[WIP] Add an aws_organizations_account_ids data source

[breser]

Part of #571

Corresponds to ListAccounts and the ListAccountsForParent APIs. Motivation here is to be able to write IAM policies that automatically allow things for all accounts in an Organization or Organizational Unit (e.g. allowing all accounts belonging to an Organization to write CloudTrail logs to the same S3 bucket) without needing to hardcode the Account Ids.

I have not written the tests for this yet because to do so I really need #4207 and #4229. But I wanted to checkpoint my work and get feedback on what I already have.

I've tested it as follows:

data "aws_organizations_account_ids" "me" {}

output "account_ids" {
  value = ["${data.aws_organizations_account_ids.me.ids}"]
}

Which resulted in the following output (actual account id obfuscated):

$ terraform apply
data.aws_organizations_account_ids.me: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

account_ids = [
    123456789012
]

With the root id:

data "aws_organizations_account_ids" "me" { parent_id = "r-oi5p" }

output "account_ids" {
  value = ["${data.aws_organizations_account_ids.me.ids}"]
}

Which resulted in the following output (actual account id obfuscated):

$ terraform apply
data.aws_organizations_account_ids.me: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

account_ids = [
    123456789012
]

I then moved the account into an OU and tried it again with the root which resulted in the following output (actual account id obfuscated):

$ terraform apply
data.aws_organizations_account_ids.me: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

account_ids = []

And then finally with the OU id:

data "aws_organizations_account_ids" "me" { parent_id = "ou-oi5p-mgp77s7y" }

output "account_ids" {
  value = ["${data.aws_organizations_account_ids.me.ids}"]
}

Which resulted in the following output (actual account id obfuscated):

$ terraform apply
data.aws_organizations_account_ids.me: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

account_ids = [
    123456789012
]

I intend to test with an account with many accounts in the Organization next week at work.

[breser]

I'll get the conflicts and the test failure fixed tonight.

[breser]

Tested this on an account with many accounts in an organization and it's working fine.

[JoshiiSinfield]

Hi,

Has there been any more movement on this?

Cheers,
Josh

[voroniys]

It is almost a year ago, there are several pull requests open, when we finally can expect the accounts data sources to be released?

[e-moshaya]

any update on this?

[mcameron]

Now that #571 has been merged, can we get this included?

[bflad]

Hi @breser 👋 Thank you very much for your time and contribution here. My apologies for the long silence on this pull request. The support for AWS Organizations has been quite the long process and there were differing implementations offered by various members of the community. In the future, we am hoping that we can host these type of implementation discussions in design issues where the implementation choice is agreed on before we wind up in the same situation of conflicting contributions.

After evaluating all the contributions, we decided to opt for a single aws_organization_organization data source that was able to represent the same functionality as the aws_organization_organization resource. This will allow operators to have a similar experience between these two options and will have the following modes of operation:

• If used in an account that is not part of an Organization, it will return an error
• If used within an Organization but outside the master account, it will return the Organization ID, ARN, and master account ID information
• If used within the Organization master account, it will return all the arguments and attributes available in the aws_organizations_organization resource including all member account information such as account ARNs and account IDs

This new aws_organizations_organization data source has been merged and will release with version 2.21.0 of the Terraform AWS Provider, in about a week. Since the functionality available in this new data source supersedes the need of an additional data source, I'm going to close out this pull request.

We really appreciate the time and effort that went into this contribution and we hope to be able to work with you again in the future.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!