fix: #242 ensuring alias is set or raise error.

src/lambda_codebase/account_processing/configure_account_alias.py

@@ -22,8 +22,13 @@ def create_account_alias(account, iam_client):
     )
     try:
         iam_client.create_account_alias(AccountAlias=account.get("alias"))
-    except iam_client.exceptions.EntityAlreadyExistsException:
-        pass
+    except iam_client.exceptions.EntityAlreadyExistsException as error:
+        LOGGER.error(
+            """The account alias security already exists.
+            The account alias must be unique across all Amazon Web Services products.
+            Refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html#AboutAccountAlias"""
+        )
+        raise error
     return account
 
 

src/lambda_codebase/account_processing/tests/test_account_alias.py

@@ -2,24 +2,47 @@
 Tests the account alias configuration lambda
 """
 
+import unittest
 import boto3
 from botocore.stub import Stubber
+from botocore.exceptions import ClientError
 from aws_xray_sdk import global_sdk_config
 from ..configure_account_alias import create_account_alias
 
 global_sdk_config.set_sdk_enabled(False)
 
-# pylint: disable=W0106
-def test_account_alias():
-    test_account = {"account_id": 123456789012, "alias": "MyCoolAlias"}
-    iam_client = boto3.client("iam")
-    stubber = Stubber(iam_client)
-    create_alias_response = {}
-    stubber.add_response(
-        "create_account_alias", create_alias_response, {"AccountAlias": "MyCoolAlias"}
-    ),
-    stubber.activate()
+class SuccessTestCase(unittest.TestCase):
+    # pylint: disable=W0106
+    def test_account_alias(self):
+        test_account = {"account_id": 123456789012, "alias": "MyCoolAlias"}
+        iam_client = boto3.client("iam")
+        stubber = Stubber(iam_client)
+        create_alias_response = {}
+        stubber.add_response(
+            "create_account_alias", create_alias_response, {"AccountAlias": "MyCoolAlias"}
+        ),
+        stubber.activate()
 
-    response = create_account_alias(test_account, iam_client)
+        response = create_account_alias(test_account, iam_client)
 
-    assert response == test_account
+        self.assertEqual(response, test_account)
+
+class FailureTestCase(unittest.TestCase):
+    # pylint: disable=W0106
+    def test_account_alias_when_nonunique(self):
+        test_account = {"account_id": 123456789012, "alias": "nonunique"}
+        iam_client = boto3.client("iam")
+        stubber = Stubber(iam_client)
+        stubber.add_client_error(
+            'create_account_alias',
+            'EntityAlreadyExistsException',
+            'An error occurred (EntityAlreadyExists) when calling the CreateAccountAlias operation: The account alias nonunique already exists.'
+        )
+        stubber.activate()
+
+        with self.assertRaises(ClientError) as _error:
+            create_account_alias(test_account, iam_client)
+        self.assertRegex(
+            str(_error.exception),
+            r'.*The account alias nonunique already exists.*'
+        )

src/lambda_codebase/initial_commit/bootstrap_repository/adf-accounts/readme.md

@@ -38,7 +38,7 @@ The OU name is the name of the direct parent of the account. If you want to move
 - `support_level`: `basic|enterprise` ADF will raise a ticket to add the account to an existing AWS support subscription when an account is created. Currently only supports basic or enterprise.
  **NB: This is for activating enterprise support on account creation only. As a prerequisite your organization master account must already have enterprise support activated**
 
-- `alias`: AWS account alias. Must be unique globally otherwise cannot be created. Check [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html) for further details. If the account alias is not created or already exists, in the Federation login page, no alias will be presented
+- `alias`: AWS account alias. Must be unique globally otherwise cannot be created. Check [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html) for further details. If the account alias is not created or already exists, in the Federation login page, no alias will be presented. This needs to be unique across all customers, if the alias is already taken the AccountManagementStateMachine will stop and raise an error.
 - `tags`: list of tags associate to the account.
 
 ### Examples