OrganizationResourcePolicy

Source: src/AWS/Organizations/OrganizationResourcePolicy.ts

The singleton AWS Organizations resource policy — an org-level resource-based policy that grants other principals (typically delegated administrator accounts) permission to call Organizations APIs.

There is at most one per organization; Alchemy adopts and reconciles the existing policy if one is already in place.

Setting the Resource Policy

const security = yield* Account("Security", {
  name: "security",
  email: "aws-security@example.com",
  parentId: root.rootId,
});

yield* OrganizationResourcePolicy("OrgResourcePolicy", {
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: security.accountId },
        Action: [
          "organizations:DescribeOrganization",
          "organizations:ListAccounts",
        ],
        Resource: "*",
      },
    ],
  },
});