AWS Bitbucket quickstart template - unable to 'create internet gateway"

[Julia G]

Due to policies on an overarching AWS organization account and attached firewall, the create stack fails and is unable to complete the Bitbbucket with ASI AWS quickstart install. The error  "client unauthorized permission."  is produced when the  VPC stack tries to create an internet gateway  

What would be recommended best practices to overcome this issue? Temporarily modifying the AWS organization account's policies/firewall to allow the creation of the internet gateway or modify the code for the bitbucket quickstart template to prohibit the 'create internet gateway"? I am concerned that manually editing the code behind the template, could cause issues in the future for changes/upgrades etc. In addition, why is an internet gateway created during the install if the template provided for the AWS bitbucket quickstart does not ask for a value to be entered ie true/false create internet gateway?  

[Daniel Eads]

Hi Julia, welcome!

You can fork and modify the quickstart on Github as necessary. When changes/upgrades occur, you can diff any changes and merge them into your fork.

It's worth noting that Bitbucket won't be able to update its own plugins/apps if the internet gateway is disabled. You can manually update the plugins/apps via file upload in this case - although you'll need to manually check for updates on Marketplace as well, since Bitbucket also won't be able to notify you when new updates are available on Marketplace.

If modifying the AWS organization's policies is straightforward, that might be a quick option. If it's a highly structured environment and making a variance isn't really an option, forking the quickstart might be a faster option. Both are probably ok choices; selecting between the two is an exercise in determining what's going to be less complicated for you and your team.

Cheers,
Daniel