organizations

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 22 Imported by: 0

README

Organizations

Parity grade: A · SDK aws-sdk-go-v2/service/organizations@v1.50.4 · last audited 2026-07-12 (012f98aa)

Coverage

Metric Value
Operations audited 63 (63 ok)
Feature families 5 (4 ok, 1 partial)
Known gaps 3
Deferred items 2
Resource leaks clean
Known gaps
  • epochSeconds() in models.go duplicates pkgs/awstime.Epoch (sub-second truncation only, wire-compatible either way) -- should be replaced with awstime.Epoch for pkgs-catalog reuse hygiene (no bd issue filed yet)
  • ListAccountsWithInvalidEffectivePolicy / ListEffectivePolicyValidationErrors don't paginate (MaxResults/NextToken silently accepted-but-ignored in the same way the 6 fixed ops used to be), but both are provably always-empty results given no real policy-schema validation exists, so pagination there is moot until schema validation is implemented (no bd issue filed yet)
  • AWS auto-creates and attaches a default 'FullAWSAccess' SCP to the root when the SERVICE_CONTROL_POLICY policy type is enabled (or org created with ALL features); this backend does not fabricate that default policy, so ListPolicies/ListPoliciesForTarget won't show it. Deep AWS behavior detail, not flagged as broken since no client mutation is silently dropped -- documented here for the next auditor (no bd issue filed yet)
Deferred
  • CreatePolicy content validation (real AWS validates SCP JSON size limits, e.g. 5120 bytes)
  • Tag validation (reserved 'aws:' key prefix rejection, max-50-tags limit)

More

Documentation

Overview

Package organizations provides an in-memory stub for the AWS Organizations API.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrOrgNotFound is returned when no organization exists.
	ErrOrgNotFound = awserr.New(
		"AWSOrganizationsNotInUseException: organization not found",
		awserr.ErrNotFound,
	)
	// ErrOrgAlreadyExists is returned when an organization already exists.
	ErrOrgAlreadyExists = awserr.New(
		"AlreadyInOrganizationException: account is already a member of an organization",
		awserr.ErrAlreadyExists,
	)
	// ErrAccountNotFound is returned when an account does not exist.
	ErrAccountNotFound = awserr.New(
		"AccountNotFoundException: account not found",
		awserr.ErrNotFound,
	)
	// ErrOUNotFound is returned when an OU does not exist.
	ErrOUNotFound = awserr.New(
		"OrganizationalUnitNotFoundException: OU not found",
		awserr.ErrNotFound,
	)
	// ErrPolicyNotFound is returned when a policy does not exist.
	ErrPolicyNotFound = awserr.New("PolicyNotFoundException: policy not found", awserr.ErrNotFound)
	// ErrPolicyTypeAlreadyEnabled is returned when a policy type is already enabled.
	ErrPolicyTypeAlreadyEnabled = awserr.New(
		"PolicyTypeAlreadyEnabledException: policy type already enabled",
		awserr.ErrConflict,
	)
	// ErrPolicyTypeNotEnabled is returned when a policy type is not enabled.
	ErrPolicyTypeNotEnabled = awserr.New(
		"PolicyTypeNotEnabledException: policy type not enabled",
		awserr.ErrConflict,
	)
	// ErrCreateAccountStatusNotFound is returned when a create-account status is not found.
	ErrCreateAccountStatusNotFound = awserr.New(
		"CreateAccountStatusNotFoundException: create account status not found",
		awserr.ErrNotFound,
	)
	// ErrDuplicatePolicyAttachment is returned when a policy is already attached.
	ErrDuplicatePolicyAttachment = awserr.New(
		"DuplicatePolicyAttachmentException: policy already attached",
		awserr.ErrConflict,
	)
	// ErrPolicyNotAttached is returned when a policy is not attached to the target.
	ErrPolicyNotAttached = awserr.New(
		"PolicyNotAttachedException: policy not attached to target",
		awserr.ErrNotFound,
	)
	// ErrInvalidInput is returned for invalid input parameters.
	ErrInvalidInput = awserr.New("InvalidInputException: invalid input", awserr.ErrInvalidParameter)
	// ErrChildNotFound is returned when a child resource is not found.
	ErrChildNotFound = awserr.New("ChildNotFoundException: child not found", awserr.ErrNotFound)
	// ErrDelegatedAdminNotFound is returned when a delegated admin is not found.
	ErrDelegatedAdminNotFound = awserr.New(
		"AccountNotRegisteredException: account is not a registered delegated administrator",
		awserr.ErrNotFound,
	)
	// ErrDelegatedAdminAlreadyExists is returned when a delegated admin already exists.
	ErrDelegatedAdminAlreadyExists = awserr.New(
		"AccountAlreadyRegisteredException: account is already a delegated administrator",
		awserr.ErrAlreadyExists,
	)
	// ErrPolicyLimitExceeded is returned when the maximum number of policies per target is exceeded.
	ErrPolicyLimitExceeded = awserr.New(
		"ConstraintViolationException: maximum policies per target exceeded",
		awserr.ErrConflict,
	)
	// ErrHandshakeNotFound is returned when a handshake does not exist.
	ErrHandshakeNotFound = awserr.New(
		"HandshakeNotFoundException: handshake not found",
		awserr.ErrNotFound,
	)
	// ErrHandshakeConstraintViolation is returned when a handshake state transition is invalid.
	ErrHandshakeConstraintViolation = awserr.New(
		"HandshakeConstraintViolationException: handshake is not in a valid state for this transition",
		awserr.ErrConflict,
	)
	// ErrResourcePolicyNotFound is returned when no resource policy exists.
	ErrResourcePolicyNotFound = awserr.New(
		"ResourcePolicyNotFoundException: resource policy not found",
		awserr.ErrNotFound,
	)
	// ErrEffectivePolicyNotFound is returned when no effective policy exists for a target.
	ErrEffectivePolicyNotFound = awserr.New(
		"EffectivePolicyNotFoundException: no effective policy of the given type",
		awserr.ErrNotFound,
	)
	// ErrAccountAlreadyClosed is returned when an account is already in PENDING_CLOSURE or SUSPENDED state.
	ErrAccountAlreadyClosed = awserr.New(
		"ConstraintViolationException: account is already closed or pending closure",
		awserr.ErrConflict,
	)
	// ErrOUDepthLimitExceeded is returned when creating an OU would exceed the depth limit.
	ErrOUDepthLimitExceeded = awserr.New(
		"ConstraintViolationException: OU_DEPTH_LIMIT_EXCEEDED",
		awserr.ErrConflict,
	)
	// ErrDuplicateOrganizationalUnit is returned when an OU with the same name already exists under the same parent.
	ErrDuplicateOrganizationalUnit = awserr.New(
		"DuplicateOrganizationalUnitException: duplicate OU name",
		awserr.ErrAlreadyExists,
	)
	// ErrTargetNotFound is returned when a policy attachment target is not found.
	ErrTargetNotFound = awserr.New(
		"TargetNotFoundException: target not found",
		awserr.ErrNotFound,
	)
	// ErrServiceNotEnabled is returned when registering a delegated admin for a service not enabled for org access.
	ErrServiceNotEnabled = awserr.New(
		"ConstraintViolationException: service principal not enabled for service access",
		awserr.ErrConflict,
	)
	// ErrPolicyInUse is returned when attempting to delete a policy still attached to targets.
	ErrPolicyInUse = awserr.New(
		"PolicyInUseException: policy is still attached to one or more targets",
		awserr.ErrConflict,
	)
	// ErrOrganizationNotEmpty is returned when attempting to delete an org that still has member accounts.
	ErrOrganizationNotEmpty = awserr.New(
		"OrganizationNotEmptyException: organization still contains member accounts",
		awserr.ErrConflict,
	)
	// ErrDuplicateHandshake is returned when an open handshake already exists for the same target.
	ErrDuplicateHandshake = awserr.New(
		"DuplicateHandshakeException: a handshake already exists for the specified account",
		awserr.ErrAlreadyExists,
	)
	// ErrPolicyTypeAttached is returned when disabling a policy type that still has attached policies.
	ErrPolicyTypeAttached = awserr.New(
		"ConstraintViolationException: cannot disable policy type while policies of that type are attached",
		awserr.ErrConflict,
	)
)

Sentinel errors.

View Source 
var ErrNilAppContext = errors.New("organizations: AppContext is nil")

ErrNilAppContext is returned when Init receives a nil AppContext.

Functions

This section is empty.

Types

type Account 

type Account struct {
	JoinedAt               time.Time `json:"joinedAt"`
	ID                     string    `json:"id"`
	ARN                    string    `json:"arn"`
	Name                   string    `json:"name"`
	Email                  string    `json:"email"`
	Status                 string    `json:"status"`
	JoinedMethod           string    `json:"joinedMethod"`
	RoleName               string    `json:"roleName,omitempty"`
	IamUserAccessToBilling string    `json:"iamUserAccessToBilling,omitempty"`
}

Account represents an AWS account in an organization.

type ChildSummary 

type ChildSummary struct {
	ID   string `json:"Id"`
	Type string `json:"Type"`
}

ChildSummary describes a child (account or OU) of a parent.

type CreateAccountStatus 

type CreateAccountStatus struct {
	ID                 string  `json:"Id"`
	AccountID          string  `json:"AccountId,omitempty"`
	GovCloudAccountID  string  `json:"GovCloudAccountId,omitempty"`
	AccountName        string  `json:"AccountName"`
	State              string  `json:"State"`
	FailureReason      string  `json:"FailureReason,omitempty"`
	RequestedTimestamp float64 `json:"RequestedTimestamp"`
	CompletedTimestamp float64 `json:"CompletedTimestamp"`
}

CreateAccountStatus is the result of a CreateAccount request.

type DelegatedAdmin 

type DelegatedAdmin struct {
	AccountID        string    `json:"Id"`
	ARN              string    `json:"Arn"`
	Name             string    `json:"Name"`
	Email            string    `json:"Email"`
	Status           string    `json:"Status"`
	JoinedMethod     string    `json:"JoinedMethod"`
	JoinedAt         time.Time `json:"JoinedTimestamp"`
	DelegationTime   time.Time `json:"DelegationEnabledDate"`
	ServicePrincipal string    `json:"-"`
}

DelegatedAdmin holds a delegated administrator registration.

type DelegatedService 

type DelegatedService struct {
	DelegationEnabledDate time.Time `json:"DelegationEnabledDate"`
	ServicePrincipal      string    `json:"ServicePrincipal"`
}

DelegatedService holds a service principal for which an account is a delegated administrator.

type EffectivePolicy 

type EffectivePolicy struct {
	LastUpdatedTimestamp time.Time `json:"lastUpdatedTimestamp"`
	PolicyContent        string    `json:"policyContent"`
	PolicyID             string    `json:"policyId"`
	PolicyType           string    `json:"policyType"`
	TargetID             string    `json:"targetId"`
}

EffectivePolicy represents the aggregated effective policy for a target.

type EnabledServicePrincipal 

type EnabledServicePrincipal struct {
	DateEnabled      time.Time `json:"DateEnabled"`
	ServicePrincipal string    `json:"ServicePrincipal"`
}

EnabledServicePrincipal holds a service principal that has been enabled for AWS service access.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler is the HTTP handler for the AWS Organizations JSON 1.1 API.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Organizations handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the primary resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Organizations operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Organizations requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state (used in tests).

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Organizations JSON 1.1 API requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type Handshake 

type Handshake struct {
	RequestedTimestamp  time.Time           `json:"requestedTimestamp"`
	ExpirationTimestamp time.Time           `json:"expirationTimestamp"`
	ID                  string              `json:"id"`
	ARN                 string              `json:"arn"`
	Action              string              `json:"action"`
	State               string              `json:"state"`
	Parties             []HandshakeParty    `json:"parties"`
	Resources           []HandshakeResource `json:"resources"`
}

Handshake represents an AWS Organizations handshake invitation or transfer.

type HandshakeParty 

type HandshakeParty struct {
	ID   string `json:"id"`
	Type string `json:"type"`
}

HandshakeParty is a participant in a handshake.

type HandshakeResource 

type HandshakeResource struct {
	Type      string              `json:"type"`
	Value     string              `json:"value"`
	Resources []HandshakeResource `json:"resources,omitempty"`
}

HandshakeResource holds a resource associated with a handshake.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory storage for the Organizations service.

Phase 3.3 datalayer note: accounts, ous, policies, createStatuses, handshakes, and serviceAccess are store.Table[T]s registered on registry (see store_setup.go); delegatedAdmins is a store.Table[DelegatedAdmin] deliberately NOT registered on registry because its composite key relies on a json:"-" field (see store_setup.go's doc comment). The remaining map fields below (targetPolicies, accountParent, policyTargets, ouParent, tags, emailToAccountID, ousByParent, accountChildrenByParent) are left as plain maps: each holds a bare, non-*T value ([]string, string, map[string]string, or map[string]bool), which does not fit store.Table's keyed-by-*T shape.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory Organizations backend.

func (*InMemoryBackend) AcceptHandshake 

func (b *InMemoryBackend) AcceptHandshake(handshakeID string) (*Handshake, error)

AcceptHandshake accepts an OPEN handshake. For INVITE handshakes, the invited account is added to the organization.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the configured AWS account ID.

func (*InMemoryBackend) AddAccountInternal 

func (b *InMemoryBackend) AddAccountInternal(a *Account)

AddAccountInternal seeds an account directly under the root for testing. Requires an organization to have been created first.

func (*InMemoryBackend) AddHandshakeInternal 

func (b *InMemoryBackend) AddHandshakeInternal(h *Handshake)

AddHandshakeInternal seeds a handshake directly for testing. If h.ID is empty, a new ID is generated. If h.ExpirationTimestamp is zero, it is set to now + handshakeExpirationDuration.

func (*InMemoryBackend) AddOUInternal 

func (b *InMemoryBackend) AddOUInternal(ou *OrganizationalUnit)

AddOUInternal seeds an OU directly for testing. Requires an organization to have been created first.

func (*InMemoryBackend) AddPolicyInternal 

func (b *InMemoryBackend) AddPolicyInternal(p *Policy)

AddPolicyInternal seeds a policy directly for testing.

func (*InMemoryBackend) AttachPolicy 

func (b *InMemoryBackend) AttachPolicy(policyID, targetID string) error

AttachPolicy attaches a policy to a target.

func (*InMemoryBackend) CancelHandshake 

func (b *InMemoryBackend) CancelHandshake(handshakeID string) (*Handshake, error)

CancelHandshake cancels an OPEN handshake.

func (*InMemoryBackend) CloseAccount 

func (b *InMemoryBackend) CloseAccount(accountID string) error

CloseAccount marks an account as PENDING_CLOSURE.

func (*InMemoryBackend) CreateAccount 

func (b *InMemoryBackend) CreateAccount(
	name, email, roleName, iamUserAccessToBilling string,
	tags []Tag,
) (*CreateAccountStatus, error)

CreateAccount creates a new account and returns its status.

func (*InMemoryBackend) CreateGovCloudAccount 

func (b *InMemoryBackend) CreateGovCloudAccount(
	name, email, roleName, iamUserAccessToBilling string,
	tags []Tag,
) (*CreateAccountStatus, error)

CreateGovCloudAccount creates a commercial account paired with a GovCloud account.

func (*InMemoryBackend) CreateOrganization 

func (b *InMemoryBackend) CreateOrganization(featureSet string) (*Organization, *Root, error)

CreateOrganization creates a new organization.

func (*InMemoryBackend) CreateOrganizationalUnit 

func (b *InMemoryBackend) CreateOrganizationalUnit(
	parentID, name string,
	tags []Tag,
) (*OrganizationalUnit, error)

CreateOrganizationalUnit creates a new OU under the given parent.

func (*InMemoryBackend) CreatePolicy 

func (b *InMemoryBackend) CreatePolicy(
	name, description, content, policyType string,
	tags []Tag,
) (*Policy, error)

CreatePolicy creates a new policy.

func (*InMemoryBackend) DeclineHandshake 

func (b *InMemoryBackend) DeclineHandshake(handshakeID string) (*Handshake, error)

DeclineHandshake declines an OPEN handshake.

func (*InMemoryBackend) DeleteOrganization 

func (b *InMemoryBackend) DeleteOrganization() error

DeleteOrganization removes the organization.

func (*InMemoryBackend) DeleteOrganizationalUnit 

func (b *InMemoryBackend) DeleteOrganizationalUnit(ouID string) error

DeleteOrganizationalUnit removes an OU.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(policyID string) error

DeletePolicy removes a policy.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy() error

DeleteResourcePolicy removes the organization resource policy.

func (*InMemoryBackend) DeregisterDelegatedAdministrator 

func (b *InMemoryBackend) DeregisterDelegatedAdministrator(
	accountID, servicePrincipal string,
) error

DeregisterDelegatedAdministrator removes a delegated admin.

func (*InMemoryBackend) DescribeAccount 

func (b *InMemoryBackend) DescribeAccount(accountID string) (*Account, error)

DescribeAccount returns an account by ID.

func (*InMemoryBackend) DescribeCreateAccountStatus 

func (b *InMemoryBackend) DescribeCreateAccountStatus(
	requestID string,
) (*CreateAccountStatus, error)

DescribeCreateAccountStatus returns the status of a CreateAccount request.

func (*InMemoryBackend) DescribeEffectivePolicy 

func (b *InMemoryBackend) DescribeEffectivePolicy(
	policyType, targetID string,
) (*EffectivePolicy, error)

DescribeEffectivePolicy returns the effective policy of a given type for a target.

func (*InMemoryBackend) DescribeHandshake 

func (b *InMemoryBackend) DescribeHandshake(handshakeID string) (*Handshake, error)

DescribeHandshake returns a handshake by ID.

func (*InMemoryBackend) DescribeOrganization 

func (b *InMemoryBackend) DescribeOrganization() (*Organization, error)

DescribeOrganization returns the current organization.

func (*InMemoryBackend) DescribeOrganizationalUnit 

func (b *InMemoryBackend) DescribeOrganizationalUnit(ouID string) (*OrganizationalUnit, error)

DescribeOrganizationalUnit returns an OU by ID.

func (*InMemoryBackend) DescribePolicy 

func (b *InMemoryBackend) DescribePolicy(policyID string) (*Policy, error)

DescribePolicy returns a policy by ID.

func (*InMemoryBackend) DescribeResourcePolicy 

func (b *InMemoryBackend) DescribeResourcePolicy() (*ResourcePolicy, error)

DescribeResourcePolicy returns the organization resource policy.

func (*InMemoryBackend) DescribeResponsibilityTransfer 

func (b *InMemoryBackend) DescribeResponsibilityTransfer(handshakeID string) (*Handshake, error)

DescribeResponsibilityTransfer returns a responsibility-transfer handshake by ID.

func (*InMemoryBackend) DetachPolicy 

func (b *InMemoryBackend) DetachPolicy(policyID, targetID string) error

DetachPolicy detaches a policy from a target.

func (*InMemoryBackend) DisableAWSServiceAccess 

func (b *InMemoryBackend) DisableAWSServiceAccess(servicePrincipal string) error

DisableAWSServiceAccess disables a service principal.

func (*InMemoryBackend) DisablePolicyType 

func (b *InMemoryBackend) DisablePolicyType(rootID, policyType string) (*Root, error)

DisablePolicyType disables a policy type on the root.

func (*InMemoryBackend) EnableAWSServiceAccess 

func (b *InMemoryBackend) EnableAWSServiceAccess(servicePrincipal string) error

EnableAWSServiceAccess enables a service principal for org-wide access.

func (*InMemoryBackend) EnableAllFeatures 

func (b *InMemoryBackend) EnableAllFeatures() (*Handshake, error)

EnableAllFeatures creates an ENABLE_ALL_FEATURES handshake and returns it. Real AWS sends this handshake to all member accounts to approve the feature upgrade.

func (*InMemoryBackend) EnablePolicyType 

func (b *InMemoryBackend) EnablePolicyType(rootID, policyType string) (*Root, error)

EnablePolicyType enables a policy type on the root.

func (*InMemoryBackend) EnsureOrgExists 

func (b *InMemoryBackend) EnsureOrgExists() error

EnsureOrgExists returns ErrOrgNotFound if no org exists (for operations that require it).

func (*InMemoryBackend) InviteAccountToOrganization 

func (b *InMemoryBackend) InviteAccountToOrganization(
	target HandshakeParty,
	notes string,
) (*Handshake, error)

func (*InMemoryBackend) InviteOrganizationToTransferResponsibility 

func (b *InMemoryBackend) InviteOrganizationToTransferResponsibility(
	target HandshakeParty,
	notes string,
) (*Handshake, error)

InviteOrganizationToTransferResponsibility creates an OPEN invitation for org-to-org responsibility transfer.

func (*InMemoryBackend) LeaveOrganization 

func (b *InMemoryBackend) LeaveOrganization() error

LeaveOrganization removes the management account from the organization (stub: returns no error).

func (*InMemoryBackend) ListAWSServiceAccessForOrganization 

func (b *InMemoryBackend) ListAWSServiceAccessForOrganization() ([]EnabledServicePrincipal, error)

ListAWSServiceAccessForOrganization returns enabled service principals.

func (*InMemoryBackend) ListAccounts 

func (b *InMemoryBackend) ListAccounts() ([]*Account, error)

func (*InMemoryBackend) ListAccountsForParent 

func (b *InMemoryBackend) ListAccountsForParent(parentID string) ([]*Account, error)

ListAccountsForParent returns all accounts directly under a parent.

func (*InMemoryBackend) ListAccountsWithInvalidEffectivePolicy 

func (b *InMemoryBackend) ListAccountsWithInvalidEffectivePolicy(
	policyType string,
) ([]*Account, error)

ListAccountsWithInvalidEffectivePolicy returns accounts with invalid effective policies (always empty for stub).

func (*InMemoryBackend) ListChildren 

func (b *InMemoryBackend) ListChildren(parentID, childType string) ([]ChildSummary, error)

ListChildren returns children of a given type under a parent.

func (*InMemoryBackend) ListCreateAccountStatus 

func (b *InMemoryBackend) ListCreateAccountStatus(states []string) ([]*CreateAccountStatus, error)

ListCreateAccountStatus returns all CreateAccount status records, optionally filtered by state.

func (*InMemoryBackend) ListDelegatedAdministrators 

func (b *InMemoryBackend) ListDelegatedAdministrators(
	servicePrincipal string,
) ([]*DelegatedAdmin, error)

ListDelegatedAdministrators lists delegated admins, optionally filtered by service principal.

func (*InMemoryBackend) ListDelegatedServicesForAccount 

func (b *InMemoryBackend) ListDelegatedServicesForAccount(
	accountID string,
) ([]DelegatedService, error)

ListDelegatedServicesForAccount returns service principals for which an account is a delegated admin.

func (*InMemoryBackend) ListEffectivePolicyValidationErrors 

func (b *InMemoryBackend) ListEffectivePolicyValidationErrors(policyType, _ string) ([]any, error)

ListEffectivePolicyValidationErrors returns validation errors for an effective policy (always empty for stub).

func (*InMemoryBackend) ListHandshakesForAccount 

func (b *InMemoryBackend) ListHandshakesForAccount(actionTypeFilter string) ([]*Handshake, error)

ListHandshakesForAccount returns all handshakes visible to the calling account. actionTypeFilter optionally restricts results to handshakes with the given Action value.

func (*InMemoryBackend) ListHandshakesForOrganization 

func (b *InMemoryBackend) ListHandshakesForOrganization(actionTypeFilter string) ([]*Handshake, error)

ListHandshakesForOrganization returns all handshakes for the organization. actionTypeFilter optionally restricts results to handshakes with the given Action value.

func (*InMemoryBackend) ListInboundResponsibilityTransfers 

func (b *InMemoryBackend) ListInboundResponsibilityTransfers() ([]*Handshake, error)

ListInboundResponsibilityTransfers returns INVITE-type handshakes targeting this account.

func (*InMemoryBackend) ListOrganizationalUnitsForParent 

func (b *InMemoryBackend) ListOrganizationalUnitsForParent(
	parentID string,
) ([]*OrganizationalUnit, error)

ListOrganizationalUnitsForParent returns all OUs under a parent.

func (*InMemoryBackend) ListOutboundResponsibilityTransfers 

func (b *InMemoryBackend) ListOutboundResponsibilityTransfers() ([]*Handshake, error)

ListOutboundResponsibilityTransfers returns responsibility-transfer handshakes initiated by this org.

func (*InMemoryBackend) ListParents 

func (b *InMemoryBackend) ListParents(childID string) ([]ParentSummary, error)

ListParents returns the parents of an account or OU.

func (*InMemoryBackend) ListPolicies 

func (b *InMemoryBackend) ListPolicies(filter string) ([]*Policy, error)

ListPolicies returns all policies of a given type. AWS requires a non-empty Filter; empty filter returns InvalidInputException.

func (*InMemoryBackend) ListPoliciesForTarget 

func (b *InMemoryBackend) ListPoliciesForTarget(targetID, filter string) ([]*Policy, error)

ListPoliciesForTarget returns policies attached to a target, filtered by type. AWS requires a non-empty Filter; empty filter returns InvalidInputException.

func (*InMemoryBackend) ListRoots 

func (b *InMemoryBackend) ListRoots() ([]*Root, error)

ListRoots returns the organization roots.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceID string) ([]Tag, error)

ListTagsForResource returns all tags for a resource.

func (*InMemoryBackend) ListTargetsForPolicy 

func (b *InMemoryBackend) ListTargetsForPolicy(policyID string) ([]PolicyTargetSummary, error)

ListTargetsForPolicy returns targets that a policy is attached to.

func (*InMemoryBackend) MoveAccount 

func (b *InMemoryBackend) MoveAccount(accountID, sourceParentID, destParentID string) error

MoveAccount moves an account from one parent to another.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(content string) (*ResourcePolicy, error)

PutResourcePolicy creates or replaces the organization resource policy.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the configured AWS region.

func (*InMemoryBackend) RegisterDelegatedAdministrator 

func (b *InMemoryBackend) RegisterDelegatedAdministrator(accountID, servicePrincipal string) error

RegisterDelegatedAdministrator registers a delegated admin for a service.

func (*InMemoryBackend) RemoveAccountFromOrganization 

func (b *InMemoryBackend) RemoveAccountFromOrganization(accountID string) error

RemoveAccountFromOrganization removes an account from the organization.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all organization state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceID string, tags []Tag) error

TagResource adds or updates tags on a resource.

func (*InMemoryBackend) TerminateResponsibilityTransfer 

func (b *InMemoryBackend) TerminateResponsibilityTransfer(handshakeID string) (*Handshake, error)

TerminateResponsibilityTransfer terminates an OPEN responsibility-transfer handshake.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceID string, tagKeys []string) error

UntagResource removes tags from a resource.

func (*InMemoryBackend) UpdateOrganizationalUnit 

func (b *InMemoryBackend) UpdateOrganizationalUnit(ouID, name string) (*OrganizationalUnit, error)

UpdateOrganizationalUnit renames an OU.

func (*InMemoryBackend) UpdatePolicy 

func (b *InMemoryBackend) UpdatePolicy(
	policyID, name, description, content string,
) (*Policy, error)

UpdatePolicy updates a policy.

func (*InMemoryBackend) UpdateResponsibilityTransfer 

func (b *InMemoryBackend) UpdateResponsibilityTransfer(
	handshakeID, action string,
) (*Handshake, error)

UpdateResponsibilityTransfer accepts or declines a responsibility-transfer handshake.

type Organization 

type Organization struct {
	ID                   string              `json:"id"`
	ARN                  string              `json:"arn"`
	FeatureSet           string              `json:"featureSet"`
	MasterAccountID      string              `json:"masterAccountID"`
	MasterAccountARN     string              `json:"masterAccountARN"`
	MasterAccountEmail   string              `json:"masterAccountEmail"`
	AvailablePolicyTypes []PolicyTypeSummary `json:"availablePolicyTypes,omitempty"`
}

Organization represents an AWS organization.

type OrganizationalUnit 

type OrganizationalUnit struct {
	ID       string `json:"id"`
	ARN      string `json:"arn"`
	Name     string `json:"name"`
	ParentID string `json:"parentID"`
}

OrganizationalUnit represents an OU in the organization hierarchy.

type ParentSummary 

type ParentSummary struct {
	ID   string `json:"Id"`
	Type string `json:"Type"`
}

ParentSummary describes the parent of an account or OU.

type Policy 

type Policy struct {
	Content       string        `json:"content"`
	PolicySummary PolicySummary `json:"policySummary"`
}

Policy represents an Organizations policy.

type PolicySummary 

type PolicySummary struct {
	ID          string `json:"id"`
	ARN         string `json:"arn"`
	Name        string `json:"name"`
	Description string `json:"description"`
	Type        string `json:"type"`
	AwsManaged  bool   `json:"awsManaged"`
}

PolicySummary holds metadata about a policy.

type PolicyTargetSummary 

type PolicyTargetSummary struct {
	TargetID string `json:"targetID"`
	ARN      string `json:"arn"`
	Name     string `json:"name"`
	Type     string `json:"type"`
}

PolicyTargetSummary describes a target of a policy attachment.

type PolicyTypeSummary 

type PolicyTypeSummary struct {
	Type   string `json:"type"`
	Status string `json:"status"`
}

PolicyTypeSummary holds policy type enablement state for a root.

type Provider 

type Provider struct{}

Provider implements service.Provider for the Organizations service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Organizations service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type ResourcePolicy 

type ResourcePolicy struct {
	ID      string `json:"id"`
	ARN     string `json:"arn"`
	Content string `json:"content"`
}

ResourcePolicy represents the organization resource-based policy.

type Root 

type Root struct {
	ID          string              `json:"id"`
	ARN         string              `json:"arn"`
	Name        string              `json:"name"`
	PolicyTypes []PolicyTypeSummary `json:"policyTypes,omitempty"`
}

Root represents the root container in an organization.

type StorageBackend 

type StorageBackend interface {
	// Organization operations
	CreateOrganization(featureSet string) (*Organization, *Root, error)
	DescribeOrganization() (*Organization, error)
	DeleteOrganization() error
	EnsureOrgExists() error

	// Account operations
	CreateAccount(name, email, roleName, iamUserAccessToBilling string, tags []Tag) (*CreateAccountStatus, error)
	CreateGovCloudAccount(
		name, email, roleName, iamUserAccessToBilling string,
		tags []Tag,
	) (*CreateAccountStatus, error)
	DescribeCreateAccountStatus(requestID string) (*CreateAccountStatus, error)
	DescribeAccount(accountID string) (*Account, error)
	ListAccounts() ([]*Account, error)
	RemoveAccountFromOrganization(accountID string) error
	MoveAccount(accountID, sourceParentID, destParentID string) error
	CloseAccount(accountID string) error

	// Root operations
	ListRoots() ([]*Root, error)

	// OU operations
	CreateOrganizationalUnit(parentID, name string, tags []Tag) (*OrganizationalUnit, error)
	DescribeOrganizationalUnit(ouID string) (*OrganizationalUnit, error)
	DeleteOrganizationalUnit(ouID string) error
	UpdateOrganizationalUnit(ouID, name string) (*OrganizationalUnit, error)
	ListOrganizationalUnitsForParent(parentID string) ([]*OrganizationalUnit, error)
	ListAccountsForParent(parentID string) ([]*Account, error)
	ListParents(childID string) ([]ParentSummary, error)
	ListChildren(parentID, childType string) ([]ChildSummary, error)

	// Policy operations
	CreatePolicy(name, description, content, policyType string, tags []Tag) (*Policy, error)
	DescribePolicy(policyID string) (*Policy, error)
	UpdatePolicy(policyID, name, description, content string) (*Policy, error)
	DeletePolicy(policyID string) error
	ListPolicies(filter string) ([]*Policy, error)
	AttachPolicy(policyID, targetID string) error
	DetachPolicy(policyID, targetID string) error
	ListPoliciesForTarget(targetID, filter string) ([]*Policy, error)
	ListTargetsForPolicy(policyID string) ([]PolicyTargetSummary, error)
	EnablePolicyType(rootID, policyType string) (*Root, error)
	DisablePolicyType(rootID, policyType string) (*Root, error)

	// Tag operations
	TagResource(resourceID string, tags []Tag) error
	UntagResource(resourceID string, tagKeys []string) error
	ListTagsForResource(resourceID string) ([]Tag, error)

	// Service access operations
	EnableAWSServiceAccess(servicePrincipal string) error
	DisableAWSServiceAccess(servicePrincipal string) error
	ListAWSServiceAccessForOrganization() ([]EnabledServicePrincipal, error)

	// Delegated admin operations
	RegisterDelegatedAdministrator(accountID, servicePrincipal string) error
	DeregisterDelegatedAdministrator(accountID, servicePrincipal string) error
	ListDelegatedAdministrators(servicePrincipal string) ([]*DelegatedAdmin, error)

	// Handshake operations
	AcceptHandshake(handshakeID string) (*Handshake, error)
	CancelHandshake(handshakeID string) (*Handshake, error)
	DeclineHandshake(handshakeID string) (*Handshake, error)
	DescribeHandshake(handshakeID string) (*Handshake, error)
	DescribeResponsibilityTransfer(handshakeID string) (*Handshake, error)
	EnableAllFeatures() (*Handshake, error)
	InviteAccountToOrganization(target HandshakeParty, notes string) (*Handshake, error)
	InviteOrganizationToTransferResponsibility(target HandshakeParty, notes string) (*Handshake, error)
	LeaveOrganization() error
	ListHandshakesForAccount(actionTypeFilter string) ([]*Handshake, error)
	ListHandshakesForOrganization(actionTypeFilter string) ([]*Handshake, error)
	ListInboundResponsibilityTransfers() ([]*Handshake, error)
	ListOutboundResponsibilityTransfers() ([]*Handshake, error)
	TerminateResponsibilityTransfer(handshakeID string) (*Handshake, error)
	UpdateResponsibilityTransfer(handshakeID, action string) (*Handshake, error)
	AddHandshakeInternal(h *Handshake)

	// Account status operations
	ListCreateAccountStatus(states []string) ([]*CreateAccountStatus, error)
	ListAccountsWithInvalidEffectivePolicy(policyType string) ([]*Account, error)

	// Delegated service operations
	ListDelegatedServicesForAccount(accountID string) ([]DelegatedService, error)

	// Effective policy validation operations
	ListEffectivePolicyValidationErrors(policyType, targetID string) ([]any, error)

	// Resource policy operations
	DeleteResourcePolicy() error
	DescribeResourcePolicy() (*ResourcePolicy, error)
	PutResourcePolicy(content string) (*ResourcePolicy, error)

	// Effective policy operations
	DescribeEffectivePolicy(policyType, targetID string) (*EffectivePolicy, error)

	// Lifecycle
	Reset()
	AccountID() string
	Region() string
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend defines the interface for the Organizations in-memory backend. All mutating methods must be safe for concurrent use.

type Tag 

type Tag struct {
	Key   string `json:"Key"`
	Value string `json:"Value"`
}

Tag is a key-value pair attached to an Organizations resource.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.