org-terraformation

JBOT - Just a Bunch Of Terraform. But to manage your AWS organization

This is a (hobby) attempt to create the features that the AWSome org-formation has, but natively in Terraform.

Features:

• Create AWS Organization
• Create Organizational units
  • Add parent Organizational Units (Max 5 levels deep!)
  • Attach Organization Policies
• Create Organization member accounts
  • Add member accounts to organizational units
  • Attach Organization Policies
• Configure delegated administrators
• Configure enabled policy types
• Create Organization Policies
  • Defaults to Service Control Policies

Wishlist:

• An analogue for org-formation init which imports the organization
• AWS Account contact information
• AWS Service Quota, ie. max accounts in the org
• More docs and examples
• Add option to automatically create (Github) OIDC providers, like: https://registry.terraform.io/modules/terraform-aws-modules/iam/aws/latest/submodules/iam-github-oidc-provider

Usage

Read up on how to install and use terraform for yourself first. Installation, deployment and state management are all context dependent

See _example for example usage as a module

Import Existing Resources

Organization

Make sure your AWS CLI profile is active for the management account

• Run terraform init
• Run terraform import aws_organizations_organization.org o-fx0z31337 (Enter your own organization ID)
• Run terraform plan
• Review if there are changes, add changes to the relevant variable
• Run terraform plan - should say No Changes.

AWS Accounts

Start off by importing the management account

• Enter the email and account name for the management account in the accounts variable
• Run terraform import aws_organizations_account.account[\"management\"] 111111111111 (enter the AWS account ID for your management account)
• Run terraform plan
• Review if there are changes, add changes to the accounts variable
• Run terraform plan - should say No Changes.
• Repeat for all existing accounts or add new accounts
• If the plan requires an OU Id, import Organizational Units first

Organizational Units

This assumes you're familiar with importing now.

• Add your ous to the ous variable
• Run e.g. terraform import ous.aws_organizations_organizational_unit.first_level_ou[\"my-ou"] ou-7hga-gvgt31337
• Repeat for all OUs

Requirements

Name	Version
terraform	>= 1.4.0
aws	~> 4.0

Providers

Name	Version
aws	~> 4.0

Resources

Name	Type
aws_organizations_account.account	resource
aws_organizations_delegated_administrator.this	resource
aws_organizations_organization.org	resource
aws_organizations_organizational_unit.fifth_level_ou	resource
aws_organizations_organizational_unit.first_level_ou	resource
aws_organizations_organizational_unit.fourth_level_ou	resource
aws_organizations_organizational_unit.second_level_ou	resource
aws_organizations_organizational_unit.third_level_ou	resource
aws_organizations_policy.this	resource
aws_organizations_policy_attachment.account	resource
aws_organizations_policy_attachment.ou	resource

Inputs

Name	Description	Type	Default	Required
accounts	A map of accounts. The key is used for the account name	map(object({ email = string tags = optional(map(string), null) iam_user_access_to_billing = optional(string, null) parent = optional(string, "root") policies = optional(list(string), null) }))	{}	no
aws_service_access_principals	List of trusted service access principals	list(any)	[]	no
delegated_administrators	Used to delegate administration of a service for the whole organization. ie. securityhub	map(object({ account = string }))	{}	no
enabled_policy_types	Which policy types to enable for the organization. See https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html	list(string)	[]	no
feature_set	Enable all features for the organization	string	"ALL"	no
ous	A map of the organizational units. The key is used for the OU name	map(object({ parent = optional(string, "") tags = optional(map(string)) policies = optional(list(string), null) }))	{}	no
policies	Organization policies	map(object({ content = string description = optional(string, null) type = optional(string, null) }))	{}	no

Outputs

Name	Description
accounts	Account names and account IDs
ous	Organizational units and OU Ids