aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::Organizations::Organization - Allow Enabling or Disabling Policy types

Open
#1,901 0 comments 5 reactions 0 assignees View on GitHub
Coverage enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

Other

### Resource name

AWS::Organizations::Organization

### Description

As a cloudformation user i want to be able to control what policies are enabled at an Organisation level using cloudformation.
Currently the `AWS::Organizations::Organization` resource only supports one parameter, FeatureSet. regardless of what this is set to when the Org is created all the Policies are `Disabled` are default.
This Template
```yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
organisation:
Type: AWS::Organizations::Organization
Properties:
FeatureSet: ALL
```
Creates this Org:
![image](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/assets/41299838/0e957d51-ca43-4fc4-9a11-65cff03e9436)

I would suggest new supported parameters like
```yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
organisation:
Type: AWS::Organizations::Organization
Properties:
FeatureSet: ALL
AIServicesOptOut: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
BackupPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
ServiceControlPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
TagPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
```
or a new `Policies` object to contain them.
```yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
organisation:
Type: AWS::Organizations::Organization
Properties:
FeatureSet: ALL
Policies:
AIServicesOptOut: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
BackupPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
ServiceControlPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
TagPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
```

Under the hood, this would call [enable-policy-type](https://docs.aws.amazon.com/cli/latest/reference/organizations/enable-policy-type.html)
E.g.
aws organizations enable-policy-type --root-id `root-id` --policy-type `policy-type`
where policy-type can be:
`AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` or `TAG_POLICY` which corresponds to the requested parameters

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::Organizations::Organization resource documentation and the linked enable-policy-type CLI reference, using the YAML examples to understand the requested properties and policy types. Done means CloudFormation can configure the listed organization policy types and the behavior is documented and covered by appropriate validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.