Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add data sources aws_organizations_organizational_unit_child_accounts and aws_organizations_organizational_unit_descendant_accounts #24350

Conversation

ahublersos
Copy link
Contributor

@ahublersos ahublersos commented Apr 21, 2022

Community Note

  • Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
  • Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Description

Closes #16153
Closes #18589.

This PR adds two data sources that allow the retrieval of a list of account IDs based on an AWS organizations Organizational Unit ID.

The aws_organizations_organizational_unit_child_accounts data source provides the immediate child accounts while the aws_organizations_organizational_unit_descendant_accounts provides all generations of child account IDs under the given OU.

Output from acceptance testing:
I'm still having trouble getting acceptance tests to run. I'm sure it's something simple I'm missing with the test framework. (Open to any suggestions!)
Cleanup from testing is tricky since all the accounts need to be manually deleted.

❯ make testacc TESTS=testAccOrganizationalUnitChildAccountsDataSource_basic PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20 -run='testAccOrganizationalUnitChildAccountsDataSource_basic'  -timeout 180m
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	3.254s [no tests to run]
❯ make testacc TESTS=testAccOrganizationalUnitDescendantAccountsDataSource_basic PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20 -run='testAccOrganizationalUnitDescendantAccountsDataSource_basic'  -timeout 180m
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	3.162s [no tests to run]

I did do some manual testing. Info on that is below, with emails and account IDs replaced with generic values.
My test org for manual testing looks like this:

  • Root OU
    • Account "test0" (000000000000)
    • Account "provider-test-mgmt" (444444444444)
    • OU "TestA"
    • OU "Test0"
      • Account "test1" (111111111111)
      • OU "Test1"
        • Account "test2" (222222222222)

My test config:


data "aws_organizations_organization" "test" {
}

resource "aws_organizations_account" "test0" {
  name  = "test0"
  email = "someaddr+test0@somedomain.com"
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

resource "aws_organizations_organizational_unit" "test0" {
  name      = "test0"
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

resource "aws_organizations_account" "test1" {
  name  = "test1"
  email = "someaddr+test1@somedomain.com"
  parent_id = aws_organizations_organizational_unit.test0.id
}

resource "aws_organizations_organizational_unit" "test1" {
  name      = "test1"
  parent_id = aws_organizations_organizational_unit.test0.id
}

resource "aws_organizations_account" "test2" {
  name  = "test2"
  email = "someaddr+test2@somedomain.com"
  parent_id = aws_organizations_organizational_unit.test1.id
}

resource "aws_organizations_organizational_unit" "testA" {
  name      = "testA"
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

data "aws_organizations_organizational_unit_descendant_accounts" "test" {
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

data "aws_organizations_organizational_unit_child_accounts" "test" {
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

data "aws_organizations_organizational_unit_descendant_accounts" "test0" {
  parent_id = aws_organizations_organizational_unit.test0.id
}

data "aws_organizations_organizational_unit_child_accounts" "test0" {
  parent_id = aws_organizations_organizational_unit.test0.id
}

data "aws_organizations_organizational_unit_descendant_accounts" "testA" {
  parent_id = aws_organizations_organizational_unit.testA.id
}

data "aws_organizations_organizational_unit_child_accounts" "testA" {
  parent_id = aws_organizations_organizational_unit.testA.id
}

output "root_descendant_ids" {
  value = data.aws_organizations_organizational_unit_descendant_accounts.test.accounts[*].id
}

output "root_children" {
  value = data.aws_organizations_organizational_unit_child_accounts.test
}

output "test0_descendants" {
  value = data.aws_organizations_organizational_unit_descendant_accounts.test0
}

output "test0_children" {
  value = data.aws_organizations_organizational_unit_child_accounts.test0
}

output "testA_descendants" {
  value = data.aws_organizations_organizational_unit_descendant_accounts.testA
}

output "testA_children" {
  value = data.aws_organizations_organizational_unit_child_accounts.testA
}

Output from some manual testing:

❯ terraform output

root_children = {
  "accounts" = tolist([
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/444444444444"
      "email" = "someaddr@somedomain.com"
      "id" = "444444444444"
      "name" = "provider-test-mgmt"
      "status" = "ACTIVE"
    },
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/000000000000"
      "email" = "someaddr+test0@somedomain.com"
      "id" = "000000000000"
      "name" = "test0"
      "status" = "ACTIVE"
    },
  ])
  "id" = "r-eca0"
  "parent_id" = "r-eca0"
}
root_descendant_ids = tolist([
  "444444444444",
  "000000000000",
  "111111111111",
  "222222222222",
])
test0_children = {
  "accounts" = tolist([
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/111111111111"
      "email" = "someaddr+test1@somedomain.com"
      "id" = "111111111111"
      "name" = "test1"
      "status" = "ACTIVE"
    },
  ])
  "id" = "ou-eca0-cno43299"
  "parent_id" = "ou-eca0-cno43299"
}
test0_descendants = {
  "accounts" = tolist([
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/111111111111"
      "email" = "someaddr+test1@somedomain.com"
      "id" = "111111111111"
      "name" = "test1"
      "status" = "ACTIVE"
    },
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/222222222222"
      "email" = "someaddr+test2@somedomain.com"
      "id" = "222222222222"
      "name" = "test2"
      "status" = "ACTIVE"
    },
  ])
  "id" = "ou-eca0-cno43299"
  "parent_id" = "ou-eca0-cno43299"
}
testA_children = {
  "accounts" = tolist([])
  "id" = "ou-eca0-f8gxkt9v"
  "parent_id" = "ou-eca0-f8gxkt9v"
}
testA_descendants = {
  "accounts" = tolist([])
  "id" = "ou-eca0-f8gxkt9v"
  "parent_id" = "ou-eca0-f8gxkt9v"
}

@github-actions github-actions bot added documentation Introduces or discusses updates to documentation. provider Pertains to the provider itself, rather than any interaction with AWS. service/organizations Issues and PRs that pertain to the organizations service. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure. needs-triage Waiting for first response or review from a maintainer. size/XL Managed by automation to categorize the size of a PR. labels Apr 21, 2022
Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Welcome @ahublersos 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

@justinretzolk justinretzolk added new-data-source Introduces a new data source. and removed needs-triage Waiting for first response or review from a maintainer. labels Apr 22, 2022
@github-actions github-actions bot removed service/appflow Issues and PRs that pertain to the appflow service. flex Pertains to FLatteners and EXpanders. labels Oct 19, 2022
@ahublersos
Copy link
Contributor Author

ahublersos commented Oct 21, 2022

I'm still having trouble getting tests to run. Below is the output I get when attempting to run the testAccOrganizationalUnitDescendantAccountsDataSource_basic test.

Some observations/things I've tried:

  • I've set up a fresh AWS account with an AdministratorAccess user, generated credentials for that user, placed them in the default profile, then ran export AWS_PROFILE=default before running the make testacc command.
  • I never see any organization or new accounts created in the aws console.
  • Changing the assertions in the test (ex: check resource2 has the attributes of resource1) has no effect on the output.
  • I get similar output when running an existing test, like testAccOrganizationalUnitsDataSource_basic

Test output:

❯ make testacc TESTS=testAccOrganizationalUnitDescendantAccountsDataSource_basic PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20 -run='testAccOrganizationalUnitDescendantAccountsDataSource_basic'  -timeout 180m
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	3.925s [no tests to run]

shoekstra added a commit to schubergphilis/terraform-provider-mcaf that referenced this pull request Oct 27, 2022
Currently there is no way to recursively find all OUs in an AWS
Organisation via a data resource and doesn't look like
hashicorp/terraform-provider-aws#24350 will get
merged any time soon, so mcaf_aws_all_organizational_units fills this
gap until such a resource exists in the community AWS provider.

Signed-off-by: Stephen Hoekstra <shoekstra@schubergphilis.com>
shoekstra added a commit to schubergphilis/terraform-provider-mcaf that referenced this pull request Oct 27, 2022
Currently there is no way to recursively find all OUs in an AWS
Organisation via a data resource and doesn't look like
hashicorp/terraform-provider-aws#24350 will get
merged any time soon, so mcaf_aws_all_organizational_units fills this
gap until such a resource exists in the community AWS provider.

Signed-off-by: Stephen Hoekstra <shoekstra@schubergphilis.com>
shoekstra added a commit to schubergphilis/terraform-provider-mcaf that referenced this pull request Oct 28, 2022
Currently there is no way to recursively find all OUs in an AWS
Organisation via a data resource and doesn't look like
hashicorp/terraform-provider-aws#24350 will get
merged any time soon, so mcaf_aws_all_organizational_units fills this
gap until such a resource exists in the community AWS provider.

Signed-off-by: Stephen Hoekstra <shoekstra@schubergphilis.com>
shoekstra added a commit to schubergphilis/terraform-provider-mcaf that referenced this pull request Oct 30, 2022
Currently there is no way to recursively find all OUs in an AWS
Organisation via a data resource and doesn't look like
hashicorp/terraform-provider-aws#24350 will get
merged any time soon, so mcaf_aws_all_organizational_units fills this
gap until such a resource exists in the community AWS provider.

Signed-off-by: Stephen Hoekstra <shoekstra@schubergphilis.com>
shoekstra added a commit to schubergphilis/terraform-provider-mcaf that referenced this pull request Nov 2, 2022
Currently there is no way to recursively find all OUs in an AWS
Organisation via a data resource and doesn't look like
hashicorp/terraform-provider-aws#24350 will get
merged any time soon, so mcaf_aws_all_organizational_units fills this
gap until such a resource exists in the community AWS provider.

Signed-off-by: Stephen Hoekstra <shoekstra@schubergphilis.com>
Copy link
Contributor

@ewbankkit ewbankkit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccOrganizations_serial/Organization/ChildAccountsDataSource' PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20  -run=TestAccOrganizations_serial/Organization/ChildAccountsDataSource -timeout 180m
=== RUN   TestAccOrganizations_serial
=== PAUSE TestAccOrganizations_serial
=== CONT  TestAccOrganizations_serial
=== RUN   TestAccOrganizations_serial/Organization
=== RUN   TestAccOrganizations_serial/Organization/ChildAccountsDataSource
=== RUN   TestAccOrganizations_serial/OrganizationalUnit
=== RUN   TestAccOrganizations_serial/OrganizationalUnits
--- PASS: TestAccOrganizations_serial (14.35s)
    --- PASS: TestAccOrganizations_serial/Organization (14.35s)
        --- PASS: TestAccOrganizations_serial/Organization/ChildAccountsDataSource (14.35s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnit (0.00s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnits (0.00s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	19.574s
% make testacc TESTARGS='-run=TestAccOrganizations_serial/OrganizationalUnits/DataSource' PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20  -run=TestAccOrganizations_serial/OrganizationalUnits/DataSource -timeout 180m
=== RUN   TestAccOrganizations_serial
=== PAUSE TestAccOrganizations_serial
=== CONT  TestAccOrganizations_serial
=== RUN   TestAccOrganizations_serial/OrganizationalUnits
=== RUN   TestAccOrganizations_serial/OrganizationalUnits/DataSource
--- PASS: TestAccOrganizations_serial (17.59s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnits (17.59s)
        --- PASS: TestAccOrganizations_serial/OrganizationalUnits/DataSource (17.59s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	23.246s
% make testacc TESTARGS='-run=TestAccOrganizations_serial/Organization/DescendantAccountsDataSource' PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20  -run=TestAccOrganizations_serial/Organization/DescendantAccountsDataSource -timeout 180m
=== RUN   TestAccOrganizations_serial
=== PAUSE TestAccOrganizations_serial
=== CONT  TestAccOrganizations_serial
=== RUN   TestAccOrganizations_serial/Organization
=== RUN   TestAccOrganizations_serial/Organization/DescendantAccountsDataSource
=== RUN   TestAccOrganizations_serial/OrganizationalUnit
=== RUN   TestAccOrganizations_serial/OrganizationalUnits
--- PASS: TestAccOrganizations_serial (24.31s)
    --- PASS: TestAccOrganizations_serial/Organization (24.31s)
        --- PASS: TestAccOrganizations_serial/Organization/DescendantAccountsDataSource (24.31s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnit (0.00s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnits (0.00s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	29.616s

@ewbankkit
Copy link
Contributor

@ahublersos @ebi-yade Thanks for the contribution 🎉 👏.

@ewbankkit ewbankkit merged commit 3084a2e into hashicorp:main Feb 16, 2023
@github-actions github-actions bot added this to the v4.55.0 milestone Feb 16, 2023
@github-actions
Copy link

This functionality has been released in v4.55.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 20, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
documentation Introduces or discusses updates to documentation. new-data-source Introduces a new data source. provider Pertains to the provider itself, rather than any interaction with AWS. service/organizations Issues and PRs that pertain to the organizations service. size/XL Managed by automation to categorize the size of a PR. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Data source for querying account OU membership in AWS Organizations
4 participants