diff --git a/.editorconfig b/.editorconfig
index 64d587d8..15d24e75 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
root=true
diff --git a/.eslintrc.json b/.eslintrc.json
index 7faec5cd..c1c7250a 100644
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -1,4 +1,4 @@
-// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
{
"env": {
"jest": true,
@@ -7,8 +7,7 @@
"root": true,
"plugins": [
"@typescript-eslint",
- "import",
- "prettier"
+ "import"
],
"parser": "@typescript-eslint/parser",
"parserOptions": {
@@ -18,7 +17,6 @@
},
"extends": [
"plugin:import/typescript",
- "prettier",
"plugin:prettier/recommended"
],
"settings": {
@@ -38,7 +36,6 @@
},
"ignorePatterns": [
"*.js",
- "!.projenrc.ts",
"*.d.ts",
"node_modules/",
"*.generated.ts",
@@ -47,9 +44,6 @@
"!projenrc/**/*.ts"
],
"rules": {
- "prettier/prettier": [
- "error"
- ],
"@typescript-eslint/no-require-imports": [
"error"
],
@@ -59,14 +53,13 @@
"devDependencies": [
"**/test/**",
"**/build-tools/**",
- "**/projenrc/**",
- ".projenrc.ts",
- "projenrc/**/*.ts",
"src/account-provider/is-complete-handler.lambda.ts",
"src/account-provider/on-event-handler.lambda.ts",
"src/organization-provider/on-event-handler.lambda.ts",
"src/organizational-unit-provider/on-event-handler.lambda.ts",
- "src/tag-resource-provider/on-event-handler.lambda.ts"
+ "src/tag-resource-provider/on-event-handler.lambda.ts",
+ ".projenrc.ts",
+ "projenrc/**/*.ts"
],
"optionalDependencies": false,
"peerDependencies": true
@@ -88,7 +81,7 @@
}
}
],
- "no-duplicate-imports": [
+ "import/no-duplicates": [
"error"
],
"no-shadow": [
diff --git a/.gitattributes b/.gitattributes
index 183c4cf5..19ff950b 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,5 +1,6 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+* text=auto eol=lf
*.snap linguist-generated
/.editorconfig linguist-generated
/.eslintrc.json linguist-generated
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 558cd611..1d9e9fb0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
version: 2
updates:
diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index 1f73aa5f..ceae8eb9 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
name: auto-approve
on:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 140e4381..eca380d9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
name: build
on:
@@ -15,10 +15,14 @@ jobs:
CI: "true"
steps:
- name: Checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
+ - name: Setup Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: lts/*
- name: Install dependencies
run: yarn install --check-files
- name: build
@@ -27,29 +31,30 @@ jobs:
id: self_mutation
run: |-
git add .
- git diff --staged --patch --exit-code > .repo.patch || echo "self_mutation_happened=true" >> $GITHUB_OUTPUT
+ git diff --staged --patch --exit-code > repo.patch || echo "self_mutation_happened=true" >> $GITHUB_OUTPUT
+ working-directory: ./
- name: Upload patch
if: steps.self_mutation.outputs.self_mutation_happened
- uses: actions/upload-artifact@v3
+ uses: actions/upload-artifact@v4.4.0
with:
- name: .repo.patch
- path: .repo.patch
+ name: repo.patch
+ path: repo.patch
+ overwrite: true
- name: Fail build on mutation
if: steps.self_mutation.outputs.self_mutation_happened
run: |-
echo "::error::Files were changed during build (see build log). If this was triggered from a fork, you will need to update your branch."
- cat .repo.patch
+ cat repo.patch
exit 1
- name: Backup artifact permissions
run: cd dist && getfacl -R . > permissions-backup.acl
continue-on-error: true
- name: Upload artifact
- uses: actions/upload-artifact@v3
+ uses: actions/upload-artifact@v4.4.0
with:
name: build-artifact
path: dist
- container:
- image: jsii/superchain:1-buster-slim-node14
+ overwrite: true
self-mutation:
needs: build
runs-on: ubuntu-latest
@@ -58,134 +63,172 @@ jobs:
if: always() && needs.build.outputs.self_mutation_happened && !(github.event.pull_request.head.repo.full_name != github.repository)
steps:
- name: Checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v4
with:
token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
- name: Download patch
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
- name: .repo.patch
+ name: repo.patch
path: ${{ runner.temp }}
- name: Apply patch
- run: '[ -s ${{ runner.temp }}/.repo.patch ] && git apply ${{ runner.temp }}/.repo.patch || echo "Empty patch. Skipping."'
+ run: '[ -s ${{ runner.temp }}/repo.patch ] && git apply ${{ runner.temp }}/repo.patch || echo "Empty patch. Skipping."'
- name: Set git identity
run: |-
git config user.name "github-actions"
git config user.email "github-actions@github.com"
- name: Push changes
- run: |2-
- git add .
- git commit -s -m "chore: self mutation"
- git push origin HEAD:${{ github.event.pull_request.head.ref }}
+ env:
+ PULL_REQUEST_REF: ${{ github.event.pull_request.head.ref }}
+ run: |-
+ git add .
+ git commit -s -m "chore: self mutation"
+ git push origin HEAD:$PULL_REQUEST_REF
package-js:
needs: build
runs-on: ubuntu-latest
- permissions: {}
- if: "! needs.build.outputs.self_mutation_happened"
+ permissions:
+ contents: read
+ if: ${{ !needs.build.outputs.self_mutation_happened }}
steps:
- - uses: actions/setup-node@v3
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
+ node-version: lts/*
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ github.event.pull_request.head.ref }}
+ repository: ${{ github.event.pull_request.head.repo.full_name }}
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create js artifact
run: cd .repo && npx projen package:js
- - name: Collect js Artifact
+ - name: Collect js artifact
run: mv .repo/dist dist
package-java:
needs: build
runs-on: ubuntu-latest
- permissions: {}
- if: "! needs.build.outputs.self_mutation_happened"
+ permissions:
+ contents: read
+ if: ${{ !needs.build.outputs.self_mutation_happened }}
steps:
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
- distribution: temurin
- java-version: 11.x
- - uses: actions/setup-node@v3
+ distribution: corretto
+ java-version: "11"
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
+ node-version: lts/*
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ github.event.pull_request.head.ref }}
+ repository: ${{ github.event.pull_request.head.repo.full_name }}
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create java artifact
run: cd .repo && npx projen package:java
- - name: Collect java Artifact
+ - name: Collect java artifact
run: mv .repo/dist dist
package-python:
needs: build
runs-on: ubuntu-latest
- permissions: {}
- if: "! needs.build.outputs.self_mutation_happened"
+ permissions:
+ contents: read
+ if: ${{ !needs.build.outputs.self_mutation_happened }}
steps:
- - uses: actions/setup-node@v3
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
- - uses: actions/setup-python@v4
+ node-version: lts/*
+ - uses: actions/setup-python@v5
with:
python-version: 3.x
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ github.event.pull_request.head.ref }}
+ repository: ${{ github.event.pull_request.head.repo.full_name }}
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create python artifact
run: cd .repo && npx projen package:python
- - name: Collect python Artifact
+ - name: Collect python artifact
run: mv .repo/dist dist
package-dotnet:
needs: build
runs-on: ubuntu-latest
- permissions: {}
- if: "! needs.build.outputs.self_mutation_happened"
+ permissions:
+ contents: read
+ if: ${{ !needs.build.outputs.self_mutation_happened }}
steps:
- - uses: actions/setup-node@v3
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
- - uses: actions/setup-dotnet@v3
+ node-version: lts/*
+ - uses: actions/setup-dotnet@v4
with:
- dotnet-version: 3.x
+ dotnet-version: 6.x
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ ref: ${{ github.event.pull_request.head.ref }}
+ repository: ${{ github.event.pull_request.head.repo.full_name }}
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create dotnet artifact
run: cd .repo && npx projen package:dotnet
- - name: Collect dotnet Artifact
+ - name: Collect dotnet artifact
run: mv .repo/dist dist
diff --git a/.github/workflows/pull-request-lint.yml b/.github/workflows/pull-request-lint.yml
index 4e53389e..100c15e0 100644
--- a/.github/workflows/pull-request-lint.yml
+++ b/.github/workflows/pull-request-lint.yml
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
name: pull-request-lint
on:
@@ -10,14 +10,16 @@ on:
- reopened
- ready_for_review
- edited
+ merge_group: {}
jobs:
validate:
name: Validate PR title
runs-on: ubuntu-latest
permissions:
pull-requests: write
+ if: (github.event_name == 'pull_request' || github.event_name == 'pull_request_target')
steps:
- - uses: amannn/action-semantic-pull-request@v5.0.2
+ - uses: amannn/action-semantic-pull-request@v5.4.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 370c4434..a72e0121 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
name: release
on:
@@ -6,6 +6,9 @@ on:
branches:
- main
workflow_dispatch: {}
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: false
jobs:
release:
runs-on: ubuntu-latest
@@ -13,96 +16,117 @@ jobs:
contents: write
outputs:
latest_commit: ${{ steps.git_remote.outputs.latest_commit }}
+ tag_exists: ${{ steps.check_tag_exists.outputs.exists }}
env:
CI: "true"
steps:
- name: Checkout
- uses: actions/checkout@v3
+ uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set git identity
run: |-
git config user.name "github-actions"
git config user.email "github-actions@github.com"
+ - name: Setup Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: lts/*
- name: Install dependencies
run: yarn install --check-files --frozen-lockfile
- name: release
run: npx projen release
+ - name: Check if version has already been tagged
+ id: check_tag_exists
+ run: |-
+ TAG=$(cat dist/releasetag.txt)
+ ([ ! -z "$TAG" ] && git ls-remote -q --exit-code --tags origin $TAG && (echo "exists=true" >> $GITHUB_OUTPUT)) || (echo "exists=false" >> $GITHUB_OUTPUT)
+ cat $GITHUB_OUTPUT
- name: Check for new commits
id: git_remote
- run: echo "latest_commit=$(git ls-remote origin -h ${{ github.ref }} | cut -f1)" >> $GITHUB_OUTPUT
+ run: |-
+ echo "latest_commit=$(git ls-remote origin -h ${{ github.ref }} | cut -f1)" >> $GITHUB_OUTPUT
+ cat $GITHUB_OUTPUT
- name: Backup artifact permissions
if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
run: cd dist && getfacl -R . > permissions-backup.acl
continue-on-error: true
- name: Upload artifact
if: ${{ steps.git_remote.outputs.latest_commit == github.sha }}
- uses: actions/upload-artifact@v3
+ uses: actions/upload-artifact@v4.4.0
with:
name: build-artifact
path: dist
- container:
- image: jsii/superchain:1-buster-slim-node14
+ overwrite: true
release_github:
name: Publish to GitHub Releases
- needs: release
+ needs:
+ - release
+ - release_npm
+ - release_maven
+ - release_pypi
+ - release_nuget
runs-on: ubuntu-latest
permissions:
contents: write
- if: needs.release.outputs.latest_commit == github.sha
+ if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
steps:
- - uses: actions/setup-node@v3
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
+ node-version: lts/*
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
- - name: Collect GitHub Metadata
- run: mv .repo/dist dist
- name: Release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_REPOSITORY: ${{ github.repository }}
- GITHUB_REF: ${{ github.ref }}
+ GITHUB_REF: ${{ github.sha }}
run: errout=$(mktemp); gh release create $(cat dist/releasetag.txt) -R $GITHUB_REPOSITORY -F dist/changelog.md -t $(cat dist/releasetag.txt) --target $GITHUB_REF 2> $errout && true; exitcode=$?; if [ $exitcode -ne 0 ] && ! grep -q "Release.tag_name already exists" $errout; then cat $errout; exit $exitcode; fi
release_npm:
name: Publish to npm
needs: release
runs-on: ubuntu-latest
permissions:
+ id-token: write
contents: read
- if: needs.release.outputs.latest_commit == github.sha
+ if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
steps:
- - uses: actions/setup-node@v3
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
+ node-version: lts/*
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create js artifact
run: cd .repo && npx projen package:js
- - name: Collect js Artifact
+ - name: Collect js artifact
run: mv .repo/dist dist
- name: Release
env:
NPM_DIST_TAG: latest
NPM_REGISTRY: registry.npmjs.org
+ NPM_CONFIG_PROVENANCE: "true"
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
run: npx -p publib@latest publib-npm
release_maven:
@@ -111,30 +135,36 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: read
- if: needs.release.outputs.latest_commit == github.sha
+ if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
steps:
- - uses: actions/setup-java@v3
+ - uses: actions/setup-java@v4
with:
- distribution: temurin
- java-version: 11.x
- - uses: actions/setup-node@v3
+ distribution: corretto
+ java-version: "11"
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
+ node-version: lts/*
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create java artifact
run: cd .repo && npx projen package:java
- - name: Collect java Artifact
+ - name: Collect java artifact
run: mv .repo/dist dist
- name: Release
env:
@@ -151,29 +181,35 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: read
- if: needs.release.outputs.latest_commit == github.sha
+ if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
steps:
- - uses: actions/setup-node@v3
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
- - uses: actions/setup-python@v4
+ node-version: lts/*
+ - uses: actions/setup-python@v5
with:
python-version: 3.x
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create python artifact
run: cd .repo && npx projen package:python
- - name: Collect python Artifact
+ - name: Collect python artifact
run: mv .repo/dist dist
- name: Release
env:
@@ -186,29 +222,35 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: read
- if: needs.release.outputs.latest_commit == github.sha
+ if: needs.release.outputs.tag_exists != 'true' && needs.release.outputs.latest_commit == github.sha
steps:
- - uses: actions/setup-node@v3
+ - uses: actions/setup-node@v4
with:
- node-version: 14.x
- - uses: actions/setup-dotnet@v3
+ node-version: lts/*
+ - uses: actions/setup-dotnet@v4
with:
- dotnet-version: 3.x
+ dotnet-version: 6.x
- name: Download build artifacts
- uses: actions/download-artifact@v3
+ uses: actions/download-artifact@v4
with:
name: build-artifact
path: dist
- name: Restore build artifact permissions
run: cd dist && setfacl --restore=permissions-backup.acl
continue-on-error: true
- - name: Prepare Repository
- run: mv dist .repo
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ path: .repo
- name: Install Dependencies
run: cd .repo && yarn install --check-files --frozen-lockfile
+ - name: Extract build artifact
+ run: tar --strip-components=1 -xzvf dist/js/*.tgz -C .repo
+ - name: Move build artifact out of the way
+ run: mv dist dist.old
- name: Create dotnet artifact
run: cd .repo && npx projen package:dotnet
- - name: Collect dotnet Artifact
+ - name: Collect dotnet artifact
run: mv .repo/dist dist
- name: Release
env:
diff --git a/.gitignore b/.gitignore
index 7defb042..c1c4e60c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
!/.gitattributes
!/.projen/tasks.json
!/.projen/deps.json
@@ -32,7 +32,6 @@ jspm_packages/
*.tgz
.yarn-integrity
.cache
-!/.projenrc.js
/test-reports/
junit.xml
/coverage/
@@ -64,3 +63,4 @@ tsconfig.json
*.iml
.vscode/
!/.editorconfig
+!/.projenrc.ts
diff --git a/.gitpod.yml b/.gitpod.yml
index b2f260c4..5c157d4b 100644
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
tasks:
- name: setup
diff --git a/.mergify.yml b/.mergify.yml
index 57f965ee..7702fabd 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -1,7 +1,8 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
queue_rules:
- name: default
+ update_method: merge
conditions:
- "#approved-reviews-by>=1"
- -label~=(do-not-merge)
@@ -10,17 +11,18 @@ queue_rules:
- status-success=package-java
- status-success=package-python
- status-success=package-dotnet
+ merge_method: squash
+ commit_message_template: |-
+ {{ title }} (#{{ number }})
+
+ {{ body }}
pull_request_rules:
- name: Automatic merge on approval and successful build
actions:
delete_head_branch: {}
queue:
- method: merge
name: default
- commit_message_template: |-
- {{ title }} (#{{ number }})
-
- {{ body }}
+ method: merge
conditions:
- "#approved-reviews-by>=1"
- -label~=(do-not-merge)
diff --git a/.npmignore b/.npmignore
index d1e43733..5b1ecab3 100644
--- a/.npmignore
+++ b/.npmignore
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
/.projen/
/test-reports/
junit.xml
@@ -7,6 +7,8 @@ permissions-backup.acl
/dist/changelog.md
/dist/version.txt
/.mergify.yml
+/.prettierignore
+/.prettierrc.json
/test/
/tsconfig.dev.json
/src/
@@ -23,3 +25,6 @@ tsconfig.tsbuildinfo
/.eslintrc.json
!.jsii
!/assets/
+/.gitattributes
+/.projenrc.ts
+/projenrc
diff --git a/.prettierignore b/.prettierignore
index eeed1716..f75fbaf6 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -1,4 +1,4 @@
-# ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
API.md
src/account-provider/is-complete-handler-function.ts
src/account-provider/on-event-handler-function.ts
diff --git a/.projen/deps.json b/.projen/deps.json
index a022541d..e6f090cc 100644
--- a/.projen/deps.json
+++ b/.projen/deps.json
@@ -2,6 +2,7 @@
"dependencies": [
{
"name": "@pepperize/projen-awscdk-construct",
+ "version": "~0.0.730",
"type": "build"
},
{
@@ -10,12 +11,10 @@
},
{
"name": "@types/jest",
- "version": "^27",
"type": "build"
},
{
"name": "@types/node",
- "version": "^14",
"type": "build"
},
{
@@ -24,17 +23,12 @@
},
{
"name": "@typescript-eslint/eslint-plugin",
- "version": "^5",
+ "version": "^8",
"type": "build"
},
{
"name": "@typescript-eslint/parser",
- "version": "^5",
- "type": "build"
- },
- {
- "name": "aws-cdk-lib",
- "version": "2.37.1",
+ "version": "^8",
"type": "build"
},
{
@@ -54,8 +48,8 @@
"type": "build"
},
{
- "name": "constructs",
- "version": "10.0.5",
+ "name": "commit-and-tag-version",
+ "version": "^12",
"type": "build"
},
{
@@ -66,10 +60,6 @@
"name": "eslint-config-prettier",
"type": "build"
},
- {
- "name": "eslint-import-resolver-node",
- "type": "build"
- },
{
"name": "eslint-import-resolver-typescript",
"type": "build"
@@ -84,21 +74,20 @@
},
{
"name": "eslint",
- "version": "^8",
+ "version": "^9",
"type": "build"
},
{
- "name": "jest-junit",
- "version": "^13",
+ "name": "jest",
"type": "build"
},
{
- "name": "jest",
- "version": "^27",
+ "name": "jest-cdk-snapshot",
"type": "build"
},
{
- "name": "jsii",
+ "name": "jest-junit",
+ "version": "^15",
"type": "build"
},
{
@@ -107,6 +96,7 @@
},
{
"name": "jsii-docgen",
+ "version": "^10.5.0",
"type": "build"
},
{
@@ -114,25 +104,29 @@
"type": "build"
},
{
- "name": "prettier",
+ "name": "jsii-rosetta",
+ "version": "~5.6.0",
"type": "build"
},
{
- "name": "projen",
+ "name": "jsii",
+ "version": "~5.6.0",
"type": "build"
},
{
- "name": "sinon",
+ "name": "prettier",
"type": "build"
},
{
- "name": "standard-version",
- "version": "^9",
+ "name": "projen",
+ "type": "build"
+ },
+ {
+ "name": "sinon",
"type": "build"
},
{
"name": "ts-jest",
- "version": "^27",
"type": "build"
},
{
@@ -149,19 +143,9 @@
},
{
"name": "projen",
- "version": "^0.67.74",
+ "version": "~0.91.1",
"type": "devenv"
},
- {
- "name": "@types/babel__traverse",
- "version": "7.18.2",
- "type": "override"
- },
- {
- "name": "@types/prettier",
- "version": "2.6.0",
- "type": "override"
- },
{
"name": "aws-cdk-lib",
"version": "^2.37.1",
@@ -177,5 +161,5 @@
"type": "runtime"
}
],
- "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+ "//": "~~ Generated by projen. To modify, edit .projenrc.ts and run \"npx projen\"."
}
diff --git a/.projen/files.json b/.projen/files.json
index 863711de..35ff7973 100644
--- a/.projen/files.json
+++ b/.projen/files.json
@@ -25,5 +25,5 @@
"src/tag-resource-provider/on-event-handler-function.ts",
"tsconfig.dev.json"
],
- "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+ "//": "~~ Generated by projen. To modify, edit .projenrc.ts and run \"npx projen\"."
}
diff --git a/.projen/tasks.json b/.projen/tasks.json
index 7a58a8fa..525b085d 100644
--- a/.projen/tasks.json
+++ b/.projen/tasks.json
@@ -33,14 +33,15 @@
"BUMPFILE": "dist/version.txt",
"RELEASETAG": "dist/releasetag.txt",
"RELEASE_TAG_PREFIX": "",
- "VERSIONRCOPTIONS": "{\"types\":[{\"type\":\"chore\",\"section\":\"Chore\",\"hidden\":false}]}"
+ "VERSIONRCOPTIONS": "{\"types\":[{\"type\":\"chore\",\"section\":\"Chore\",\"hidden\":false}]}",
+ "BUMP_PACKAGE": "commit-and-tag-version@^12"
},
"steps": [
{
"builtin": "release/bump-version"
}
],
- "condition": "! git log --oneline -1 | grep -q \"chore(release):\""
+ "condition": "git log --oneline -1 | grep -qv \"chore(release):\""
},
"bundle": {
"name": "bundle",
@@ -68,7 +69,7 @@
"description": "Create a JavaScript bundle from src/account-provider/is-complete-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/account-provider/is-complete-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/account-provider/is-complete-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
+ "exec": "esbuild --bundle src/account-provider/is-complete-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/account-provider/is-complete-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
}
]
},
@@ -77,7 +78,7 @@
"description": "Continuously update the JavaScript bundle from src/account-provider/is-complete-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/account-provider/is-complete-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/account-provider/is-complete-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
+ "exec": "esbuild --bundle src/account-provider/is-complete-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/account-provider/is-complete-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
}
]
},
@@ -86,7 +87,7 @@
"description": "Create a JavaScript bundle from src/account-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/account-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/account-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
+ "exec": "esbuild --bundle src/account-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/account-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
}
]
},
@@ -95,7 +96,7 @@
"description": "Continuously update the JavaScript bundle from src/account-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/account-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/account-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
+ "exec": "esbuild --bundle src/account-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/account-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
}
]
},
@@ -104,7 +105,7 @@
"description": "Create a JavaScript bundle from src/organization-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/organization-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/organization-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
+ "exec": "esbuild --bundle src/organization-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/organization-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
}
]
},
@@ -113,7 +114,7 @@
"description": "Continuously update the JavaScript bundle from src/organization-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/organization-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/organization-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
+ "exec": "esbuild --bundle src/organization-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/organization-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
}
]
},
@@ -122,7 +123,7 @@
"description": "Create a JavaScript bundle from src/organizational-unit-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/organizational-unit-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/organizational-unit-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
+ "exec": "esbuild --bundle src/organizational-unit-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/organizational-unit-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
}
]
},
@@ -131,7 +132,7 @@
"description": "Continuously update the JavaScript bundle from src/organizational-unit-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/organizational-unit-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/organizational-unit-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
+ "exec": "esbuild --bundle src/organizational-unit-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/organizational-unit-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
}
]
},
@@ -140,7 +141,7 @@
"description": "Create a JavaScript bundle from src/tag-resource-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/tag-resource-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/tag-resource-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
+ "exec": "esbuild --bundle src/tag-resource-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/tag-resource-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\""
}
]
},
@@ -149,7 +150,7 @@
"description": "Continuously update the JavaScript bundle from src/tag-resource-provider/on-event-handler.lambda.ts",
"steps": [
{
- "exec": "esbuild --bundle src/tag-resource-provider/on-event-handler.lambda.ts --target=\"node16\" --platform=\"node\" --outfile=\"assets/tag-resource-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
+ "exec": "esbuild --bundle src/tag-resource-provider/on-event-handler.lambda.ts --target=\"node18\" --platform=\"node\" --outfile=\"assets/tag-resource-provider/on-event-handler.lambda/index.js\" --tsconfig=\"tsconfig.dev.json\" --watch"
}
]
},
@@ -236,9 +237,13 @@
"eslint": {
"name": "eslint",
"description": "Runs eslint against the codebase",
+ "env": {
+ "ESLINT_USE_FLAT_CONFIG": "false"
+ },
"steps": [
{
- "exec": "eslint --ext .ts,.tsx --fix --no-error-on-unmatched-pattern src test build-tools projenrc .projenrc.ts"
+ "exec": "eslint --ext .ts,.tsx --fix --no-error-on-unmatched-pattern $@ src test build-tools projenrc .projenrc.ts",
+ "receiveArgs": true
}
]
},
@@ -251,12 +256,35 @@
}
]
},
+ "install": {
+ "name": "install",
+ "description": "Install project dependencies and update lockfile (non-frozen)",
+ "steps": [
+ {
+ "exec": "yarn install --check-files"
+ }
+ ]
+ },
+ "install:ci": {
+ "name": "install:ci",
+ "description": "Install project dependencies using frozen lockfile",
+ "steps": [
+ {
+ "exec": "yarn install --check-files --frozen-lockfile"
+ }
+ ]
+ },
"package": {
"name": "package",
"description": "Creates the distribution package",
"steps": [
{
- "exec": "if [ ! -z ${CI} ]; then rsync -a . .repo --exclude .git --exclude node_modules && rm -rf dist && mv .repo dist; else npx projen package-all; fi"
+ "spawn": "package:js",
+ "condition": "node -e \"if (!process.env.CI) process.exit(1)\""
+ },
+ {
+ "spawn": "package-all",
+ "condition": "node -e \"if (process.env.CI) process.exit(1)\""
}
]
},
@@ -387,7 +415,8 @@
"BUMPFILE": "dist/version.txt",
"RELEASETAG": "dist/releasetag.txt",
"RELEASE_TAG_PREFIX": "",
- "VERSIONRCOPTIONS": "{\"types\":[{\"type\":\"chore\",\"section\":\"Chore\",\"hidden\":false}]}"
+ "VERSIONRCOPTIONS": "{\"types\":[{\"type\":\"chore\",\"section\":\"Chore\",\"hidden\":false}]}",
+ "BUMP_PACKAGE": "commit-and-tag-version@^12"
},
"steps": [
{
@@ -406,7 +435,7 @@
}
},
"env": {
- "PATH": "$(npx -c \"node -e \\\"console.log(process.env.PATH)\\\"\")"
+ "PATH": "$(npx -c \"node --print process.env.PATH\")"
},
- "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+ "//": "~~ Generated by projen. To modify, edit .projenrc.ts and run \"npx projen\"."
}
diff --git a/.projenrc.ts b/.projenrc.ts
index 2757d14e..9c98eab0 100644
--- a/.projenrc.ts
+++ b/.projenrc.ts
@@ -30,7 +30,7 @@ const project = new AwsCdkConstructLibrary({
deps: ["pascal-case"],
bundledDeps: ["pascal-case"],
devDeps: [
- "@pepperize/projen-awscdk-construct",
+ "@pepperize/projen-awscdk-construct@~0.0.730",
"@types/aws-lambda",
"@types/jest",
"@types/sinon",
@@ -38,6 +38,7 @@ const project = new AwsCdkConstructLibrary({
"aws-sdk",
"aws-sdk-mock",
"cdk-nag",
+ "jest-cdk-snapshot",
"sinon",
],
@@ -66,7 +67,7 @@ const project = new AwsCdkConstructLibrary({
gitpod: true,
lambdaOptions: {
- runtime: awscdk.LambdaRuntime.NODEJS_16_X,
+ runtime: awscdk.LambdaRuntime.NODEJS_18_X,
bundlingOptions: {
externals: [],
},
diff --git a/API.md b/API.md
index 3d618858..234c0850 100644
--- a/API.md
+++ b/API.md
@@ -1,511 +1,3 @@
-[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)
-[![GitHub](https://img.shields.io/github/license/pepperize/cdk-organizations?style=flat-square)](https://github.com/pepperize/cdk-organizations/blob/main/LICENSE)
-[![npm (scoped)](https://img.shields.io/npm/v/@pepperize/cdk-organizations?style=flat-square)](https://www.npmjs.com/package/@pepperize/cdk-organizations)
-[![PyPI](https://img.shields.io/pypi/v/pepperize.cdk-organizations?style=flat-square)](https://pypi.org/project/pepperize.cdk-organizations/)
-[![Nuget](https://img.shields.io/nuget/v/Pepperize.CDK.Organizations?style=flat-square)](https://www.nuget.org/packages/Pepperize.CDK.Organizations/)
-[![Sonatype Nexus (Releases)](https://img.shields.io/nexus/r/com.pepperize/cdk-organizations?server=https%3A%2F%2Fs01.oss.sonatype.org%2F&style=flat-square)](https://s01.oss.sonatype.org/content/repositories/releases/com/pepperize/cdk-organizations/)
-[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/pepperize/cdk-organizations/release.yml?branch=main&label=release&style=flat-square)](https://github.com/pepperize/cdk-organizations/actions/workflows/release.yml)
-[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/pepperize/cdk-organizations?sort=semver&style=flat-square)](https://github.com/pepperize/cdk-organizations/releases)
-[![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod&style=flat-square)](https://gitpod.io/#https://github.com/pepperize/cdk-organizations)
-
-# CDK Organizations [![Mentioned in Awesome CDK](https://awesome.re/mentioned-badge.svg)](https://github.com/kolomied/awesome-cdk)
-
-Manage AWS organizations, organizational units (OU), accounts and service control policies (SCP).
-
-Features:
-
-- [Organization](https://github.com/pepperize/cdk-organizations#organization)
-- [Organizational Unit (OU)](https://github.com/pepperize/cdk-organizations#organizational-unit-ou)
-- [Account](https://github.com/pepperize/cdk-organizations#account)
-- [Delegated Administrator](https://github.com/pepperize/cdk-organizations#delegated-administrator)
-- [Trusted Service](https://github.com/pepperize/cdk-organizations#enable-an-aws-service-trusted-service)
-- [Policies](https://github.com/pepperize/cdk-organizations#policy), [PolicyTypes](https://github.com/pepperize/cdk-organizations#enable-a-policy-type), [PolicyAttachment](https://github.com/pepperize/cdk-organizations#policyattachment)
-- [Tagging](https://github.com/pepperize/cdk-organizations#tagging-resources)
-
-[![View on Construct Hub](https://constructs.dev/badge?package=%40pepperize%2Fcdk-organizations)](https://constructs.dev/packages/@pepperize/cdk-organizations)
-
-## Install
-
-### TypeScript
-
-```shell
-npm install @pepperize/cdk-organizations
-```
-
-or
-
-```shell
-yarn add @pepperize/cdk-organizations
-```
-
-### Python
-
-```shell
-pip install pepperize.cdk-organizations
-```
-
-### C\# / .Net
-
-```
-dotnet add package Pepperize.CDK.Organizations
-```
-
-### Java
-
-```xml
-
- com.pepperize
- cdk-organizations
- ${cdkOrganizations.version}
-
-```
-
-## Contributing
-
-Contributions of all kinds are welcome :rocket: Check out our [contributor's guide](https://github.com/pepperize/cdk-organizations/blob/main/CONTRIBUTING.md).
-
-For a quick start, [check out](https://github.com/pepperize/cdk-organizations/fork) a development environment:
-
-```shell
-git clone git@github.com:pepperize/cdk-organizations
-cd cdk-organizations
-# install dependencies
-yarn
-# build with projen
-yarn build
-```
-
-## Getting Started
-
-1. Create a new account
-
- [Signup for AWS](https://portal.aws.amazon.com/billing/signup#/start)
-
-2. Prepare an IAM User with `AdministratorAccess`
-
- To deploy your new organization, you have to create an Administrator with an AccessKey
-
- - [Creating your first IAM admin user and user group](https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started_create-admin-group.html)
- - [Managing access keys for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey)
-
-3. Create a new CDK TypeScript App project with [projen](https://github.com/projen/projen)
-
- ```shell
- mkdir my-project
- cd my-project
- git init -b main
- npx projen new awscdk-app-ts
- ```
-
-4. Add `@pepperize/cdk-organizations` to your dependencies in `.projenrc.js`
-
- ```typescript
- const project = new awscdk.AwsCdkTypeScriptApp({
- //...
- deps: ["@pepperize/cdk-organizations"],
- });
- ```
-
-5. Install the dependency
-
- ```shell
- npx projen
- ```
-
-6. Create a stack
-
- ```typescript
- import { Account, Organization, OrganizationalUnit } from "@pepperize/cdk-organizations";
- import { Stack } from "aws-cdk-lib";
-
- export class OrganizationStack extends Stack {
- constructor(scope: Construct, id: string, props: StackProps = {}) {
- super(scope, id, props);
-
- // Create your organization
- const organization = new Organization(stack, "Organization", {});
-
- // Create an organizational unit (OU)
- const organizationUnit = new OrganizationalUnit(stack, "OrganizationalUnit", {
- organizationalUnitName: "MyFirstOU",
- parent: organization.root,
- });
-
- // Create an account
- const account = new Account(stack, "Account", {
- accountName: "MyFirstAccount",
- email: "",
- parent: organizationUnit,
- });
- }
- }
- ```
-
-7. Configure your AWS CLI to deploy
-
- - [Configuring the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html)
- - [AWSume](https://awsu.me/)
-
- The easiest is to export your access key
-
- ```shell
- export AWS_ACCESS_KEY_ID=
- export AWS_SECRET_ACCESS_KEY=
- ```
-
-8. Deploy your first AWS organization
-
- ```shell
- export CDK_DEFAULT_REGION=
- export CDK_DEFAULT_ACCOUNT=
- ```
-
- ```shell
- yarn deploy
- ```
-
-## Usage
-
-### Organization
-
-To create a new organization or import an existing organization, add the following construct to your stack:
-
-```typescript
-const organization = new Organization(stack, "Organization", {
- featureSet: FeatureSet.ALL, // (default) required later on to enable SCPs, enable AWS services or delegate an administrator account
-});
-organization.root; // The organization's root is automatically created
-```
-
-- `FeatureSet.ALL` is required for advanced features like Service Control Policies (SCP) and is the [preferred way to work with AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html)
-- The account which deploys the stack, will automatically become the management account of the new organization.
-- If an organization already exists, it will be imported automatically. You can disable this behaviour by passing `importOnDuplicate: false` in the props.
-- If the construct is removed from the stack, the organization will remain and must be deleted manually. For deletion of an organization you must previously remove all the member accounts, OUs, and policies from the organization. [Deleting the organization by removing the management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_delete.html)
-- An organization root is automatically created for you when you create the new organization.
-
-See [IOrganization](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.IOrganization)
-
-### Organization Principal
-
-To retrieve the AWS IAM organization principal in a member account, add the following to any construct:
-
-```
-const organization = Organization.of(scope, "Organization");
-organization.principal; // The AWS IAM organization principal
-```
-
-- This helper construct can be used in any member account in the organization.
-
-See [AWS Organization API Reference - DescribeOrganization](https://docs.aws.amazon.com/organizations/latest/APIReference/API_DescribeOrganization.html)
-
-### Organizational Unit (OU)
-
-To create a new organizational unit (OU), add the following construct to your stack:
-
-```typescript
-const organizationUnit = new OrganizationalUnit(stack, "Organization", {
- organizationalUnitName: "Project2",
- parent: organization.root,
-});
-```
-
-- The parent of an organizational unit (OU) can be either the organization's root or another OU within the organization.
-- An organizational unit (OU) can't be moved. You have to create a new OU first, move all the accounts and then delete the old OU.
-- For deletion of an organizational unit (OU) you must first move all accounts out of the OU and any child OUs, and then you can delete the child OUs. [Deleting an organizational unit](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html#delete-ou)
-
-See [IOrganizationalUnit](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.IOrganizationalUnit)
-
-#### Organizational Unit (OU) Properties
-
-- `importOnDuplicate` If an organizational unit (OU) with the name exists in the parent, it will be imported.
-- `removalPolicy` Default `RemovalPolicy.Retain` If you set `removalPolicy` to `RemovalPolicy.destroy`, the organizational unit (OU) will be deleted on Cloudformation delete event.
-
-See [OrganizationalUnitProps](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.OrganizationalUnitProps)
-
-### Account
-
-To create a new account, add the following construct to your stack:
-
-```typescript
-new Account(stack, "Account", {
- accountName: "MyAccount",
- email: "info@pepperize.com",
- parent: organization.root,
-});
-```
-
-- The email address must not already be associated with another AWS account. You may suffix the email address, i.e. `info+account-123456789012@pepperize.com`.
-- The AWS Organizations supports only a one account creation `IN_PROGRESS`. Ensure account creation by using `account2.node.addDependency(account1)` [dependency relationship](https://docs.aws.amazon.com/cdk/api/v1/docs/core-readme.html#dependencies).
-- An account will be created and moved to the parent, if the parent is an organizational unit (OU).
-- An account can only be created from within the management account.
-
-See [IAccount](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.IAccount)
-
-#### Account Properties
-
-- `importOnDuplicate` If an account with the same email address exists in the organization, it will be imported.
-- `removalPolicy` Default `RemovalPolicy.Retain` If you set `removalPolicy` to `RemovalPolicy.destroy`, the account will be closed. [Closing an AWS account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.html)
-- `iamUserAccessToBilling` Default `IamUserAccessToBilling.ALLOW` If you set `iamUserAccessToBilling` to `ALLOW`, IAM users and roles that have appropriate permissions can view billing information for the account.
-- `roleName` Default `OrganizationAccountAccessRole` is preconfigures in the newly created account and grants users in the management account administrator permissions in the new member account.
-
-See [AccountProps](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.AccountProps)
-
-### Delegated Administrator
-
-A compatible AWS service (trusted service) can register an AWS member account in the organization as an administrator in the organization on your behalf. To enable an AWS account as administrator of that trusted in your organization call `delegateAdministrator` on your account:
-
-```typescript
-const account = new Account(stack, "Account", {
- accountName: "StackSetsDelegatedAdministrator",
- email: "info@pepperize.com",
-});
-account.delegateAdministrator("stacksets.amazonaws.com");
-```
-
-- [AWS services that support Delegated Administrator](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html)
-- To be able to use Delegated Administrator, your organization must have [all features](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.FeatureSet) enabled.
-
-See [DelegatedAdministrator](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.DelegatedAdministrator)
-
-### Enable an AWS Service (trusted service)
-
-To enable trusted access for a supported AWS service (trusted service), which performs tasks in your organization and its accounts on your behalf, call `enableAwsService` on your organization:
-
-```typescript
-const organization = new Organization(stack, "Organization", {
- featureSet: FeatureSet.ALL, // (default) the organization must be created with all features enabled
-});
-organization.enableAwsServiceAccess("ssm.amazonaws.com");
-```
-
-- To enable trusted access, you must have [all features](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.FeatureSet) enabled.
-- It's recommended to use only the trusted service's console [How to enable or disable trusted access](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html#orgs_how-to-enable-disable-trusted-access)
-- [AWS services that you can use with AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html)
-
-See [EnableAwsServiceAccess](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.EnableAwsServiceAccess)
-
-### Enable a Policy Type
-
-To enable a policy type call `enablePolicyType` on your organization.
-
-```typescript
-const organization = new Organization(stack, "Organization", {
- featureSet: FeatureSet.ALL, // (default) the organization must be created with all features enabled
-});
-organization.enablePolicyType(PolicyType.SERVICE_CONTROL_POLICY);
-organization.enablePolicyType(PolicyType.TAG_POLICY);
-organization.enablePolicyType(PolicyType.BACKUP_POLICY);
-organization.enablePolicyType(PolicyType.AISERVICES_OPT_OUT_POLICY);
-```
-
-- To create or attach policies later on, you have to [enable all features](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.FeatureSet) and the [policy type](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html#orgs-policy-types) .
-
-See [EnablePolicyType](https://github.com/pepperize/cdk-organizations/blob/main/API.md#enablepolicytype-), [PolicyType](https://github.com/pepperize/cdk-organizations/blob/main/API.md#policytype-).
-
-### Policy
-
-To create a new policy add the following construct to your stack:
-
-```typescript
-new Policy(stack, "Policy", {
- content: '{\n"Version":"2012-10-17","Statement":{\n"Effect":"Allow","Action":"s3:*"\n}\n}',
- description: "Enables admins of attached accounts to delegate all S3 permissions",
- policyName: "AllowAllS3Actions",
- policyType: PolicyType.SERVICE_CONTROL_POLICY,
-});
-```
-
-- To create or attach policies, you must have [all features](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.FeatureSet) and the [policy type](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html#orgs-policy-types) enabled.
-- The [SCP Syntax](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_syntax.html) is quite similar to IAM policies, but way more limited.
-
-See [Policy](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.Policy)
-
-### PolicyAttachment
-
-To attach a policy to a root, an organizational unit (OU), or an individual account call `attachPolicy` with the policy to attach:
-
-```typescript
-organization.enablePolicyType(PolicyType.TAG_POLICY);
-
-const policy = new Policy(stack, "Policy", {
- content: '{\n"tags":{\n"CostCenter":{\n"tag_key":{\n"@@assign":"CostCenter"\n}\n}\n}\n}',
- description: "Defines the CostCenter tag key",
- policyName: "CostCenterTag",
- policyType: PolicyType.TAG_POLICY,
-});
-
-organization.attachPolicy(policy);
-organizationalUnit.attachPolicy(policy);
-account.attachPolicy(policy);
-```
-
-- To create or attach policies, you must have [all features](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.FeatureSet) and the [policy type](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html#orgs-policy-types) enabled.
-
-### Tagging resources
-
-To tag a resource you may follow the [AWS CDK Developer Guide - Tagging](https://docs.aws.amazon.com/cdk/v2/guide/tagging.html):
-
-You can add one or more tags to the following resources in AWS Organizations.
-
-- Account
-- Organization root
-- Organizational unit (OU)
-- Policy
-
-See [Tagging AWS Organizations resources](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_tagging.html), [ITaggableResource](https://github.com/pepperize/cdk-organizations/blob/main/API.md#@pepperize/cdk-organizations.ITaggableResource)
-
-#### Tagging an organization's root
-
-```typescript
-import { Tags } from "aws-cdk-lib";
-
-const organization = new Organization();
-Tags.of(organization.root).add("key", "value");
-```
-
-#### Tagging an organizational unit (OU)
-
-```typescript
-import { Tags } from "aws-cdk-lib";
-
-const organizationalUnit = new OrganizationalUnit();
-Tags.of(organizationalUnit).add("key", "value");
-```
-
-#### Tagging an account
-
-```typescript
-import { Tags } from "aws-cdk-lib";
-
-const account = new Account();
-Tags.of(account).add("key", "value");
-```
-
-#### Tagging a policy
-
-```typescript
-import { Tags } from "aws-cdk-lib";
-
-const policy = new Policy();
-Tags.of(policy).add("key", "value");
-```
-
-## Limitations
-
-AWS Organizations has some limitations:
-
-- The stack's account must be the management account of an existing organization.
-- The stack's account becomes the management account of the new organization.
-- An account belongs to only one organization within a single root.
-- [Quotas for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_limits.html)
-
-> AWS Organizations is a global service with service endpoints in `us-east-1`, `us-gov-west-1` and `cn-northwest-1`. Read also
-> [Endpoint to call When using the AWS CLI or the AWS SDK](https://docs.aws.amazon.com/organizations/latest/APIReference/Welcome.html).
-> Currently all custom resources of this library defaults to use `us-east-1`, but it can be configured to use `cn-northwest-1`
-> with the environment variable `CDK_AWS_PARTITION` set to `aws-cn`.
-
-## Example
-
-See [example](https://github.com/pepperize/cdk-organizations-example/blob/main/src/example-stack.ts)
-
-```typescript
-import { App, Stack } from "aws-cdk-lib/core";
-import {
- Account,
- DelegatedAdministrator,
- EnableAwsServiceAccess,
- EnablePolicyType,
- FeatureSet,
- IamUserAccessToBilling,
- Organization,
- OrganizationalUnit,
- Policy,
- PolicyAttachment,
- PolicyType,
-} from "@pepperize/cdk-organizations";
-
-const app = new App();
-const stack = new Stack(app);
-
-// Create an organization
-const organization = new Organization(stack, "Organization", {
- featureSet: FeatureSet.ALL,
-});
-// Enable AWS Service Access (requires FeatureSet: ALL)
-organization.enableAwsServiceAccess("service-abbreviation.amazonaws.com");
-
-// Create an account
-const account1 = new Account(stack, "SharedAccount", {
- accountName: "SharedAccount",
- email: "info+shared-account@pepperize.com",
- roleName: "OrganizationAccountAccessRole",
- iamUserAccessToBilling: IamUserAccessToBilling.ALLOW,
- parent: organization.root,
-});
-// Enable a delegated admin account
-account1.delegateAdministrator("service-abbreviation.amazonaws.com");
-
-// Create an OU in the current organizations root
-const projects = new OrganizationalUnit(stack, "ProjectsOU", {
- organizationalUnitName: "Projects",
- parent: organization.root,
-});
-const account2 = new Account(stack, "Project1Account", {
- accountName: "SharedAccount",
- email: "info+project1@pepperize.com",
- parent: projects,
-});
-account2.node.addDependency(account1);
-
-// Create a nested OU and attach two accounts
-const project2 = new OrganizationalUnit(stack, "Project2OU", {
- organizationalUnitName: "Project2",
- parent: projects,
-});
-const account3 = new Account(stack, "Project2DevAccount", {
- accountName: "Project 2 Dev",
- email: "info+project2-dev@pepperize.com",
- parent: project2,
-});
-account3.node.addDependency(account2);
-const account4 = new Account(stack, "Project2ProdAccount", {
- accountName: "Project 2 Prod",
- email: "info+project2-prod@pepperize.com",
- parent: project2,
-});
-account4.node.addDependency(account3);
-
-// Enable the service control policy (SCP) type within the organization
-organization.enablePolicyType(PolicyType.SERVICE_CONTROL_POLICY);
-// Create and attach and Service Control Policy (SCP)
-const policy = new Policy(stack, "Policy", {
- content: '{\n"Version":"2012-10-17","Statement":{\n"Effect":"Allow","Action":"s3:*"\n}\n}',
- description: "Enables admins of attached accounts to delegate all S3 permissions",
- policyName: "AllowAllS3Actions",
- policyType: PolicyType.SERVICE_CONTROL_POLICY,
-});
-organization.attachPolicy(policy);
-
-// Tagging AWS organization resources of this stack
-Tags.of(stack).add("tagKey", "tagValue");
-```
-
-## References
-
-- [CDK Organizations API Reference](https://github.com/pepperize/cdk-organizations/blob/main/API.md)
-- [AWS Account Management Reference Guide](https://docs.aws.amazon.com/accounts/latest/reference/accounts-welcome.html)
-- [AWS Organizations User Guide](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html)
-- [AWS API Reference](https://docs.aws.amazon.com/organizations/latest/APIReference/Welcome.html)
-- [AWS CDK Custom Resources](https://docs.aws.amazon.com/cdk/api/v1/docs/custom-resources-readme.html#custom-resources-for-aws-apis)
-
-## Alternatives
-
-- [AWS Bootstrap Kit](https://github.com/awslabs/aws-bootstrap-kit)
-- [Terraform AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest)
-- [AWS Deployment Framework (ADF)](https://github.com/awslabs/aws-deployment-framework)
-- [AWS Organization Formation](https://github.com/org-formation)
-- [AWS Control Tower Account Factory for Terraform (ATF)](https://github.com/aws-ia/terraform-aws-control_tower_account_factory)
-
# API Reference
## Constructs
@@ -592,7 +84,7 @@ Before you can attach the policy, you must enable that policy type for use. You
##### `delegateAdministrator`
```typescript
-public delegateAdministrator(servicePrincipal: string, region?: string): void
+public delegateAdministrator(servicePrincipal: string, region?: string, props?: {[ key: string ]: any}): void
```
Enables trusted access for the AWS service (trusted service) as Delegated Administrator, which performs tasks in your organization and its accounts on your behalf.
@@ -613,6 +105,14 @@ The region to delegate in.
---
+###### `props`Optional
+
+- *Type:* {[ key: string ]: any}
+
+additional DelegatedAdministrator props.
+
+---
+
##### `identifier`
```typescript
@@ -2455,6 +1955,7 @@ const delegatedAdministratorProps: DelegatedAdministratorProps = { ... }
| account
| IAccount
| The member account in the organization to register as a delegated administrator. |
| servicePrincipal
| string
| The service principal of the AWS service for which you want to make the member account a delegated administrator. |
| region
| string
| The region to delegate the administrator in. |
+| removalPolicy
| aws-cdk-lib.RemovalPolicy
| If set to RemovalPolicy.RETAIN, the delegation will not be removed. |
---
@@ -2494,6 +1995,19 @@ The region to delegate the administrator in.
---
+##### `removalPolicy`Optional
+
+```typescript
+public readonly removalPolicy: RemovalPolicy;
+```
+
+- *Type:* aws-cdk-lib.RemovalPolicy
+- *Default:* RemovalPolicy.DESTROY
+
+If set to RemovalPolicy.RETAIN, the delegation will not be removed.
+
+---
+
### EnableAwsServiceAccessProps
#### Initializer
@@ -3063,7 +2577,7 @@ Validators.of()
##### `delegateAdministrator`
```typescript
-public delegateAdministrator(servicePrincipal: string, region?: string): void
+public delegateAdministrator(servicePrincipal: string, region?: string, props?: {[ key: string ]: any}): void
```
Enables trusted access for the AWS service (trusted service) as Delegated Administrator, which performs tasks in your organization and its accounts on your behalf.
@@ -3084,6 +2598,14 @@ The region to delegate in.
---
+###### `props`Optional
+
+- *Type:* {[ key: string ]: any}
+
+additional DelegatedAdministrator props.
+
+---
+
#### Properties
| **Name** | **Type** | **Description** |
@@ -3596,7 +3118,7 @@ If set to DENY, only the root user of the new account can access account billing
### PolicyType
-Organizations offers policy types in the following two broad categories: - Authorization policies help you to centrally manage the security of the AWS accounts in your organization.
- Management policies enable you to centrally configure and manage AWS services and their features.
.
+Organizations offers policy types in the following two broad categories: - Authorization policies help you to centrally manage the security of the AWS accounts in your organization.
- Management policies enable you to centrally configure and manage AWS services and their features.
.
> [https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html#orgs-policy-types](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html#orgs-policy-types)
diff --git a/package.json b/package.json
index 8e0ab93a..5231628e 100644
--- a/package.json
+++ b/package.json
@@ -48,36 +48,37 @@
"organization": true
},
"devDependencies": {
- "@pepperize/projen-awscdk-construct": "^0.0.451",
+ "@pepperize/projen-awscdk-construct": "~0.0.730",
"@types/aws-lambda": "^8.10.111",
"@types/jest": "^27",
"@types/node": "^14",
"@types/sinon": "^10.0.13",
- "@typescript-eslint/eslint-plugin": "^5",
- "@typescript-eslint/parser": "^5",
+ "@typescript-eslint/eslint-plugin": "^8",
+ "@typescript-eslint/parser": "^8",
"aws-cdk-lib": "2.37.1",
"aws-lambda": "^1.0.7",
"aws-sdk": "^2.1328.0",
"aws-sdk-mock": "^5.8.0",
"cdk-nag": "^2.22.27",
+ "commit-and-tag-version": "^12",
"constructs": "10.0.5",
"esbuild": "^0.17.11",
- "eslint": "^8",
+ "eslint": "^9",
"eslint-config-prettier": "^8.7.0",
- "eslint-import-resolver-node": "^0.3.7",
"eslint-import-resolver-typescript": "^3.5.3",
"eslint-plugin-import": "^2.27.5",
"eslint-plugin-prettier": "^4.2.1",
"jest": "^27",
- "jest-junit": "^13",
- "jsii": "^1.77.0",
+ "jest-cdk-snapshot": "^2.2.5",
+ "jest-junit": "^15",
+ "jsii": "~5.6.0",
"jsii-diff": "^1.77.0",
- "jsii-docgen": "^7.1.17",
+ "jsii-docgen": "^10.5.0",
"jsii-pacmak": "^1.77.0",
+ "jsii-rosetta": "~5.6.0",
"prettier": "^2.8.4",
- "projen": "^0.67.74",
+ "projen": "~0.91.1",
"sinon": "^15.0.1",
- "standard-version": "^9",
"ts-jest": "^27",
"ts-node": "^10",
"typescript": "^4.9.5"
@@ -114,9 +115,12 @@
},
"version": "0.0.0",
"jest": {
+ "coverageProvider": "v8",
"testMatch": [
- "/src/**/__tests__/**/*.ts?(x)",
- "/(test|src)/**/*(*.)@(spec|test).ts?(x)"
+ "/@(src|test)/**/*(*.)@(spec|test).ts?(x)",
+ "/@(src|test)/**/__tests__/**/*.ts?(x)",
+ "/@(projenrc)/**/*(*.)@(spec|test).ts?(x)",
+ "/@(projenrc)/**/__tests__/**/*.ts?(x)"
],
"clearMocks": true,
"collectCoverage": true,
@@ -179,9 +183,5 @@
"rootDir": "src"
}
},
- "resolutions": {
- "@types/prettier": "2.6.0",
- "@types/babel__traverse": "7.18.2"
- },
- "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"npx projen\"."
+ "//": "~~ Generated by projen. To modify, edit .projenrc.ts and run \"npx projen\"."
}
diff --git a/src/account-provider/is-complete-handler-function.ts b/src/account-provider/is-complete-handler-function.ts
index df0eec4f..3018f4e7 100644
--- a/src/account-provider/is-complete-handler-function.ts
+++ b/src/account-provider/is-complete-handler-function.ts
@@ -1,4 +1,4 @@
-// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
import * as path from 'path';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
@@ -17,7 +17,7 @@ export class IsCompleteHandlerFunction extends lambda.Function {
super(scope, id, {
description: 'src/account-provider/is-complete-handler.lambda.ts',
...props,
- runtime: new lambda.Runtime('nodejs16.x', lambda.RuntimeFamily.NODEJS),
+ runtime: new lambda.Runtime('nodejs18.x', lambda.RuntimeFamily.NODEJS),
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, '../../assets/account-provider/is-complete-handler.lambda')),
});
diff --git a/src/account-provider/on-event-handler-function.ts b/src/account-provider/on-event-handler-function.ts
index a22c25e0..421310d9 100644
--- a/src/account-provider/on-event-handler-function.ts
+++ b/src/account-provider/on-event-handler-function.ts
@@ -1,4 +1,4 @@
-// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
import * as path from 'path';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
@@ -17,7 +17,7 @@ export class OnEventHandlerFunction extends lambda.Function {
super(scope, id, {
description: 'src/account-provider/on-event-handler.lambda.ts',
...props,
- runtime: new lambda.Runtime('nodejs16.x', lambda.RuntimeFamily.NODEJS),
+ runtime: new lambda.Runtime('nodejs18.x', lambda.RuntimeFamily.NODEJS),
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, '../../assets/account-provider/on-event-handler.lambda')),
});
diff --git a/src/account.ts b/src/account.ts
index 8d4c32ef..fb701bf5 100644
--- a/src/account.ts
+++ b/src/account.ts
@@ -87,8 +87,9 @@ export interface IAccount extends IPolicyAttachmentTarget, IChild, IConstruct, I
*
* @param servicePrincipal The supported AWS service that you specify
* @param region The region to delegate in
+ * @param {DelegatedAdministratorProps} props additional DelegatedAdministrator props
*/
- delegateAdministrator(servicePrincipal: string, region?: string): void;
+ delegateAdministrator(servicePrincipal: string, region?: string, props?: Record): void;
}
/**
@@ -155,16 +156,17 @@ export class Account extends Construct implements IAccount, ITaggableResource {
*
* @param {string} servicePrincipal The supported AWS service that you specify
* @param {string} region The region to delegate in
+ * @param {DelegatedAdministratorProps} props additional DelegatedAdministrator props
*/
- public delegateAdministrator(servicePrincipal: string, region?: string) {
+ public delegateAdministrator(servicePrincipal: string, region?: string, props: Record = {}) {
const organizationsRegion = process.env.CDK_AWS_PARTITION === "aws-cn" ? "cn-northwest-1" : "us-east-1";
-
const delegatedAdministrator = new DelegatedAdministrator(
this.scope,
`Delegate${pascalCase(servicePrincipal)}${
region && region !== organizationsRegion ? `-${region}` : ""
}-${Names.nodeUniqueId(this.node)}`,
{
+ ...props,
account: this,
servicePrincipal: servicePrincipal,
region,
diff --git a/src/delegated-administrator.ts b/src/delegated-administrator.ts
index 95007b59..be45474e 100644
--- a/src/delegated-administrator.ts
+++ b/src/delegated-administrator.ts
@@ -1,3 +1,4 @@
+import { RemovalPolicy } from "aws-cdk-lib";
import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
import { Construct } from "constructs";
import { IAccount } from "./account";
@@ -15,6 +16,12 @@ export interface DelegatedAdministratorProps {
* The region to delegate the administrator in.
*/
readonly region?: string;
+ /**
+ * If set to RemovalPolicy.RETAIN, the delegation will not be removed.
+ *
+ * @default RemovalPolicy.DESTROY
+ */
+ readonly removalPolicy?: RemovalPolicy;
}
/**
@@ -44,15 +51,19 @@ export class DelegatedAdministrator extends Construct {
},
ignoreErrorCodesMatching: "AccountAlreadyRegisteredException", // https://docs.aws.amazon.com/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html#API_RegisterDelegatedAdministrator_Errors
},
- onDelete: {
- service: "Organizations",
- action: "deregisterDelegatedAdministrator", // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Organizations.html#deregisterDelegatedAdministrator-property
- region: region ?? organizationsRegion,
- parameters: {
- AccountId: account.accountId,
- ServicePrincipal: servicePrincipal,
- },
- },
+ ...(props.removalPolicy === RemovalPolicy.RETAIN
+ ? {}
+ : {
+ onDelete: {
+ service: "Organizations",
+ action: "deregisterDelegatedAdministrator", // https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Organizations.html#deregisterDelegatedAdministrator-property
+ region: region ?? organizationsRegion,
+ parameters: {
+ AccountId: account.accountId,
+ ServicePrincipal: servicePrincipal,
+ },
+ },
+ }),
installLatestAwsSdk: false,
policy: AwsCustomResourcePolicy.fromSdkCalls({
resources: AwsCustomResourcePolicy.ANY_RESOURCE,
diff --git a/src/organization-provider/on-event-handler-function.ts b/src/organization-provider/on-event-handler-function.ts
index d7f16bdc..681115b1 100644
--- a/src/organization-provider/on-event-handler-function.ts
+++ b/src/organization-provider/on-event-handler-function.ts
@@ -1,4 +1,4 @@
-// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
import * as path from 'path';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
@@ -17,7 +17,7 @@ export class OnEventHandlerFunction extends lambda.Function {
super(scope, id, {
description: 'src/organization-provider/on-event-handler.lambda.ts',
...props,
- runtime: new lambda.Runtime('nodejs16.x', lambda.RuntimeFamily.NODEJS),
+ runtime: new lambda.Runtime('nodejs18.x', lambda.RuntimeFamily.NODEJS),
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, '../../assets/organization-provider/on-event-handler.lambda')),
});
diff --git a/src/organizational-unit-provider/on-event-handler-function.ts b/src/organizational-unit-provider/on-event-handler-function.ts
index 3ddeac55..a5b510e3 100644
--- a/src/organizational-unit-provider/on-event-handler-function.ts
+++ b/src/organizational-unit-provider/on-event-handler-function.ts
@@ -1,4 +1,4 @@
-// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
import * as path from 'path';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
@@ -17,7 +17,7 @@ export class OnEventHandlerFunction extends lambda.Function {
super(scope, id, {
description: 'src/organizational-unit-provider/on-event-handler.lambda.ts',
...props,
- runtime: new lambda.Runtime('nodejs16.x', lambda.RuntimeFamily.NODEJS),
+ runtime: new lambda.Runtime('nodejs18.x', lambda.RuntimeFamily.NODEJS),
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, '../../assets/organizational-unit-provider/on-event-handler.lambda')),
});
diff --git a/src/tag-resource-provider/on-event-handler-function.ts b/src/tag-resource-provider/on-event-handler-function.ts
index e197b799..92e260ba 100644
--- a/src/tag-resource-provider/on-event-handler-function.ts
+++ b/src/tag-resource-provider/on-event-handler-function.ts
@@ -1,4 +1,4 @@
-// ~~ Generated by projen. To modify, edit .projenrc.js and run "npx projen".
+// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
import * as path from 'path';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
@@ -17,7 +17,7 @@ export class OnEventHandlerFunction extends lambda.Function {
super(scope, id, {
description: 'src/tag-resource-provider/on-event-handler.lambda.ts',
...props,
- runtime: new lambda.Runtime('nodejs16.x', lambda.RuntimeFamily.NODEJS),
+ runtime: new lambda.Runtime('nodejs18.x', lambda.RuntimeFamily.NODEJS),
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, '../../assets/tag-resource-provider/on-event-handler.lambda')),
});
diff --git a/test/__snapshots__/account.test.ts.snap b/test/__snapshots__/account.test.ts.snap
index e417678e..76cf3c24 100644
--- a/test/__snapshots__/account.test.ts.snap
+++ b/test/__snapshots__/account.test.ts.snap
@@ -2,23 +2,13 @@
exports[`Account Should match snapshot 1`] = `
Object {
- "Parameters": Object {
- "BootstrapVersion": Object {
- "Default": "/cdk-bootstrap/hnb659fds/version",
- "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]",
- "Type": "AWS::SSM::Parameter::Value",
- },
- },
"Resources": Object {
"AWS679f53fac002430cb0da5b7982bd22872D164C4C": Object {
"DependsOn": Array [
"AWS679f53fac002430cb0da5b7982bd2287ServiceRoleC1EA0FF2",
],
"Properties": Object {
- "Code": Object {
- "S3Bucket": "cdk-hnb659fds-assets-123456789012-us-east-1",
- "S3Key": "6dbd112fe448437b3438da4382c72fccbb7d2ee1543db222620d7447fffebc50.zip",
- },
+ "Code": Any