diff --git a/infrastructure/global/stacksets/inf-org-crossaccount/test-cross-org.py b/infrastructure/global/stacksets/inf-org-crossaccount/test-cross-org.py index 84a6215d..b403c6d4 100755 --- a/infrastructure/global/stacksets/inf-org-crossaccount/test-cross-org.py +++ b/infrastructure/global/stacksets/inf-org-crossaccount/test-cross-org.py @@ -2,6 +2,7 @@ import argparse import os import sys +import logging from botocore.exceptions import ClientError, ProfileNotFound def get_args(): @@ -19,15 +20,26 @@ def get_args(): parser.add_argument("--role-name", required=True, help="The IAM role name to assume in member accounts") + + parser.add_argument("--debug", + action="store_true", + help="Enable verbose Boto3/Botocore HTTP wire-trace logging") return parser.parse_args() def test_connectivity(args): + # 1. Handle Debug Logging immediately + if args.debug: + # This is the 'canonical' way to debug Boto3; + # it logs everything (headers, payloads, etc.) to stdout. + boto3.set_stream_logger(name='botocore', level=logging.DEBUG) + print("!!! DEBUG LOGGING ENABLED (Botocore wire-trace) !!!\n") + try: # Initialize the base session session = boto3.Session(profile_name=args.profile, region_name=args.region) - # 1. Print Pre-flight Check (The "Where am I?" info) + # 2. Print Configuration Summary current_profile = args.profile or "Default/Environment" current_region = session.region_name @@ -36,14 +48,15 @@ def test_connectivity(args): print(f" Profile: {current_profile}") print(f" Base Region: {current_region}") print(f" Target Role: {args.role_name}") + print(f" Debug Mode: {'ON' if args.debug else 'OFF'}") print("-" * 60) - # 2. Get Management Account Identity + # 3. Get Management Account Identity sts_client = session.client('sts') caller = sts_client.get_caller_identity() print(f"Sourcing identity from: {caller['Arn']}\n") - # 3. Start Organization loop + # 4. Start Organization loop org_client = session.client('organizations') print(f"{'Account Name':<25} | {'Account ID':<15} | {'Status'}") print("-" * 60) @@ -65,7 +78,7 @@ def test_connectivity(args): RoleSessionName="ConnectivityTest" ) - # Prove success by verifying identity inside the member account + # Verify identity inside the member account creds = assumed['Credentials'] member_sts = boto3.client( 'sts', @@ -75,7 +88,6 @@ def test_connectivity(args): region_name=current_region ) - # If this succeeds, connectivity is confirmed member_sts.get_caller_identity() print(f"{acc_name[:25]:<25} | {acc_id:<15} | ✅ Success")