Skip to content

Commit eb8611c

Browse files
ewbankkitewbankkit
authored
Merge pull request #45274 from tabito-hara/td-aws_organizations-add_new_policies
[Docs/Tests] aws_organizations_organization/aws_organizations_policy: Add tests and update documentation for `SECURITYHUB_POLICY`, `INSPECTOR_POLICY` and `UPGRADE_ROLLOUT_POLICY`
2 parents 9f309f7 + 96ea365 commit eb8611c

File tree

5 files changed

+183
-3
lines changed

5 files changed

+183
-3
lines changed

‎internal/service/organizations/organization_test.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,25 @@ func testAccOrganization_EnabledPolicyTypes(t *testing.T) {
237237
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeSecurityhubPolicy)),
238238
),
239239
},
240+
{
241+
Config: testAccOrganizationConfig_enabledPolicyTypeWithServiceAccessPrincipals(string(awstypes.PolicyTypeInspectorPolicy), "inspector2.amazonaws.com"),
242+
Check: resource.ComposeTestCheckFunc(
243+
testAccCheckOrganizationExists(ctx, resourceName, &organization),
244+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "1"),
245+
resource.TestCheckTypeSetElemAttr(resourceName, "aws_service_access_principals.*", "inspector2.amazonaws.com"),
246+
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
247+
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeInspectorPolicy)),
248+
),
249+
},
250+
{
251+
Config: testAccOrganizationConfig_enabledPolicyTypes1(string(awstypes.PolicyTypeUpgradeRolloutPolicy)),
252+
Check: resource.ComposeTestCheckFunc(
253+
testAccCheckOrganizationExists(ctx, resourceName, &organization),
254+
resource.TestCheckResourceAttr(resourceName, "aws_service_access_principals.#", "0"),
255+
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.#", "1"),
256+
resource.TestCheckResourceAttr(resourceName, "enabled_policy_types.0", string(awstypes.PolicyTypeUpgradeRolloutPolicy)),
257+
),
258+
},
240259
{
241260
ResourceName: resourceName,
242261
ImportState: true,

‎internal/service/organizations/organizations_test.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,9 @@ func TestAccOrganizations_serial(t *testing.T) {
7474
"Type_Backup": testAccPolicy_type_Backup,
7575
"Type_SCP": testAccPolicy_type_SCP,
7676
"Type_Tag": testAccPolicy_type_Tag,
77+
"Type_SecurityHub": testAccPolicy_type_SecurityHub,
78+
"Type_Inspector": testAccPolicy_type_Inspector,
79+
"Type_UpgradeRollout": testAccPolicy_type_UpgradeRollout,
7780
"ImportAwsManagedPolicy": testAccPolicy_importManagedPolicy,
7881
"Identity": testAccOrganizationsPolicy_IdentitySerial,
7982
},

‎internal/service/organizations/policy_test.go‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,162 @@ func testAccPolicy_type_Tag(t *testing.T) {
409409
})
410410
}
411411

412+
func testAccPolicy_type_SecurityHub(t *testing.T) {
413+
ctx := acctest.Context(t)
414+
var policy awstypes.Policy
415+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
416+
resourceName := "aws_organizations_policy.test"
417+
// Reference: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub_syntax.html
418+
inspectorPolicyContent := `{
419+
"securityhub" : {
420+
"enable_in_regions" : {
421+
"@@assign" : [
422+
"ALL_SUPPORTED"
423+
]
424+
},
425+
"disable_in_regions" : {
426+
"@@assign" : []
427+
}
428+
}
429+
}`
430+
431+
resource.Test(t, resource.TestCase{
432+
PreCheck: func() {
433+
acctest.PreCheck(ctx, t)
434+
acctest.PreCheckOrganizationManagementAccount(ctx, t)
435+
},
436+
ErrorCheck: acctest.ErrorCheck(t, names.OrganizationsServiceID),
437+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
438+
CheckDestroy: testAccCheckPolicyDestroy(ctx),
439+
Steps: []resource.TestStep{
440+
{
441+
Config: testAccPolicyConfig_type(rName, inspectorPolicyContent, string(awstypes.PolicyTypeSecurityhubPolicy)),
442+
Check: resource.ComposeTestCheckFunc(
443+
testAccCheckPolicyExists(ctx, resourceName, &policy),
444+
resource.TestCheckResourceAttr(resourceName, names.AttrType, string(awstypes.PolicyTypeSecurityhubPolicy)),
445+
),
446+
},
447+
{
448+
ResourceName: resourceName,
449+
ImportState: true,
450+
ImportStateVerify: true,
451+
ImportStateVerifyIgnore: []string{names.AttrSkipDestroy},
452+
},
453+
},
454+
})
455+
}
456+
457+
func testAccPolicy_type_Inspector(t *testing.T) {
458+
ctx := acctest.Context(t)
459+
var policy awstypes.Policy
460+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
461+
resourceName := "aws_organizations_policy.test"
462+
// Reference: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inspector_syntax.html
463+
//lintignore:AWSAT003
464+
inspectorPolicyContent := `{
465+
"inspector" : {
466+
"enablement" : {
467+
"ec2_scanning" : {
468+
"enable_in_regions" : {
469+
"@@assign" : ["us-east-1", "us-west-2"]
470+
},
471+
"disable_in_regions" : {
472+
"@@assign" : ["eu-west-1"]
473+
}
474+
}
475+
}
476+
}
477+
}`
478+
479+
resource.Test(t, resource.TestCase{
480+
PreCheck: func() {
481+
acctest.PreCheck(ctx, t)
482+
acctest.PreCheckOrganizationManagementAccount(ctx, t)
483+
},
484+
ErrorCheck: acctest.ErrorCheck(t, names.OrganizationsServiceID),
485+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
486+
CheckDestroy: testAccCheckPolicyDestroy(ctx),
487+
Steps: []resource.TestStep{
488+
{
489+
Config: testAccPolicyConfig_type(rName, inspectorPolicyContent, string(awstypes.PolicyTypeInspectorPolicy)),
490+
Check: resource.ComposeTestCheckFunc(
491+
testAccCheckPolicyExists(ctx, resourceName, &policy),
492+
resource.TestCheckResourceAttr(resourceName, names.AttrType, string(awstypes.PolicyTypeInspectorPolicy)),
493+
),
494+
},
495+
{
496+
ResourceName: resourceName,
497+
ImportState: true,
498+
ImportStateVerify: true,
499+
ImportStateVerifyIgnore: []string{names.AttrSkipDestroy},
500+
},
501+
},
502+
})
503+
}
504+
505+
func testAccPolicy_type_UpgradeRollout(t *testing.T) {
506+
ctx := acctest.Context(t)
507+
var policy awstypes.Policy
508+
rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
509+
resourceName := "aws_organizations_policy.test"
510+
// Reference: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_upgrade_syntax.html
511+
upgradeRolloutPolicyContent := `{
512+
"upgrade_rollout" : {
513+
"default" : {
514+
"patch_order" : {
515+
"@@assign" : "last"
516+
}
517+
},
518+
"tags" : {
519+
"my_patch_order_tag" : {
520+
"tag_values" : {
521+
"tag1" : {
522+
"patch_order" : {
523+
"@@assign" : "first"
524+
}
525+
},
526+
"tag2" : {
527+
"patch_order" : {
528+
"@@assign" : "second"
529+
}
530+
},
531+
"tag3" : {
532+
"patch_order" : {
533+
"@@assign" : "last"
534+
}
535+
}
536+
}
537+
}
538+
}
539+
}
540+
}`
541+
542+
resource.Test(t, resource.TestCase{
543+
PreCheck: func() {
544+
acctest.PreCheck(ctx, t)
545+
acctest.PreCheckOrganizationManagementAccount(ctx, t)
546+
},
547+
ErrorCheck: acctest.ErrorCheck(t, names.OrganizationsServiceID),
548+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
549+
CheckDestroy: testAccCheckPolicyDestroy(ctx),
550+
Steps: []resource.TestStep{
551+
{
552+
Config: testAccPolicyConfig_type(rName, upgradeRolloutPolicyContent, string(awstypes.PolicyTypeUpgradeRolloutPolicy)),
553+
Check: resource.ComposeTestCheckFunc(
554+
testAccCheckPolicyExists(ctx, resourceName, &policy),
555+
resource.TestCheckResourceAttr(resourceName, names.AttrType, string(awstypes.PolicyTypeUpgradeRolloutPolicy)),
556+
),
557+
},
558+
{
559+
ResourceName: resourceName,
560+
ImportState: true,
561+
ImportStateVerify: true,
562+
ImportStateVerifyIgnore: []string{names.AttrSkipDestroy},
563+
},
564+
},
565+
})
566+
}
567+
412568
func testAccPolicy_importManagedPolicy(t *testing.T) {
413569
ctx := acctest.Context(t)
414570
resourceName := "aws_organizations_policy.test"

‎website/docs/r/organizations_organization.html.markdown‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ resource "aws_organizations_organization" "org" {
3232
This resource supports the following arguments:
3333

3434
* `aws_service_access_principals` - (Optional) List of AWS service principal names for which you want to enable integration with your organization. This is typically in the form of a URL, such as service-abbreviation.amazonaws.com. Organization must have `feature_set` set to `ALL`. Some services do not support enablement via this endpoint, see [warning in aws docs](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnableAWSServiceAccess.html).
35-
* `enabled_policy_types` - (Optional) List of Organizations policy types to enable in the Organization Root. Organization must have `feature_set` set to `ALL`. For additional information about valid policy types (e.g., `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `CHATBOT_POLICY`, `DECLARATIVE_POLICY_EC2`, `RESOURCE_CONTROL_POLICY`, `SECURITYHUB_POLICY`, `SERVICE_CONTROL_POLICY`, and `TAG_POLICY`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html). To enable `SECURITYHUB_POLICY`, `aws_service_access_principals` must include `securityhub.amazonaws.com`.
35+
* `enabled_policy_types` - (Optional) List of Organizations policy types to enable in the Organization Root. Organization must have `feature_set` set to `ALL`. For additional information about valid policy types (e.g., `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `CHATBOT_POLICY`, `DECLARATIVE_POLICY_EC2`, `INSPECTOR_POLICY`, `RESOURCE_CONTROL_POLICY`, `SECURITYHUB_POLICY`, `SERVICE_CONTROL_POLICY`, `TAG_POLICY` and `UPGRADE_ROLLOUT_POLICY`), see the [AWS Organizations API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_EnablePolicyType.html). To enable `INSPECTOR_POLICY`, `aws_service_access_principals` must include `inspector2.amazonaws.com`. To enable `SECURITYHUB_POLICY`, `aws_service_access_principals` must include `securityhub.amazonaws.com`.
3636
* `feature_set` - (Optional) Specify `ALL` (default) or `CONSOLIDATED_BILLING`.
3737

3838
## Attribute Reference

‎website/docs/r/organizations_policy.html.markdown‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,15 @@ For more information about the AI Services opt-out Policy syntax, see the [AI Se
3737
For more information about the Backup Policy syntax, see the [Backup Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_backup_syntax.html).
3838
For more information about the Chatbot Policy syntax, see the [Chatbot Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_chatbot_syntax.html).
3939
For more information about the Declarative Policy syntax, see the [Declarative Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_declarative_syntax.html).
40+
For more information about the Inspector Policy syntax, see the [Inspector Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inspector_syntax.html).
4041
For more information about the RCP syntax, see the [Resource Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps_syntax.html).
41-
For more information about the SCP syntax, see the [Service Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.html).
42+
For more information about the Security Hub Policy syntax, see the [Security Hub Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub_syntax.html). For more information about the SCP syntax, see the [Service Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.html).
4243
For more information on the Tag Policy syntax, see the [Tag Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html).
44+
For more information about the Upgrade Rollout Policy syntax, see the [Upgrade Rollout Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_upgrade_syntax.html).
4345
* `name` - (Required) The friendly name to assign to the policy.
4446
* `description` - (Optional) A description to assign to the policy.
4547
* `skip_destroy` - (Optional) If set to `true`, destroy will **not** delete the policy and instead just remove the resource from state. This can be useful in situations where the policies (and the associated attachment) must be preserved to meet the AWS minimum requirement of 1 attached policy.
46-
* `type` - (Optional) The type of policy to create. Valid values are `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `CHATBOT_POLICY`, `DECLARATIVE_POLICY_EC2`,`RESOURCE_CONTROL_POLICY` (RCP), `SERVICE_CONTROL_POLICY` (SCP), and `TAG_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`.
48+
* `type` - (Optional) The type of policy to create. Valid values are `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `CHATBOT_POLICY`, `DECLARATIVE_POLICY_EC2`, `INSPECTOR_POLICY`, `RESOURCE_CONTROL_POLICY` (RCP), `SECURITYHUB_POLICY`, `SERVICE_CONTROL_POLICY` (SCP), `TAG_POLICY`, and `UPGRADE_ROLLOUT_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`.
4749
* `tags` - (Optional) Key-value map of resource tags. If configured with a provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block) present, tags with matching keys will overwrite those defined at the provider-level.
4850

4951
## Attribute Reference

0 commit comments

Comments
 (0)
⚡