Organizations

6 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

OrganizationsAccount # GA

OrganizationsAccount is the Schema for managing AWS Organizations member accounts.

kubectl get organizationsaccounts · example on GitHub

Example

# OrganizationsAccount — Organizations
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/organizations.html#organizationsaccount
apiVersion: aws.konfig.io/v1alpha1
kind: OrganizationsAccount
metadata:
  name: example-organizationsaccount
  namespace: default
spec:
  accountName: example-organizationsaccount
  closeOnDelete: false
  email: ops@example.com
  iamUserAccessToBilling: ALLOW
  parentRef:
    name: example-parent
  providerRef:
    name: example-organizationsaccount
    region: us-east-1
  roleName: example-organizationsaccount
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`accountName`	string	yes	AccountName is the friendly name of the member account.
`closeOnDelete`	boolean	—	CloseOnDelete requests that the AWS account be closed (CloseAccount) when this CR is deleted.
`email`	string	yes	Email is the email address of the account owner.
`iamUserAccessToBilling`	enum	—	IAMUserAccessToBilling controls whether IAM users in the new account can access billing information. Allowed: `ALLOW, DENY`
`parentId`	string	—	ParentID is the root (r-...) or OU (ou-...) ID to move the account into after creation via MoveAccount.
`parentRef`	object	—	ParentRef references an OrganizationsOU CR to move the account into after creation.
`parentRef.name`	string	—	Name of the resource in the same namespace.
`parentRef.namespace`	string	—	Namespace of the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleName`	string	—	RoleName is the name of the IAM role created in the new account that grants the management account administrator access.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the account.

Status

Field	Type	Required	Description
`accountId`	string	—	AccountID is the 12-digit AWS account ID once creation succeeds.
`arn`	string	—	ARN is the Amazon Resource Name of the account.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createAccountRequestId`	string	—	CreateAccountRequestID is the CreateAccount request ID (car-...) used to poll DescribeCreateAccountStatus while creation is in progress.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the last observed CreateAccount state (IN_PROGRESS, SUCCEEDED, or FAILED).

OrganizationsOU # GA

OrganizationsOU is the Schema for managing AWS Organizations organizational units.

kubectl get organizationsous · example on GitHub

Example

# OrganizationsOU — Organizations
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/organizations.html#organizationsou
apiVersion: aws.konfig.io/v1alpha1
kind: OrganizationsOU
metadata:
  name: example-organizationsou
  namespace: default
spec:
  name: example-organizationsou
  parentRef:
    name: example-parent
  providerRef:
    name: example-organizationsou
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`name`	string	yes	Name is the friendly name of the organizational unit.
`parentId`	string	—	ParentID is the ID of the parent root (r-...) or OU (ou-...) to create this OU under.
`parentRef`	object	—	ParentRef references another OrganizationsOU CR to use as the parent.
`parentRef.name`	string	—	Name of the resource in the same namespace.
`parentRef.namespace`	string	—	Namespace of the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the OU.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the organizational unit.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`ouId`	string	—	OUID is the unique identifier (ou-...) of the organizational unit.

OrganizationsOrganization # CLOUD CONTROL · AWS::Organizations::Organization ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: organization-wide: creating or deleting this affects every member account. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. OrganizationsOrganization manages AWS::Organizations::Organization through the AWS Cloud Control API.

kubectl get organizationsorganizations · example on GitHub

Example

# OrganizationsOrganization — Organizations
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/organizations.html#organizationsorganization
apiVersion: aws.konfig.io/v1alpha1
kind: OrganizationsOrganization
metadata:
  name: example-organizationsorganization
  namespace: default
spec:
  featureSet: ALL
  providerRef:
    name: example-organizationsorganization
    region: us-east-1

Spec

Field	Type	Required	Description
`featureSet`	enum	—	Specifies the feature set supported by the new organization. Allowed: `ALL, CONSOLIDATED_BILLING`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of an organization.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The unique identifier (ID) of an organization.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`managementAccountArn`	string	—	The Amazon Resource Name (ARN) of the account that is designated as the management account for the organization.
`managementAccountEmail`	string	—	The email address that is associated with the AWS account that is designated as the management account for the organization.
`managementAccountId`	string	—	The unique identifier (ID) of the management account of an organization.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`rootId`	string	—	The unique identifier (ID) for the root.

OrganizationsPolicy # GA

OrganizationsPolicy is the Schema for managing AWS Organizations policies.

kubectl get organizationspolicies · example on GitHub

Example

# OrganizationsPolicy — Organizations
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/organizations.html#organizationspolicy
apiVersion: aws.konfig.io/v1alpha1
kind: OrganizationsPolicy
metadata:
  name: example-organizationspolicy
  namespace: default
spec:
  content: example
  description: Managed by konfig-konector
  name: example-organizationspolicy
  providerRef:
    name: example-organizationspolicy
    region: us-east-1
  tags:
    environment: dev
    team: platform
  type: SERVICE_CONTROL_POLICY

Spec

Field	Type	Required	Description
`content`	string	yes	Content is the policy document as JSON text.
`description`	string	—	Description is an optional description for the policy.
`name`	string	yes	Name is the friendly name of the policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the policy.
`type`	enum	yes	Type is the policy type. Allowed: `SERVICE_CONTROL_POLICY, TAG_POLICY, BACKUP_POLICY, AISERVICES_OPT_OUT_POLICY`

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the policy.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`policyId`	string	—	PolicyID is the unique identifier (p-...) of the policy.

OrganizationsPolicyAttachment # GA

OrganizationsPolicyAttachment is the Schema for managing AWS Organizations policy attachments.

kubectl get organizationspolicyattachments · example on GitHub

Example

# OrganizationsPolicyAttachment — Organizations
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/organizations.html#organizationspolicyattachment
apiVersion: aws.konfig.io/v1alpha1
kind: OrganizationsPolicyAttachment
metadata:
  name: example-organizationspolicyattachment
  namespace: default
spec:
  policyRef:
    name: example-organizationspolicyattachment
  providerRef:
    name: example-organizationspolicyattachment
    region: us-east-1
  targetId: example-id

Spec

Field	Type	Required	Description
`policyRef`	object	yes	PolicyRef references the policy to attach.
`policyRef.name`	string	—	Name of an OrganizationsPolicy CR in the same namespace.
`policyRef.policyId`	string	—	PolicyID is a direct AWS Organizations policy ID (p-...).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`targetId`	string	yes	TargetID is the root ID (r-...), OU ID (ou-...), or 12-digit account ID to attach the policy to.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`policyId`	string	—	PolicyID is the resolved AWS policy ID that was attached.
`targetId`	string	—	TargetID is the target the policy was attached to.

OrganizationsResourcePolicy # CLOUD CONTROL · AWS::Organizations::ResourcePolicy ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: organization-wide resource policy. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. OrganizationsResourcePolicy manages AWS::Organizations::ResourcePolicy through the AWS Cloud Control API.

kubectl get organizationsresourcepolicies · example on GitHub

Example

# OrganizationsResourcePolicy — Organizations
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/organizations.html#organizationsresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: OrganizationsResourcePolicy
metadata:
  name: example-organizationsresourcepolicy
  namespace: default
spec:
  providerRef:
    name: example-organizationsresourcepolicy
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`content`	object	yes	The policy document.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A list of tags that you want to attach to the resource policy
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the resource policy.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The unique identifier (ID) associated with this resource policy.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.