AWS Organizations

This example lives in the pulumi/examples repository. Check out just this directory to use it:

$ git clone --filter=blob:none --sparse https://github.com/pulumi/examples pulumi-examples
$ git -C pulumi-examples sparse-checkout set aws-ts-organizations
$ cd pulumi-examples/aws-ts-organizations

This example shows you how you can automate the creation of member accounts in AWS Organizations with Pulumi. This example is written in TypeScript, however, the concepts used within can be used with any of the supported SDKs in Pulumi. Read the associated blog post to learn more.

This example also creates a sample backup policy and tag policy at the organization unit-level. Before deploying, enable those policy types for your management account by navigating to the AWS Organizations service > Policies, then click Backup policies as well as Tag policies and enable them.

Note: This app requires credentials that have permissions to the AWS Organizations service. The IAM user running this app should also be granted permissions to assume the role identified by OrganizationalAccountAccessRole in any account.

Note also that unlike other resources that can be created/destroyed easily, this app creates an AWS account, and closed accounts are in a suspended state for 90 days. That means you won’t be able to delete the organizational unit until the 90 days has elapsed.

Prerequisites#

1. Install Pulumi
2. Configure AWS credentials
3. Install Node.js

Deploying the example#

1. Create a new stack:

   pulumi stack init accounts

2. Set the AWS region and the email contact to use for the dev AWS account that this app creates. The email contact for each member account needs to be unique. You can take advantage of email aliases that some email services provide by using the + character. Check with your email provider to see if you can use email aliases.

   pulumi config set aws:region us-west-2
   pulumi config set devAccountEmailContact <email> --secret

3. Install dependencies:

   npm install

4. Deploy the stack:

   pulumi up

   Note that the flag to automatically close an account when the associated resource is destroyed in Pulumi is set to false, so the account won’t be closed automatically. You can, of course, change that flag in the code to true, but that decision is left to you.

Cleaning up#

Before you can destroy all the resources deployed by this stack with a pulumi destroy, there are a couple of things to note.

1. The single AWS account that this example creates is protected from deletion by using Pulumi’s protect resource option. That means you should first tell Pulumi to release the protection. See the docs to learn how you can do that quickly.
2. As mentioned before, closed accounts will enter into a suspended state for 90 days. That means you will encounter an error about not being able to delete the organizational unit (OU) despite having closed the AWS account that was under it. You will need to wait for 90 days before you can delete the OU.

Once those conditions are met, tear down the stack:

pulumi destroy
pulumi stack rm