identityCenterAssignments getting ValidationException Filter is deprecated

[TheGreatNull]

we are having an issue create identityCenterAssignments using iam-config getting ValidationException Filter is deprecated

this is the iam-config file:

  identityCenterAssignments: 
  - name: LandingZoneAdmins
    permissionSetName: SSO-LZTeam-Admin
    principals:
      - type: GROUP
        name: LZTeam_Admin
    deploymentTargets:
      organizationalUnits:
        - Security
        - Network
        - Management

AWSAccelerator-IdentityCenterStack-11111111111111-il-central-1 | 6:39:13 PM | CREATE_FAILED | Custom::IdentityCenterAssignments | IdentityCenterAssignmentLandingZoneAdmins/Resource/Default (IdentityCenterAssignmentLandingZoneAdmins47EB1DC4) Received response status [FAILED] from custom resource. Message returned: ValidationException: Filter is deprecated, please remove filter from request. at de_ValidationExceptionRes (/var/task/index.js:84:126707) at de_CommandError (/var/task/index.js:84:125613) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) at async /var/task/index.js:2:11287 at async /var/task/index.js:3:6621 at async /var/task/index.js:13:16355 at async /var/task/index.js:1:15424 (RequestId: 573ec546-c672-4d6a-85c0-ca50981c30ec) new CustomResource (/codebuild/output/src575/src/s3/00/source/node_modules/aws-cdk-lib/core/lib/custom-resource.js:1:1075) \_ new IdentityCenterAssignments (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/constructs/lib/aws-identity-center/identity-center-assignments.ts:117:22) \_ IdentityCenterStack.createAssignment (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/lib/stacks/identity-center-stack.ts:278:5) \_ IdentityCenterStack.addIdentityCenterAssignments (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/lib/stacks/identity-center-stack.ts:261:12) \_ IdentityCenterStack.addIdentityCenterResources (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/lib/stacks/identity-center-stack.ts:312:12) \_ new IdentityCenterStack (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/lib/stacks/identity-center-stack.ts:70:12) \_ createIdentityCenterStack (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/utils/stack-utils.ts:876:33) \_ createManagementAccountStacks (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/bin/app.ts:108:28) \_ main (/codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/bin/app.ts:246:5) \_ processTicksAndRejections (node:internal/process/task_queues:95:5) \_ async /codebuild/output/src575/src/s3/00/source/packages/@aws-accelerator/accelerator/bin/app.ts:260:5

• Version: 1.10
• Region: il-central-1

[erwaxler]

Hi @TheGreatNull , thanks for reaching out to the Landing Zone Accelerator team!

I have been able to replicate this behavior, it appears the Identity Center team is deprecating the ability to filter the responses of these APIs. I have created a ticket for the team to triage this work internally, in the meantime you can workaround this issue by specifying the principal Id of the user or group:

  identityCenterAssignments: 
  - name: PowerGroupUsers
    permissionSetName: PowerUserAccess
    principalId: 'abcd1234-ab12-cd34-ef56-abcdef123456'
    principalType: GROUP

I will keep this issue updated as the team works towards a fix. Thank you for your support of the Landing Zone Accelerator!