Add data sources aws_organizations_organizational_unit_child_accounts and aws_organizations_organizational_unit_descendant_accounts #24350

ahublersos · 2022-04-21T21:47:01Z

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Description

This PR adds two data sources that allow the retrieval of a list of account IDs based on an AWS organizations Organizational Unit ID.

The aws_organizations_organizational_unit_child_accounts data source provides the immediate child accounts while the aws_organizations_organizational_unit_descendant_accounts provides all generations of child account IDs under the given OU.

Output from acceptance testing:
I'm still having trouble getting acceptance tests to run. I'm sure it's something simple I'm missing with the test framework. (Open to any suggestions!)
Cleanup from testing is tricky since all the accounts need to be manually deleted.

❯ make testacc TESTS=testAccOrganizationalUnitChildAccountsDataSource_basic PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20 -run='testAccOrganizationalUnitChildAccountsDataSource_basic'  -timeout 180m
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	3.254s [no tests to run]

❯ make testacc TESTS=testAccOrganizationalUnitDescendantAccountsDataSource_basic PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20 -run='testAccOrganizationalUnitDescendantAccountsDataSource_basic'  -timeout 180m
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	3.162s [no tests to run]

I did do some manual testing. Info on that is below, with emails and account IDs replaced with generic values.
My test org for manual testing looks like this:

Root OU
- Account "test0" (000000000000)
- Account "provider-test-mgmt" (444444444444)
- OU "TestA"
- OU "Test0"
- - Account "test1" (111111111111)
- - OU "Test1"
- - - Account "test2" (222222222222)

My test config:


data "aws_organizations_organization" "test" {
}

resource "aws_organizations_account" "test0" {
  name  = "test0"
  email = "[email protected]"
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

resource "aws_organizations_organizational_unit" "test0" {
  name      = "test0"
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

resource "aws_organizations_account" "test1" {
  name  = "test1"
  email = "[email protected]"
  parent_id = aws_organizations_organizational_unit.test0.id
}

resource "aws_organizations_organizational_unit" "test1" {
  name      = "test1"
  parent_id = aws_organizations_organizational_unit.test0.id
}

resource "aws_organizations_account" "test2" {
  name  = "test2"
  email = "[email protected]"
  parent_id = aws_organizations_organizational_unit.test1.id
}

resource "aws_organizations_organizational_unit" "testA" {
  name      = "testA"
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

data "aws_organizations_organizational_unit_descendant_accounts" "test" {
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

data "aws_organizations_organizational_unit_child_accounts" "test" {
  parent_id = data.aws_organizations_organization.test.roots[0].id
}

data "aws_organizations_organizational_unit_descendant_accounts" "test0" {
  parent_id = aws_organizations_organizational_unit.test0.id
}

data "aws_organizations_organizational_unit_child_accounts" "test0" {
  parent_id = aws_organizations_organizational_unit.test0.id
}

data "aws_organizations_organizational_unit_descendant_accounts" "testA" {
  parent_id = aws_organizations_organizational_unit.testA.id
}

data "aws_organizations_organizational_unit_child_accounts" "testA" {
  parent_id = aws_organizations_organizational_unit.testA.id
}

output "root_descendant_ids" {
  value = data.aws_organizations_organizational_unit_descendant_accounts.test.accounts[*].id
}

output "root_children" {
  value = data.aws_organizations_organizational_unit_child_accounts.test
}

output "test0_descendants" {
  value = data.aws_organizations_organizational_unit_descendant_accounts.test0
}

output "test0_children" {
  value = data.aws_organizations_organizational_unit_child_accounts.test0
}

output "testA_descendants" {
  value = data.aws_organizations_organizational_unit_descendant_accounts.testA
}

output "testA_children" {
  value = data.aws_organizations_organizational_unit_child_accounts.testA
}

Output from some manual testing:

❯ terraform output

root_children = {
  "accounts" = tolist([
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/444444444444"
      "email" = "[email protected]"
      "id" = "444444444444"
      "name" = "provider-test-mgmt"
      "status" = "ACTIVE"
    },
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/000000000000"
      "email" = "[email protected]"
      "id" = "000000000000"
      "name" = "test0"
      "status" = "ACTIVE"
    },
  ])
  "id" = "r-eca0"
  "parent_id" = "r-eca0"
}
root_descendant_ids = tolist([
  "444444444444",
  "000000000000",
  "111111111111",
  "222222222222",
])
test0_children = {
  "accounts" = tolist([
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/111111111111"
      "email" = "[email protected]"
      "id" = "111111111111"
      "name" = "test1"
      "status" = "ACTIVE"
    },
  ])
  "id" = "ou-eca0-cno43299"
  "parent_id" = "ou-eca0-cno43299"
}
test0_descendants = {
  "accounts" = tolist([
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/111111111111"
      "email" = "[email protected]"
      "id" = "111111111111"
      "name" = "test1"
      "status" = "ACTIVE"
    },
    {
      "arn" = "arn:aws:organizations::444444444444:account/o-ux49ku5z71/222222222222"
      "email" = "[email protected]"
      "id" = "222222222222"
      "name" = "test2"
      "status" = "ACTIVE"
    },
  ])
  "id" = "ou-eca0-cno43299"
  "parent_id" = "ou-eca0-cno43299"
}
testA_children = {
  "accounts" = tolist([])
  "id" = "ou-eca0-f8gxkt9v"
  "parent_id" = "ou-eca0-f8gxkt9v"
}
testA_descendants = {
  "accounts" = tolist([])
  "id" = "ou-eca0-f8gxkt9v"
  "parent_id" = "ou-eca0-f8gxkt9v"
}

Finalize `aws_organizations_accounts` data source

github-actions

Welcome @ahublersos 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTING guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

ahublersos · 2022-10-21T02:31:54Z

I'm still having trouble getting tests to run. Below is the output I get when attempting to run the testAccOrganizationalUnitDescendantAccountsDataSource_basic test.

Some observations/things I've tried:

I've set up a fresh AWS account with an AdministratorAccess user, generated credentials for that user, placed them in the default profile, then ran export AWS_PROFILE=default before running the make testacc command.
I never see any organization or new accounts created in the aws console.
Changing the assertions in the test (ex: check resource2 has the attributes of resource1) has no effect on the output.
I get similar output when running an existing test, like testAccOrganizationalUnitsDataSource_basic

Test output:

❯ make testacc TESTS=testAccOrganizationalUnitDescendantAccountsDataSource_basic PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20 -run='testAccOrganizationalUnitDescendantAccountsDataSource_basic'  -timeout 180m
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	3.925s [no tests to run]

Currently there is no way to recursively find all OUs in an AWS Organisation via a data resource and doesn't look like hashicorp/terraform-provider-aws#24350 will get merged any time soon, so mcaf_aws_all_organizational_units fills this gap until such a resource exists in the community AWS provider. Signed-off-by: Stephen Hoekstra <[email protected]>

…nts" This reverts commit a753b82, reversing changes made to 4de0df9.

This reverts commit 4de0df9.

This reverts commit 8e415e6.

This reverts commit 117439f.

…ithoutTimeout' CRUD handlers.

…untsForParent'.

…to 'WithoutTimeout' CRUD handlers.

ewbankkit

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccOrganizations_serial/Organization/ChildAccountsDataSource' PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20  -run=TestAccOrganizations_serial/Organization/ChildAccountsDataSource -timeout 180m
=== RUN   TestAccOrganizations_serial
=== PAUSE TestAccOrganizations_serial
=== CONT  TestAccOrganizations_serial
=== RUN   TestAccOrganizations_serial/Organization
=== RUN   TestAccOrganizations_serial/Organization/ChildAccountsDataSource
=== RUN   TestAccOrganizations_serial/OrganizationalUnit
=== RUN   TestAccOrganizations_serial/OrganizationalUnits
--- PASS: TestAccOrganizations_serial (14.35s)
    --- PASS: TestAccOrganizations_serial/Organization (14.35s)
        --- PASS: TestAccOrganizations_serial/Organization/ChildAccountsDataSource (14.35s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnit (0.00s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnits (0.00s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	19.574s
% make testacc TESTARGS='-run=TestAccOrganizations_serial/OrganizationalUnits/DataSource' PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20  -run=TestAccOrganizations_serial/OrganizationalUnits/DataSource -timeout 180m
=== RUN   TestAccOrganizations_serial
=== PAUSE TestAccOrganizations_serial
=== CONT  TestAccOrganizations_serial
=== RUN   TestAccOrganizations_serial/OrganizationalUnits
=== RUN   TestAccOrganizations_serial/OrganizationalUnits/DataSource
--- PASS: TestAccOrganizations_serial (17.59s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnits (17.59s)
        --- PASS: TestAccOrganizations_serial/OrganizationalUnits/DataSource (17.59s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	23.246s
% make testacc TESTARGS='-run=TestAccOrganizations_serial/Organization/DescendantAccountsDataSource' PKG=organizations
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/organizations/... -v -count 1 -parallel 20  -run=TestAccOrganizations_serial/Organization/DescendantAccountsDataSource -timeout 180m
=== RUN   TestAccOrganizations_serial
=== PAUSE TestAccOrganizations_serial
=== CONT  TestAccOrganizations_serial
=== RUN   TestAccOrganizations_serial/Organization
=== RUN   TestAccOrganizations_serial/Organization/DescendantAccountsDataSource
=== RUN   TestAccOrganizations_serial/OrganizationalUnit
=== RUN   TestAccOrganizations_serial/OrganizationalUnits
--- PASS: TestAccOrganizations_serial (24.31s)
    --- PASS: TestAccOrganizations_serial/Organization (24.31s)
        --- PASS: TestAccOrganizations_serial/Organization/DescendantAccountsDataSource (24.31s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnit (0.00s)
    --- PASS: TestAccOrganizations_serial/OrganizationalUnits (0.00s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/organizations	29.616s

ewbankkit · 2023-02-16T20:25:30Z

@ahublersos @ebi-yade Thanks for the contribution 🎉 👏.

github-actions · 2023-02-17T18:37:10Z

This functionality has been released in v4.55.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

github-actions · 2023-03-20T02:16:28Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

ebi-yade and others added 5 commits April 13, 2021 14:13

Add data source aws_organizations_accounts

117439f

Create the documentation of data.aws_organizations_accounts

8e415e6

Fix indent

4de0df9

Finalize aws_organizations_accounts data source

807e19d

Merge pull request #1 from mikeroll/f-aws_organizations_accounts

a753b82

Finalize `aws_organizations_accounts` data source

github-actions bot reviewed Apr 21, 2022

View reviewed changes

justinretzolk added new-data-source Introduces a new data source. and removed needs-triage Waiting for first response or review from a maintainer. labels Apr 22, 2022

ahublersos added 16 commits October 14, 2022 15:06

Add ou child accounts data source

4dc5ac0

Add ou descendant accounts data source

c031035

formatting

6d99fba

Fix timestamp type

4a005dd

Fix replace ou variable with new accounts var

31f5446

convert time type to string

5daad8a

add new data sources to provider.go

0f10c5a

update test emails

e56398d

Add documentation

2ff0fa1

remove dupe flatten_accounts function

43378bd

remove commented out declaration

ae84fd7

rename data source files

a80fe83

add checks for each account in acc test

d42f207

Use random email addresses in acc test

2e4bf84

pass random addresses to test config

d83b451

formatting

2ed63ed

github-actions bot removed service/appflow Issues and PRs that pertain to the appflow service. flex Pertains to FLatteners and EXpanders. labels Oct 19, 2022

Providers to ProtoV5ProviderFactories

96690bd

ahublersos mentioned this pull request Oct 21, 2022

Data source for querying account OU membership in AWS Organizations #16153

Closed

shoekstra mentioned this pull request Oct 27, 2022

Add mcaf_aws_all_organizational_units data resource schubergphilis/terraform-provider-mcaf#15

Merged

ewbankkit added 10 commits February 16, 2023 11:55

Revert "Merge pull request #1 from mikeroll/f-aws_organizations_accou…

3566e6a

…nts" This reverts commit a753b82, reversing changes made to 4de0df9.

Revert "Fix indent"

be0f383

This reverts commit 4de0df9.

Revert "Create the documentation of data.aws_organizations_accounts"

58b1b8b

This reverts commit 8e415e6.

Revert "Add data source aws_organizations_accounts"

3539b05

This reverts commit 117439f.

Merge commit '3539b0500cd7ed3384abc9aad157af8ec36ef032' into HEAD

997e8f4

Merge branch 'main' into HEAD

dd82cfe

d/aws_organizations_organizational_unit_child_accounts: Convert to 'W…

eb00c80

…ithoutTimeout' CRUD handlers.

d/aws_organizations_organizational_units: Add 'findOUsForParent'.

2864842

d/aws_organizations_organizational_unit_child_accounts: Add 'findAcco…

ae7f32a

…untsForParent'.

d/aws_organizations_organizational_unit_descendant_accounts: Convert …

09cda9e

…to 'WithoutTimeout' CRUD handlers.

ewbankkit approved these changes Feb 16, 2023

View reviewed changes

Fix semgrep 'ci.semgrep.migrate.aws-api-context'.

0b91321

ewbankkit merged commit 3084a2e into hashicorp:main Feb 16, 2023

github-actions bot added this to the v4.55.0 milestone Feb 16, 2023

joshuamkite mentioned this pull request Feb 19, 2023

An aws_organizations data source using list-accounts-for-parent #11268

Closed

github-actions bot locked as resolved and limited conversation to collaborators Mar 20, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add data sources aws_organizations_organizational_unit_child_accounts and aws_organizations_organizational_unit_descendant_accounts #24350

Add data sources aws_organizations_organizational_unit_child_accounts and aws_organizations_organizational_unit_descendant_accounts #24350

ahublersos commented Apr 21, 2022 •

edited by ewbankkit

Loading

github-actions bot left a comment

ahublersos commented Oct 21, 2022 •

edited

Loading

ewbankkit left a comment

ewbankkit commented Feb 16, 2023

github-actions bot commented Feb 17, 2023

github-actions bot commented Mar 20, 2023

Add data sources aws_organizations_organizational_unit_child_accounts and aws_organizations_organizational_unit_descendant_accounts #24350

Add data sources aws_organizations_organizational_unit_child_accounts and aws_organizations_organizational_unit_descendant_accounts #24350

Conversation

ahublersos commented Apr 21, 2022 • edited by ewbankkit Loading

Community Note

Description

github-actions bot left a comment

Choose a reason for hiding this comment

ahublersos commented Oct 21, 2022 • edited Loading

ewbankkit left a comment

Choose a reason for hiding this comment

ewbankkit commented Feb 16, 2023

github-actions bot commented Feb 17, 2023

github-actions bot commented Mar 20, 2023

ahublersos commented Apr 21, 2022 •

edited by ewbankkit

Loading

ahublersos commented Oct 21, 2022 •

edited

Loading