feat(organizations): add basic organizations higher level constructs #23001

pflorek · 2022-11-20T16:00:56Z

basic higher level constructs

features:

adds higher level constructs Account, OrganizationalUnit, Policy building up the org tree
adds utility construct OrganizationRoot to retrieve the root for the first organizational units (singleton AwsCustomResource)

todo:

AWS Organizations L2 Construct aws-cdk-rfcs#465
API Bar Raiser
decide how to sequentially chain the organization tree
add doc blocks, usage example and howtos
improve tests (unit coverage and integ tests)

sequentially chain resources is an important feature. The AWS Organizations API can create accounts only sequentially. Also adding policies, delegating administration and enabling trusted services needs to sequentially chained. Here is a solution that uses the construct tree walking Aspect: https://github.com/pepperize/cdk-organizations/blob/main/src/dependency-chain.ts. Another option could be to chain the dependencies in the Account and OrganizationalUnit

inversion of parentship:
It could be useful to inverse the parent child relation, for example

organizationalUnit.addAccount(account);

instead of

new Account(scope, id, {
  parent: ou,
});

also it could be useful to inverse the policy attachment

export class Account {
  public function attachPolicy(policy: IPolicy): void {
    policy.addAccount(this);
  }
}

Delegation of the attachment could also be useful if explicit dependency chaining is used.

next (later on):

add ScpPolicy, BackupPolicy, TagPolicy, AiPolicy as flavors of PolicyBase
add Organization construct to enable AWS Organizations
add enabling PolicyType, DelegatedAdministrator, TrustedService

Fixes: #2877

All Submissions:

Have you followed the guidelines in our Contributing guide?

Adding new Unconventional Dependencies:

This PR adds new unconventional dependencies following the process described here

New Features

Have you added the new feature to an integration test?
- Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

> basic higher level constructs **features:** - adds higher level constructs `Account`, `OrganizationalUnit`, `Policy` building up the org tree - adds utility construct `OrganizationRoot` to retrieve the root for the first organizational units (singleton `AwsCustomResource`) **todo:** - [] decide how to sequentially chain the organization tree - [] add doc blocks, usage example and howtos - [] improve tests (unit coverage and integ tests) > sequentially chain resources is an important feature. The AWS Organizations API can create accounts only sequentially. Also adding policies, delegating administration and enabling trusted services needs to sequentially chained. Here is a solution that uses the construct tree walking `Aspect`: [https://github.com/pepperize/cdk-organizations/blob/main/src/dependency-chain.ts](https://github.com/pepperize/cdk-organizations/blob/main/src/dependency-chain.ts). Another option could be to chain the dependencies in the `Account` and `OrganizationalUnit` **inversion of parentship:** It could be useful to inverse the parent child relation, for example ```typescript organizationalUnit.addAccount(account); ``` instead of ``` new Account(scope, id, { parent: ou, }); ``` also it could be useful to inverse the policy attachment ```typescript export class Account { public function attachPolicy(policy: IPolicy): void { policy.addAccount(this); } } ``` _Delegation of the attachment could also be useful if explicit dependency chaining is used._ **next (later on):** - add `ScpPolicy`, `BackupPolicy`, `TagPolicy`, `AiPolicy` as flavors of `PolicyBase` - add `Organization` construct to enable AWS Organizations - add enabling `PolicyType`, `DelegatedAdministrator`, `TrustedService` Fixes: aws#2877

gitpod-io · 2022-11-20T16:01:01Z

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

pflorek · 2022-11-20T16:15:50Z

Need help on:

How do we want to chain the sequential resources Account, Organization, Policy
How to write integ.test for CFN resources that don't get deleted (Account)

aws-cdk-automation · 2022-11-20T16:17:36Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: fc3fe18
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

hoegertn · 2022-11-20T19:23:11Z

Some thoughts:

As the org root does not change, what about using a lookup instead of a custom resource?
For consistency I think it should be new Account(...) but still there could be a method .addAccount(...) on the OU calling this constructor
Imho the serialization could be done in an aspect, but please raise a feature request with AWS as this should be handled in CFN I think
Maybe we need an IAccount interface somewhere in base as other services also reference accounts like SSO(Identity Center), ControlTower, etc. Would be cool to use an org-account in the creation of a PermissionSet attachment.

TheRealAmazonKendra

For new L2 constructs, we require an approved RFC before we will accept any code. Feel free to keep this open as a draft in the meantime, but please start with an RFC to proceed.

pflorek · 2022-11-21T16:24:56Z

packages/@aws-cdk/aws-organizations/lib/account.ts

+import { IOrganizationalUnit } from './organizational-unit';
+import { CfnAccount } from './organizations.generated';
+
+export interface IAccount extends IResource {


@hoegertn Thank you

pflorek · 2022-11-21T16:26:41Z

For new L2 constructs, we require an approved RFC before we will accept any code. Feel free to keep this open as a draft in the meantime, but please start with an RFC to proceed.

@TheRealAmazonKendra aws/aws-cdk-rfcs#465 I'm looking for an API Bar Raiser

pflorek · 2022-11-21T16:28:10Z

packages/@aws-cdk/aws-organizations/lib/organization-root.ts

+      }),
+    });
+
+    this.organizationRootId = resource.getResponseField('Roots.0.Id');


@hoegertn Here is the important lookup needed for the first OUs

Sure, but I was thinking about doing a cx-api lookup and store it in cdk.context.json instead of a CR

poc: how to transition to aws cdk native cfn organizations support - aws/aws-cdk#23001 - aws/aws-cdk-rfcs#465 - aws/aws-cdk#22876 - aws/aws-cdk#22971

jeromevdl · 2022-11-23T09:21:45Z

packages/@aws-cdk/aws-organizations/lib/organization-root.ts

+  /**
+   * @internal
+   */
+  public constructor(scope: Construct, id: string, props?: OrganizationRootProps) {


shouldn't it be private?

jeromevdl · 2022-11-23T09:27:35Z

packages/@aws-cdk/aws-organizations/lib/organizational-unit.ts

+  public constructor(scope: Construct, id: string, props: OrganizationalUnitProps) {
+    super(scope, id);
+
+    const parentId = props.parent?.organizationalUnitId ?? OrganizationRoot.getOrCreate(this).organizationRootId;


not sure we should create the org for the user...

aws-cdk-automation · 2022-12-12T00:08:58Z

This PR has been in the BUILD FAILING state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

aws-cdk-automation · 2022-12-19T00:09:02Z

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

aws-cdk-automation · 2022-12-19T00:12:21Z

The pull request linter fails with the following errors:

❌ Features must contain a change to a README file.
❌ Features must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

aws-cdk-automation requested a review from a team November 20, 2022 16:01

github-actions bot added p2 beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK labels Nov 20, 2022

pflorek marked this pull request as draft November 20, 2022 16:01

aws-cdk-automation requested changes Nov 20, 2022

View reviewed changes

pflorek changed the title ~~feat: organization base~~ feat(organizations): add basic organizations higher level constructs Nov 20, 2022

pflorek mentioned this pull request Nov 20, 2022

AWS Organizations L2 Construct aws/aws-cdk-rfcs#465

Closed

11 tasks

TheRealAmazonKendra requested changes Nov 21, 2022

View reviewed changes

pflorek commented Nov 21, 2022

View reviewed changes

This was referenced Nov 22, 2022

feat(policy): use aws_organizations cfn policy pepperize/cdk-organizations#753

Draft

AWS Organizations L2s #2877

Open

jeromevdl reviewed Nov 23, 2022

View reviewed changes

aws-cdk-automation added the closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. label Dec 19, 2022

aws-cdk-automation closed this Dec 19, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(organizations): add basic organizations higher level constructs #23001

feat(organizations): add basic organizations higher level constructs #23001

pflorek commented Nov 20, 2022 •

edited

gitpod-io bot commented Nov 20, 2022

aws-cdk-automation left a comment

pflorek commented Nov 20, 2022 •

edited

aws-cdk-automation commented Nov 20, 2022

hoegertn commented Nov 20, 2022

TheRealAmazonKendra left a comment

pflorek Nov 21, 2022

pflorek commented Nov 21, 2022

pflorek Nov 21, 2022

hoegertn Nov 21, 2022

jeromevdl Nov 23, 2022

jeromevdl Nov 23, 2022

aws-cdk-automation commented Dec 12, 2022

aws-cdk-automation commented Dec 19, 2022

aws-cdk-automation commented Dec 19, 2022

feat(organizations): add basic organizations higher level constructs #23001

feat(organizations): add basic organizations higher level constructs #23001

Conversation

pflorek commented Nov 20, 2022 • edited

todo:

All Submissions:

Adding new Unconventional Dependencies:

New Features

gitpod-io bot commented Nov 20, 2022

aws-cdk-automation left a comment

Choose a reason for hiding this comment

pflorek commented Nov 20, 2022 • edited

aws-cdk-automation commented Nov 20, 2022

AWS CodeBuild CI Report

hoegertn commented Nov 20, 2022

TheRealAmazonKendra left a comment

Choose a reason for hiding this comment

pflorek Nov 21, 2022

Choose a reason for hiding this comment

pflorek commented Nov 21, 2022

pflorek Nov 21, 2022

Choose a reason for hiding this comment

hoegertn Nov 21, 2022

Choose a reason for hiding this comment

jeromevdl Nov 23, 2022

Choose a reason for hiding this comment

jeromevdl Nov 23, 2022

Choose a reason for hiding this comment

aws-cdk-automation commented Dec 12, 2022

aws-cdk-automation commented Dec 19, 2022

aws-cdk-automation commented Dec 19, 2022

pflorek commented Nov 20, 2022 •

edited

pflorek commented Nov 20, 2022 •

edited