RootPolicyType

Source: src/AWS/Organizations/RootPolicyType.ts

Enables a policy type on an organization root.

A policy type (SCP, tag policy, …) must be enabled on the root before any Policy of that type can be attached via PolicyAttachment. Existence-only resource: changing rootId or policyType replaces it.

Enabling Policy Types

Enable Service Control Policies

const root = yield* Root("Root", {});

const scpEnabled = yield* RootPolicyType("ScpEnabled", {
  rootId: root.rootId,
  policyType: "SERVICE_CONTROL_POLICY",
});

Enable Tag Policies Before Attaching One

const tagPoliciesEnabled = yield* RootPolicyType("TagPoliciesEnabled", {
  rootId: root.rootId,
  policyType: "TAG_POLICY",
});

yield* PolicyAttachment("RequireEnvTagOnRoot", {
  policyId: tagPolicy.policyId,
  // depend on the enablement so attachment happens after it
  targetId: tagPoliciesEnabled.rootId,
});