accounts_with_invalid_effective_policies

Creates, updates, deletes, gets or lists an accounts_with_invalid_effective_policies resource.

Overview

Name	accounts_with_invalid_effective_policies
Type	Resource
Id	aws.organizations.accounts_with_invalid_effective_policies

Fields

The following fields are returned by SELECT queries:

list_accounts_with_invalid_effective_policy

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of the account. For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference. (pattern: <code>^arn:aws:organizations::\d{12}:account/o-[a-z0-9]{10,32}/\d{12}</code>)
email	string	The email address associated with the Amazon Web Services account. The regex pattern for this parameter is a string of characters that represents a standard internet email address. (pattern: <code>[^\s@]+@[^\s@]+.[^\s@]+</code>)
id	string	The unique identifier (ID) of the account. The regex pattern for an account ID string requires exactly 12 digits. (pattern: <code>^\d{12}$</code>)
joined_method	string	The method by which the account joined the organization. (INVITED, CREATED)
joined_timestamp	string (date-time)	The date the account became a part of the organization.
name	string	The friendly name of the account. The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range. (pattern: <code>[\s\S]*</code>)
paths	array	The paths in the organization where the account exists.
state	string	Each state represents a specific phase in the account lifecycle. Use this information to manage account access, automate workflows, or trigger actions based on account state changes. For more information about account states and their implications, see Monitor the state of your Amazon Web Services accounts in the Organizations User Guide. (PENDING_ACTIVATION, ACTIVE, SUSPENDED, PENDING_CLOSURE, CLOSED)
status	string	The status of the account in the organization. The Status parameter in the Account object will be retired on September 9, 2026. Although both the account State and account Status parameters are currently available in the Organizations APIs (DescribeAccount, ListAccounts, ListAccountsForParent), we recommend that you update your scripts or other code to use the State parameter instead of Status before September 9, 2026. (ACTIVE, SUSPENDED, PENDING_CLOSURE)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_accounts_with_invalid_effective_policy	select	region		Lists all the accounts in an organization that have invalid effective policies. An invalid effective policy is an effective policy that fails validation checks, resulting in the effective policy not being fully enforced on all the intended accounts within an organization. You can only call this operation from the management account or a member account that is a delegated administrator.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_accounts_with_invalid_effective_policy

Lists all the accounts in an organization that have invalid effective policies. An invalid effective policy is an effective policy that fails validation checks, resulting in the effective policy not being fully enforced on all the intended accounts within an organization. You can only call this operation from the management account or a member account that is a delegated administrator.

SELECT
arn,
email,
id,
joined_method,
joined_timestamp,
name,
paths,
state,
status
FROM aws.organizations.accounts_with_invalid_effective_policies
WHERE region = '{{ region }}' -- required
;