awslabs / awslabs/aws-deployment-framework

[Feat]: Resolving OU based parameters when not targeting OU

Open
#593 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
699
Forks
235
Avg merge
20h 53m
Merged PRs (30d)
7

Description

### Describe the feature

When targeting accounts with tags, we would need to be able to give parameters to a set of accounts.

```
targets:
- tags:
tag1: value
tag2: value2
regions: [eu-west-1, eu-north-1]
```

The accounts are put into separate OU's for examples sake /prod and /dev

Pipeline repository would have files, and these would be matched to the template according to the OU the account belongs to

```
params/
├── global.yml
├── ou-123-445678.yml or prod.yml
└── ou-123-567890.yml or dev.yml
```

I mentioned this in issue #294 and Simon asked to open a separate ticket - so here it is.

### Use Case

We have a client setup that targets with tags (if you ask why, I can give you a legacy answer before version 3.2.0 came out).

When targeting accounts with tags, giving separate parameters to accounts can only currently be done with account.yml or global.yml

`global.yml
└───deployment_account_region.yml (e.g. global_eu-west-1.yml)
└───ou.yml (e.g. ou-1a2b-3c4d5e.yml)
└───ou_region.yml (e.g. ou-1a2b-3c4d5e_eu-west-1.yml)
└───account.yml (e.g. dev-account-1.yml)
└───account_region.yml (e.g. dev-account-1_eu-west-1.yml)`

It would make management of accounts in this setup easier, when one can have one type of account in its own OU (ex. /dev) and parameters would come from ou.yml, instead of having account.yml for each account.

### Proposed Solution

Script generating parameters could check the OU the account belongs to and check if OU parameter file exists and use that.

### Acknowledgements

- [ ] I may be able to implement this feature request

Contributor guide

Open the contributing guide

Research direction

Start by locating the script that generates parameters and trace the existing account and OU resolution flow. Compare the current params/global.yml and account.yml handling with the proposed OU-named files, then verify that tag-targeted accounts can resolve OU parameters while retaining the existing hierarchy and regional behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.