allow empty id

aws-samples · Sep 12, 2024 · 27b120b · 27b120b
1 parent a6afce9
commit 27b120b
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/...s/solutions/security_lake/security_lake_org/templates/sra-security-lake-org-main-ssm.yaml b/...s/solutions/security_lake/security_lake_org/templates/sra-security-lake-org-main-ssm.yaml
@@ -453,9 +453,10 @@ Rules:
       - Assert: !Not [!Equals [!Ref pEnabledRegions, '']]
         AssertDescription: Please provide Enabled Regions
   ProvideUniqueExternalIds:
-    RuleCondition: !Equals
-      - !Ref pAuditAccountDataSubscriberExternalId
-      - !Ref pAuditAccountQuerySubscriberExternalId
+    RuleCondition: !And
+      - !Not [!Equals [!Ref pAuditAccountDataSubscriberExternalId, '']]
+      - !Not [!Equals [!Ref pAuditAccountQuerySubscriberExternalId, '']]
+      - !Equals [!Ref pAuditAccountDataSubscriberExternalId, !Ref pAuditAccountQuerySubscriberExternalId]
     Assertions:
       - Assert: !Not [!Equals [!Ref pAuditAccountDataSubscriberExternalId, !Ref pAuditAccountQuerySubscriberExternalId]]
         AssertDescription: The external ID for Security Lake Audit (Security Tooling) data access and query access subscribers must be different from one another.