organizational_units

Creates, updates, deletes, gets or lists an organizational_units resource.

Overview

Name	organizational_units
Type	Resource
Id	aws.organizations.organizational_units

Fields

The following fields are returned by SELECT queries:

describe_organizational_unit

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of this OU. For more information about ARNs in Organizations, see ARN Formats Supported by Organizations in the Amazon Web Services Service Authorization Reference. (pattern: <code>^arn:aws:organizations::\d{12}:ou/o-[a-z0-9]{10,32}/ou-[0-9a-z]{4,32}-[0-9a-z]{8,32}</code>)
id	string	The unique identifier (ID) associated with this OU. The ID is unique to the organization only. The regex pattern for an organizational unit ID string requires "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that contains the OU). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits. (pattern: <code>^ou-[0-9a-z]{4,32}-[a-z0-9]{8,32}$</code>)
name	string	The friendly name of this OU. The regex pattern that is used to validate this parameter is a string of any of the characters in the ASCII character range. (pattern: <code>[\s\S]*</code>)
path	string	The path in the organization where this OU exists. (pattern: <code>^(o-[a-z0-9]{10,32}/r-[0-9a-z]{4,32}(/ou-[0-9a-z]{4,32}-[a-z0-9]{8,32})(/\d{12}))/</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_organizational_unit	select	region		Retrieves information about an organizational unit (OU). You can only call this operation from the management account or a member account that is a delegated administrator.
create_organizational_unit	insert	region, ParentId, Name		Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables you to organize your accounts to apply policies according to your business requirements. The number of levels deep that you can nest OUs is dependent upon the policy types enabled for that root. For service control policies, the limit is five. For more information about OUs, see Managing organizational units (OUs) in the Organizations User Guide. If the request includes tags, then the requester must have the organizations:TagResource permission. You can only call this operation from the management account.
update_organizational_unit	update	region, OrganizationalUnitId		Renames the specified organizational unit (OU). The ID and ARN don't change. The child OUs and accounts remain in place, and any attached policies of the OU remain attached. You can only call this operation from the management account.
delete_organizational_unit	delete	region		Deletes an organizational unit (OU) from a root or another OU. You must first remove all accounts and child OUs from the OU that you want to delete. You can only call this operation from the management account.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_organizational_unit

Retrieves information about an organizational unit (OU). You can only call this operation from the management account or a member account that is a delegated administrator.

SELECT
arn,
id,
name,
path
FROM aws.organizations.organizational_units
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_organizational_unit

Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables you to organize your accounts to apply policies according to your business requirements. The number of levels deep that you can nest OUs is dependent upon the policy types enabled for that root. For service control policies, the limit is five. For more information about OUs, see Managing organizational units (OUs) in the Organizations User Guide. If the request includes tags, then the requester must have the organizations:TagResource permission. You can only call this operation from the management account.

INSERT INTO aws.organizations.organizational_units (
ParentId,
Name,
Tags,
region
)
SELECT 
'{{ ParentId }}' /* required */,
'{{ Name }}' /* required */,
'{{ Tags }}',
'{{ region }}'
RETURNING
organizational_unit
;

Manifest

# Description fields are for documentation purposes
- name: organizational_units
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the organizational_units resource.
  - name: ParentId
    value: "{{ ParentId }}"
    description: |
      ID for the parent root or OU that you want to create the new OU in. The regex pattern for a parent ID string requires one of the following: Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits. Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.
  - name: Name
    value: "{{ Name }}"
    description: |
      The friendly name to assign to the new OU.
  - name: Tags
    description: |
      A list of tags that you want to attach to the newly created OU. For each tag in the list, you must specify both a tag key and a value. You can set the value to an empty string, but you can't set it to null. For more information about tagging, see Tagging Organizations resources in the Organizations User Guide. If any one of the tags is not valid or if you exceed the allowed number of tags for an OU, then the entire request fails and the OU is not created.
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"

UPDATE examples

update_organizational_unit

Renames the specified organizational unit (OU). The ID and ARN don't change. The child OUs and accounts remain in place, and any attached policies of the OU remain attached. You can only call this operation from the management account.

UPDATE aws.organizations.organizational_units
SET 
OrganizationalUnitId = '{{ OrganizationalUnitId }}',
Name = '{{ Name }}'
WHERE 
region = '{{ region }}' --required
AND OrganizationalUnitId = '{{ OrganizationalUnitId }}' --required
RETURNING
organizational_unit;

DELETE examples

delete_organizational_unit

Deletes an organizational unit (OU) from a root or another OU. You must first remove all accounts and child OUs from the OU that you want to delete. You can only call this operation from the management account.

DELETE FROM aws.organizations.organizational_units
WHERE region = '{{ region }}' --required
;