Skip to content

Commit 015f785

Browse files
ewbankkitewbankkit
authored
Merge pull request hashicorp#45135 from tabito-hara/f-aws_organizations_organization-support_SECURITYHUB_POLICY
[Enhancement] aws_organizations_organization: Add `SECURITYHUB_POLICY` as a valid value of `enabled_policy_types`
2 parents 01f5ad0 + 3f51d34 commit 015f785

File tree

4 files changed

+51
-20
lines changed

4 files changed

+51
-20
lines changed

‎.changelog/45135.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
resource/aws_organizations_organization: Add `SECURITYHUB_POLICY` as a valid value for `enabled_policy_types` argument
3+
```

‎internal/service/organizations/organization.go‎

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -343,37 +343,35 @@ func resourceOrganizationUpdate(ctx context.Context, d *schema.ResourceData, met
343343
var diags diag.Diagnostics
344344
conn := meta.(*conns.AWSClient).OrganizationsClient(ctx)
345345

346-
if d.HasChange("aws_service_access_principals") {
347-
o, n := d.GetChange("aws_service_access_principals")
348-
os, ns := o.(*schema.Set), n.(*schema.Set)
349-
add, del := flex.ExpandStringValueSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
346+
if d.HasChanges("aws_service_access_principals", "enabled_policy_types") {
347+
oa, na := d.GetChange("aws_service_access_principals")
348+
oas, nas := oa.(*schema.Set), na.(*schema.Set)
349+
adda, dela := flex.ExpandStringValueSet(nas.Difference(oas)), flex.ExpandStringValueSet(oas.Difference(nas))
350350

351-
for _, v := range del {
352-
if err := disableServicePrincipal(ctx, conn, v); err != nil {
351+
defaultRootID := d.Get("roots.0.id").(string)
352+
ot, nt := d.GetChange("enabled_policy_types")
353+
ots, nts := ot.(*schema.Set), nt.(*schema.Set)
354+
addt, delt := flex.ExpandStringValueSet(nts.Difference(ots)), flex.ExpandStringValueSet(ots.Difference(nts))
355+
356+
for _, v := range delt {
357+
if err := disablePolicyType(ctx, conn, awstypes.PolicyType(v), defaultRootID); err != nil {
353358
return sdkdiag.AppendFromErr(diags, err)
354359
}
355360
}
356361

357-
for _, v := range add {
358-
if err := enableServicePrincipal(ctx, conn, v); err != nil {
362+
for _, v := range dela {
363+
if err := disableServicePrincipal(ctx, conn, v); err != nil {
359364
return sdkdiag.AppendFromErr(diags, err)
360365
}
361366
}
362-
}
363-
364-
if d.HasChange("enabled_policy_types") {
365-
defaultRootID := d.Get("roots.0.id").(string)
366-
o, n := d.GetChange("enabled_policy_types")
367-
os, ns := o.(*schema.Set), n.(*schema.Set)
368-
add, del := flex.ExpandStringValueSet(ns.Difference(os)), flex.ExpandStringValueSet(os.Difference(ns))
369367

370-
for _, v := range del {
371-
if err := disablePolicyType(ctx, conn, awstypes.PolicyType(v), defaultRootID); err != nil {
368+
for _, v := range adda {
369+
if err := enableServicePrincipal(ctx, conn, v); err != nil {
372370
return sdkdiag.AppendFromErr(diags, err)
373371
}
374372
}
375373

376-
for _, v := range add {
374+
for _, v := range addt {
377375
if err := enablePolicyType(ctx, conn, awstypes.PolicyType(v), defaultRootID); err != nil {
378376
return sdkdiag.AppendFromErr(diags, err)
379377
}

‎internal/service/organizations/organization_test.go‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ func testAccOrganization_basic(t *testing.T) {
4040
resource.TestCheckResourceAttrPair(resourceName, "accounts.0.arn", resourceName, "master_account_arn"),
4141
resource.TestCheckResourceAttrPair(resourceName, "accounts.0.email", resourceName, "master_account_email"),
4242
resource.TestCheckResourceAttrPair(resourceName, "accounts.0.id", resourceName, "master_account_id"),
43-
acctest.CheckResourceAttrGlobalARNFormat(ctx, resourceName, names.AttrARN, "organizations", "organization/o-{id}"),
43+
acctest.CheckResourceAttrGlobalARNFormat(ctx, resourceName, names.AttrARN, "organizations", "organization/{id}"),
4444
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
4545
resource.TestCheckResourceAttr(resourceName, "feature_set", string(awstypes.OrganizationFeatureSetAll)),
4646
acctest.MatchResourceAttrGlobalARN(ctx, resourceName, "master_account_arn", "organizations", regexache.MustCompile(`account/`+organizationIDRegexPattern+`/\d{12}$`)),
@@ -146,6 +146,7 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
146146
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeServiceControlPolicy)),
147147
Check: resource.ComposeTestCheckFunc(
148148
testAccCheckOrganizationExists(ctx, resourceName, &organization),
149+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
149150
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
150151
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeServiceControlPolicy)),
151152
),
@@ -159,13 +160,15 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
159160
Config: testAccOrganizationConfig_basic,
160161
Check: resource.ComposeTestCheckFunc(
161162
testAccCheckOrganizationExists(ctx, resourceName, &organization),
163+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
162164
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "0"),
163165
),
164166
},
165167
{
166168
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeAiservicesOptOutPolicy)),
167169
Check: resource.ComposeTestCheckFunc(
168170
testAccCheckOrganizationExists(ctx, resourceName, &organization),
171+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
169172
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
170173
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeAiservicesOptOutPolicy)),
171174
),
@@ -174,6 +177,7 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
174177
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeServiceControlPolicy)),
175178
Check: resource.ComposeTestCheckFunc(
176179
testAccCheckOrganizationExists(ctx, resourceName, &organization),
180+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
177181
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
178182
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeServiceControlPolicy)),
179183
),
@@ -182,6 +186,7 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
182186
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeBackupPolicy)),
183187
Check: resource.ComposeTestCheckFunc(
184188
testAccCheckOrganizationExists(ctx, resourceName, &organization),
189+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
185190
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
186191
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeBackupPolicy)),
187192
),
@@ -190,6 +195,7 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
190195
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeChatbotPolicy)),
191196
Check: resource.ComposeTestCheckFunc(
192197
testAccCheckOrganizationExists(ctx, resourceName, &organization),
198+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
193199
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
194200
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeChatbotPolicy)),
195201
),
@@ -198,6 +204,7 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
198204
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeDeclarativePolicyEc2)),
199205
Check: resource.ComposeTestCheckFunc(
200206
testAccCheckOrganizationExists(ctx, resourceName, &organization),
207+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
201208
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
202209
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeDeclarativePolicyEc2)),
203210
),
@@ -206,6 +213,7 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
206213
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeResourceControlPolicy)),
207214
Check: resource.ComposeTestCheckFunc(
208215
testAccCheckOrganizationExists(ctx, resourceName, &organization),
216+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
209217
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
210218
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeResourceControlPolicy)),
211219
),
@@ -214,10 +222,21 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
214222
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeTagPolicy)),
215223
Check: resource.ComposeTestCheckFunc(
216224
testAccCheckOrganizationExists(ctx, resourceName, &organization),
225+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
217226
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
218227
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeTagPolicy)),
219228
),
220229
},
230+
{
231+
Config: testAccOrganizationConfig_enabledPolicyTypeWithServiceAccessPrincipals(string(awstypes.PolicyTypeSecurityhubPolicy), "securityhub.amazonaws.com"),
232+
Check: resource.ComposeTestCheckFunc(
233+
testAccCheckOrganizationExists(ctx, resourceName, &organization),
234+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "1"),
235+
resource.TestCheckTypeSetElemAttr(resourceName, "aws_service_access_principals.*", "securityhub.amazonaws.com"),
236+
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
237+
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeSecurityhubPolicy)),
238+
),
239+
},
221240
{
222241
ResourceName: resourceName,
223242
ImportState: true,
@@ -227,13 +246,15 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
227246
Config: testAccOrganizationConfig_basic,
228247
Check: resource.ComposeTestCheckFunc(
229248
testAccCheckOrganizationExists(ctx, resourceName, &organization),
249+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
230250
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "0"),
231251
),
232252
},
233253
{
234254
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeTagPolicy)),
235255
Check: resource.ComposeTestCheckFunc(
236256
testAccCheckOrganizationExists(ctx, resourceName, &organization),
257+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
237258
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
238259
),
239260
},
@@ -435,6 +456,15 @@ resource "aws_organizations_organization" "test" {
435456
`, policyType1)
436457
}
437458

459+
func testAccOrganizationConfig_enabledPolicyTypeWithServiceAccessPrincipals(policyType1, serviceAccessPrincipals string) string {
460+
return fmt.Sprintf(`
461+
resource "aws_organizations_organization" "test" {
462+
aws_service_access_principals = [%[2]q]
463+
enabled_policy_types = [%[1]q]
464+
}
465+
`, policyType1, serviceAccessPrincipals)
466+
}
467+
438468
func testAccOrganizationConfig_featureSet(featureSet string) string {
439469
return fmt.Sprintf(`
440470
resource "aws_organizations_organization" "test" {

‎website/docs/r/organizations_organization.html.markdown‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ resource "aws_organizations_organization" "org" {
3232
This resource supports the following arguments:
3333

3434
* `aws_service_access_principals` - (Optional) List of AWS service principal names for which you want to enable integration with your organization. This is typically in the form of a URL, such as service-abbreviation.amazonaws.com. Organization must have `feature_set` set to `ALL`. Some services do not support enablement via this endpoint, see [warning in aws docs](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html).
35-
* `enabled_policy_types` - (Optional) List of Organizations policy types to enable in the Organization Root. Organization must have `feature_set` set to `ALL`. For additional information about valid policy types (e.g., `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `CHATBOT_POLICY`, `DECLARATIVE_POLICY_EC2`, `RESOURCE_CONTROL_POLICY`, `SERVICE_CONTROL_POLICY`, and `TAG_POLICY`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html).
35+
* `enabled_policy_types` - (Optional) List of Organizations policy types to enable in the Organization Root. Organization must have `feature_set` set to `ALL`. For additional information about valid policy types (e.g., `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `CHATBOT_POLICY`, `DECLARATIVE_POLICY_EC2`, `RESOURCE_CONTROL_POLICY`, `SECURITYHUB_POLICY`, `SERVICE_CONTROL_POLICY`, and `TAG_POLICY`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html). To enable `SECURITYHUB_POLICY`, `aws_service_access_principals` must include `securityhub.amazonaws.com`.
3636
* `feature_set` - (Optional) Specify `ALL` (default) or `CONSOLIDATED_BILLING`.
3737

3838
## Attribute Reference

0 commit comments

Comments
 (0)