PolicyAttachment

Source: src/AWS/Organizations/PolicyAttachment.ts

Attaches an Organizations Policy to a root, OU, or account.

Existence-only resource: changing either policyId or targetId replaces the attachment. The policy’s type must already be enabled on the root (see RootPolicyType).

Attaching Policies

Attach an SCP to an Organizational Unit

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

const denyRegions = yield* Policy("DenyOtherRegions", {
  type: "SERVICE_CONTROL_POLICY",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        NotAction: ["iam:*", "organizations:*", "sts:*"],
        Resource: "*",
        Condition: {
          StringNotEquals: { "aws:RequestedRegion": ["us-east-1", "us-west-2"] },
        },
      },
    ],
  },
});

yield* PolicyAttachment("DenyRegionsOnWorkloads", {
  policyId: denyRegions.policyId,
  targetId: workloads.ouId,
});

Attach a Policy to a Member Account

yield* PolicyAttachment("DenyRegionsOnDev", {
  policyId: denyRegions.policyId,
  targetId: devAccount.accountId,
});