infrastructure-live-root-template: Runbooks Now Discover Accounts, Partition and Name Prefix

infrastructure-live-root-template is the Gruntwork template repository for an infrastructure-live-root setup, and it carries the runbooks used to bootstrap the related access control and delegated repositories. The only change this week is a big one: a feature commit that makes the runbooks look up AWS accounts, the partition and the name prefix from the AWS Organization. The repository had one commit in the window, touching 24 files.

Less typing in the bootstrap runbooks

Before this change, operators entered several values by hand. The commit moves three of them into a discovery step in discover-accounts.sh, which runs with management account credentials:

  • The AWS partition, read from the caller ARN (aws, aws-us-gov or aws-cn).
  • The name prefix, read from the management account’s state bucket.
  • The core accounts, with ID and root email from the Organization.

The script now writes AWSPartition and DiscoveredOrgNamePrefix to the runbook output next to the existing account data. The partition matters because generated IAM policies and pipelines config embed it. Deriving it from the credentials in use removes one way to get it wrong.

How the name prefix is detected

Terragrunt state buckets follow the pattern <name_prefix>-<account>-<region>-tf-state, lowercased. The script lists buckets and matches the management one:

aws s3api list-buckets --query 'Buckets[].Name' --output text
# matches <prefix>-management-<region>-tf-state

If exactly one prefix matches, it is used. If several match, or none, the script warns and the operator fills in the Org Name Prefix form field from name_prefix in the root repo’s common.hcl. There is one catch noted in the code comments: bucket names are lowercase, so a prefix written with capitals in common.hcl comes back lowercased. Enter it in the form to override.

The script also got stricter. If the Organization returns no root email for an account, it now stops with an error instead of carrying an empty value forward.

Restricted variants for no management access

Not everyone can call the management account. The commit adds two new runbooks for that case:

The restricted access control runbook says plainly that nothing in it calls AWS. Account IDs, root emails, the name prefix and the partition are typed in. The IDs and emails come from the root repository’s accounts.yml. Its tool check needs only git, curl, jq and boilerplate, so gh and glab are not required. Each variant has its own scripts, such as record-accounts.sh and get-repo-details.sh, so the two paths do not share fragile conditionals.

The runbook also covers Git authentication for GitHub or GitLab, including self hosted GitLab, where you enter the host so it is recognized.

Reworked standard runbooks

The existing bootstrap-access-control runbook was reworked to consume the discovered values. The delegated repo runbook was rewritten more heavily, and gained its own discover-accounts.sh. The generate scripts and verify-generated-repo.sh got small edits so they take the partition and prefix from the discovery output. The diff adds about 2,961 lines and removes 226, mostly from the new restricted runbooks.

What to watch

  • If you have multiple state buckets with different prefixes in the management account, expect the form field fallback.
  • Prefixes with capital letters in common.hcl need a manual override.
  • Pick the restricted runbook only when management access is truly unavailable. The standard one catches mistakes for you.
  • This is a template repo, so existing deployments are not changed. The effect shows up the next time you bootstrap.

← All updates