organization

Enables and configures AWS Organizations for the management account.

Provisions the AWS Organization with a configurable feature set, enables trusted-access for AWS service principals (GuardDuty, Security Hub, Config, CloudTrail, IAM Identity Center, RAM, Inspector, and others), enables Service Control Policy and Tag Policy types, and registers delegated administrator accounts per service.

When guardduty.amazonaws.com is in delegated_administrators, the module also enables aws_guardduty_organization_admin_account in the provider region (management account). Run the module once per region where GuardDuty org administration is required.

Usage

module "organization" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/organization/aws"
  version = "0.1.0"

  delegated_administrators = {
    "guardduty.amazonaws.com"   = "111122223333"
    "securityhub.amazonaws.com" = "111122223333"
    "config.amazonaws.com"      = "111122223333"
  }
}

Requirements

Name	Version
terraform	>= 1.5.0
aws	~> 5.0

Providers

Name	Version
aws	~> 5.0

Resources

Name	Type
aws_organizations_delegated_administrator.this	resource
aws_organizations_organization.this	resource

Inputs

Name	Description	Type	Default	Required
aws_service_access_principals	AWS service principals to enable as trusted access in the organization	list(string)	[ "cloudtrail.amazonaws.com", "config.amazonaws.com", "config-multiaccountsetup.amazonaws.com", "guardduty.amazonaws.com", "securityhub.amazonaws.com", "ram.amazonaws.com", "sso.amazonaws.com", "account.amazonaws.com", "inspector2.amazonaws.com", "malware-protection.guardduty.amazonaws.com" ]	no
delegated_administrators	Map of service principal to account ID for delegated administrator registration	map(string)	{}	no
enabled_policy_types	Policy types to enable in the organization	list(string)	[ "SERVICE_CONTROL_POLICY", "TAG_POLICY" ]	no
feature_set	Feature set for the organization — ALL or CONSOLIDATED_BILLING	string	"ALL"	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
arn	Organization ARN
id	Organization ID
master_account_arn	Management account ARN
master_account_id	Management account ID
non_master_accounts	Non-management accounts in the organization
roots	List of organization roots