proserve-organizations-account.json

{
    "typeName": "ProServe::Organizations::Account",
    "description": "Resource Schema for ProServe::Organizations::Account",
    "sourceUrl": "https://gitlab.aws.dev/aws-enterprise-jumpstart/aws-organizations-account-resource",
    "typeConfiguration": {
        "properties": {
            "RoleArn": {
                "$ref": "#/definitions/RoleArn"
            }
        },
        "additionalProperties": false,
        "required": []
    },
    "definitions": {
        "RoleArn": {
            "description": "Role ARN to be assumed in order to create the Account",
            "type": "string"
        },
        "DeploymentAccountConfiguration": {
            "description": "(Optional) A dedicated deployment account can be used to further enhance security. This configuration creates a second role within the newly created account. This role trusts the given deployment account, allowing users in the given deployment account to assume the role.",
            "type": "object",
            "properties": {
                "AccountId": {
                    "description": "Deployment Account Id",
                    "type": "string",
                    "minLength": 12,
                    "maxLength": 12
                },
                "RoleName": {
                    "description": "Deployment Role Name.",
                    "type": "string",
                    "default": "DeploymentAccountAccessRole",
                    "minLength": 1,
                    "maxLength": 256
                },
                "AWSManagedPolicyArns": {
                    "description": "A List of AWS managed policy arn's to attach to the deployment account role",
                    "type": "array",
                    "minItems": 1,
                    "uniqueItems": true,
                    "insertionOrder": false,
                    "items": {
                        "type": "string"
                    }
                }
            },
            "additionalProperties": false,
            "required": [
                "AccountId",
                "AWSManagedPolicyArns"
            ]
        },
        "AlternateContacts": {
            "description": "(Optional) Alternate contacts to be set",
            "type": "object",
            "additionalProperties": false,
            "properties": {
                "Billing": {
                    "$ref": "#/definitions/AlternateContact"
                },
                "Operations": {
                    "$ref": "#/definitions/AlternateContact"
                },
                "Security": {
                    "$ref": "#/definitions/AlternateContact"
                }
            }
        },
        "AlternateContact": {
            "description": "Alternate contact to be set",
            "type": "object",
            "additionalProperties": false,
            "properties": {
                "Email": {
                    "description": "Contacts email address",
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 64,
                    "pattern": "[\\w+=,.-]+@[\\w.-]+\\.[\\w]+"
                },
                "Name": {
                    "description": "Contacts name",
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 64
                },
                "PhoneNumber": {
                    "description": "Contacts phone number",
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 25,
                    "pattern": "^[\\s0-9()+-]+$"
                },
                "Title": {
                    "description": "Contacts title",
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 50
                }
            },
            "required": [
                "Email",
                "Name",
                "PhoneNumber",
                "Title"
            ]
        },
        "Tag": {
            "type": "object",
            "properties": {
                "Key": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 128
                },
                "Value": {
                    "type": "string",
                    "minLength": 1,
                    "maxLength": 256
                }
            },
            "additionalProperties": false,
            "required": [
                "Key",
                "Value"
            ]
        }
    },
    "properties": {
        "AccountName": {
            "description": "The friendly name of the member account.",
            "type": "string"
        },
        "AccountEmail": {
            "description": "The email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account. You must use a valid email address to complete account creation. You can't access the root user of the account or remove an account that was created with an invalid email address.",
            "type": "string"
        },
        "OrganizationalUnitId": {
            "description": "The unique identifier (ID) of the root or organizational unit that you want to create the account in.",
            "type" : "string"
        },
        "AlternateContacts": {
            "$ref": "#/definitions/AlternateContacts"
        },
        "OrganizationAccountAccessRoleName": {
            "description": "The name of an IAM role that AWS Organizations automatically preconfigures in the new member account. This role trusts the management account, allowing users in the management account to assume the role, as permitted by the management account administrator. The role has administrator permissions in the new member account.\n\nIf you don't specify this parameter, the role name defaults to `OrganizationAccountAccessRole`.",
            "type": "string",
            "default": "OrganizationAccountAccessRole"
        },
        "DeploymentAccountConfiguration": {
            "$ref" : "#/definitions/DeploymentAccountConfiguration"
        },
        "Tags": {
            "description": "One or more tags.",
            "type": "array",
            "insertionOrder": false,
            "items": {
                "$ref" : "#/definitions/Tag"
            }
        },
        "NotificationTopicArn": {
            "description": "The SNS topic ARN to which to publish failure reasons.",
            "type": "string"
        },
        "AccountRequestId": {
            "description": "The unique identifier (ID) of the account creation request.",
            "type": "string"
        },
        "AccountId": {
            "description": "The unique identifier (ID) of the account.",
            "type": "string"  
        },
        "CloseAccountOnDeletion": {
            "description": "If set to true account will be closed by AWS CloudFormation. Otherwise, just parked in root organizational unit.",
            "type": "boolean"
        }
    },
    "additionalProperties": false,
    "taggable": true,
    "required": [
        "AccountName",
        "AccountEmail",
        "OrganizationalUnitId"
    ],
    "readOnlyProperties": [
        "/properties/AccountId",
        "/properties/AccountRequestId"
    ],
    "writeOnlyProperties": [
        "/properties/NotificationTopicArn",
        "/properties/OrganizationAccountAccessRoleName",
        "/properties/DeploymentAccountConfiguration"
    ],
    "primaryIdentifier": [
        "/properties/AccountId"
    ],
    "createOnlyProperties": [
        "/properties/OrganizationAccountAccessRoleName",
        "/properties/DeploymentAccountConfiguration"
    ],
    "handlers": {
        "create": {
            "permissions": [
                "sts:AssumeRole",
                "organizations:CreateAccount",
                "organizations:MoveAccount",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:ListRoots",
                "organizations:ListParents",
                "organizations:ListChildren",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:DescribeCreateAccountStatus",
                "organizations:ListTagsForResource",
                "organizations:TagResource",
                "organizations:UntagResource",
                "account:DeleteAlternateContact",
                "account:GetAlternateContact",
                "account:PutAlternateContact",
                "sns:Publish"
            ]
        },
        "read": {
            "permissions": [
                "sts:AssumeRole",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:ListRoots",
                "organizations:ListParents",
                "organizations:ListChildren",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListTagsForResource",
                "account:GetAlternateContact",
                "sns:Publish"
            ]
        },
        "update": {
            "permissions": [
                "sts:AssumeRole",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:ListRoots",
                "organizations:ListParents",
                "organizations:ListChildren",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListTagsForResource",
                "account:DeleteAlternateContact",
                "account:GetAlternateContact",
                "account:PutAlternateContact",
                "sns:Publish"
            ]
        },
        "delete": {
            "permissions": [
                "sts:AssumeRole",
                "organizations:MoveAccount",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:ListRoots",
                "organizations:ListParents",
                "organizations:ListChildren",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListTagsForResource",
                "organizations:TagResource",
                "organizations:UntagResource",
                "organizations:CloseAccount",
                "account:DeleteAlternateContact",
                "account:GetAlternateContact",
                "account:PutAlternateContact",
                "sns:Publish"
            ]
        },
        "list": {
            "permissions": [
                "sts:AssumeRole",
                "organizations:DescribeAccount",
                "organizations:ListRoots",
                "organizations:ListParents",
                "organizations:ListAccounts",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListTagsForResource",
                "account:GetAlternateContact",
                "sns:Publish"
            ]
        }
    }
}