terraform-aws-organization-policies

Deploy SCPs, RCPs, and other AWS organization policies with Terraform.

Module Inputs

module "scps" {
  source      = "aws-samples/organization-policies/aws"
  version     = "3.1.0"
  policytype = "SERVICECONTROL_POLICY"
  ou_map = {
    "r-1xyz"           = ["root", "allow_services"] #root
    "ou-abcd-11223344" = ["sandbox"]                #sandbox ou
    "ou-efgh-22334455" = ["ssm"]                    #workload ou
  }
}

module "rcps" {
  source      = "aws-samples/organization-policies/aws"
  version     = "3.1.0"
  policytype = "RESOURCECONTROL_POLICY"
  ou_map = {
    "r-1xyz" = ["root"] #root
  }
}

policy_type is the type of organizational policy. A new module needs to be created for each policy type.

oumap is a map of OU IDs and the policies attached to them. Policies are stored as json files in an adjacent directory. The directory name defaults to the policy type, eg ./servicecontrol_policy/.

The above two module inputs would look like this:

. ├── resourcecontrolpolicy │   └── root.json ├── servicecontrolpolicy │   ├── allow_services.json │   ├── root.json │   ├── sandbox.json │   └── ssm.json └── main.tf

Optional Inputs

module "scps" {
  ... 
  policies_directory = "policies/scps"
}

policiesdirectory overrides the name and location of the directory used to store policies. Otherwise it will default to the name of the policy type, eg ./servicecontrol_policy/.

Template Files

The module accepts template files (.json.tpl). These can be inputted alongside json files.

module "scps" {   source      = "aws-samples/organization-policies/aws"   version     = "3.1.0"   policytype = "SERVICECONTROL_POLICY"   ou_map = {     "r-1xyz"           = ["root", "iam"] #root   }   template_variables = {     managementaccountid = var.managementaccountid   } }

• Managing organization policies with AWS Organizations
• Service Control Policy (SCP) examples
• Resource Control Policy (RCP) examples
• Declarative policy syntax and examples
• Backup policy syntax and examples
• Tag policy syntax and examples
• AI policy syntax and examples
• aws-samples/data-perimeter-policy-examples
• aws-samples/service-control-policy-examples
• Resource: awsorganizationspolicy
• Resource: awsorganizationspolicyattachment
• Terraform Registry: aws-samples/organization-policies/aws

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.