policy_attachment#

State module for managing Amazon Organizations Policy Attachments.

async idem_aws.states.aws.organizations.policy_attachment.present(hub, ctx, name: str, policy_id: str, target_id: str, resource_id: str = None) → Dict[str, Any][source]#

Attaches a policy to a root, an organizational unit (OU), or an individual account.

How the policy affects accounts depends on the type of policy. The only supported policy types are SERVICE_CONTROL_POLICY, AISERVICES_OPT_OUT_POLICY, TAG_POLICY and BACKUP_POLICY.

Parameters:

name (str) – An Idem name of the resource.
policy_id (str) – The unique identifier (ID) of the policy that you want to attach to the target.
target_id (str) – The unique identifier (ID) of the root, OU, or account that you want to attach the policy to.
resource_id (str, Optional) – The identifier for this object

Request syntax:

[idem_test_aws_organizations_policy_attachment]:
  aws.organizations.policy_attachment.present:
    - name: 'string'
    - policy_id: 'string'
    - target_id: 'string'

Returns:: Dict[str, Any]

Examples

idem_test_aws_organizations_policy_attachment:
  aws.organizations.policy_attachment.present:
    - name: 'idem_test_policy_attachment'
    - policy_id: 'p-123456789012'
    - target_id: 'ou-root-id'

async idem_aws.states.aws.organizations.policy_attachment.absent(hub, ctx, name: str, policy_id: str = None, target_id: str = None) → Dict[str, Any][source]#

Detaches a policy from a target root, organizational unit (OU), or account.

Warning

If the policy being detached is a service control policy (SCP), the changes to permissions for Identity and Access Management (IAM) users and roles in affected accounts are immediate.

Every root, OU, and account must have at least one SCP attached. If you want to replace the default FullAWSAccess policy with an SCP that limits the permissions that can be delegated, you must attach the replacement SCP before you can remove the default SCP. This is the authorization strategy of an allow list. If you instead attach a second SCP and leave the FullAWSAccess SCP still attached, and specify "Effect": "Deny" in the second SCP to override the "Effect": "Allow" in the FullAWSAccess policy (or any other attached SCP), you’re using the authorization strategy of a deny list.

Parameters:

name (str) – An Idem name of the resource.
policy_id (str, Optional) – The unique identifier (ID) of the policy you want to detach.
target_id (str, Optional) – The unique identifier (ID) of the root, OU, or account that you want to detach the policy from.

Request syntax:

[idem_test_aws_organizations_policy_attachment]:
  aws.organizations.policy_attachment.absent:
    - name: 'string'
    - policy_id: 'string'
    - target_id: 'string'

Returns:: Dict[str, Any]

Examples

idem_test_aws_organizations_policy_attachment:
  aws.organizations.policy_attachment.absent:
    - name: 'idem_test_policy_attachment'
    - policy_id: 'p-123456789012'
    - target_id: 'ou-root-id'

async idem_aws.states.aws.organizations.policy_attachment.describe(hub, ctx) → Dict[str, Dict[str, Any]][source]#

Describes AWS Organization Policy attachments in a way that can be recreated/managed with the corresponding “present” function.

This operation can be called only from the organization’s management account or by a member account that is a delegated administrator for an AWS service.

The supported policy types are SERVICE_CONTROL_POLICY, TAG_POLICY, AISERVICES_OPT_OUT_POLICY and BACKUP_POLICY.

Returns:: Dict[str, Dict[str, Any]

Examples

$ idem describe aws.organizations.policy_attachment