Add aws_organizations_delegated_administrator and aws_organizations_delegated_services_for_account tables (#2421) by FuadAbdullah · Pull Request #2477 · turbot/steampipe-plugin-aws

FuadAbdullah · 2025-04-23T14:13:23Z

Integration test logs

N/A

Add passing integration test logs here

Example query results

NOTE: I have compared the output with AWS CLI-equivalent command aws organizations list-delegated-administrators

Results

QUERY: select * from aws_organizations_delegated_administrator

-[ RECORD 1  ]---------------------------------------------------------------------------
delegated_account_id    | <redacted>
arn                     | <redacted>
email                   | <redacted>
name                    | Identity
status                  | ACTIVE
joined_method           | CREATED
joined_timestamp        | 2024-07-21T21:23:01+08:00
delegation_enabled_date | 2024-08-02T16:48:43+08:00
title                   | Identity
akas                    | ["arn:aws:organizations::<redacted>:account/<redacted>/<redacted>"]
partition               | aws
region                  | global
account_id              | <redacted>
sp_connection_name      | profile_<redacted>
sp_ctx                  | {"connection_name":"profile_<redacted>","steampipe":{"sdk_version":"5.11.5"}}
_ctx                    | {"connection_name":"profile_<redacted>","steampipe":{"sdk_version":"5.11.5"}}
-[ RECORD 2  ]---------------------------------------------------------------------------
delegated_account_id    | <redacted>
arn                     | <redacted>
email                   | <redacted>
name                    | Security Tooling
status                  | ACTIVE
joined_method           | CREATED
joined_timestamp        | 2024-07-20T14:25:31+08:00
delegation_enabled_date | 2025-04-23T16:25:48+08:00
title                   | Security Tooling
akas                    | ["arn:aws:organizations::<redacted>:account/<redacted>/<redacted>"]
partition               | aws
region                  | global
account_id              | <redacted>
sp_connection_name      | profile_<redacted>
sp_ctx                  | {"connection_name":"profile_<redacted>","steampipe":{"sdk_version":"5.11.5"}}
_ctx                    | {"connection_name":"profile_<redacted>","steampipe":{"sdk_version":"5.11.5"}}

QUERY: select * from aws_organizations_delegated_services_for_account where delegated_account_id='\<redacted\>'


-[ RECORD 1  ]---------------------------------------------------------------------------
delegated_account_id    | <redacted>
service_principal       | access-analyzer.amazonaws.com
delegation_enabled_date | 2025-04-23T16:25:48+08:00
title                   | access-analyzer.amazonaws.com
akas                    | ["access-analyzer.amazonaws.com"]
partition               | aws
region                  | global
account_id              | <redacted>
sp_connection_name      | profile_<redacted>
sp_ctx                  | {"connection_name":"profile_<redacted>","steampipe":{"sdk_version":"5.11.5"}}
_ctx                    | {"connection_name":"profile_<redacted>","steampipe":{"sdk_version":"5.11.5"}}

…ated_account_id

Copilot

Pull Request Overview

This PR introduces two new Steampipe tables to query AWS Organizations delegated administrators and delegated services for an account.

Added documentation markdown files for both tables.
Implemented Go code files to list and format results from AWS Organizations.
Updated the plugin registration to include the new tables.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
docs/tables/aws_organizations_delegated_services_for_account.md	Added documentation for querying delegated services for an account
docs/tables/aws_organizations_delegated_administrator.md	Added documentation for querying delegated administrator accounts
aws/table_aws_organizations_delegated_services_for_account.go	Implemented table and list function for delegated services
aws/table_aws_organizations_delegated_administrator.go	Implemented table and list function for delegated administrators
aws/plugin.go	Registered the new tables in the plugin

Comments suppressed due to low confidence (1)

aws/table_aws_organizations_delegated_services_for_account.go:41

[nitpick] Clarify the purpose of mapping the 'title' and 'akas' columns from 'ServicePrincipal'. Once confirmed, consider removing the TODO comment to avoid confusion in production code.

// TODO
// I am unsure whether the title and akas below should correspond to 'ServicePrincipal'.

ParthaI

Hi @FuadAbdullah, I have left a few review comments. Could you please take a look? Thanks!

aws/table_aws_organizations_delegated_administrator.go

ParthaI · 2025-05-08T05:02:36Z

aws/table_aws_organizations_delegated_services_for_account.go

+		Name:        "aws_organizations_delegated_services_for_account",
+		Description: "AWS Organizations Delegated Services For Account",
+		List: &plugin.ListConfig{
+			KeyColumns: plugin.SingleColumn("delegated_account_id"),


Instead of making delegated_account_id a required key qualifier, can we consider using the aws_organizations_delegated_administrator table as the parent?

Proposed Design:

Use listOrganizationsDelegatedAdmins as the ParentHydrate function.

Make delegated_account_id an optional qualifier rather than required.

In the list function of this table, add a check to skip the API call if delegated_account_id is explicitly provided in the query parameters.

You can refer to the aws_cloudwatch_log_stream table for a similar implementation pattern.

Referenced aws_cloudwatch_log_stream and implemented the parent hydrate and direct query methods into aws_organizations_delegated_services_for_account table

aws/table_aws_organizations_delegated_services_for_account.go

ParthaI · 2025-05-08T05:09:40Z

aws/table_aws_organizations_delegated_services_for_account.go

+func listDelegatedServices(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+
+	// Retrieve the `delegated_account_id` from the user's `WHERE` statement
+	delegatedAccountId := d.EqualsQuals["delegated_account_id"].GetStringValue()


Please take a look at the earlier suggestion (Instead of making delegated_account_id a required key qualifier, can we consider using the aws_organizations_delegated_administrator table as the parent?)

I have made delegatedAccountId optional in the latest PR for table aws_organizations_delegated_services_for_account

ParthaI · 2025-05-12T07:10:41Z

Hello @FuadAbdullah, just checking in — did you get a chance to review the comments above?

FuadAbdullah · 2025-05-12T07:28:09Z

Hi @ParthaI, I am currently reviewing the comments. I will review and apply the changes based on your comments. Thanks for the heads up!

…recommendations

…e two delegated administrators .go files

…legated_services_for_account.md

…ted_administrator.md

FuadAbdullah · 2025-05-12T09:38:54Z

Hi @ParthaI, I have amended the four files related to Delegated Administrator per your comments and recommendations. Please have a look and let me know if there are any other amendments to be made. Thanks!

ParthaI

Hello @FuadAbdullah,

The changes look great to me. However, I’ve added a couple of additional review comments—could you please take a look when you get a chance?

Additionally, if the log statements are not necessary, please consider cleaning them up. As a general practice, we try to avoid including log statements unless they are capturing API errors.

Thanks again!

aws/table_aws_organizations_delegated_administrator.go

aws/table_aws_organizations_delegated_services_for_account.go

…elegated_services_for_account and removed custom Transform functions from the two tables

FuadAbdullah · 2025-05-13T15:19:58Z

Good day, @ParthaI, I have performed changes according to your latest feedback. Please have a look and let me know if there's anything to be changed. Also, I believe there's only four error loggers in both tables but I might have overlooked so do let me know so I can check the loggers out and see if I should remove them.

…elegated_services_for_account tables (#2421) (#2477) (#2496) Co-authored-by: Muhammad Fuad Bin Abdullah <67743055+FuadAbdullah@users.noreply.github.com>

FuadAbdullah and others added 8 commits March 3, 2025 18:43

Added aws_organizations_delegated_administrator table

a67ed2f

Added aws_organizations_delegated_services_for_account, but buggy

949a6ad

Added table_aws_organizations_delegated_services_for_account

cba798d

Renamed aws_organizations_delegated_administrator table's id to deleg…

72901f9

…ated_account_id

Added aws_organizations_delegated_administrator doc

4d9743a

Added aws_organizations_delegated_services_for_account doc

eed7142

Merge branch 'turbot:main' into main

67a7751

Added 'folder' to AWS Organizations Delegated Administrator tables

d552e9a

misraved requested a review from Copilot April 23, 2025 15:06

Copilot AI reviewed Apr 23, 2025

View reviewed changes

misraved requested a review from ParthaI April 23, 2025 15:12

misraved linked an issue Apr 30, 2025 that may be closed by this pull request

Add table aws_delegate_admin #2421

Closed

ParthaI reviewed May 8, 2025

View reviewed changes

FuadAbdullah added 4 commits May 12, 2025 17:24

Refactored delegated administrator tables and documentation based on …

70ab936

…recommendations

Added new line before 'Standard columns for all tables' comment in th…

1e02faa

…e two delegated administrators .go files

Added period to the end of Basic info section in aws_organizations_de…

13a55aa

…legated_services_for_account.md

Reinstated delegation_enabled_date column in aws_organizations_delega…

ec4cebd

…ted_administrator.md

ParthaI reviewed May 13, 2025

View reviewed changes

aws/table_aws_organizations_delegated_administrator.go Outdated Show resolved Hide resolved

aws/table_aws_organizations_delegated_services_for_account.go Outdated Show resolved Hide resolved

aws/table_aws_organizations_delegated_services_for_account.go Outdated Show resolved Hide resolved

Simplified the delegated account id comparison in aws_organizations_d…

57f64cc

…elegated_services_for_account and removed custom Transform functions from the two tables

ParthaI changed the base branch from main to add-table-aws-delegate-admin May 16, 2025 05:11

ParthaI approved these changes May 16, 2025

View reviewed changes

ParthaI merged commit d009484 into turbot:add-table-aws-delegate-admin May 16, 2025
1 check passed

misraved changed the title ~~Add table aws_delegate_admin (#2421)~~ Add aws_organizations_delegated_administrator and aws_organizations_delegated_services_for_account tables (#2421) May 22, 2025

Conversation

FuadAbdullah commented Apr 23, 2025

Integration test logs

Example query results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

ParthaI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ParthaI May 8, 2025

Choose a reason for hiding this comment

Proposed Design:

Uh oh!

FuadAbdullah May 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ParthaI May 8, 2025

Choose a reason for hiding this comment

Uh oh!

FuadAbdullah May 12, 2025

Choose a reason for hiding this comment

Uh oh!

ParthaI commented May 12, 2025

Uh oh!

FuadAbdullah commented May 12, 2025

Uh oh!

FuadAbdullah commented May 12, 2025

Uh oh!

ParthaI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FuadAbdullah commented May 13, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants