AWS.Organizations reference

AcceptHandshake

Source: src/AWS/Organizations/AcceptHandshake.ts

Runtime binding for organizations:AcceptHandshake.

Accepts a pending handshake — e.g. an invitation to join an organization, called from the invited member account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.AcceptHandshakeHttp).

AcceptHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const acceptHandshake = yield* AWS.Organizations.AcceptHandshake();

// runtime
const { Handshake } = yield* acceptHandshake({ HandshakeId: handshakeId });

Account

Source: src/AWS/Organizations/Account.ts

A member account created and managed by AWS Organizations.

Account creation is asynchronous — the provider polls the vending request until the account ID is assigned. Must be deployed from the organization’s management account. Changing email replaces the account; changing name updates it in place.

Account: Creating Member Accounts

Account Under the Organization Root

const root = yield* Root("Root", {});

const dev = yield* Account("Dev", {
  name: "dev",
  email: "aws-dev@example.com",
  parentId: root.rootId,
});

Account Inside an Organizational Unit

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

const prod = yield* Account("Prod", {
  name: "prod",
  email: "aws-prod@example.com",
  parentId: workloads.ouId,
  roleName: "OrganizationAccountAccessRole",
  tags: { environment: "prod" },
});

CancelHandshake

Source: src/AWS/Organizations/CancelHandshake.ts

Runtime binding for organizations:CancelHandshake.

Cancels a pending handshake from the originator side — e.g. withdrawing an invitation before the recipient responds. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.CancelHandshakeHttp).

CancelHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const cancelHandshake = yield* AWS.Organizations.CancelHandshake();

// runtime
const { Handshake } = yield* cancelHandshake({ HandshakeId: handshakeId });

DeclineHandshake

Source: src/AWS/Organizations/DeclineHandshake.ts

Runtime binding for organizations:DeclineHandshake.

Declines a pending handshake, ending the invitation from the recipient side; the originator can no longer act on it. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DeclineHandshakeHttp).

DeclineHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const declineHandshake = yield* AWS.Organizations.DeclineHandshake();

// runtime
const { Handshake } = yield* declineHandshake({ HandshakeId: handshakeId });

DelegatedAdministrator

Source: src/AWS/Organizations/DelegatedAdministrator.ts

Registers a member Account as the delegated administrator for a trusted AWS service, letting that account manage the service org-wide instead of the management account.

Requires trusted access for the same service principal (see TrustedServiceAccess). Existence-only resource: changing accountId or servicePrincipal replaces the registration.

DelegatedAdministrator: Delegating Administration

const security = yield* Account("Security", {
  name: "security",
  email: "aws-security@example.com",
  parentId: root.rootId,
});

const guardDutyAccess = yield* TrustedServiceAccess("GuardDutyAccess", {
  servicePrincipal: "guardduty.amazonaws.com",
});

yield* DelegatedAdministrator("GuardDutyAdmin", {
  accountId: security.accountId,
  servicePrincipal: guardDutyAccess.servicePrincipal,
});

DescribeCreateAccountStatus

Source: src/AWS/Organizations/DescribeCreateAccountStatus.ts

Runtime binding for organizations:DescribeCreateAccountStatus.

Retrieves the current status of an asynchronous account-creation request — the polling half of an account-vending workflow. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeCreateAccountStatusHttp).

DescribeCreateAccountStatus: Account Vending

// init — account-level binding, no resource argument
const describeCreateAccountStatus = yield* AWS.Organizations.DescribeCreateAccountStatus();

// runtime
const { CreateAccountStatus } = yield* describeCreateAccountStatus({
  CreateAccountRequestId: requestId,
});

DescribeEffectivePolicy

Source: src/AWS/Organizations/DescribeEffectivePolicy.ts

Runtime binding for organizations:DescribeEffectivePolicy.

Returns the contents of the effective policy of the specified type for an account — the aggregation of inherited plus directly attached management policies (tag, backup, AI-services opt-out, …). Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeEffectivePolicyHttp).

DescribeEffectivePolicy: Policies & Effective Policy

// init — account-level binding, no resource argument
const describeEffectivePolicy = yield* AWS.Organizations.DescribeEffectivePolicy();

// runtime
const { EffectivePolicy } = yield* describeEffectivePolicy({
  PolicyType: "TAG_POLICY",
  TargetId: accountId,
});

DescribeHandshake

Source: src/AWS/Organizations/DescribeHandshake.ts

Runtime binding for organizations:DescribeHandshake.

Returns the details and current state of a handshake — accepted, declined, or canceled handshakes stay readable for 30 days. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeHandshakeHttp).

DescribeHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const describeHandshake = yield* AWS.Organizations.DescribeHandshake();

// runtime
const { Handshake } = yield* describeHandshake({ HandshakeId: handshakeId });

DescribeOrganization

Source: src/AWS/Organizations/DescribeOrganization.ts

Runtime binding for organizations:DescribeOrganization.

Retrieves information about the organization that the calling account belongs to — its id, ARN, feature set, and management account. Available from any account in the organization. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeOrganizationHttp).

DescribeOrganization: Reading the Organization Tree

// init — account-level binding, no resource argument
const describeOrganization = yield* AWS.Organizations.DescribeOrganization();

// runtime
const { Organization } = yield* describeOrganization();
console.log(Organization?.Id, Organization?.MasterAccountId);

InviteAccountToOrganization

Source: src/AWS/Organizations/InviteAccountToOrganization.ts

Runtime binding for organizations:InviteAccountToOrganization.

Sends an invitation (handshake) to another account to join the organization as a member account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.InviteAccountToOrganizationHttp).

InviteAccountToOrganization: Handshakes & Invitations

// init — account-level binding, no resource argument
const inviteAccountToOrganization = yield* AWS.Organizations.InviteAccountToOrganization();

// runtime
const { Handshake } = yield* inviteAccountToOrganization({
  Target: { Id: "111122223333", Type: "ACCOUNT" },
});

ListAccounts

Source: src/AWS/Organizations/ListAccounts.ts

Runtime binding for organizations:ListAccounts.

Lists all accounts in the organization — the backbone of cross-account automation that iterates every member account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAccountsHttp).

ListAccounts: Reading the Organization Tree

// init — account-level binding, no resource argument
const listAccounts = yield* AWS.Organizations.ListAccounts();

// runtime
const { Accounts } = yield* listAccounts();

ListAccountsForParent

Source: src/AWS/Organizations/ListAccountsForParent.ts

Runtime binding for organizations:ListAccountsForParent.

Lists the accounts directly contained by the specified root or organizational unit (not accounts in child OUs). Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAccountsForParentHttp).

ListAccountsForParent: Reading the Organization Tree

// init — account-level binding, no resource argument
const listAccountsForParent = yield* AWS.Organizations.ListAccountsForParent();

// runtime
const { Accounts } = yield* listAccountsForParent({ ParentId: ouId });

ListAccountsWithInvalidEffectivePolicy

Source: src/AWS/Organizations/ListAccountsWithInvalidEffectivePolicy.ts

Runtime binding for organizations:ListAccountsWithInvalidEffectivePolicy.

Lists the accounts whose effective policy of the specified type is invalid — e.g. exceeds the size limit after policy inheritance. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAccountsWithInvalidEffectivePolicyHttp).

ListAccountsWithInvalidEffectivePolicy: Policies & Effective Policy

// init — account-level binding, no resource argument
const listAccountsWithInvalidEffectivePolicy = yield* AWS.Organizations.ListAccountsWithInvalidEffectivePolicy();

// runtime
const { Accounts } = yield* listAccountsWithInvalidEffectivePolicy({
  PolicyType: "TAG_POLICY",
});

ListAWSServiceAccessForOrganization

Source: src/AWS/Organizations/ListAWSServiceAccessForOrganization.ts

Runtime binding for organizations:ListAWSServiceAccessForOrganization.

Lists the Amazon Web Services services that are enabled for trusted access with the organization. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAWSServiceAccessForOrganizationHttp).

ListAWSServiceAccessForOrganization: Delegated Administration & Trusted Access

// init — account-level binding, no resource argument
const listAWSServiceAccessForOrganization = yield* AWS.Organizations.ListAWSServiceAccessForOrganization();

// runtime
const { EnabledServicePrincipals } =
  yield* listAWSServiceAccessForOrganization();

ListChildren

Source: src/AWS/Organizations/ListChildren.ts

Runtime binding for organizations:ListChildren.

Lists the child accounts or organizational units directly under the specified parent root or OU — one level of the organization tree at a time. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListChildrenHttp).

ListChildren: Reading the Organization Tree

// init — account-level binding, no resource argument
const listChildren = yield* AWS.Organizations.ListChildren();

// runtime
const { Children } = yield* listChildren({
  ParentId: rootId,
  ChildType: "ORGANIZATIONAL_UNIT",
});

ListCreateAccountStatus

Source: src/AWS/Organizations/ListCreateAccountStatus.ts

Runtime binding for organizations:ListCreateAccountStatus.

Lists the account-creation requests that match the specified states — auditing in-flight and completed account vending. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListCreateAccountStatusHttp).

ListCreateAccountStatus: Account Vending

// init — account-level binding, no resource argument
const listCreateAccountStatus = yield* AWS.Organizations.ListCreateAccountStatus();

// runtime
const { CreateAccountStatuses } = yield* listCreateAccountStatus({
  States: ["IN_PROGRESS"],
});

ListDelegatedAdministrators

Source: src/AWS/Organizations/ListDelegatedAdministrators.ts

Runtime binding for organizations:ListDelegatedAdministrators.

Lists the accounts that are designated as delegated administrators in the organization, optionally filtered by service principal. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListDelegatedAdministratorsHttp).

ListDelegatedAdministrators: Delegated Administration & Trusted Access

// init — account-level binding, no resource argument
const listDelegatedAdministrators = yield* AWS.Organizations.ListDelegatedAdministrators();

// runtime
const { DelegatedAdministrators } = yield* listDelegatedAdministrators();

ListDelegatedServicesForAccount

Source: src/AWS/Organizations/ListDelegatedServicesForAccount.ts

Runtime binding for organizations:ListDelegatedServicesForAccount.

Lists the Amazon Web Services services for which the specified account is a delegated administrator. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListDelegatedServicesForAccountHttp).

ListDelegatedServicesForAccount: Delegated Administration & Trusted Access

// init — account-level binding, no resource argument
const listDelegatedServicesForAccount = yield* AWS.Organizations.ListDelegatedServicesForAccount();

// runtime
const { DelegatedServices } = yield* listDelegatedServicesForAccount({
  AccountId: accountId,
});

ListEffectivePolicyValidationErrors

Source: src/AWS/Organizations/ListEffectivePolicyValidationErrors.ts

Runtime binding for organizations:ListEffectivePolicyValidationErrors.

Lists the validation errors in an account’s effective policy of the specified type — the reasons the aggregated policy is invalid. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListEffectivePolicyValidationErrorsHttp).

ListEffectivePolicyValidationErrors: Policies & Effective Policy

// init — account-level binding, no resource argument
const listEffectivePolicyValidationErrors = yield* AWS.Organizations.ListEffectivePolicyValidationErrors();

// runtime
const { EffectivePolicyValidationErrors } =
  yield* listEffectivePolicyValidationErrors({
    AccountId: accountId,
    PolicyType: "TAG_POLICY",
  });

ListHandshakesForAccount

Source: src/AWS/Organizations/ListHandshakesForAccount.ts

Runtime binding for organizations:ListHandshakesForAccount.

Lists the handshakes that are associated with the calling account — pending and recently concluded invitations. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListHandshakesForAccountHttp).

ListHandshakesForAccount: Handshakes & Invitations

// init — account-level binding, no resource argument
const listHandshakesForAccount = yield* AWS.Organizations.ListHandshakesForAccount();

// runtime
const { Handshakes } = yield* listHandshakesForAccount();

ListHandshakesForOrganization

Source: src/AWS/Organizations/ListHandshakesForOrganization.ts

Runtime binding for organizations:ListHandshakesForOrganization.

Lists the handshakes sent by the organization’s management account — outstanding and recently concluded invitations. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListHandshakesForOrganizationHttp).

ListHandshakesForOrganization: Handshakes & Invitations

// init — account-level binding, no resource argument
const listHandshakesForOrganization = yield* AWS.Organizations.ListHandshakesForOrganization();

// runtime
const { Handshakes } = yield* listHandshakesForOrganization();

ListOrganizationalUnitsForParent

Source: src/AWS/Organizations/ListOrganizationalUnitsForParent.ts

Runtime binding for organizations:ListOrganizationalUnitsForParent.

Lists the organizational units directly contained by the specified root or parent OU. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListOrganizationalUnitsForParentHttp).

ListOrganizationalUnitsForParent: Reading the Organization Tree

// init — account-level binding, no resource argument
const listOrganizationalUnitsForParent = yield* AWS.Organizations.ListOrganizationalUnitsForParent();

// runtime
const { OrganizationalUnits } = yield* listOrganizationalUnitsForParent({
  ParentId: rootId,
});

ListParents

Source: src/AWS/Organizations/ListParents.ts

Runtime binding for organizations:ListParents.

Lists the direct parent (root or OU) of the specified child account or OU — walking the organization tree upward. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListParentsHttp).

ListParents: Reading the Organization Tree

// init — account-level binding, no resource argument
const listParents = yield* AWS.Organizations.ListParents();

// runtime
const { Parents } = yield* listParents({ ChildId: accountId });

ListPolicies

Source: src/AWS/Organizations/ListPolicies.ts

Runtime binding for organizations:ListPolicies.

Lists all policies of the specified type (service control, tag, backup, AI-services opt-out, …) in the organization. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListPoliciesHttp).

ListPolicies: Policies & Effective Policy

// init — account-level binding, no resource argument
const listPolicies = yield* AWS.Organizations.ListPolicies();

// runtime
const { Policies } = yield* listPolicies({ Filter: "SERVICE_CONTROL_POLICY" });

ListPoliciesForTarget

Source: src/AWS/Organizations/ListPoliciesForTarget.ts

Runtime binding for organizations:ListPoliciesForTarget.

Lists the policies of the specified type that are directly attached to the specified target root, OU, or account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListPoliciesForTargetHttp).

ListPoliciesForTarget: Policies & Effective Policy

// init — account-level binding, no resource argument
const listPoliciesForTarget = yield* AWS.Organizations.ListPoliciesForTarget();

// runtime
const { Policies } = yield* listPoliciesForTarget({
  TargetId: accountId,
  Filter: "SERVICE_CONTROL_POLICY",
});

ListRoots

Source: src/AWS/Organizations/ListRoots.ts

Runtime binding for organizations:ListRoots.

Lists the roots of the organization, including the policy types enabled on each root. The root id is the starting point for walking the organization tree. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListRootsHttp).

ListRoots: Reading the Organization Tree

// init — account-level binding, no resource argument
const listRoots = yield* AWS.Organizations.ListRoots();

// runtime
const { Roots } = yield* listRoots();
const rootId = Roots?.[0]?.Id;

ListTagsForResource

Source: src/AWS/Organizations/ListTagsForResource.ts

Runtime binding for organizations:ListTagsForResource.

Lists the tags attached to the specified Organizations resource — an account, root, organizational unit, or policy. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListTagsForResourceHttp).

ListTagsForResource: Tags

// init — account-level binding, no resource argument
const listTagsForResource = yield* AWS.Organizations.ListTagsForResource();

// runtime
const { Tags } = yield* listTagsForResource({ ResourceId: accountId });

ListTargetsForPolicy

Source: src/AWS/Organizations/ListTargetsForPolicy.ts

Runtime binding for organizations:ListTargetsForPolicy.

Lists all roots, organizational units, and accounts that the specified policy is attached to. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListTargetsForPolicyHttp).

ListTargetsForPolicy: Policies & Effective Policy

// init — account-level binding, no resource argument
const listTargetsForPolicy = yield* AWS.Organizations.ListTargetsForPolicy();

// runtime
const { Targets } = yield* listTargetsForPolicy({ PolicyId: policyId });

Organization

Source: src/AWS/Organizations/Organization.ts

The AWS Organization for the current management account.

This is a singleton-style resource. If an organization already exists, Alchemy adopts and reconciles it instead of creating a second one.

Organization: Creating An Organization

const organization = yield* Organization("Org", {
  featureSet: "ALL",
});

OrganizationalUnit

Source: src/AWS/Organizations/OrganizationalUnit.ts

An AWS Organizations organizational unit.

OrganizationalUnit: Creating OUs

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

OrganizationResourcePolicy

Source: src/AWS/Organizations/OrganizationResourcePolicy.ts

The singleton AWS Organizations resource policy — an org-level resource-based policy that grants other principals (typically delegated administrator accounts) permission to call Organizations APIs.

There is at most one per organization; Alchemy adopts and reconciles the existing policy if one is already in place.

OrganizationResourcePolicy: Setting the Resource Policy

const security = yield* Account("Security", {
  name: "security",
  email: "aws-security@example.com",
  parentId: root.rootId,
});

yield* OrganizationResourcePolicy("OrgResourcePolicy", {
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: security.accountId },
        Action: [
          "organizations:DescribeOrganization",
          "organizations:ListAccounts",
        ],
        Resource: "*",
      },
    ],
  },
});

Policy

Source: src/AWS/Organizations/Policy.ts

An AWS Organizations policy such as an SCP or tag policy.

Attach it to a root, OU, or account with PolicyAttachment. Changing type or name replaces the policy; document and description changes update in place.

Policy: Creating Policies

Service Control Policy (Typed Document)

const denyLeaveOrg = yield* Policy("DenyLeaveOrg", {
  type: "SERVICE_CONTROL_POLICY",
  description: "Prevent member accounts from leaving the organization",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Action: ["organizations:LeaveOrganization"],
        Resource: "*",
      },
    ],
  },
});

Tag Policy (Raw JSON)

const tagPolicy = yield* Policy("RequireEnvTag", {
  type: "TAG_POLICY",
  document: JSON.stringify({
    tags: {
      environment: {
        tag_key: { "@@assign": "environment" },
        tag_value: { "@@assign": ["dev", "staging", "prod"] },
      },
    },
  }),
});

Policy: Attaching Policies

const root = yield* Root("Root", {});

const scpEnabled = yield* RootPolicyType("ScpEnabled", {
  rootId: root.rootId,
  policyType: "SERVICE_CONTROL_POLICY",
});

yield* PolicyAttachment("DenyLeaveOrgOnRoot", {
  policyId: denyLeaveOrg.policyId,
  targetId: scpEnabled.rootId,
});

PolicyAttachment

Source: src/AWS/Organizations/PolicyAttachment.ts

Attaches an Organizations Policy to a root, OU, or account.

Existence-only resource: changing either policyId or targetId replaces the attachment. The policy’s type must already be enabled on the root (see RootPolicyType).

PolicyAttachment: Attaching Policies

Attach an SCP to an Organizational Unit

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

const denyRegions = yield* Policy("DenyOtherRegions", {
  type: "SERVICE_CONTROL_POLICY",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        NotAction: ["iam:*", "organizations:*", "sts:*"],
        Resource: "*",
        Condition: {
          StringNotEquals: { "aws:RequestedRegion": ["us-east-1", "us-west-2"] },
        },
      },
    ],
  },
});

yield* PolicyAttachment("DenyRegionsOnWorkloads", {
  policyId: denyRegions.policyId,
  targetId: workloads.ouId,
});

Attach a Policy to a Member Account

yield* PolicyAttachment("DenyRegionsOnDev", {
  policyId: denyRegions.policyId,
  targetId: devAccount.accountId,
});

Root

Source: src/AWS/Organizations/Root.ts

The organization root.

Root is an import-style resource. It discovers the existing root returned by AWS Organizations and can reconcile root tags. Use root.rootId as the parentId for top-level OrganizationalUnits and Accounts, and as the targetId/rootId for PolicyAttachment and RootPolicyType.

Root: Importing the Root

Adopt the Organization Root

const organization = yield* Organization("Org", { featureSet: "ALL" });
const root = yield* Root("Root", {});

Parent OUs and Accounts Under the Root

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

const sandbox = yield* Account("Sandbox", {
  name: "sandbox",
  email: "aws-sandbox@example.com",
  parentId: root.rootId,
});

RootPolicyType

Source: src/AWS/Organizations/RootPolicyType.ts

Enables a policy type on an organization root.

A policy type (SCP, tag policy, …) must be enabled on the root before any Policy of that type can be attached via PolicyAttachment. Existence-only resource: changing rootId or policyType replaces it.

RootPolicyType: Enabling Policy Types

Enable Service Control Policies

const root = yield* Root("Root", {});

const scpEnabled = yield* RootPolicyType("ScpEnabled", {
  rootId: root.rootId,
  policyType: "SERVICE_CONTROL_POLICY",
});

Enable Tag Policies Before Attaching One

const tagPoliciesEnabled = yield* RootPolicyType("TagPoliciesEnabled", {
  rootId: root.rootId,
  policyType: "TAG_POLICY",
});

yield* PolicyAttachment("RequireEnvTagOnRoot", {
  policyId: tagPolicy.policyId,
  // depend on the enablement so attachment happens after it
  targetId: tagPoliciesEnabled.rootId,
});

TenantRoot

Source: src/AWS/Organizations/TenantRoot.ts

Compose an opinionated single-tenant landing zone inside the current AWS Organizations management account.

This helper intentionally stays aligned to native AWS semantics: one real Organization, one root, nested OUs, and accounts beneath that tenant root. The broader RootRoot concept is an Alchemy control-plane abstraction over many such tenant roots deployed into separate management accounts, not a nested AWS Organizations feature.

TenantRoot: Creating A Tenant Root

const tenant = yield* TenantRoot("CustomerA", {
  identityCenter: {
    mode: "existing",
    groups: [
      { key: "platform", displayName: "platform-engineers" },
    ],
    permissionSets: [
      {
        key: "admin",
        name: "AdministratorAccess",
        sessionDuration: "8 hours",
      },
    ],
    assignments: [
      {
        permissionSetKey: "admin",
        groupKey: "platform",
        accountKey: "prod",
      },
    ],
  },
});

TrustedServiceAccess

Source: src/AWS/Organizations/TrustedServiceAccess.ts

Enables trusted access for an AWS service principal, allowing that service to operate across all accounts in the organization.

Typically paired with a DelegatedAdministrator that hands day-to-day administration of the service to a member account. Existence-only resource: changing servicePrincipal replaces it.

TrustedServiceAccess: Enabling Trusted Access

Enable IAM Identity Center

yield* TrustedServiceAccess("SsoTrustedAccess", {
  servicePrincipal: "sso.amazonaws.com",
});

Trusted Access Plus a Delegated Administrator

const guardDutyAccess = yield* TrustedServiceAccess("GuardDutyAccess", {
  servicePrincipal: "guardduty.amazonaws.com",
});

yield* DelegatedAdministrator("GuardDutyAdmin", {
  accountId: securityAccount.accountId,
  servicePrincipal: guardDutyAccess.servicePrincipal,
});