AWS CDK Construct Library to manage specific AWS Organization resources
Project description
cdk-library-aws-organization
This CDK library is a WIP and not ready for production use.
Key challenges with Organizations
- Accounts aren't like AWS resources and the removal process isn't a simple delete. Therefore the constructs contained in this library do not have the goal to delete accounts.
- CloudFormation doesn't support Organizations directly so the constructs in this library use CloudFormation custom resources that utilize Python and Boto3
Testing the custom provider code with SAM CLI
Pre-reqs
- You will either want a previously created test account or allow the tests to create a new account
Testing
- Create a test project that utilizes this library (you can use a development version by utilizing
yarn link
, but note you might need to set a static dependency for CDK versions orconstructs
in the local app or you'll get errors about mismatched object types) - Create a test stack
- Synthesize the test stack with
cdk synth --no-staging > template.yml
- Get the handler function names from the template
- Run
sam local start-lambda -t template.yml
- Run the
handler_tests
python files withpytest
like follows:
TEST_ACCOUNT_NAME='<name>' TEST_ACCOUNT_EMAIL='<email>' TEST_ACCOUNT_ORIGINAL_OU='<original ou id>' ACCOUNT_LAMBDA_FUNCTION_NAME='<name you noted earlier>' OU_LAMBDA_FUNCTION_NAME='<name you noted earlier>' pytest ./handler_tests/<test file name>.py -rA --capture=sys
- Using the name, email, and original OU env variables here allows the test suite to re-use a single test account. Given deleting accounts is not simple you likely dont want to randomly create a new account every time you run tests.
- The
test.py
also looks up the root org id to run tests so you'll need to have AWS creds set up to accomodate that behavior. - You can run the provided tests against the real lambda function by getting the deployed function name from AWS and setting the
RUN_LOCALLY
env variable
TEST_ACCOUNT_NAME='<name>' TEST_ACCOUNT_EMAIL='<email>' TEST_ACCOUNT_ORIGINAL_OU='<original ou id>' RUN_LOCALLY='false' ACCOUNT_LAMBDA_FUNCTION_NAME='<name you noted earlier>' OU_LAMBDA_FUNCTION_NAME='<name from AWS>' pytest ./handler_tests/<test file name>.py -rA --capture=sys
Why can't I move an OU?
Moving OUs isn't supported by Organizations and would cause significant issues with keeping track of OUs in the CDK. Imagine a scenario like below:
-
You have an ou,
OUAdmin
, and it has 2 children,OUChild1 and Account1
, that are also managed by the CDK stack. -
You change the parent of
OUAdmin
toOUFoo
. The CDK would need to take the following actions:-
Create a new
OU
underOUFoo
with the nameOUAdmin
-
Move all of the original
OUAdmin
OU's children to the newOUAdmin
-
Delete the old
OUAdmin
-
Update all physical resource IDs
- It would succeed at moving accounts because physical IDs should not change. Accounting moving between OUs is supported by Organizations
- It would fail at moving any child OUs because they would also be recreated. Resulting in a change to physical resource ID. Because the custom resource can only managed the resource it's currently acting on,
OUAdmin
, any children OUs would be "lost" in this process and ugly to try and manage.
-
The best way to move OUs would be to add additional OUs to your org then move any accounts as needed then proceed to delete the OUs, like so:
- Add new OU resources
- Deploy the stack
- Change account parents
- Deploy the stack
- Remove old OU resources
- Deploy the stack
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for renovosolutions.aws-cdk-aws-organization-0.4.69.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 8457ec06b0958718c0619d5e465faa129a2986ff30f62e7e2d753ee48b8b18bc |
|
MD5 | 0bd0c5b83907351a57324c5a1b88d9dd |
|
BLAKE2b-256 | 87d92857e8f1c5e641912d7b5adb118bc3f04db184759dba454a8f1404761183 |
Hashes for renovosolutions.aws_cdk_aws_organization-0.4.69-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 2336222eb308c638a0d0138a79a29350768ed2fe7fe224ad0e0a978b0e11f043 |
|
MD5 | 032b833b3f5318f113aef97eb0d4aa05 |
|
BLAKE2b-256 | 6b5750e4db76b8df2f6e9cf3a40f22536969ea8c00869daa22faca5f4310b1c9 |