Currently, if you try to deploy this solution in a gov region which uses the us-gov-west-1 Organizations endpoint, the deployment fill fail as this package will only the allow the use of the us-east-1 and cn-northwest-1 Organization endpoints on lambda functions which use the Organizations SDK.
It will fail with an error stating that the security token is invalid whenever a custom resource
The security token included in the request is invalid
I found that most, if not all, lambda functions which back custom resources in this package will be provided the organizations endpoint to use form this piece of code. This code will limit the endpoint to either being "cn-northwest-1" or "us-east-1".
const organizationsRegion = process.env.CDK_AWS_PARTITION === "aws-cn" ? "cn-northwest-1" : "us-east-1";
This search of the repository shows each location where this code is defined. This issue may be resolved by updating the definition of the organizationsRegion variable everywhere it is defined to the following:
const organizationsRegion = process.env.CDK_AWS_PARTITION === "aws-cn" ? "cn-northwest-1" : process.env.CDK_AWS_PARTITION === "us-gov" ? "us-gov-west-1" : "us-east-1";
This will allow the package to correctly use the Organizations US Gov Cloud endpoint if the CDK_AWS_PARTITION environment variable is set to "us-gov".
Currently, if you try to deploy this solution in a gov region which uses the us-gov-west-1 Organizations endpoint, the deployment fill fail as this package will only the allow the use of the us-east-1 and cn-northwest-1 Organization endpoints on lambda functions which use the Organizations SDK.
It will fail with an error stating that the security token is invalid whenever a custom resource
I found that most, if not all, lambda functions which back custom resources in this package will be provided the organizations endpoint to use form this piece of code. This code will limit the endpoint to either being "cn-northwest-1" or "us-east-1".
This search of the repository shows each location where this code is defined. This issue may be resolved by updating the definition of the organizationsRegion variable everywhere it is defined to the following:
This will allow the package to correctly use the Organizations US Gov Cloud endpoint if the CDK_AWS_PARTITION environment variable is set to "us-gov".