# organization

Enables and configures AWS Organizations for the management account.

Provisions the AWS Organization with a configurable feature set, enables trusted-access for AWS service principals (GuardDuty, Security Hub, Config, CloudTrail, IAM Identity Center, RAM, Inspector, and others), enables Service Control Policy and Tag Policy types, and registers delegated administrator accounts per service.

When `guardduty.amazonaws.com` is in `delegated_administrators`, the module also enables `aws_guardduty_organization_admin_account` in the **provider region** (management account). Run the module once per region where GuardDuty org administration is required.

## Usage

```hcl
module "organization" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/organization/aws"
  version = "0.1.0"

  delegated_administrators = {
    "guardduty.amazonaws.com"   = "111122223333"
    "securityhub.amazonaws.com" = "111122223333"
    "config.amazonaws.com"      = "111122223333"
  }
}
```



## Requirements


| Name                                | Version  |
| ----------------------------------- | -------- |
| [terraform](#requirement_terraform) | >= 1.5.0 |
| [aws](#requirement_aws)             | ~> 5.0   |




## Providers


| Name                 | Version |
| -------------------- | ------- |
| [aws](#provider_aws) | ~> 5.0  |




## Resources


| Name                                                                                                                                                                | Type     |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_organizations_delegated_administrator.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_delegated_administrator) | resource |
| [aws_organizations_organization.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/organizations_organization)                       | resource |




## Inputs


| Name                                                                  | Description                                                                     | Type           | Default                                                                                                                                                                                                                                                                                               | Required |
| --------------------------------------------------------------------- | ------------------------------------------------------------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| [aws_service_access_principals](#input_aws_service_access_principals) | AWS service principals to enable as trusted access in the organization          | `list(string)` | [ "cloudtrail.amazonaws.com", "config.amazonaws.com", "config-multiaccountsetup.amazonaws.com", "guardduty.amazonaws.com", "securityhub.amazonaws.com", "ram.amazonaws.com", "sso.amazonaws.com", "account.amazonaws.com", "inspector2.amazonaws.com", "malware-protection.guardduty.amazonaws.com" ] | no       |
| [delegated_administrators](#input_delegated_administrators)           | Map of service principal to account ID for delegated administrator registration | `map(string)`  | `{}`                                                                                                                                                                                                                                                                                                  | no       |
| [enabled_policy_types](#input_enabled_policy_types)                   | Policy types to enable in the organization                                      | `list(string)` | [ "SERVICE_CONTROL_POLICY", "TAG_POLICY" ]                                                                                                                                                                                                                                                            | no       |
| [feature_set](#input_feature_set)                                     | Feature set for the organization — ALL or CONSOLIDATED_BILLING                  | `string`       | `"ALL"`                                                                                                                                                                                                                                                                                               | no       |
| [tags](#input_tags)                                                   | Resource tags to apply to all resources                                         | `map(string)`  | `{}`                                                                                                                                                                                                                                                                                                  | no       |




## Outputs


| Name                                               | Description                                 |
| -------------------------------------------------- | ------------------------------------------- |
| [arn](#output_arn)                                 | Organization ARN                            |
| [id](#output_id)                                   | Organization ID                             |
| [master_account_arn](#output_master_account_arn)   | Management account ARN                      |
| [master_account_id](#output_master_account_id)     | Management account ID                       |
| [non_master_accounts](#output_non_master_accounts) | Non-management accounts in the organization |
| [roots](#output_roots)                             | List of organization roots                  |