-dg/generated-role/data-admin/id
    tooling:
      vpcId: "{{context:hub_vpc_id}}"
      subnetIds:
        - "{{context:hub_private_subnet_id1}}"
        - "{{context:hub_private_subnet_id2}}"

    groups:
      wkld1-data-admin:
        ssoId: "{{context:wkld1_admin_group_sso_id}}"

    # Associated workload account
    associatedAccounts:
      wkld1:
        account: "{{context:wkld1_account}}"
        createCdkUser: true
        cdkRoleArn: arn:aws:iam::{{context:wkld1_account}}:role/cdk-hnb659fds-cfn-exec-role-{{context:wkld1_account}}-ca-central-1
        # Tooling in workload account
        tooling:
          vpcId: "{{context:wkld1_vpc_id}}"
          subnetIds:
            - "{{context:wkld1_private_subnet_id1}}"
            - "{{context:wkld1_private_subnet_id2}}"

    domainUnits:
      business-teams:
        description: business-teams
        domainUnits:
          sub-domain1:
            description: Sub domain 1 desc
            ownerAccounts:
              - wkld1

            # mdaa 1.5.0 compatible only
            allowAllUsers: true
            allowedGroups:
              - wkld1-data-admin
            ownerGroups:
              - wkld1-data-admin
            authorizationPolicies:
              ProjectOwnershipAssumptionPolicy:
                policyType: OVERRIDE_PROJECT_OWNERS
                includeChildDomainUnits: true
                description: "Project Ownership Assumption Policy for Sub domain 1 desc"
                principals:
                - groupName: wkld1-data-admin    # 20260525 - no longer needed - error: authorization already exists
            # end


            # mdaa 1.6.0 compatible only
            authorizations:
              eligibleProjectMembers:
                all: false
            # end

workaround
run deployment with --no-rollback, then manually add IAM permissions to the domainconfig-handler IAM role in the spoke account
as well as manually domainconfig-handler iam role user profile on the SMUS domain

[guonengamazon]

Hi @sonorone ,

Thank you again for raising this issue. We are actively working on a fix. We will update you when we have a more concrete date of a fix release.

Thanks.

[guonengamazon]

Hi @sonorone ,
We have completed this fix with adding kms:GenerateDataKey to the IAM policy statement for the DomainConfig custom resource handler. It will be part of the next release scheduled for end of this month.

Thank you for your patience!