allow 'Root' as an OU name to apply a stackset to all accounts in our Organization

[RutgerBeyen]

Allow a Cloudformation Stackset to be deployed to all accounts in the AWS Organization with a single statement, in stead of having to supply all OUs or AccountIDs separately.
This code allows the use of

deploy_to_ou:
  - Root

in the manifest file.
The result is that the affected Cloudformation Stack will be deployed in every account under the AWS Organization, including the master account.

Allow an SCP to be attached to the Root level of the AWS Organization with a single statement, in stead of having to supply all OUs separately.
This code allows the use of

apply_to_accounts_in_ou:
  - Root

in the manifest file.
The result is that the affected SCP is attached at the 'root' level of the AWS Organization, and consequently inherited by all OUs and accounts automatically.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[groverlalit]

Thanks for opening the the pull request. We have added this to our backlog.

[RobReus]

@groverlalit with the recent 1.2.0 release, was this one included in? We really need this feature for our use-cases, and from the looks of this PR, its ready to be merged in.

[jefp]

@groverlalit with the recent 1.2.0 release, was this one included in? We really need this feature for our use-cases, and from the looks of this PR, its ready to be merged in.

+1 I have a customer with this need too.

[abragg]

+1
I need to install additional processing for account-factory lifecycle events.

[abragg]

accounts_in_all_ous is not defined in this context. I believe a better change would be to lines 255 and 256 (now 259 and 260).

        _ou_name_to_id_map = {"Root":root_id}
        _all_ou_ids = [root_id]

[adamcousins]

Does the current version support

deploy_to_ou: 
      - Root

and is the current behaviour able to deploy to the Master account?

For those wondering, you can move the Master account into a new OU created and then you can target that OU (ie target the master account). Such as:

deploy_to_ou: 
      - OU_WITH_MASTER_ACCOUNT_INSIDE_IT

[jefp]

This could break the upgrades of Control Tower.
During a repair, CT will move the master account into the Root OU.

Does the current version support

deploy_to_ou: 
      - Root

and is the current behaviour able to deploy to the Master account?

For those wondering, you can move the Master account into a new OU created and then you can target that OU (ie target the master account). Such as:

deploy_to_ou: 
      - OU_WITH_MASTER_ACCOUNT_INSIDE_IT

[mikkelramlov]

+1

[hunttom]

++1. This a blocker for me. Why hasn't this been merged yet? This seems like an good recommendation.

[rakshb]

@hunttom This is currently in our backlog. We have other highly requested features that we are adding in the next release of CFCT.. We will review this request in a future update

[hunttom]

@hunttom This is currently in our backlog. We have other highly requested features that we are adding in the next release of CFCT.. We will review this request in a future update

Thanks, we are eagerly looking forward to it!

[gschaffer-cxn]

@rakshb any estimation on release? Could we have maybe some transparency what you are working on a la https://github.com/aws/containers-roadmap/projects/1 ?

[aijunpeng]

This feature has been released.