### AWS LZA Development Setup

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-lza/README.md

Instructions for setting up the development environment for AWS LZA, including cloning the repository, installing dependencies, and building the project.

```bash
git clone <repository-url>
cd source/packages/@aws-lza
npm install
npm run build
```

--------------------------------

### Verify Setup by Running Unit Tests

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/CONTRIBUTING.md

Navigates to the installer-container directory and runs unit tests to verify the setup.

```bash
cd source/packages/@aws-accelerator/installer-container
yarn test:unit
```

--------------------------------

### Build installer package

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/README.md

Build the installer package from its directory.

```bash
yarn --cwd ../installer build
```

--------------------------------

### IpamPoolConfig Documentation Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/doc-guidelines.md

Example demonstrating the documentation structure for the IpamPoolConfig class, including breadcrumb links, service descriptions, and YAML examples for base and regional pools.

```typescript
/**
 * *{@link NetworkConfig} / {@link CentralNetworkServicesConfig} / {@link IpamConfig} / {@link IpamPoolConfig}*
 *
 * {@link https://docs.aws.amazon.com/vpc/latest/ipam/how-it-works-ipam.html | VPC IPAM pool} configuration.
 * Use this configuration to define custom IPAM pools for your VPCs. A pool is a collection of contiguous
 * IP address ranges. IPAM pools enable you to organize your IP addresses according to your routing and security needs.
 *
 * @example
 * Base pool:
 * ```
 * - name: accelerator-base-pool
 *   description: Base IPAM pool
 *   provisionedCidrs:
 *     - 10.0.0.0/16
 *   tags: []
 * ```
 * Regional pool:
 * ```
 * - name: accelerator-regional-pool
 *   description: Regional pool for us-east-1
 *   locale: us-east-1
 *   provisionedCidrs:
 *     - 10.0.0.0/24
 *   sourceIpamPool: accelerator-base-pool
 * ```
 */
```

--------------------------------

### Install Dependencies and Build Packages

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/CONTRIBUTING.md

Installs project dependencies and builds necessary packages from the repository root.

```bash
# From repository root
yarn install

# Build required packages
yarn --cwd source/packages/@aws-accelerator/installer build
yarn --cwd source/packages/@aws-accelerator/utils build
yarn --cwd source/packages/@aws-accelerator/constructs build
```

--------------------------------

### Example global-config.yaml

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/faq/networking/general.md

This configuration specifies the home region and the regions where resources will be enabled.

```yaml
homeRegion: us-east-1
enabledRegions:
  - us-east-1
  - eu-west-2
```

--------------------------------

### Install Development Dependencies

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/dependencies.md

Navigate to the source directory and install development dependencies using Yarn. Ensure you have NodeJS 16.x or above, AWS CDK CLI, and Yarn installed.

```bash
cd <rootDir>/source
yarn install
```

--------------------------------

### Multiple Includes Not Working Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/configuration-include.md

This troubleshooting example highlights potential issues when using multiple !include directives. Ensure each include is a separate list item and uses proper YAML syntax.

```text
# If you see unexpected behavior with multiple includes
```

--------------------------------

### Simple Include Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/configuration-include.md

Shows a simple include scenario where a main configuration file references an included file for workload accounts.

```yaml
mandatoryAccounts:
  - name: Management
    description: The management (primary) account
    email: management@example.com
    organizationalUnit: Root
  - name: LogArchive
    description: The log archive account
    email: logarchive@example.com
    organizationalUnit: Security
  - name: Audit
    description: The security audit account
    email: audit@example.com
    organizationalUnit: Security

workloadAccounts: !include include/account-config-workloads.yaml
```

```yaml
- name: SharedServices
  description: The SharedServices account
  email: shared-services@example.com
  organizationalUnit: Infrastructure
- name: Network
  description: The Network account
  email: network@example.com
  organizationalUnit: Infrastructure
```

--------------------------------

### Control Tower Setup Landing Zone Module Implementation

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/module-development/module-naming-and-scope.md

Provides the implementation for the 'Setup Landing Zone' module, adhering to the defined interface contract.

```typescript
// lib/control-tower/setup-landing-zone/index.ts
export class SetupLandingZoneModule
  implements ISetupLandingZoneModule {
  
  public async handler(
    props: ISetupLandingZoneHandlerParameter
  ): Promise<string> {
    // Implementation logic
  }
}
```

--------------------------------

### Snapshot Diff Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/TESTING.md

Illustrates how to review differences between old and new snapshot values.

```diff
- "BucketName": "old-bucket-name"
+ "BucketName": "new-bucket-name"  ✅ Expected change

- "Effect": "Allow"
+ "Effect": "Deny"  ⚠️ Investigate this!

+ "NewResource": { ... }  ✅ New resource added
```

--------------------------------

### Synth Combined Deployment Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/README.md

Synthesize the CDK application with multiple context variables enabled: external pipeline account, permission boundary, and single account mode.

```bash
cdk synth \
  -c use-external-pipeline-account=true \
  -c use-permission-boundary=true \
  -c enable-single-account-mode=true
```

--------------------------------

### Run CDK Synthesis for Installer Stack

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/installation.md

Builds and synthesizes the Installer stack using Yarn and AWS CDK. This generates the CloudFormation template for deployment.

```bash
cd <rootDir>/source/packages/@aws-accelerator/installer
yarn build && yarn cdk synth
```

--------------------------------

### Example network-config.yaml for Default VPC Deletion

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/faq/networking/general.md

This configuration enables the deletion of default VPCs and specifies accounts to exclude.

```yaml
defaultVpc:
  delete: true
  excludeAccounts: []
```

--------------------------------

### AWS LZA CLI Commands for Macie Setup

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-lza/README.md

Demonstrates various ways to invoke the AWS LZA CLI for setting up Amazon Macie, including help commands.

```bash
aws-lza setup macie -c file://config.json

aws-lza --help
aws-lza setup --help
aws-lza setup macie --help
```

--------------------------------

### Deploy Installer Stack using AWS CLI

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/installation.md

Deploys the Installer stack using the AWS CLI. This involves creating an S3 bucket, uploading the template, and then creating the CloudFormation stack with specified parameters.

```bash
cd <rootDir>/source/packages/@aws-accelerator/installer
export BUCKET_NAME=<bucket name>
aws s3 mb s3://$BUCKET_NAME
export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
aws s3api head-bucket --bucket $BUCKET_NAME --expected-bucket-owner $ACCOUNT_ID
aws s3 cp ./cdk.out/AWSAccelerator-InstallerStack.template.json s3://$BUCKET_NAME
```

```bash
aws cloudformation create-stack --stack-name AWSAccelerator-InstallerStack --template-url https://$BUCKET_NAME.s3.<region>.amazonaws.com/AWSAccelerator-InstallerStack.template.json \
--parameters ParameterKey=RepositoryName,ParameterValue=<Repository_Name> \
ParameterKey=RepositoryBranchName,ParameterValue=<Branch_Name> \
ParameterKey=ManagementAccountEmail,ParameterValue=<Management_Email> \
ParameterKey=LogArchiveAccountEmail,ParameterValue=<LogArchive_Email> \
ParameterKey=AuditAccountEmail,ParameterValue=<Audit_Email> \
ParameterKey=EnableApprovalStage,ParameterValue=Yes \
ParameterKey=ApprovalStageNotifyEmailList,ParameterValue=<Comma_Delimited_Notify_Emails> \
ParameterKey=ControlTowerEnabled,ParameterValue=Yes \
--capabilities CAPABILITY_IAM
```

--------------------------------

### Example Commit Message for Feature Addition

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/CONTRIBUTING.md

Provides an example commit message structure for documenting feature additions and snapshot updates.

```git
feat: add new parameter to stack

- Added MyNewParameter for feature X
- Updated snapshot tests to reflect new parameter
- All existing resources unchanged
```

--------------------------------

### Synth Basic Deployment

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/README.md

Synthesize the CDK application for a basic deployment of the LZA installer container.

```bash
cd source/packages/@aws-accelerator/installer-container
cdk synth
```

--------------------------------

### Example Module Structure

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/module-development/module-naming-and-scope.md

Illustrates the directory structure for LZA modules, where each subdirectory corresponds to a specific AWS service.

```plaintext
source/packages/@aws-lza/lib/
├── macie/                  # Amazon Macie operations
├── control-tower/          # AWS Control Tower operations
├── security-hub/           # AWS Security Hub operations
└── guard-duty/             # Amazon GuardDuty operations
```

--------------------------------

### Setup Amazon Macie via CLI

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-lza/README.md

Use the AWS LZA CLI to set up Amazon Macie with a configuration file. This is a quick way to enable Macie organization-wide.

```bash
aws-lza setup macie -c file://macie-config.json
```

--------------------------------

### AWS LZA CLI Configuration Options for Macie

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-lza/README.md

Shows different methods for providing configuration to the 'aws-lza setup macie' command, including file paths, JSON strings, dry runs, and region overrides.

```bash
aws-lza setup macie -c file://macie-config.json
aws-lza setup macie -c '{"enable":true,"delegatedAdminAccountId":"123456789012"}'
aws-lza setup macie -c config.json --dry-run
aws-lza setup macie -c config.json --region us-west-2
```

--------------------------------

### Example accounts-config.yaml for LZA Account Invitation

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/container/README.md

Configure account invitations during deployment by adding accounts to the `accountIds` section of your `accounts-config.yaml` file. Ensure the appropriate IAM role exists in each account.

```yaml
accountIds:
  - email: account1@example.com
    accountId: '111111111111'
```

--------------------------------

### Security Hub Configuration Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/faq/security.md

This configuration demonstrates how Security Hub cannot be disabled once enabled, even with `enable: false` or `excludeRegions`.

```yaml
securityHub:
  enable: false  # This will not disable Security Hub if previously enabled
  regionAggregation: true
  excludeRegions:
    - eu-west-1  # This will not disable Security Hub in excluded regions
  standards:
    - name: AWS Foundational Security Best Practices v1.0.0
      enable: true
```

--------------------------------

### Control Tower Setup Landing Zone Module Interface

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/module-development/module-development-guidelines.md

Defines the interface for the SetupLandingZoneModule, specifying the handler method signature.

```typescript
// interfaces/control-tower/setup-landing-zone.ts
export interface SetupLandingZoneModule {
  handler(props: ISetupLandingZoneHandlerParameter): Promise<string>;
}
```

--------------------------------

### Synth Deployment with External Pipeline Account

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/README.md

Synthesize the CDK application to deploy the LZA installer container with the pipeline in an external account.

```bash
cdk synth \
  -c use-external-pipeline-account=true
```

--------------------------------

### Integration Testing LZA Module Deployment

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/module-development/integration-guide.md

Provides an example of integration testing for the `setupControlTowerLandingZone` module using a testing framework. It includes tests for successful deployment with valid parameters and handling of invalid configurations.

```typescript
describe('SetupLandingZoneModule Integration Test', () => {
  it('should successfully deploy Control Tower Landing Zone', async () => {
    const params = {
      // Test configuration
    };
    
    const result = await setupControlTowerLandingZone(params);
    expect(result).toBeDefined();
  });

  it('should handle invalid configurations', async () => {
    const invalidParams = {
      // Invalid configuration
    };
    
    await expect(setupControlTowerLandingZone(invalidParams))
      .rejects
      .toThrow();
  });
});
```

--------------------------------

### Get Help via CLI

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-lza/README.md

Access help information for the AWS LZA CLI and its subcommands. This is useful for understanding available options and commands.

```bash
aws-lza --help
```

--------------------------------

### File Not Found Error Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/configuration-include.md

This error occurs when the specified file for an !include directive cannot be found. Verify the relative path and file existence.

```text
Failed to include file /path/to/config/include/missing-file.yaml: ENOENT: no such file or directory
```

--------------------------------

### IpamPoolConfig Property Definitions

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/doc-guidelines.md

Example showing property definitions within the IpamPoolConfig class, including descriptions, remarks, and optionality indicators.

```typescript
export class IpamPoolConfig implements t.TypeOf<typeof NetworkConfigTypes.ipamPoolConfig> {
  /**
   * The address family for the IPAM pool.
   *
   * @remarks
   * The default value is `ipv4`.
   *
   * @see {@link NetworkConfigTypes.ipVersionEnum}
   */
  readonly addressFamily: t.TypeOf<typeof NetworkConfigTypes.ipVersionEnum> | undefined = 'ipv4';
  /**
   * A friendly name for the IPAM pool.
   *
   * @remarks
   * **CAUTION**: Changing this value after initial deployment
   * will cause the pool to be recreated.
   * Please be aware that any downstream dependencies may cause
   * this property update to fail.
   */
  readonly name: string = '';
  /**
   * (OPTIONAL) The friendly name of the IPAM scope to assign the IPAM pool to.
   *
   * @remarks
   * Note: This is the logical `name` property of the scope as defined in network-config.yaml.
   * Leave this property undefined to create the pool in the default private scope.
   *
   * @see {@link IpamScopeConfig}
   */
  readonly scope: string | undefined = undefined;
  /**
   * (OPTIONAL) The default netmask length of IPAM allocations for this pool.
   *
   * @remarks
   * Setting this property will enforce a default netmask length for all IPAM allocations in this pool.
   */
  readonly allocationDefaultNetmaskLength: number | undefined = undefined;
  /**
```

--------------------------------

### YAML Syntax Error Example

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/configuration-include.md

This error indicates a problem with the YAML formatting in either the main or an included file. Ensure proper indentation and valid YAML syntax.

```text
Could not parse content in accounts-config: YAMLException: bad indentation
```

--------------------------------

### Commit Message Examples: New Features

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/commits.md

Examples of commit messages for new features, specifying the component affected.

```Conventional Commits
feat(orgs): allowing chatbot policies to be set in organization config
```

--------------------------------

### Commit Message Examples: Bug Fixes

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/commits.md

Examples of commit messages for bug fixes, specifying the component affected.

```Conventional Commits
fix(kms): fixed CWL CMK condition
```

```Conventional Commits
fix(iam): prevents cdk execution role from assuming vpc trust policy
```

--------------------------------

### Commit Message Examples: Chores and Maintenance

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/commits.md

Examples of commit messages for chores and maintenance tasks, specifying the component affected.

```Conventional Commits
chore(sample-config): disable event bus policy sample config
```

```Conventional Commits
chore(test): add audit manager integration testing gitlab ci job
```

--------------------------------

### Basic !include Syntax

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/configuration-include.md

Demonstrates the basic syntax for using the !include directive as a mapping value or an array item in YAML configuration files.

```yaml
configurationSection: !include relative/path/to/file.yaml

items:
  - !include path/to/item1.yaml
  - !include path/to/item2.yaml
```

--------------------------------

### Import and Use LZA Module for Control Tower

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/module-development/integration-guide.md

Demonstrates importing the `setupControlTowerLandingZone` function and using it with a detailed parameter object to deploy a Control Tower landing zone. Includes basic try-catch error handling.

```typescript
import {
  setupControlTowerLandingZone,
  ISetupLandingZoneHandlerParameter
} from '@aws-lza';

async function deployControlTower() {
  const params: ISetupLandingZoneHandlerParameter = {
    dryRun: false,
    partition: 'aws',
    homeRegion: 'us-east-1',
    configuration: {
      version: '3.3',
      enabledRegions: ['us-east-1', 'us-west-2'],
      logging: {
        organizationTrail: true,
        retention: {
          loggingBucket: 365,
          accessLoggingBucket: 365
        }
      },
      security: {
        enableIdentityCenterAccess: true
      },
      sharedAccounts: {
        management: {
          name: 'Management',
          email: 'management@example.com'
        },
        logging: {
          name: 'LogArchive',
          email: 'log-archive@example.com'
        },
        audit: {
          name: 'Audit',
          email: 'audit@example.com'
        }
      }
    }
  };

  try {
    const result = await setupControlTowerLandingZone(params);
    console.log('Status:', result);
  } catch (error) {
    console.error('Failure:', error.message);
  }
}
```

--------------------------------

### Valid JSON Example with Comment Removal

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/sample-configurations/standard/overview.md

This example shows a JSON snippet with a comment. Comments are not valid in standard JSON and must be removed before processing by AWS services or the console.

```json
{
    "Effect": "Allow",
    "Principal": {
    "AWS": "arn:aws:iam::123456789012:root" // Trust the Organization Management account
    },
    "Action": "sts:AssumeRole"
}
```

--------------------------------

### Container Installer Task Definition Environment Variables

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/docs/s3-config-initializer.md

Illustrates how the container installer configures environment variables for the ECS task definition. This includes the S3 path for configuration and account emails.

```typescript
// Task Definition environment variables
environment: [
  { name: 'CONFIG_S3_PATH', value: `s3://${configBucket}/lza/aws-accelerator-config.zip` },
  { name: 'MANAGEMENT_ACCOUNT_EMAIL', value: managementAccountEmail },
  { name: 'LOG_ARCHIVE_ACCOUNT_EMAIL', value: logArchiveAccountEmail },
  { name: 'AUDIT_ACCOUNT_EMAIL', value: auditAccountEmail },
  { name: 'CONTROL_TOWER_ENABLED', value: controlTowerEnabled },
  // ... other variables
]
```

--------------------------------

### Project Structure Overview

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-lza/README.md

Illustrates the directory structure of the AWS LZA project, highlighting key directories like lib/, bin/, and test/.

```bash
@aws-lza/
├── lib/
│   ├── common/           # Shared utilities and functions
│   ├── cli/              # CLI framework and commands
│   └── amazon-macie/     # Macie service module
├── bin/                  # CLI executables
└── test/                 # Test suites
```

--------------------------------

### Setup Control Tower Landing Zone Handler

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/module-development/module-development-guidelines.md

An asynchronous function that handles the setup of a Control Tower landing zone. It calls the handler of the SetupLandingZoneModule and includes basic error logging.

```typescript
export async function setupControlTowerLandingZone(input: ISetupLandingZoneHandlerParameter): Promise<string> {
  try {
    return await new SetupLandingZoneModule().handler(input);
  } catch (e: unknown) {
    console.error(e);
    throw new Error(`${e}`);
  }
}
```

--------------------------------

### Control Tower Setup Landing Zone Interface Definition

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/developer-guide/module-development/module-naming-and-scope.md

Defines the interface contract for the 'Setup Landing Zone' functionality within the Control Tower module, extending common parameters.

```typescript
// interfaces/control-tower/setup-landing-zone.ts
export interface ISetupLandingZoneModule {
  handler(props: ISetupLandingZoneHandlerParameter): Promise<string>;
  // Other required methods and types
}
```

--------------------------------

### init-config.ts CLI Logic

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/docs/s3-config-initializer.md

This TypeScript CLI handles the initialization of LZA configuration files. It reads environment variables, checks for existing configurations in S3 to ensure idempotency, generates default configuration files, creates a zip archive, and uploads it to S3.

```typescript
// Location: source/packages/@aws-accelerator/accelerator/bin/init-config.ts
```

--------------------------------

### Build utils package

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/README.md

Build the utils package from its directory.

```bash
yarn --cwd ../utils build
```

--------------------------------

### Example Role Trust Policy for AWS Control Tower

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/faq/ct-cfct.md

This is an example of a role trust policy required for the `managementAccountAccessRole`. It allows AWS Control Tower and the management account root to assume the role, which is necessary for managing individual accounts and reporting information.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "controltower.amazonaws.com",
                "AWS": "arn:<PARTITION>:iam::<MANAGEMENT_ACCOUNT_ID>:root"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

--------------------------------

### Example ARN for VPC Subnet in Management Account

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/sample-configurations/standard/overview.md

This example shows the format of an Amazon Resource Name (ARN) for a VPC subnet within the AWS Organization Management (root) account. It illustrates the standard 12-digit account ID convention used for the management account.

```text
arn:aws:ec2:us-east-1:123456789012:subnet/subnet-0e9801d129EXAMPLE
```

--------------------------------

### Run Tests and Review Snapshot

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/CONTRIBUTING.md

Executes unit tests and displays the generated snapshot file for review.

```bash
yarn test:unit
```

```bash
# View the generated snapshot
cat test/__snapshots__/installer-container-stack.test.ts.snap
```

--------------------------------

### Full Test Development Workflow

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/TESTING.md

A comprehensive workflow for developing and testing changes to the Installer Container stack, including code modification, test addition, dependency building, test execution, snapshot review, and version control.

```bash
# 1. Make code changes to stack
vim lib/installer-container-stack.ts

# 2. Add new test case
vim test/installer-container-stack.test.ts

# 3. Build dependencies if needed
yarn --cwd ../installer build

# 4. Run tests (will fail - no snapshot yet)
yarn test:unit

# 5. Review the generated snapshot
cat test/__snapshots__/installer-container-stack.test.ts.snap

# 6. If correct, tests pass automatically (snapshot created)
# If changes to existing tests, review diff and update:
yarn test:unit -u

# 7. Verify all tests pass
yarn test:unit

# 8. Commit changes
git add test/ lib/
git commit -m "feat: add new configuration option with tests"
```

--------------------------------

### Add custom snapshot serializer

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/README.md

Example of adding a custom serializer to handle dynamic values in snapshots.

```typescript
// 1. Identify the pattern
const myValueRegex = /my-dynamic-pattern/;
const isMyValue = (val: unknown) => 
  typeof val === 'string' && val.match(myValueRegex) != null;

// 2. Add serializer in configureSnapshotSerializers()
expect.addSnapshotSerializer({
  test: isMyValue,
  print: () => '"REPLACED-MY-VALUE"',
});
```

--------------------------------

### Add new test case

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/README.md

Example of adding a new test case for the InstallerContainerStack construct in TypeScript.

```typescript
snapShotTest('Construct(InstallerContainerStack): My New Config', () => {
  const app = new cdk.App();
  return new InstallerContainerStack(app, 'TestStack', {
    // Your configuration
    myNewProp: true,
  });
});
```

--------------------------------

### run-lza.sh Script Logic

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/docs/s3-config-initializer.md

This bash script is the entry point for container-based LZA deployments. It orchestrates the configuration initialization process by setting up environment variables, invoking the init-config CLI, downloading the configuration from S3, and then executing the main pipeline script.

```bash
# Location: deployment/container/scripts/run-lza.sh
```

--------------------------------

### Build constructs package

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/README.md

Build the constructs package from its directory.

```bash
yarn --cwd ../constructs build
```

--------------------------------

### Correct YAML List Syntax for Includes

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/configuration-include.md

Demonstrates the proper way to include multiple files within a YAML list. Ensure each included item is a distinct list element.

```yaml
items:
  - !include file1.yaml
  - !include file2.yaml
```

--------------------------------

### Previewing Replacements with CLI

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/replacement-variables.md

Use the LZA Command Line Interface to preview the results of replacements in your configuration files. This command outputs a copy of the configuration files with the '-replaced' suffix.

```bash
yarn config-replacement /path/to/aws-accelerator-config/
```

--------------------------------

### Run Unit Tests

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/packages/@aws-accelerator/installer-container/test/CONTRIBUTING.md

Command to execute unit tests. This is a standard step after writing or modifying tests.

```bash
# Run test
yarn test:unit
```

--------------------------------

### Invalid StringList Replacement Configuration

Source: https://github.com/awslabs/landing-zone-accelerator-on-aws/blob/release/v1.15.5/source/mkdocs/docs/user-guide/replacement-variables.md

An example of an invalid configuration for StringList replacement, which will result in an error. This format does not correctly represent a list for replacement.

```yaml
topics:
  - name: SampleTopic
    emailAddresses:
      - {{AddressList}}
```