Policy

Source: src/AWS/Organizations/Policy.ts

An AWS Organizations policy such as an SCP or tag policy.

Attach it to a root, OU, or account with PolicyAttachment. Changing type or name replaces the policy; document and description changes update in place.

Creating Policies

Service Control Policy (Typed Document)

const denyLeaveOrg = yield* Policy("DenyLeaveOrg", {
  type: "SERVICE_CONTROL_POLICY",
  description: "Prevent member accounts from leaving the organization",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Action: ["organizations:LeaveOrganization"],
        Resource: "*",
      },
    ],
  },
});

Tag Policy (Raw JSON)

const tagPolicy = yield* Policy("RequireEnvTag", {
  type: "TAG_POLICY",
  document: JSON.stringify({
    tags: {
      environment: {
        tag_key: { "@@assign": "environment" },
        tag_value: { "@@assign": ["dev", "staging", "prod"] },
      },
    },
  }),
});

Attaching Policies

const root = yield* Root("Root", {});

const scpEnabled = yield* RootPolicyType("ScpEnabled", {
  rootId: root.rootId,
  policyType: "SERVICE_CONTROL_POLICY",
});

yield* PolicyAttachment("DenyLeaveOrgOnRoot", {
  policyId: denyLeaveOrg.policyId,
  targetId: scpEnabled.rootId,
});