AWS Organizations L2 Construct

Question

AWS Organizations L2 Construct

pflorek opened this issue a year ago · comments

Description

I would like to have AWS Organization L2 constructs implemented.

As of CDK v2.51.0 generated L1 constructs aws_organizations.CfnAccount and aws_organizations.CfnPolicy are available (CFN spec v97.0.0). CfnOrganizationUnit will be available with CFN spec v98.0.0

We are looking for an API Bar Raiser 🚀

It would be really great to have CDK support to manage the Organization hierarchy like

    const organizationalUnit = new OrganizationalUnit(stack, "OrganizationalUnit", {
      organizationalUnitName: "AnyOrganizationalUnitName",
    });
    const account = new Account(stack, "Account", {
      accountName: "AnyAccountName",
      email: "patrick.florek+cdk@gmail.com",
      parent: organizationalUnit,
    });
    const policy = new Policy(stack, "Policy", {
      policyName: "AnyPolicyName",
      description: "AnyDescription",
      content: {
        // ...
      },
      targets: [PolicyAttachmentTarget.ofAccount(account)],
      policyType: PolicyType.SERVICE_CONTROL_POLICY,
    });

The L2 constructs may also help a lot to maintain the sequential dependency chain. Either by Aspect cdk-organizations or explicit in the L2 constructs.

There are already two custom AWS construct libraries to manage AWS Organizations with the CDK:

cdk-organizations L2
bootstrap-kit L3

Here is a draft PR aws/aws-cdk#23001

There are some design decision to be discussed like inversion of parentship

organizationalUnit.addOrganizationalUnit(childOU);
organizationalUnit.addAccount(childAccount);
organizationalUnit.attachPolicy(policy);

vs.

const organizationalUnit = new OrganizationalUnit(stack, "ChildOrganizationalUnit", {
  organizationalUnitName: "AnyOrganizationalUnitName",
  parent: parentOU,
});

Writing integ.tests wouldn't be easy, since closing an account underlies some limitations.

To get a first working increment it's enough to get the organization root and postpone Organization, EnablePolicyType, DelegateAdministrator, EnableAwsServiceAccess into a follow-up. Also later on we can easily add L2 constructs for AI, Backup, Tag and Service Control Policies.

This topic has a lot of votes aws/aws-cdk#2877

I strongly believe having this in the CDK is more valuable instead of a custom construct library, so we can focus in the construct libraries on opionated constructs, while having the same interfaces shared by the aws-cdk-lib.

Ideas 💡

Organization Root as AwsCustomResource'
Organization Root via cx-api
IAccount into core useful for SSO, IAM, ...
Managing dependencies as Aspect
Managing dependencies by node.addDependency
Import existing Organization into CFN Stack
Using Account, OrganizationalUnit, Policy standalone
Distinct constructs for AiPolicy, TagPolicy, BackupPolicy, ScpPolicy
ScpPolicy may leverage iam.PolicyDocument (SCP is more restrictive)

See aws/aws-cdk#23001 (comment)

Roles

Role	User
Proposed by	@pflorek, @hoegertn
Author(s)	@pflorek, @hoegertn
API Bar Raiser	@Naumel
Stakeholders	@alias, @alias, @alias

See RFC Process for details

Workflow

Author is responsible to progress the RFC according to this checklist, and
apply the relevant labels to this issue so that the RFC table in README gets
updated.

Abdu · Answer 1 · Mon Oct 16 2023 19:14:50 GMT+0800 (China Standard Time)

any update on this? 👀

Mark Beacom · Answer 2 · Fri Dec 08 2023 22:43:17 GMT+0800 (China Standard Time)

What is needed to get some movement on this RFC? Can someone please provide either approval or feedback about what needs to be improved? The original PFR can be considered as starting from the time aws/aws-cdk#2877 was opened in July 2019.

It appears @Naumel self-unassigned in July of this year. If you were impacted by layoffs or PIP, sorry for that... but is there anyone we can escalate this to? @TheRealAmazonKendra ? re: aws/aws-cdk#23001 (review)
cc @MrArnoldPalmer

awsmjs · Answer 3 · Fri Dec 15 2023 07:01:21 GMT+0800 (China Standard Time)

Closing this ticket. We believe the functionality is beneficial, but does not intersect with the core framework and should be vended and maintained separately.