fix: Prefer accountId for AwsOrganizationCloudAccountProcessor authentication

Signed-off-by: Ooi Yee Fei <yeefeiooi@gmail.com>

.changeset/swift-kings-sparkle.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-aws': patch
+---
+
+AwsOrganizationCloudAccountProcessor configuration field roleArn is deprecated in favor of new field accountId

plugins/catalog-backend-module-aws/config.d.ts

@@ -26,8 +26,14 @@ export interface Config {
         provider: {
           /**
            * The role to be assumed by this processor
+           * @deprecated Use `accountId` instead.
            */
           roleArn?: string;
+
+          /**
+           * The AWS account ID to query for organizational data
+           */
+          accountId?: string;
         };
       };
     };

plugins/catalog-backend-module-aws/src/awsOrganization/config.test.ts

@@ -22,11 +22,13 @@ describe('readAwsOrganizationConfig', () => {
     const config = {
       provider: {
         roleArn: 'aws::arn::foo',
+        accountId: '111111111111',
       },
     };
     const actual = readAwsOrganizationConfig(new ConfigReader(config));
     const expected = {
       roleArn: 'aws::arn::foo',
+      accountId: '111111111111',
     };
     expect(actual).toEqual(expected);
   });

plugins/catalog-backend-module-aws/src/awsOrganization/config.ts

@@ -24,6 +24,11 @@ export type AwsOrganizationProviderConfig = {
    * The role to assume for the processor.
    */
   roleArn?: string;
+
+  /**
+   * The AWS accountId
+   */
+  accountId?: string;
 };
 
 export function readAwsOrganizationConfig(
@@ -32,7 +37,9 @@ export function readAwsOrganizationConfig(
   const providerConfig = config.getOptionalConfig('provider');
 
   const roleArn = providerConfig?.getOptionalString('roleArn');
+  const accountId = providerConfig?.getOptionalString('accountId');
   return {
     roleArn,
+    accountId,
   };
 }

plugins/catalog-backend-module-aws/src/processors/AwsOrganizationCloudAccountProcessor.ts

@@ -59,10 +59,18 @@ export class AwsOrganizationCloudAccountProcessor implements CatalogProcessor {
   static async fromConfig(config: Config, options: { logger: LoggerService }) {
     const c = config.getOptionalConfig('catalog.processors.awsOrganization');
     const orgConfig = c ? readAwsOrganizationConfig(c) : undefined;
+
+    if (orgConfig?.roleArn) {
+      options.logger.warn(
+        'The roleArn configuration for AwsOrganizationCloudAccountProcessor ignores the role name, use accountId configuration instead',
+      );
+    }
+
     const awsCredentialsManager =
       DefaultAwsCredentialsManager.fromConfig(config);
     const credProvider = await awsCredentialsManager.getCredentialProvider({
       arn: orgConfig?.roleArn,
+      accountId: orgConfig?.accountId,
     });
     return new AwsOrganizationCloudAccountProcessor(
       credProvider,
@@ -98,23 +106,27 @@ export class AwsOrganizationCloudAccountProcessor implements CatalogProcessor {
 
     this.logger?.info('Discovering AWS Organization Account objects');
 
-    (await this.getAwsAccounts())
-      .map(account => this.mapAccountToComponent(account))
-      .filter(entity => {
-        if (location.target !== '') {
-          if (entity.metadata.annotations) {
-            return (
-              entity.metadata.annotations[ORGANIZATION_ANNOTATION] ===
-              location.target
-            );
+    try {
+      (await this.getAwsAccounts())
+        .map(account => this.mapAccountToComponent(account))
+        .filter(entity => {
+          if (location.target !== '') {
+            if (entity.metadata.annotations) {
+              return (
+                entity.metadata.annotations[ORGANIZATION_ANNOTATION] ===
+                location.target
+              );
+            }
+            return false;
           }
-          return false;
-        }
-        return true;
-      })
-      .forEach(entity => {
-        emit(processingResult.entity(location, entity));
-      });
+          return true;
+        })
+        .forEach(entity => {
+          emit(processingResult.entity(location, entity));
+        });
+    } catch (e) {
+      this.logger?.error(e);
+    }
 
     return true;
   }