aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::Organizations::Organization - Allow Enabling or Disabling Policy types
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
Other
### Resource name
AWS::Organizations::Organization
### Description
As a cloudformation user i want to be able to control what policies are enabled at an Organisation level using cloudformation.
Currently the `AWS::Organizations::Organization` resource only supports one parameter, FeatureSet. regardless of what this is set to when the Org is created all the Policies are `Disabled` are default.
This Template
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
organisation:
Type: AWS::Organizations::Organization
Properties:
FeatureSet: ALL
```
Creates this Org:

I would suggest new supported parameters like
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
organisation:
Type: AWS::Organizations::Organization
Properties:
FeatureSet: ALL
AIServicesOptOut: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
BackupPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
ServiceControlPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
TagPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
```
or a new `Policies` object to contain them.
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
organisation:
Type: AWS::Organizations::Organization
Properties:
FeatureSet: ALL
Policies:
AIServicesOptOut: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
BackupPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
ServiceControlPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
TagPolicies: ENABLED # Can be ENABLED or DISABLED. Defaults to DISABLED
```
Under the hood, this would call [enable-policy-type](https://docs.aws.amazon.com/cli/latest/reference/organizations/enable-policy-type.html)
E.g.
aws organizations enable-policy-type --root-id `root-id` --policy-type `policy-type`
where policy-type can be:
`AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` or `TAG_POLICY` which corresponds to the requested parameters
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::Organizations::Organization resource documentation and the linked enable-policy-type CLI reference, using the YAML examples to understand the requested properties and policy types. Done means CloudFormation can configure the listed organization policy types and the behavior is documented and covered by appropriate validation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100