diff --git a/modules/agentless-scanning/organizational.tf b/modules/agentless-scanning/organizational.tf index c02ea6b..f5c2cf9 100644 --- a/modules/agentless-scanning/organizational.tf +++ b/modules/agentless-scanning/organizational.tf @@ -191,12 +191,15 @@ TEMPLATE # stackset instance to deploy resources for agentless scanning, in all regions of each account in all organization units resource "aws_cloudformation_stack_set_instance" "ou_stackset_instance" { - for_each = var.is_organizational ? local.region_set : toset([]) - region = each.key + for_each = var.is_organizational ? { + for pair in setproduct(local.region_set, local.organizational_unit_ids) : + "${pair[0]}-${pair[1]}" => pair + } : {} + region = each.value[0] stack_set_name = aws_cloudformation_stack_set.ou_resources_stackset[0].name deployment_targets { - organizational_unit_ids = local.organizational_unit_ids + organizational_unit_ids = [each.value[1]] } operation_preferences { max_concurrent_percentage = 100 diff --git a/modules/config-posture/organizational.tf b/modules/config-posture/organizational.tf index 01e74f0..f4d5c18 100644 --- a/modules/config-posture/organizational.tf +++ b/modules/config-posture/organizational.tf @@ -88,12 +88,12 @@ TEMPLATE } resource "aws_cloudformation_stack_set_instance" "stackset_instance" { - count = var.is_organizational ? 1 : 0 + for_each = var.is_organizational ? toset(local.org_units_to_deploy) : [] region = var.region == "" ? null : var.region stack_set_name = aws_cloudformation_stack_set.stackset[0].name deployment_targets { - organizational_unit_ids = local.org_units_to_deploy + organizational_unit_ids = [each.value] } operation_preferences { max_concurrent_percentage = 100 diff --git a/modules/integrations/event-bridge/organizational.tf b/modules/integrations/event-bridge/organizational.tf index 53230e4..8ede7ee 100644 --- a/modules/integrations/event-bridge/organizational.tf +++ b/modules/integrations/event-bridge/organizational.tf @@ -103,12 +103,15 @@ TEMPLATE // stackset instance to deploy rule in all organization units resource "aws_cloudformation_stack_set_instance" "eb_rule_stackset_instance" { - for_each = var.is_organizational ? local.region_set : toset([]) - region = each.key + for_each = var.is_organizational ? { + for pair in setproduct(local.region_set, local.organizational_unit_ids) : + "${pair[0]}-${pair[1]}" => pair + } : {} + region = each.value[0] stack_set_name = aws_cloudformation_stack_set.eb-rule-stackset[0].name deployment_targets { - organizational_unit_ids = local.organizational_unit_ids + organizational_unit_ids = [each.value[1]] } operation_preferences { max_concurrent_percentage = 100 @@ -126,11 +129,11 @@ resource "aws_cloudformation_stack_set_instance" "eb_rule_stackset_instance" { // stackset instance to deploy role in all organization units resource "aws_cloudformation_stack_set_instance" "eb_role_stackset_instance" { - count = var.is_organizational ? 1 : 0 + for_each = var.is_organizational ? toset(local.organizational_unit_ids) : [] stack_set_name = aws_cloudformation_stack_set.eb-role-stackset[0].name deployment_targets { - organizational_unit_ids = local.organizational_unit_ids + organizational_unit_ids = [each.value] } operation_preferences { max_concurrent_percentage = 100 diff --git a/modules/onboarding/organizational.tf b/modules/onboarding/organizational.tf index 151e43f..97ec977 100644 --- a/modules/onboarding/organizational.tf +++ b/modules/onboarding/organizational.tf @@ -66,12 +66,12 @@ TEMPLATE } resource "aws_cloudformation_stack_set_instance" "stackset_instance" { - count = var.is_organizational ? 1 : 0 + for_each = var.is_organizational ? toset(local.org_units_to_deploy) : [] region = var.region == "" ? null : var.region stack_set_name = aws_cloudformation_stack_set.stackset[0].name deployment_targets { - organizational_unit_ids = local.org_units_to_deploy + organizational_unit_ids = [each.value] } operation_preferences { max_concurrent_percentage = 100 diff --git a/modules/vm-workload-scanning/organizational.tf b/modules/vm-workload-scanning/organizational.tf index e90edf0..a0c5c49 100644 --- a/modules/vm-workload-scanning/organizational.tf +++ b/modules/vm-workload-scanning/organizational.tf @@ -128,11 +128,11 @@ resource "aws_cloudformation_stack_set" "scanning_role_stackset" { # stackset instance to deploy agentless scanning role, in all organization units resource "aws_cloudformation_stack_set_instance" "scanning_role_stackset_instance" { - count = var.is_organizational ? 1 : 0 + for_each = var.is_organizational ? toset(local.organizational_unit_ids) : [] stack_set_name = aws_cloudformation_stack_set.scanning_role_stackset[0].name deployment_targets { - organizational_unit_ids = local.organizational_unit_ids + organizational_unit_ids = [each.value] } operation_preferences { max_concurrent_percentage = 100