Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

Facing a similar issue with log source. got it to work under specific circumstances/parameters. A few observations below:

Observation 1: [ERROR] ran the following through the delegated securitylake admin account and got the same error as the issue description. But when i check the console, the logs are indeed enabled in all accounts in the org. This org has accounts that are currently in suspended state.

resource "aws_securitylake_aws_log_source" "route53" {
    source {
        regions     = ["eu-west-1"]   ###includes suspended and active accounts in the organization ####
        source_name = "ROUTE53"
    }
   depends_on = [aws_securitylake_data_lake.securitylake]
}

Observation 2: [ERROR] Destroyed previous run w/ TF and ran the following through the delegated securitylake admin account and got the same error again. The only difference is that I added source_version = "2.0"

resource "aws_securitylake_aws_log_source" "route53" {
    source {
        regions     = ["eu-west-1"]   ###includes suspended and active accounts in the organization ####
        source_name = "ROUTE53"
     **source_version = "2.0"  ###Added source versioning here###**
    }
  
    depends_on = [aws_securitylake_data_lake.securitylake]
}

Observation 3: [SUCCESSFUL]
Destroyed the previous log sources and then ran the following through the delegatedadmin account again with two additions below and was SUCCESSFUL

resource "aws_securitylake_aws_log_source" "route53" {
    source {
     **account    = ["active_account_ID1", "active_account_ID2", "..." ] ##Ensured no suspended account IDs were included##**
        regions     = ["eu-west-1"]
        source_name = "ROUTE53"
     **source_version = "2.0"  ###Added source versioning here###**
    }
    depends_on = [aws_securitylake_data_lake.securitylake]
}

Obviously, hardcoding active account IDs is not ideal, especially in a large and growing AWS organization with many accounts. I'm assuming at this point that the suspended accounts in an organization are causing this error along with not specifying the actual source_version parameter.
So the ask would be to have the resource creation skip over the suspended account as well so we can have a TF run that will create log sources in all the active accounts without having to manually hard code the account IDs.