resource/aws_organizations_account: Add parent_id argument (support moving accounts) #8583

bflad · 2019-05-09T05:59:01Z

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" comments, they generate extra noise for pull request followers and do not help prioritize the request

Includes 2 relevant commits from #4405
Closes #8281

Release note for CHANGELOG:

resource/aws_organizations_account: Add parent_id argument (support moving accounts)

Please note that automated acceptance testing is not currently possible with this resource, due to manual steps required to remove an account from an organization: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html

These changes were manually verified via the following.

Given an existing configuration, previously applied with version 2.9.0 of the Terraform AWS Provider:

resource "aws_organizations_organization" "organization" {
  feature_set = "ALL"
}

resource "aws_organizations_account" "bflad-dev1" {
  name  = "bflad-dev1"
  email = "--OMITTED--"
}

resource "aws_organizations_account" "bflad-dev2" {
  name  = "bflad-dev2"
  email = "--OMITTED--"
}

Overwrite Terraform AWS Provider binary including this changeset, ensure plan shows no changes, and ensure parent_id is properly written to Terraform state:

$ cp ~/go/bin/terraform-provider-aws .terraform/plugins/darwin_amd64/terraform-provider-aws_v2.9.0_x4
$ terraform init
...
$ terraform plan
...
aws_organizations_organization.organization: Refreshing state... (ID: o-p687o6l073)
aws_organizations_account.bflad-dev2: Refreshing state... (ID: --OMITTED--)
aws_organizations_account.bflad-dev1: Refreshing state... (ID: --OMITTED--)

------------------------------------------------------------------------

No changes. Infrastructure is up-to-date.
$ terraform refresh
...
$ terraform state show aws_organizations_account.bflad-dev1 | grep parent_id
parent_id     = r-cg2b

Add organizational unit to configuration and add parent_id to an existing account pointing to it:

resource "aws_organizations_organization" "organization" {
  feature_set = "ALL"
}

resource "aws_organizations_organizational_unit" "test1" {
  name      = "test1"
  parent_id = "${aws_organizations_organization.organization.roots.0.id}"
}

resource "aws_organizations_account" "bflad-dev1" {
  name      = "bflad-dev1"
  email     = "--OMITTED--"
  parent_id = "${aws_organizations_organizational_unit.test1.id}"
}

resource "aws_organizations_account" "bflad-dev2" {
  name  = "bflad-dev2"
  email = "--OMITTED--"
}

Verifying Update functionality:

$ terraform apply
...
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  ~ aws_organizations_account.bflad-dev1
      parent_id: "r-cg2b" => "${aws_organizations_organizational_unit.test1.id}"

  + aws_organizations_organizational_unit.test1
      id:        <computed>
      arn:       <computed>
      name:      "test1"
      parent_id: "r-cg2b"


Plan: 1 to add, 1 to change, 0 to destroy.

...

aws_organizations_organizational_unit.test1: Creating...
  arn:       "" => "<computed>"
  name:      "" => "test1"
  parent_id: "" => "r-cg2b"
aws_organizations_organizational_unit.test1: Creation complete after 0s (ID: ou-cg2b-7aa8b56k)
aws_organizations_account.bflad-dev1: Modifying... (ID: --OMITTED--)
  parent_id: "r-cg2b" => "ou-cg2b-7aa8b56k"
aws_organizations_account.bflad-dev1: Modifications complete after 1s (ID: --OMITTED--)

$ terraform state show aws_organizations_account.bflad-dev1 | grep parent_id
parent_id     = ou-cg2b-7aa8b56k

Add account with parent_id to configuration:

resource "aws_organizations_organization" "organization" {
  feature_set = "ALL"
}

resource "aws_organizations_organizational_unit" "test1" {
  name      = "test1"
  parent_id = "${aws_organizations_organization.organization.roots.0.id}"
}

resource "aws_organizations_account" "bflad-dev1" {
  name      = "bflad-dev1"
  email     = "--OMITTED--"
  parent_id = "${aws_organizations_organizational_unit.test1.id}"
}

resource "aws_organizations_account" "bflad-dev2" {
  name  = "bflad-dev2"
  email = "--OMITTED--"
}

resource "aws_organizations_account" "bflad-dev3" {
  name      = "bflad-dev3"
  email     = "--OMITTED--"
  parent_id = "${aws_organizations_organizational_unit.test1.id}"
}

Verifying Create functionality:

$ terraform apply
...
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  + aws_organizations_account.bflad-dev3
      id:               <computed>
      arn:              <computed>
      email:            "--OMITTED--"
      joined_method:    <computed>
      joined_timestamp: <computed>
      name:             "bflad-dev3"
      parent_id:        "ou-cg2b-7aa8b56k"
      status:           <computed>


Plan: 1 to add, 0 to change, 0 to destroy.

...

aws_organizations_account.bflad-dev3: Creating...
  arn:              "" => "<computed>"
  email:            "" => "--OMITTED--"
  joined_method:    "" => "<computed>"
  joined_timestamp: "" => "<computed>"
  name:             "" => "bflad-dev3"
  parent_id:        "" => "ou-cg2b-7aa8b56k"
  status:           "" => "<computed>"
aws_organizations_account.bflad-dev3: Still creating... (10s elapsed)
aws_organizations_account.bflad-dev3: Creation complete after 12s (ID: --OMITTED--)
$ terraform state show aws_organizations_account.bflad-dev3 | grep parent_id
parent_id     = ou-cg2b-7aa8b56k

…entation References: * #4405 * #8281 Please note that automated acceptance testing is not currently possible with this resource, due to manual steps required to remove an account from an organization: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html These changes were manually verified via the following. Given an existing configuration, previously applied with version 2.9.0 of the Terraform AWS Provider: ```hcl resource "aws_organizations_organization" "organization" { feature_set = "ALL" } resource "aws_organizations_account" "bflad-dev1" { name = "bflad-dev1" email = "--OMITTED--" } resource "aws_organizations_account" "bflad-dev2" { name = "bflad-dev2" email = "--OMITTED--" } ``` Overwrite Terraform AWS Provider binary including this changeset, ensure plan shows no changes, and ensure `parent_id` is properly written to Terraform state: ```console $ cp ~/go/bin/terraform-provider-aws .terraform/plugins/darwin_amd64/terraform-provider-aws_v2.9.0_x4 $ terraform init ... $ terraform plan ... aws_organizations_organization.organization: Refreshing state... (ID: o-p687o6l073) aws_organizations_account.bflad-dev2: Refreshing state... (ID: --OMITTED--) aws_organizations_account.bflad-dev1: Refreshing state... (ID: --OMITTED--) ------------------------------------------------------------------------ No changes. Infrastructure is up-to-date. $ terraform refresh ... $ terraform state show aws_organizations_account.bflad-dev1 | grep parent_id parent_id = r-cg2b ``` Add organizational unit to configuration and add `parent_id` to an existing account pointing to it: ```hcl resource "aws_organizations_organization" "organization" { feature_set = "ALL" } resource "aws_organizations_organizational_unit" "test1" { name = "test1" parent_id = "${aws_organizations_organization.organization.roots.0.id}" } resource "aws_organizations_account" "bflad-dev1" { name = "bflad-dev1" email = "--OMITTED--" parent_id = "${aws_organizations_organizational_unit.test1.id}" } resource "aws_organizations_account" "bflad-dev2" { name = "bflad-dev2" email = "--OMITTED--" } ``` Verifying `Update` functionality: ``` $ terraform apply ... An execution plan has been generated and is shown below. Resource actions are indicated with the following symbols: + create ~ update in-place Terraform will perform the following actions: ~ aws_organizations_account.bflad-dev1 parent_id: "r-cg2b" => "${aws_organizations_organizational_unit.test1.id}" + aws_organizations_organizational_unit.test1 id: <computed> arn: <computed> name: "test1" parent_id: "r-cg2b" Plan: 1 to add, 1 to change, 0 to destroy. ... aws_organizations_organizational_unit.test1: Creating... arn: "" => "<computed>" name: "" => "test1" parent_id: "" => "r-cg2b" aws_organizations_organizational_unit.test1: Creation complete after 0s (ID: ou-cg2b-7aa8b56k) aws_organizations_account.bflad-dev1: Modifying... (ID: --OMITTED--) parent_id: "r-cg2b" => "ou-cg2b-7aa8b56k" aws_organizations_account.bflad-dev1: Modifications complete after 1s (ID: --OMITTED--) $ terraform state show aws_organizations_account.bflad-dev1 | grep parent_id parent_id = ou-cg2b-7aa8b56k ``` Add account with `parent_id` to configuration: ```hcl resource "aws_organizations_organization" "organization" { feature_set = "ALL" } resource "aws_organizations_organizational_unit" "test1" { name = "test1" parent_id = "${aws_organizations_organization.organization.roots.0.id}" } resource "aws_organizations_account" "bflad-dev1" { name = "bflad-dev1" email = "--OMITTED--" parent_id = "${aws_organizations_organizational_unit.test1.id}" } resource "aws_organizations_account" "bflad-dev2" { name = "bflad-dev2" email = "--OMITTED--" } resource "aws_organizations_account" "bflad-dev3" { name = "bflad-dev3" email = "--OMITTED--" parent_id = "${aws_organizations_organizational_unit.test1.id}" } ``` Verifying `Create` functionality: ``` $ terraform apply ... An execution plan has been generated and is shown below. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: + aws_organizations_account.bflad-dev3 id: <computed> arn: <computed> email: "--OMITTED--" joined_method: <computed> joined_timestamp: <computed> name: "bflad-dev3" parent_id: "ou-cg2b-7aa8b56k" status: <computed> Plan: 1 to add, 0 to change, 0 to destroy. ... aws_organizations_account.bflad-dev3: Creating... arn: "" => "<computed>" email: "" => "--OMITTED--" joined_method: "" => "<computed>" joined_timestamp: "" => "<computed>" name: "" => "bflad-dev3" parent_id: "" => "ou-cg2b-7aa8b56k" status: "" => "<computed>" aws_organizations_account.bflad-dev3: Still creating... (10s elapsed) aws_organizations_account.bflad-dev3: Creation complete after 12s (ID: --OMITTED--) $ terraform state show aws_organizations_account.bflad-dev3 | grep parent_id parent_id = ou-cg2b-7aa8b56k ```

ryanwalder · 2019-05-10T09:15:42Z

This really is they key to making orgs usable in tf. Keep up the great work!

nywilken · 2019-05-17T09:35:57Z

aws/resource_aws_organizations_test.go

@@ -12,7 +12,8 @@ func TestAccAWSOrganizations(t *testing.T) {
 			"FeatureSet":                 testAccAwsOrganizationsOrganization_FeatureSet,
 		},
 		"Account": {
-			"basic": testAccAwsOrganizationsAccount_basic,
+			"basic":    testAccAwsOrganizationsAccount_basic,


nywilken · 2019-05-17T09:43:14Z

aws/resource_aws_organizations_account_test.go

@@ -12,6 +12,8 @@ import (
 )

 func testAccAwsOrganizationsAccount_basic(t *testing.T) {
+	t.Skip("AWS Organizations Account testing is not currently automated due to manual account deletion steps.")


Does it make sense to include a comment with a link back to this PR to show the verification steps taken as an example? Or maybe a comment with the link https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html?

Including testing documentation in some form is probably not a bad idea. Let's discuss what form this should take (probably in a multi-line skip message) after we cut the release.

Luckily this is the first time we've needed to touch this resource since its creation so this awful manual process isn't required too much, but surely easy to forget!

nywilken

Nicely done 👍 The testing write-up is greatly appreciated.

bflad · 2019-05-17T13:50:51Z

This has been released in version 2.11.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

ghost · 2020-03-30T17:14:53Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

afeld and others added 3 commits May 9, 2019 00:33

compute the parent_id for the aws_organizations_account

ba1dd53

allow the parent_id to be specified on an aws_organizations_account

072c303

bflad added enhancement Requests to existing resources that expand the functionality or scope. service/organizations Issues and PRs that pertain to the organizations service. labels May 9, 2019

bflad requested a review from a team May 9, 2019 05:59

ghost added size/L Managed by automation to categorize the size of a PR. documentation Introduces or discusses updates to documentation. tests PRs: expanded test coverage. Issues: expanded coverage, enhancements to test infrastructure. labels May 9, 2019

This was referenced May 9, 2019

[WIP] support setting the parent for organization accounts #4405

Closed

AWS Organizations Move Account support #8281

Closed

nywilken reviewed May 17, 2019

View reviewed changes

nywilken approved these changes May 17, 2019

View reviewed changes

bflad added this to the v2.11.0 milestone May 17, 2019

bflad merged commit ff8ab50 into master May 17, 2019

bflad deleted the afeld-account-parent branch May 17, 2019 12:15

bflad added a commit that referenced this pull request May 17, 2019

Update CHANGELOG for #8583

3ea7031

ghost locked and limited conversation to collaborators Mar 30, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

resource/aws_organizations_account: Add parent_id argument (support moving accounts) #8583

resource/aws_organizations_account: Add parent_id argument (support moving accounts) #8583

bflad commented May 9, 2019

ryanwalder commented May 10, 2019

nywilken May 17, 2019

nywilken May 17, 2019

bflad May 17, 2019

nywilken left a comment

bflad commented May 17, 2019

ghost commented Mar 30, 2020

resource/aws_organizations_account: Add parent_id argument (support moving accounts) #8583

resource/aws_organizations_account: Add parent_id argument (support moving accounts) #8583

Conversation

bflad commented May 9, 2019

Community Note

ryanwalder commented May 10, 2019

nywilken May 17, 2019

Choose a reason for hiding this comment

nywilken May 17, 2019

Choose a reason for hiding this comment

bflad May 17, 2019

Choose a reason for hiding this comment

nywilken left a comment

Choose a reason for hiding this comment

bflad commented May 17, 2019

ghost commented Mar 30, 2020