Skip to content

Commit 95ff1b2

Browse files
author
awstools
committed
feat(client-organizations): This release introduces delegated administrator for AWS Organizations, a new feature to help you delegate the management of your Organizations policies, enabling you to govern your AWS organization in a decentralized way. You can now allow member accounts to manage Organizations policies.
1 parent 7ee98f5 commit 95ff1b2

15 files changed

+2127
-740
lines changed

‎clients/client-organizations/src/Organizations.ts

Lines changed: 121 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,11 @@ import {
6666
DeletePolicyCommandInput,
6767
DeletePolicyCommandOutput,
6868
} from "./commands/DeletePolicyCommand";
69+
import {
70+
DeleteResourcePolicyCommand,
71+
DeleteResourcePolicyCommandInput,
72+
DeleteResourcePolicyCommandOutput,
73+
} from "./commands/DeleteResourcePolicyCommand";
6974
import {
7075
DeregisterDelegatedAdministratorCommand,
7176
DeregisterDelegatedAdministratorCommandInput,
@@ -106,6 +111,11 @@ import {
106111
DescribePolicyCommandInput,
107112
DescribePolicyCommandOutput,
108113
} from "./commands/DescribePolicyCommand";
114+
import {
115+
DescribeResourcePolicyCommand,
116+
DescribeResourcePolicyCommandInput,
117+
DescribeResourcePolicyCommandOutput,
118+
} from "./commands/DescribeResourcePolicyCommand";
109119
import {
110120
DetachPolicyCommand,
111121
DetachPolicyCommandInput,
@@ -219,6 +229,11 @@ import {
219229
ListTargetsForPolicyCommandOutput,
220230
} from "./commands/ListTargetsForPolicyCommand";
221231
import { MoveAccountCommand, MoveAccountCommandInput, MoveAccountCommandOutput } from "./commands/MoveAccountCommand";
232+
import {
233+
PutResourcePolicyCommand,
234+
PutResourcePolicyCommandInput,
235+
PutResourcePolicyCommandOutput,
236+
} from "./commands/PutResourcePolicyCommand";
222237
import {
223238
RegisterDelegatedAdministratorCommand,
224239
RegisterDelegatedAdministratorCommandInput,
@@ -325,7 +340,7 @@ export class Organizations extends OrganizationsClient {
325340
/**
326341
* <p>Sends a response to the originator of a handshake agreeing to the action proposed by
327342
* the handshake request.</p>
328-
* <p>This operation can be called only by the following principals when they also have the
343+
* <p>You can only call this operation by the following principals when they also have the
329344
* relevant IAM permissions:</p>
330345
* <ul>
331346
* <li>
@@ -512,9 +527,9 @@ export class Organizations extends OrganizationsClient {
512527
* grace period while the account is in SUSPENDED status. </p>
513528
* </li>
514529
* <li>
515-
* <p>If the Amazon Web Services account you attempt to close is linked to an Amazon Web Services GovCloud (US)
516-
* account, the <code>CloseAccount</code> request will close both accounts. To
517-
* learn important pre-closure details, see <a href="https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/Closing-govcloud-account.html">
530+
* <p>If the Amazon Web Services account you attempt to close is linked to an Amazon Web Services GovCloud
531+
* (US) account, the <code>CloseAccount</code> request will close both
532+
* accounts. To learn important pre-closure details, see <a href="https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/Closing-govcloud-account.html">
518533
* Closing an Amazon Web Services GovCloud (US) account</a> in the <i>
519534
* Amazon Web Services GovCloud User Guide</i>.</p>
520535
* </li>
@@ -559,8 +574,8 @@ export class Organizations extends OrganizationsClient {
559574
* account. To check the status of the request, do one of the following:</p>
560575
* <ul>
561576
* <li>
562-
* <p>Use the <code>Id</code> member of the <code>CreateAccountStatus</code>
563-
* response element from this operation to provide as a parameter to the <a>DescribeCreateAccountStatus</a> operation.</p>
577+
* <p>Use the <code>Id</code> value of the <code>CreateAccountStatus</code> response
578+
* element from this operation to provide as a parameter to the <a>DescribeCreateAccountStatus</a> operation.</p>
564579
* </li>
565580
* <li>
566581
* <p>Check the CloudTrail log for the <code>CreateAccountResult</code> event. For
@@ -1076,6 +1091,39 @@ export class Organizations extends OrganizationsClient {
10761091
}
10771092
}
10781093

1094+
/**
1095+
* <p>Deletes the resource policy from your organization.</p>
1096+
* <p>You can only call this operation from the organization's management account.</p>
1097+
*/
1098+
public deleteResourcePolicy(
1099+
args: DeleteResourcePolicyCommandInput,
1100+
options?: __HttpHandlerOptions
1101+
): Promise<DeleteResourcePolicyCommandOutput>;
1102+
public deleteResourcePolicy(
1103+
args: DeleteResourcePolicyCommandInput,
1104+
cb: (err: any, data?: DeleteResourcePolicyCommandOutput) => void
1105+
): void;
1106+
public deleteResourcePolicy(
1107+
args: DeleteResourcePolicyCommandInput,
1108+
options: __HttpHandlerOptions,
1109+
cb: (err: any, data?: DeleteResourcePolicyCommandOutput) => void
1110+
): void;
1111+
public deleteResourcePolicy(
1112+
args: DeleteResourcePolicyCommandInput,
1113+
optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: DeleteResourcePolicyCommandOutput) => void),
1114+
cb?: (err: any, data?: DeleteResourcePolicyCommandOutput) => void
1115+
): Promise<DeleteResourcePolicyCommandOutput> | void {
1116+
const command = new DeleteResourcePolicyCommand(args);
1117+
if (typeof optionsOrCb === "function") {
1118+
this.send(command, optionsOrCb);
1119+
} else if (typeof cb === "function") {
1120+
if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
1121+
this.send(command, optionsOrCb || {}, cb);
1122+
} else {
1123+
return this.send(command, optionsOrCb);
1124+
}
1125+
}
1126+
10791127
/**
10801128
* <p>Removes the specified member Amazon Web Services account as a delegated administrator for the
10811129
* specified Amazon Web Services service.</p>
@@ -1375,6 +1423,39 @@ export class Organizations extends OrganizationsClient {
13751423
}
13761424
}
13771425

1426+
/**
1427+
* <p>Retrieves information about a resource policy.</p>
1428+
* <p>You can only call this operation from the organization's management account or by a member account that is a delegated administrator for an AWS service.</p>
1429+
*/
1430+
public describeResourcePolicy(
1431+
args: DescribeResourcePolicyCommandInput,
1432+
options?: __HttpHandlerOptions
1433+
): Promise<DescribeResourcePolicyCommandOutput>;
1434+
public describeResourcePolicy(
1435+
args: DescribeResourcePolicyCommandInput,
1436+
cb: (err: any, data?: DescribeResourcePolicyCommandOutput) => void
1437+
): void;
1438+
public describeResourcePolicy(
1439+
args: DescribeResourcePolicyCommandInput,
1440+
options: __HttpHandlerOptions,
1441+
cb: (err: any, data?: DescribeResourcePolicyCommandOutput) => void
1442+
): void;
1443+
public describeResourcePolicy(
1444+
args: DescribeResourcePolicyCommandInput,
1445+
optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: DescribeResourcePolicyCommandOutput) => void),
1446+
cb?: (err: any, data?: DescribeResourcePolicyCommandOutput) => void
1447+
): Promise<DescribeResourcePolicyCommandOutput> | void {
1448+
const command = new DescribeResourcePolicyCommand(args);
1449+
if (typeof optionsOrCb === "function") {
1450+
this.send(command, optionsOrCb);
1451+
} else if (typeof cb === "function") {
1452+
if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
1453+
this.send(command, optionsOrCb || {}, cb);
1454+
} else {
1455+
return this.send(command, optionsOrCb);
1456+
}
1457+
}
1458+
13781459
/**
13791460
* <p>Detaches a policy from a target root, organizational unit (OU), or account.</p>
13801461
* <important>
@@ -1622,7 +1703,7 @@ export class Organizations extends OrganizationsClient {
16221703
* Organizations with Other Amazon Web Services Services</a> in the
16231704
* <i>Organizations User Guide.</i>
16241705
* </p>
1625-
* <p>This operation can be called only from the organization's management account and only
1706+
* <p>You can only call this operation from the organization's management account and only
16261707
* if the organization has <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html">enabled all
16271708
* features</a>.</p>
16281709
*/
@@ -2554,6 +2635,39 @@ export class Organizations extends OrganizationsClient {
25542635
}
25552636
}
25562637

2638+
/**
2639+
* <p>Creates or updates a resource policy.</p>
2640+
* <p>You can only call this operation from the organization's management account.</p>
2641+
*/
2642+
public putResourcePolicy(
2643+
args: PutResourcePolicyCommandInput,
2644+
options?: __HttpHandlerOptions
2645+
): Promise<PutResourcePolicyCommandOutput>;
2646+
public putResourcePolicy(
2647+
args: PutResourcePolicyCommandInput,
2648+
cb: (err: any, data?: PutResourcePolicyCommandOutput) => void
2649+
): void;
2650+
public putResourcePolicy(
2651+
args: PutResourcePolicyCommandInput,
2652+
options: __HttpHandlerOptions,
2653+
cb: (err: any, data?: PutResourcePolicyCommandOutput) => void
2654+
): void;
2655+
public putResourcePolicy(
2656+
args: PutResourcePolicyCommandInput,
2657+
optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: PutResourcePolicyCommandOutput) => void),
2658+
cb?: (err: any, data?: PutResourcePolicyCommandOutput) => void
2659+
): Promise<PutResourcePolicyCommandOutput> | void {
2660+
const command = new PutResourcePolicyCommand(args);
2661+
if (typeof optionsOrCb === "function") {
2662+
this.send(command, optionsOrCb);
2663+
} else if (typeof cb === "function") {
2664+
if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
2665+
this.send(command, optionsOrCb || {}, cb);
2666+
} else {
2667+
return this.send(command, optionsOrCb);
2668+
}
2669+
}
2670+
25572671
/**
25582672
* <p>Enables the specified member account to administer the Organizations features of the specified
25592673
* Amazon Web Services service. It grants read-only access to Organizations service data. The account still

‎clients/client-organizations/src/OrganizationsClient.ts

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,10 @@ import {
6969
} from "./commands/DeleteOrganizationalUnitCommand";
7070
import { DeleteOrganizationCommandInput, DeleteOrganizationCommandOutput } from "./commands/DeleteOrganizationCommand";
7171
import { DeletePolicyCommandInput, DeletePolicyCommandOutput } from "./commands/DeletePolicyCommand";
72+
import {
73+
DeleteResourcePolicyCommandInput,
74+
DeleteResourcePolicyCommandOutput,
75+
} from "./commands/DeleteResourcePolicyCommand";
7276
import {
7377
DeregisterDelegatedAdministratorCommandInput,
7478
DeregisterDelegatedAdministratorCommandOutput,
@@ -92,6 +96,10 @@ import {
9296
DescribeOrganizationCommandOutput,
9397
} from "./commands/DescribeOrganizationCommand";
9498
import { DescribePolicyCommandInput, DescribePolicyCommandOutput } from "./commands/DescribePolicyCommand";
99+
import {
100+
DescribeResourcePolicyCommandInput,
101+
DescribeResourcePolicyCommandOutput,
102+
} from "./commands/DescribeResourcePolicyCommand";
95103
import { DetachPolicyCommandInput, DetachPolicyCommandOutput } from "./commands/DetachPolicyCommand";
96104
import {
97105
DisableAWSServiceAccessCommandInput,
@@ -159,6 +167,7 @@ import {
159167
ListTargetsForPolicyCommandOutput,
160168
} from "./commands/ListTargetsForPolicyCommand";
161169
import { MoveAccountCommandInput, MoveAccountCommandOutput } from "./commands/MoveAccountCommand";
170+
import { PutResourcePolicyCommandInput, PutResourcePolicyCommandOutput } from "./commands/PutResourcePolicyCommand";
162171
import {
163172
RegisterDelegatedAdministratorCommandInput,
164173
RegisterDelegatedAdministratorCommandOutput,
@@ -196,6 +205,7 @@ export type ServiceInputTypes =
196205
| DeleteOrganizationCommandInput
197206
| DeleteOrganizationalUnitCommandInput
198207
| DeletePolicyCommandInput
208+
| DeleteResourcePolicyCommandInput
199209
| DeregisterDelegatedAdministratorCommandInput
200210
| DescribeAccountCommandInput
201211
| DescribeCreateAccountStatusCommandInput
@@ -204,6 +214,7 @@ export type ServiceInputTypes =
204214
| DescribeOrganizationCommandInput
205215
| DescribeOrganizationalUnitCommandInput
206216
| DescribePolicyCommandInput
217+
| DescribeResourcePolicyCommandInput
207218
| DetachPolicyCommandInput
208219
| DisableAWSServiceAccessCommandInput
209220
| DisablePolicyTypeCommandInput
@@ -229,6 +240,7 @@ export type ServiceInputTypes =
229240
| ListTagsForResourceCommandInput
230241
| ListTargetsForPolicyCommandInput
231242
| MoveAccountCommandInput
243+
| PutResourcePolicyCommandInput
232244
| RegisterDelegatedAdministratorCommandInput
233245
| RemoveAccountFromOrganizationCommandInput
234246
| TagResourceCommandInput
@@ -250,6 +262,7 @@ export type ServiceOutputTypes =
250262
| DeleteOrganizationCommandOutput
251263
| DeleteOrganizationalUnitCommandOutput
252264
| DeletePolicyCommandOutput
265+
| DeleteResourcePolicyCommandOutput
253266
| DeregisterDelegatedAdministratorCommandOutput
254267
| DescribeAccountCommandOutput
255268
| DescribeCreateAccountStatusCommandOutput
@@ -258,6 +271,7 @@ export type ServiceOutputTypes =
258271
| DescribeOrganizationCommandOutput
259272
| DescribeOrganizationalUnitCommandOutput
260273
| DescribePolicyCommandOutput
274+
| DescribeResourcePolicyCommandOutput
261275
| DetachPolicyCommandOutput
262276
| DisableAWSServiceAccessCommandOutput
263277
| DisablePolicyTypeCommandOutput
@@ -283,6 +297,7 @@ export type ServiceOutputTypes =
283297
| ListTagsForResourceCommandOutput
284298
| ListTargetsForPolicyCommandOutput
285299
| MoveAccountCommandOutput
300+
| PutResourcePolicyCommandOutput
286301
| RegisterDelegatedAdministratorCommandOutput
287302
| RemoveAccountFromOrganizationCommandOutput
288303
| TagResourceCommandOutput

‎clients/client-organizations/src/commands/AcceptHandshakeCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ export interface AcceptHandshakeCommandOutput extends AcceptHandshakeResponse, _
3131
/**
3232
* <p>Sends a response to the originator of a handshake agreeing to the action proposed by
3333
* the handshake request.</p>
34-
* <p>This operation can be called only by the following principals when they also have the
34+
* <p>You can only call this operation by the following principals when they also have the
3535
* relevant IAM permissions:</p>
3636
* <ul>
3737
* <li>

‎clients/client-organizations/src/commands/CloseAccountCommand.ts

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,9 @@ export interface CloseAccountCommandOutput extends __MetadataBearer {}
6060
* grace period while the account is in SUSPENDED status. </p>
6161
* </li>
6262
* <li>
63-
* <p>If the Amazon Web Services account you attempt to close is linked to an Amazon Web Services GovCloud (US)
64-
* account, the <code>CloseAccount</code> request will close both accounts. To
65-
* learn important pre-closure details, see <a href="https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/Closing-govcloud-account.html">
63+
* <p>If the Amazon Web Services account you attempt to close is linked to an Amazon Web Services GovCloud
64+
* (US) account, the <code>CloseAccount</code> request will close both
65+
* accounts. To learn important pre-closure details, see <a href="https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/Closing-govcloud-account.html">
6666
* Closing an Amazon Web Services GovCloud (US) account</a> in the <i>
6767
* Amazon Web Services GovCloud User Guide</i>.</p>
6868
* </li>

‎clients/client-organizations/src/commands/CreateAccountCommand.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ export interface CreateAccountCommandOutput extends CreateAccountResponse, __Met
3737
* account. To check the status of the request, do one of the following:</p>
3838
* <ul>
3939
* <li>
40-
* <p>Use the <code>Id</code> member of the <code>CreateAccountStatus</code>
41-
* response element from this operation to provide as a parameter to the <a>DescribeCreateAccountStatus</a> operation.</p>
40+
* <p>Use the <code>Id</code> value of the <code>CreateAccountStatus</code> response
41+
* element from this operation to provide as a parameter to the <a>DescribeCreateAccountStatus</a> operation.</p>
4242
* </li>
4343
* <li>
4444
* <p>Check the CloudTrail log for the <code>CreateAccountResult</code> event. For

0 commit comments

Comments
 (0)