Skip to content

Commit 0883ca6

Browse files
author
AWS
committed
AWS Organizations Update: This release introduces 2 new APIs in Organizations: 1. ListAccountsWithInvalidEffectivePolicy 2. ListEffectivePolicyValidationErrors
1 parent f70e5b8 commit 0883ca6

File tree

3 files changed

+185
-0
lines changed

3 files changed

+185
-0
lines changed

‎.changes/next-release/feature-AWSOrganizations-c0301ed.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "AWS Organizations",
4+
"contributor": "",
5+
"description": "This release introduces 2 new APIs in Organizations: 1. ListAccountsWithInvalidEffectivePolicy 2. ListEffectivePolicyValidationErrors"
6+
}

‎services/organizations/src/main/resources/codegen-resources/paginators-1.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@
1515
"limit_key": "MaxResults",
1616
"output_token": "NextToken"
1717
},
18+
"ListAccountsWithInvalidEffectivePolicy": {
19+
"input_token": "NextToken",
20+
"limit_key": "MaxResults",
21+
"output_token": "NextToken",
22+
"result_key": "Accounts"
23+
},
1824
"ListChildren": {
1925
"input_token": "NextToken",
2026
"limit_key": "MaxResults",
@@ -37,6 +43,12 @@
3743
"output_token": "NextToken",
3844
"result_key": "DelegatedServices"
3945
},
46+
"ListEffectivePolicyValidationErrors": {
47+
"input_token": "NextToken",
48+
"limit_key": "MaxResults",
49+
"output_token": "NextToken",
50+
"result_key": "EffectivePolicyValidationErrors"
51+
},
4052
"ListHandshakesForAccount": {
4153
"input_token": "NextToken",
4254
"limit_key": "MaxResults",

‎services/organizations/src/main/resources/codegen-resources/service-2.json

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -696,6 +696,26 @@
696696
],
697697
"documentation":"<p>Lists the accounts in an organization that are contained by the specified target root or organizational unit (OU). If you specify the root, you get a list of all the accounts that aren't in any OU. If you specify an OU, you get a list of all the accounts in only that OU and not in any child OUs. To get a list of all accounts in the organization, use the <a>ListAccounts</a> operation.</p> <note> <p>Always check the <code>NextToken</code> response parameter for a <code>null</code> value when calling a <code>List*</code> operation. These operations can occasionally return an empty set of results even when there are more results available. The <code>NextToken</code> response parameter value is <code>null</code> <i>only</i> when there are no more results to display.</p> </note> <p>This operation can be called only from the organization's management account or by a member account that is a delegated administrator.</p>"
698698
},
699+
"ListAccountsWithInvalidEffectivePolicy":{
700+
"name":"ListAccountsWithInvalidEffectivePolicy",
701+
"http":{
702+
"method":"POST",
703+
"requestUri":"/"
704+
},
705+
"input":{"shape":"ListAccountsWithInvalidEffectivePolicyRequest"},
706+
"output":{"shape":"ListAccountsWithInvalidEffectivePolicyResponse"},
707+
"errors":[
708+
{"shape":"AccessDeniedException"},
709+
{"shape":"AWSOrganizationsNotInUseException"},
710+
{"shape":"ConstraintViolationException"},
711+
{"shape":"EffectivePolicyNotFoundException"},
712+
{"shape":"ServiceException"},
713+
{"shape":"TooManyRequestsException"},
714+
{"shape":"InvalidInputException"},
715+
{"shape":"UnsupportedAPIEndpointException"}
716+
],
717+
"documentation":"<p>Lists all the accounts in an organization that have invalid effective policies. An <i>invalid effective policy</i> is an <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_effective.html\">effective policy</a> that fails validation checks, resulting in the effective policy not being fully enforced on all the intended accounts within an organization.</p> <p>This operation can be called only from the organization's management account or by a member account that is a delegated administrator.</p>"
718+
},
699719
"ListChildren":{
700720
"name":"ListChildren",
701721
"http":{
@@ -772,6 +792,27 @@
772792
],
773793
"documentation":"<p>List the Amazon Web Services services for which the specified account is a delegated administrator.</p> <p>This operation can be called only from the organization's management account or by a member account that is a delegated administrator.</p>"
774794
},
795+
"ListEffectivePolicyValidationErrors":{
796+
"name":"ListEffectivePolicyValidationErrors",
797+
"http":{
798+
"method":"POST",
799+
"requestUri":"/"
800+
},
801+
"input":{"shape":"ListEffectivePolicyValidationErrorsRequest"},
802+
"output":{"shape":"ListEffectivePolicyValidationErrorsResponse"},
803+
"errors":[
804+
{"shape":"AccessDeniedException"},
805+
{"shape":"AWSOrganizationsNotInUseException"},
806+
{"shape":"ConstraintViolationException"},
807+
{"shape":"EffectivePolicyNotFoundException"},
808+
{"shape":"ServiceException"},
809+
{"shape":"TooManyRequestsException"},
810+
{"shape":"AccountNotFoundException"},
811+
{"shape":"InvalidInputException"},
812+
{"shape":"UnsupportedAPIEndpointException"}
813+
],
814+
"documentation":"<p>Lists all the validation errors on an <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_effective.html\">effective policy</a> for a specified account and policy type.</p> <p>This operation can be called only from the organization's management account or by a member account that is a delegated administrator.</p>"
815+
},
775816
"ListHandshakesForAccount":{
776817
"name":"ListHandshakesForAccount",
777818
"http":{
@@ -2075,6 +2116,32 @@
20752116
"SECURITYHUB_POLICY"
20762117
]
20772118
},
2119+
"EffectivePolicyValidationError":{
2120+
"type":"structure",
2121+
"members":{
2122+
"ErrorCode":{
2123+
"shape":"ErrorCode",
2124+
"documentation":"<p>The error code for the validation error. For example, <code>ELEMENTS_TOO_MANY</code>.</p>"
2125+
},
2126+
"ErrorMessage":{
2127+
"shape":"ErrorMessage",
2128+
"documentation":"<p>The error message for the validation error.</p>"
2129+
},
2130+
"PathToError":{
2131+
"shape":"PathToError",
2132+
"documentation":"<p>The path within the effective policy where the validation error occurred.</p>"
2133+
},
2134+
"ContributingPolicies":{
2135+
"shape":"PolicyIds",
2136+
"documentation":"<p>The individual policies <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_mgmt.html\">inherited</a> and <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_policies_attach.html\">attached</a> to the account which contributed to the validation error.</p>"
2137+
}
2138+
},
2139+
"documentation":"<p>Contains details about the validation errors that occurred when generating or enforcing an <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_effective.html\">effective policy</a>, such as which policies contributed to the error and location of the error.</p>"
2140+
},
2141+
"EffectivePolicyValidationErrors":{
2142+
"type":"list",
2143+
"member":{"shape":"EffectivePolicyValidationError"}
2144+
},
20782145
"Email":{
20792146
"type":"string",
20802147
"max":64,
@@ -2149,6 +2216,8 @@
21492216
"type":"list",
21502217
"member":{"shape":"EnabledServicePrincipal"}
21512218
},
2219+
"ErrorCode":{"type":"string"},
2220+
"ErrorMessage":{"type":"string"},
21522221
"ExceptionMessage":{"type":"string"},
21532222
"ExceptionType":{"type":"string"},
21542223
"FinalizingOrganizationException":{
@@ -2530,6 +2599,41 @@
25302599
}
25312600
}
25322601
},
2602+
"ListAccountsWithInvalidEffectivePolicyRequest":{
2603+
"type":"structure",
2604+
"required":["PolicyType"],
2605+
"members":{
2606+
"PolicyType":{
2607+
"shape":"EffectivePolicyType",
2608+
"documentation":"<p>The type of policy that you want information about. You can specify one of the following values:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html\">DECLARATIVE_POLICY_EC2</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_backup.html\">BACKUP_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html\">TAG_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_chatbot.html\">CHATBOT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html\">AISERVICES_OPT_OUT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub.html\">SECURITYHUB_POLICY</a> </p> </li> </ul>"
2609+
},
2610+
"NextToken":{
2611+
"shape":"NextToken",
2612+
"documentation":"<p>The parameter for receiving additional results if you receive a <code>NextToken</code> response in a previous request. A <code>NextToken</code> response indicates that more output is available. Set this parameter to the value of the previous call's <code>NextToken</code> response to indicate where the output should continue from.</p>"
2613+
},
2614+
"MaxResults":{
2615+
"shape":"MaxResults",
2616+
"documentation":"<p>The total number of results that you want included on each page of the response. If you do not include this parameter, it defaults to a value that is specific to the operation. If additional items exist beyond the maximum you specify, the <code>NextToken</code> response element is present and has a value (is not null). Include that value as the <code>NextToken</code> request parameter in the next call to the operation to get the next part of the results. Note that Organizations might return fewer results than the maximum even when there are more results available. You should check <code>NextToken</code> after every operation to ensure that you receive all of the results.</p>"
2617+
}
2618+
}
2619+
},
2620+
"ListAccountsWithInvalidEffectivePolicyResponse":{
2621+
"type":"structure",
2622+
"members":{
2623+
"Accounts":{
2624+
"shape":"Accounts",
2625+
"documentation":"<p>The accounts in the organization which have an invalid effective policy for the specified policy type.</p>"
2626+
},
2627+
"PolicyType":{
2628+
"shape":"EffectivePolicyType",
2629+
"documentation":"<p>The specified policy type. One of the following values:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html\">DECLARATIVE_POLICY_EC2</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_backup.html\">BACKUP_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html\">TAG_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_chatbot.html\">CHATBOT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html\">AISERVICES_OPT_OUT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub.html\">SECURITYHUB_POLICY</a> </p> </li> </ul>"
2630+
},
2631+
"NextToken":{
2632+
"shape":"NextToken",
2633+
"documentation":"<p>If present, indicates that more output is available than is included in the current response. Use this value in the <code>NextToken</code> request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the <code>NextToken</code> response element comes back as <code>null</code>.</p>"
2634+
}
2635+
}
2636+
},
25332637
"ListChildrenRequest":{
25342638
"type":"structure",
25352639
"required":[
@@ -2659,6 +2763,60 @@
26592763
}
26602764
}
26612765
},
2766+
"ListEffectivePolicyValidationErrorsRequest":{
2767+
"type":"structure",
2768+
"required":[
2769+
"AccountId",
2770+
"PolicyType"
2771+
],
2772+
"members":{
2773+
"AccountId":{
2774+
"shape":"AccountId",
2775+
"documentation":"<p>The ID of the account that you want details about. Specifying an organization root or organizational unit (OU) as the target is not supported.</p>"
2776+
},
2777+
"PolicyType":{
2778+
"shape":"EffectivePolicyType",
2779+
"documentation":"<p>The type of policy that you want information about. You can specify one of the following values:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html\">DECLARATIVE_POLICY_EC2</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_backup.html\">BACKUP_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html\">TAG_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_chatbot.html\">CHATBOT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html\">AISERVICES_OPT_OUT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub.html\">SECURITYHUB_POLICY</a> </p> </li> </ul>"
2780+
},
2781+
"NextToken":{
2782+
"shape":"NextToken",
2783+
"documentation":"<p>The parameter for receiving additional results if you receive a <code>NextToken</code> response in a previous request. A <code>NextToken</code> response indicates that more output is available. Set this parameter to the value of the previous call's <code>NextToken</code> response to indicate where the output should continue from.</p>"
2784+
},
2785+
"MaxResults":{
2786+
"shape":"MaxResults",
2787+
"documentation":"<p>The total number of results that you want included on each page of the response. If you do not include this parameter, it defaults to a value that is specific to the operation. If additional items exist beyond the maximum you specify, the <code>NextToken</code> response element is present and has a value (is not null). Include that value as the <code>NextToken</code> request parameter in the next call to the operation to get the next part of the results. Note that Organizations might return fewer results than the maximum even when there are more results available. You should check <code>NextToken</code> after every operation to ensure that you receive all of the results.</p>"
2788+
}
2789+
}
2790+
},
2791+
"ListEffectivePolicyValidationErrorsResponse":{
2792+
"type":"structure",
2793+
"members":{
2794+
"AccountId":{
2795+
"shape":"AccountId",
2796+
"documentation":"<p>The ID of the specified account.</p>"
2797+
},
2798+
"PolicyType":{
2799+
"shape":"EffectivePolicyType",
2800+
"documentation":"<p>The specified policy type. One of the following values:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative.html\">DECLARATIVE_POLICY_EC2</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_backup.html\">BACKUP_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html\">TAG_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_chatbot.html\">CHATBOT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html\">AISERVICES_OPT_OUT_POLICY</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub.html\">SECURITYHUB_POLICY</a> </p> </li> </ul>"
2801+
},
2802+
"Path":{
2803+
"shape":"Path",
2804+
"documentation":"<p>The path in the organization where the specified account exists.</p>"
2805+
},
2806+
"EvaluationTimestamp":{
2807+
"shape":"Timestamp",
2808+
"documentation":"<p>The time when the latest effective policy was generated for the specified account.</p>"
2809+
},
2810+
"NextToken":{
2811+
"shape":"NextToken",
2812+
"documentation":"<p>If present, indicates that more output is available than is included in the current response. Use this value in the <code>NextToken</code> request parameter in a subsequent call to the operation to get the next part of the output. You should repeat this until the <code>NextToken</code> response element comes back as <code>null</code>.</p>"
2813+
},
2814+
"EffectivePolicyValidationErrors":{
2815+
"shape":"EffectivePolicyValidationErrors",
2816+
"documentation":"<p>The <code>EffectivePolicyValidationError</code> object contains details about the validation errors that occurred when generating or enforcing an effective policy, such as which policies contributed to the error and location of the error.</p>"
2817+
}
2818+
}
2819+
},
26622820
"ListHandshakesForAccountRequest":{
26632821
"type":"structure",
26642822
"members":{
@@ -3131,6 +3289,11 @@
31313289
"type":"list",
31323290
"member":{"shape":"Parent"}
31333291
},
3292+
"Path":{
3293+
"type":"string",
3294+
"pattern":"^(o-[a-z0-9]{10,32}\\/r-[0-9a-z]{4,32}(\\/ou\\-[0-9a-z]{4,32}-[a-z0-9]{8,32})*(\\/\\d{12})*)\\/"
3295+
},
3296+
"PathToError":{"type":"string"},
31343297
"Policies":{
31353298
"type":"list",
31363299
"member":{"shape":"PolicySummary"}
@@ -3176,6 +3339,10 @@
31763339
"max":130,
31773340
"pattern":"^p-[0-9a-zA-Z_]{8,128}$"
31783341
},
3342+
"PolicyIds":{
3343+
"type":"list",
3344+
"member":{"shape":"PolicyId"}
3345+
},
31793346
"PolicyInUseException":{
31803347
"type":"structure",
31813348
"members":{

0 commit comments

Comments
 (0)