cdk-library-aws-organization

This CDK library is a WIP and not ready for production use.

Key challenges with Organizations

Accounts aren't like AWS resources and the removal process isn't a simple delete. Therefore the constructs contained in this library do not have the goal to delete accounts.
CloudFormation doesn't support Organizations directly so the constructs in this library use CloudFormation custom resources that utilize Python and Boto3

Testing the custom provider code with SAM CLI

Pre-reqs

You will either want a previously created test account or allow the tests to create a new account

Testing

Create a test project that utilizes this library (you can use a development version by utilizing yarn link, but note you might need to set a static dependency for CDK versions or constructs in the local app or you'll get errors about mismatched object types)
Create a test stack
Synthesize the test stack with cdk synth --no-staging > template.yml
Get the handler function names from the template
Run sam local start-lambda -t template.yml
Run the handler_tests python files with pytest like follows:

TEST_ACCOUNT_NAME='<name>' TEST_ACCOUNT_EMAIL='<email>' TEST_ACCOUNT_ORIGINAL_OU='<original ou id>' ACCOUNT_LAMBDA_FUNCTION_NAME='<name you noted earlier>' OU_LAMBDA_FUNCTION_NAME='<name you noted earlier>' pytest ./handler_tests/<test file name>.py -rA --capture=sys

Using the name, email, and original OU env variables here allows the test suite to re-use a single test account. Given deleting accounts is not simple you likely dont want to randomly create a new account every time you run tests.
The test.py also looks up the root org id to run tests so you'll need to have AWS creds set up to accomodate that behavior.
You can run the provided tests against the real lambda function by getting the deployed function name from AWS and setting the RUN_LOCALLY env variable

TEST_ACCOUNT_NAME='<name>' TEST_ACCOUNT_EMAIL='<email>' TEST_ACCOUNT_ORIGINAL_OU='<original ou id>' RUN_LOCALLY='false' ACCOUNT_LAMBDA_FUNCTION_NAME='<name you noted earlier>' OU_LAMBDA_FUNCTION_NAME='<name from AWS>' pytest ./handler_tests/<test file name>.py -rA --capture=sys

Why can't I move an OU?

Moving OUs isn't supported by Organizations and would cause significant issues with keeping track of OUs in the CDK. Imagine a scenario like below:

You have an ou, OUAdmin, and it has 2 children, OUChild1 and Account1, that are also managed by the CDK stack.
You change the parent of OUAdmin to OUFoo. The CDK would need to take the following actions:
- Create a new OU under OUFoo with the name OUAdmin
- Move all of the original OUAdmin OU's children to the new OUAdmin
- Delete the old OUAdmin
- Update all physical resource IDs
  - It would succeed at moving accounts because physical IDs should not change. Accounting moving between OUs is supported by Organizations
  - It would fail at moving any child OUs because they would also be recreated. Resulting in a change to physical resource ID. Because the custom resource can only managed the resource it's currently acting on, OUAdmin, any children OUs would be "lost" in this process and ugly to try and manage.

The best way to move OUs would be to add additional OUs to your org then move any accounts as needed then proceed to delete the OUs, like so:

Add new OU resources
Deploy the stack
Change account parents
Deploy the stack
Remove old OU resources
Deploy the stack

Metadata

Release files for renovosolutions.aws-cdk-aws-organization 0.4.69

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for renovosolutions.aws-cdk-aws-organization 0.4.69
File	Size	Uploaded
renovosolutions.aws-cdk-aws-organization-0.4.69.tar.gz	57.0 kB	Apr 7, 2022	Details

Built distribution (wheel)

Table of built distributions (wheels) for renovosolutions.aws-cdk-aws-organization 0.4.69
File	Interpreter	ABI	Platform	Reset
renovosolutions.aws_cdk_aws_organization-0.4.69-py3-none-any.whl 55.5 kB Apr 7, 2022	Python 3	none	any	Details

Total release size: 112.5 kB

Release files / renovosolutions.aws-cdk-aws-organization-0.4.69.tar.gz

Download URL	renovosolutions.aws-cdk-aws-organization-0.4.69.tar.gz
Size	57.0 kB
Tags	Source
SHA-256 checksum How to use checksums	`8457ec06b0958718c0619d5e465faa129a2986ff30f62e7e2d753ee48b8b18bc`
BLAKE2b-256 checksum How to use checksums	`87d92857e8f1c5e641912d7b5adb118bc3f04db184759dba454a8f1404761183`
Upload date	Apr 7, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.0 CPython/3.10.4`

Release files / renovosolutions.aws_cdk_aws_organization-0.4.69-py3-none-any.whl

Download URL	renovosolutions.aws_cdk_aws_organization-0.4.69-py3-none-any.whl
Size	55.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`2336222eb308c638a0d0138a79a29350768ed2fe7fe224ad0e0a978b0e11f043`
BLAKE2b-256 checksum How to use checksums	`6b5750e4db76b8df2f6e9cf3a40f22536969ea8c00869daa22faca5f4310b1c9`
Upload date	Apr 7, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.0 CPython/3.10.4`