fix(iam): adding organization id pattern verification

packages/aws-cdk-lib/aws-iam/lib/principals.ts

@@ -32,7 +32,7 @@ export interface IGrantable {
  * Notifications Service).
  *
  * A single logical Principal may also map to a set of physical principals.
- * For example, `new OrganizationPrincipal('o-1234')` represents all
+ * For example, `new OrganizationPrincipal('o-12345abcde')` represents all
  * identities that are part of the given AWS Organization.
  */
 export interface IPrincipal extends IGrantable {
@@ -603,6 +603,9 @@ export class ServicePrincipal extends PrincipalBase {
 
 /**
  * A principal that represents an AWS Organization
+ *
+ * Property organizationId must match regex pattern ^o-[a-z0-9]{10,32}$
+ * @see https://docs.aws.amazon.com/organizations/latest/APIReference/API_Organization.html
  */
 export class OrganizationPrincipal extends PrincipalBase {
   /**
@@ -611,6 +614,9 @@ export class OrganizationPrincipal extends PrincipalBase {
    */
   constructor(public readonly organizationId: string) {
     super();
+    if (!organizationId.match(/^o-[a-z0-9]{10,32}$/)) {
+      throw new Error(`Expected Organization ID must match regex pattern ^o-[a-z0-9]{10,32}$, received ${organizationId}`);
+    }
   }
 
   public get policyFragment(): PrincipalPolicyFragment {

packages/aws-cdk-lib/aws-iam/test/principals.test.ts

@@ -518,3 +518,15 @@ test('ServicePrinciple construct by default reset the principle name to the defa
     },
   });
 });
+
+test('throw error when Organization ID does not match regex pattern', () => {
+  // GIVEN
+  const shortOrgId = 'o-shortname';
+  const noOOrgName = 'no-o-name';
+  const longOrgName = 'o-thisnameistoooooooooooooooooolong';
+
+  // THEN
+  expect(() => new iam.OrganizationPrincipal(shortOrgId)).toThrow(`Expected Organization ID must match regex pattern ^o-[a-z0-9]{10,32}$, received ${shortOrgId}`);
+  expect(() => new iam.OrganizationPrincipal(noOOrgName)).toThrow(`Expected Organization ID must match regex pattern ^o-[a-z0-9]{10,32}$, received ${noOOrgName}`);
+  expect(() => new iam.OrganizationPrincipal(longOrgName)).toThrow(`Expected Organization ID must match regex pattern ^o-[a-z0-9]{10,32}$, received ${longOrgName}`);
+});