New Resource: aws_organizations_organization #903

asedge · 2017-06-19T00:44:50Z

A resource to help implement AWS Organizations: #571.

Originally attempted a PR at: hashicorp/terraform#13831. Noticed the providers had been split so I'm trying again to get this merged.

tamsky

suggested style fixes

tamsky · 2017-06-27T06:26:03Z

website/docs/r/organization.html.markdown

+
+The following arguments are supported:
+
+* `feature_set` - (Optional) Specify "ALL" (default) or "CONSOLIDATED_BILLING.


missing trailing-"

tamsky · 2017-06-27T06:26:52Z

aws/resource_aws_organization_test.go

+	}
+
+	return nil
+


rm extra NL

asedge · 2017-06-27T10:55:08Z

@tamsky Thanks for the review. Submitted a fix for the issues you pointed out.

asedge · 2017-06-28T00:46:18Z

Thanks again @MrGossett!

tpoindessous · 2017-07-11T14:01:25Z

Hi

any idea this PR will be merged ?

Thanks !

Ninir · 2017-07-11T19:56:19Z

Hey @asedge, everyone,

This looks good to me. I am going to add some fixes and the missing upgrade from CONSOLIDATED_BILLING to ALL (http://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAllFeatures.html).

Will keep you informed when everything sounds ok.

Thanks!

asedge · 2017-07-11T20:57:47Z

@Ninir, fine by me. Thanks!

asedge · 2017-07-14T13:05:07Z

@Ninir, do you think anything else is needed? I'm willing to make changes if necessary.

Ninir · 2017-07-14T16:13:12Z

Hey @asedge

Sorry for keeping you not up-to-date on this.
I'm struggling with something a bit tricky at the moment, regarding the feature_set.

As you know, an AWS Organization can be created in 2 modes: CONSOLIDATED_BILLING or ALL.

There are 2 cases right now:

  If the option is set to ALL or not set, you cannot switch back to CONSOLIDATED BILLING (I added a validation error in my local code)

  If the option is CONSOLIDATED_BILLING and you want to switch to ALL, the [EnableAllFeatures](http://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAllFeatures.html) call is made.

EnableAllFeatures for AWS Organizations needs unanimity from its members, thus everyone receives an email to either accept or decline the change.
As soon as everyone accepted the enabling of the ALL mode, a new email is received by the Organization Owner, and the owner needs to go to the console, validating the change manually.
The action can take at min 1min (you’re alone in the org), at max 15 days (expiration).

There are 2 ways to proceed there:

Let the user change the value from one to the other and throw an error or make the EnableCall
Remove the ability to change this specific attribute by adding the ForceNew flag

In case 1, the template configuration could then be updated, the API Call (EnableAllFeatures) would be made, but Terraform would ask still for the change until you finalize the process manually in the console
In case 2, if you already had members, you would need to remove them from it.

We are currently discussing the UX perspective with @catsby on this.
What are your thougths there? :)

asedge · 2017-07-15T12:34:06Z

@Ninir Is it possible to store some information about the Handshake in Terraform's state? The presence of a Handshake would indicate there's no need to call EnableAllFeatures again plus the Handshake includes the expiration date: Handshake structure - which we could use to time out the presence of the Handshake. Perhaps a bit too over complicated.

There's a complication with case 2 as well. If any of the Organization member accounts have been created from Organization master account they cannot be removed from the Organization without completing some manual steps: Removing a Member Account From Your Organization. I have another PR for creating aws_organization_account and some of the discussion around this happened here: hashicorp/terraform#12337

There don't seem to be many good options.

Ninir · 2017-07-26T13:32:06Z

Cases requiring a validation are always tough to handle. We try to avoid these complex stuff by either not allowing, either finding a way to do so.
Here, storing the handshake could bring a few drawbacks, since organisations are pretty new.
We started a talk with @catsby on that, will get back to you soon!

Thanks for being patient on this topic :)

barundel · 2017-08-22T11:20:07Z

any update? would really like to see this functionality ;)

sionsmith · 2017-08-24T08:20:24Z

Can someone resolve this conflict so we can get this into GA.

ellerbrock · 2017-08-25T07:23:21Z

just started to play for the first time with aws and terraform and would love to start the whole account setup with terraform. so when i understand it right its not yet merged and currently not possible to do the overall:

create organisiation
create subaccounts
add organisation policies to subaccounts ...

yet, right?

cheers maik

asedge · 2017-08-25T11:02:12Z

@ellerbrock You are correct, it's not yet possible. I have aws_organization_account ready to file a PR but was hoping to get this merged first. Both resources depend on adding some new libs from aws-sdk-go. I had both PRs filed when providers were still tightly coupled with Terraform but ended up just constantly fixing merge conflicts in vendor/vendor.json.

ellerbrock · 2017-09-04T19:36:53Z

any news if stuff get merged?
i have to setup a aws multi account and would love to do all with one awesome tool called terraform :)

JoshiiSinfield · 2017-09-08T16:10:35Z

+1.

bcwilsondotcom · 2017-09-12T21:05:24Z

+1 Seems like there's a lot of us that would love to have this merged.

radeksimko · 2017-09-13T09:49:49Z

Hi folks,
we do appreciate the interest and +1's if these don't generate notifications. 😅

We'll get to this PR 🔜 .
I'll lock this thread temporarily, until we do so, to avoid cluttering everyone's notification feed.

Thanks.

Ninir · 2018-02-20T14:29:56Z

@bflad we certainly need to address #903 (comment) in some way as it is sure that people will encounter this issue a day or the other. As discussed, going no-op with warnings or just ignoring...

bflad · 2018-02-20T14:54:49Z

aws/provider.go

@@ -454,6 +454,7 @@ func Provider() terraform.ResourceProvider {
 			"aws_opsworks_user_profile":                    resourceAwsOpsworksUserProfile(),
 			"aws_opsworks_permission":                      resourceAwsOpsworksPermission(),
 			"aws_opsworks_rds_db_instance":                 resourceAwsOpsworksRdsDbInstance(),
+			"aws_organization":                             resourceAwsOrganization(),


Its going to look ugly at first and Naming is Hard, but we should probably also rename this aws_organizations_organization for a few reasons:

The AWS Organizations service supports multiple resources we'll want to manage, e.g. aws_organizations_account, aws_organizations_organization_unit, aws_organizations_policy, this will keep everything bundled together nicely naming-wise

To prevent confusion with other AWS services that might use the terminology "organization"

If AWS ever creates a separate account organization management service/method

Ideally the resource function names will be updated to long form as well: resourceAwsOrganizationsOrganization, resourceAwsOrganizationsOrganizationRead, etc

I think I handled all the other feedback you provided. I'm not against doing this but it seemed like more work than I was willing to put in tonight.

…on and update all the other function names so they match.

asedge · 2018-02-23T00:27:43Z

@bflad I believe I've taken care of everything you've given me feedback on.

bflad

This looks awesome! Thanks for all the hard work here @asedge!

make testacc TEST=./aws TESTARGS='-run=TestAccAWSOrganizations'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -run=TestAccAWSOrganizations -timeout 120m
=== RUN   TestAccAWSOrganizations
=== RUN   TestAccAWSOrganizations/Organization
=== RUN   TestAccAWSOrganizations/Organization/basic
=== RUN   TestAccAWSOrganizations/Organization/importBasic
=== RUN   TestAccAWSOrganizations/Organization/consolidatedBilling
--- PASS: TestAccAWSOrganizations (56.39s)
    --- PASS: TestAccAWSOrganizations/Organization (56.39s)
        --- PASS: TestAccAWSOrganizations/Organization/basic (18.38s)
        --- PASS: TestAccAWSOrganizations/Organization/importBasic (21.86s)
        --- PASS: TestAccAWSOrganizations/Organization/consolidatedBilling (16.15s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	56.435s

bflad · 2018-02-25T05:26:50Z

@Ninir I think we are okay for now with #903 (comment) since we are no longer allowing updates in the resource (ForceNew: true on feature_set). We can and certainly should address those two scenarios if or when updates are added to the resource. Please correct me if I'm wrong and I'll address ASAP. Thanks!

bflad · 2018-03-09T20:03:44Z

This has been released in version 1.11.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

asedge · 2018-03-09T20:33:06Z

@bflad It looks like I screwed up the documentation page: https://www.terraform.io/docs/providers/aws/r/organizations_organization.html

ghost · 2020-04-07T17:19:40Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

Add resource to create an AWS Organization.

009d501

Ninir added the new-resource Introduces a new resource. label Jun 19, 2017

asedge mentioned this pull request Jun 20, 2017

provider/aws: Add resource_aws_organization. hashicorp/terraform#13831

Closed

tamsky reviewed Jun 27, 2017

View reviewed changes

Style fixes.

a463708

MrGossett approved these changes Jun 27, 2017

View reviewed changes

Added more debug, fixed CS issues, added missing ERB section

878b1c3

hashicorp deleted a comment from tamsky Jul 11, 2017

Ninir added 2 commits July 11, 2017 20:24

Upgraded AWS organization vendor to last version

9288b29

Added Organization import test

54f122b

Ninir requested a review from catsby August 17, 2017 19:45

radeksimko requested review from radeksimko and removed request for catsby August 29, 2017 13:12

bflad reviewed Feb 20, 2018

View reviewed changes

radeksimko removed their request for review February 20, 2018 15:21

asedge added 9 commits February 20, 2018 19:40

Resource, as written, does not support updates so clean up.

5d70149

Use constant from SDK rather than hard code the string.

b36c873

Remove INFO log statement.

12c692d

Some small fixes based on review feedback.

1cb414e

Use goimports.

306de02

Rename import test func.

31f379f

Enhance documentation.

153b712

Use a const instead of a func for test config.

37d64f5

Fix error checking in tests.

c0a0c61

ghost added the size/L Managed by automation to categorize the size of a PR. label Feb 21, 2018

asedge added 2 commits February 22, 2018 19:02

Rename resource from aws_organization to aws_organizations_organizati…

a53e483

…on and update all the other function names so they match.

Adjust the acceptance testing for parallelism.

754238e

bflad approved these changes Feb 25, 2018

View reviewed changes

bflad modified the milestones: v1.13.0, v1.11.0 Feb 25, 2018

bflad changed the title ~~New Resource: aws_organization~~ New Resource: aws_organizations_organization Feb 25, 2018

bflad merged commit 385a2a3 into hashicorp:master Feb 25, 2018

bflad added a commit that referenced this pull request Feb 25, 2018

Update CHANGELOG for #903

7223d8f

asedge mentioned this pull request Feb 25, 2018

New Resource: aws_organizations_account #3524

Merged

asedge deleted the resource_aws_organization branch March 24, 2018 02:25

bflad mentioned this pull request Jul 16, 2019

docs/provider: Clarify Resource Naming guidelines in Contributing Guide #9347

Merged

ghost locked and limited conversation to collaborators Apr 7, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Resource: aws_organizations_organization #903

New Resource: aws_organizations_organization #903

asedge commented Jun 19, 2017

tamsky left a comment

tamsky Jun 27, 2017

tamsky Jun 27, 2017

asedge commented Jun 27, 2017

asedge commented Jun 28, 2017

tpoindessous commented Jul 11, 2017

Ninir commented Jul 11, 2017

asedge commented Jul 11, 2017

asedge commented Jul 14, 2017

Ninir commented Jul 14, 2017

asedge commented Jul 15, 2017 •

edited

Loading

Ninir commented Jul 26, 2017

barundel commented Aug 22, 2017

sionsmith commented Aug 24, 2017

ellerbrock commented Aug 25, 2017

asedge commented Aug 25, 2017

ellerbrock commented Sep 4, 2017 •

edited

Loading

JoshiiSinfield commented Sep 8, 2017

bcwilsondotcom commented Sep 12, 2017

radeksimko commented Sep 13, 2017

Ninir commented Feb 20, 2018 •

edited

Loading

bflad Feb 20, 2018 •

edited

Loading

asedge Feb 21, 2018

asedge commented Feb 23, 2018

bflad left a comment

bflad commented Feb 25, 2018

bflad commented Mar 9, 2018

asedge commented Mar 9, 2018 •

edited

Loading

ghost commented Apr 7, 2020


		The following arguments are supported:

		* `feature_set` - (Optional) Specify "ALL" (default) or "CONSOLIDATED_BILLING.

New Resource: aws_organizations_organization #903

New Resource: aws_organizations_organization #903

Conversation

asedge commented Jun 19, 2017

tamsky left a comment

Choose a reason for hiding this comment

tamsky Jun 27, 2017

Choose a reason for hiding this comment

tamsky Jun 27, 2017

Choose a reason for hiding this comment

asedge commented Jun 27, 2017

asedge commented Jun 28, 2017

tpoindessous commented Jul 11, 2017

Ninir commented Jul 11, 2017

asedge commented Jul 11, 2017

asedge commented Jul 14, 2017

Ninir commented Jul 14, 2017

asedge commented Jul 15, 2017 • edited Loading

Ninir commented Jul 26, 2017

barundel commented Aug 22, 2017

sionsmith commented Aug 24, 2017

ellerbrock commented Aug 25, 2017

asedge commented Aug 25, 2017

ellerbrock commented Sep 4, 2017 • edited Loading

JoshiiSinfield commented Sep 8, 2017

bcwilsondotcom commented Sep 12, 2017

radeksimko commented Sep 13, 2017

Ninir commented Feb 20, 2018 • edited Loading

bflad Feb 20, 2018 • edited Loading

Choose a reason for hiding this comment

asedge Feb 21, 2018

Choose a reason for hiding this comment

asedge commented Feb 23, 2018

bflad left a comment

Choose a reason for hiding this comment

bflad commented Feb 25, 2018

bflad commented Mar 9, 2018

asedge commented Mar 9, 2018 • edited Loading

ghost commented Apr 7, 2020

asedge commented Jul 15, 2017 •

edited

Loading

ellerbrock commented Sep 4, 2017 •

edited

Loading

Ninir commented Feb 20, 2018 •

edited

Loading

bflad Feb 20, 2018 •

edited

Loading

asedge commented Mar 9, 2018 •

edited

Loading