Important
We highly recommend that you keep your environments up to date by upgrading to the latest version. See Update the solution for the required actions to upgrade. The Landing Zone Accelerator on AWS is designed and tested to work with the latest versions of Service Control Policies (SCPs) from the LZA Universal Configuration and the LZA CCCS Medium Configuration. Please review the latest changes in these repositories to ensure your SCPs align with the latest changes.
Bug Fixes
Central Logs Bucket Policy Validation in Opt-In Regions
The central logs S3 bucket policy now uses a condition-based statement for opt-in region Amazon Macie and Amazon GuardDuty service principals. Previously, when an opt-in region was included in enabledRegions but was not activated, LoggingStack failed validation with an invalid-principal error. The policy now scopes these service principals with a condition so the stack deploys correctly whether or not the opt-in region is activated.
Route 53 Query Logging for LZA-Created VPCs in ASEA-Imported Accounts
Fixed Route 53 Resolver query log handling so that LZA-created VPCs in ASEA-imported accounts receive a query-log configuration and its SSM parameter. Previously the association loop stopped at the first ASEA-managed VPC, so any LZA-created VPC ordered after it was skipped.
Account State Handling
LZA now uses the AWS Organizations account State field to determine deployment targets. Non-ACTIVE accounts are excluded from deployment targets, and uninstaller cleanup is limited to ACTIVE and PENDING_CLOSURE accounts. Legacy Status compatibility is retained.
SDK-Based Modules Honor cdkOptions.customDeploymentRole for Cross-Account Operations
Starting in 1.16.2, when cdkOptions.customDeploymentRole is set (and cdkOptions.useManagementAccessRole is not true), SDK-based modules assume that role for cross-account operations. Previously they always used managementAccountAccessRole.
If LZA creates the deployment role (default), no action is needed. It already has the required trust and permissions.
Action required only if you bring your own role (cdkOptions.useExistingRoles: true): before upgrading, make sure that role (1) trusts the module-runner principal so it can be assumed, and (2) grants the actions each enabled module needs (see MODULE_SESSION_POLICIES and the Bootstrap docs). Otherwise module execution fails with AccessDenied.
useManagementAccessRole: true is unchanged and continues to use managementAccountAccessRole.
Changes
Dependency Vulnerability Remediation
Resolved HIGH severity vulnerabilities in dependencies, including updates to pacote and tar.
Additional Resources
For full details, please see the CHANGELOG.