# Service Control Policies =====================================================
# Creates SCP documents and attaches them to their target OUs or accounts.

# SCPs =========================================================================

resource "aws_organizations_policy" "this" {
  for_each = var.policies

  name        = each.value.name
  description = each.value.description
  content     = each.value.content
  type        = "SERVICE_CONTROL_POLICY"

  tags = local.policy_tags[each.key]
}

# SCP attachments: managed -----------------------------------------------------

resource "aws_organizations_policy_attachment" "this" {
  for_each = local.policy_target_map

  policy_id = aws_organizations_policy.this[each.value.policy_key].id
  target_id = each.value.target
}

# SCP attachments: existing ----------------------------------------------------

resource "aws_organizations_policy_attachment" "existing" {
  for_each = local.attachment_target_map

  policy_id = each.value.policy_id
  target_id = each.value.target
}