IaC Bazaar
Browse modules
Menu
AWSStatic-verified

Organizations, OUs and Service Control Policies

The organization, its organizational units, member accounts and the service control policies attached to them. Root attachment is off by default, because an SCP sets the ceiling on what anybody may do - including the account root user who would have to undo it.

terraformAWSaws
aws-organizationsvizier v1.2.0

Verification

Static-verified

Passed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan pending (Checkov)
  • Plan tests (mocked: validation rules · outputs)

Provenance

  • SHA-256 checksum
  • Signature (pending)

Functional

  • Live test pending (no cloud run yet)

Last verified 2026-09-12 · how we verify

Use it from the registry

terraform · opentofu
module "organizations" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-organizations/aws"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

aws-organizations

The organization, its organizational units, member accounts and service control policies. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

Read this before attaching a policy to the root. A service control policy sets the ceiling on what anybody in an account may do - including that account's root user. A deny attached at the organization root covering iam:* cannot be undone from the account it locked, because undoing it is also denied. Only the management account is exempt, and that exemption is the sole reason the mistake is recoverable.

So attach_to_root is off by default and documented where you set it, and the example attaches to an OU instead: a mistake there locks one branch of the tree rather than the whole organization.

Other things worth knowing:

  • An account created here cannot be deleted by Terraform. AWS closes accounts rather than deleting them, and a closed one still counts against the organization's quota for 90 days. close_on_deletion decides whether destroy closes it or leaves it alone
  • Each account needs an email address unique across all of AWS, not just your organization
  • service_access_principals is explicit: each entry hands that AWS service the ability to create roles in every member account

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Usage
Create a free accountSign in