AWS Organizations

The AWS Organizations connector facilitates the management and retrieval of AWS account and organizational structure information.

AWS Organizations offers policy-based management for multiple AWS accounts. With the AWS Organizations Turbine Connector, users can automate account management and governance within the Swimlane platform. This connector enables the retrieval of detailed account information and organizational structure, streamlining compliance and oversight processes. By integrating with AWS Organizations, Swimlane Turbine users can enhance their security automation workflows, ensuring efficient management of AWS resources and policies across their enterprise.

Limitations

None to date.

Supported Versions

This connector supports the latest version of the AWS Organizations API.

Additional Docs

AWS Organizations API Docs

Configuration

Prerequisites

To utilize the AWS Organizations connector for Turbine, ensure you have the following:

AWS credentials for authentication with the necessary permissions to access AWS Organizations. These include:

Access Key: Your AWS access key ID.

Secret Key: Your AWS secret access key.

Region Name: The AWS region where your AWS Organizations is hosted.

Authentication Methods

To effectively utilize the AWS Organizations connector with Swimlane Turbine, ensure you have the following prerequisites:

AWS credentials authentication with the following parameters:

Access Key ID: Your unique AWS identifier key.

Secret Key: Your secret key for AWS API access.

Region Name: The AWS region your organization operates in.

Obtaining AWS Credentials

To manage multiple AWS accounts centrally, you can use AWS Organizations. This service helps you consolidate billing, apply policies, and automate account management across your environment.

To use this integration, you will need to enable and configure AWS Organizations in your AWS account by following the steps below:

If you have not already created an organization, click on Create organization and choose Enable all features.

Once the organization is created, you will be assigned a management account (formerly known as the master account).

To add member accounts:

Click Add an AWS account.

Choose to create a new account, invite an existing one, or add an account from an organization.

Provide the necessary details and follow the on-screen instructions.

Managing Organizational Units and Policies

AWS Organizations allows you to group accounts using Organizational Units (OUs) and apply Service Control Policies (SCPs) to manage permissions.

In the AWS Organizations console, navigate to the Organizational Units section.

Click Create organizational unit to define logical groupings of accounts.

Select an OU, then click on Policies to attach SCPs.

To create or attach a Service Control Policy:

Click Policies from the left-hand menu.

Choose Create policy and define your JSON policy document.

Attach the policy to an OU or directly to an account.

Permissions

To allow users or roles to manage AWS Organizations, specific permissions must be granted.

Open the IAM Management Console.

Navigate to the user or role that requires access.

Click on the Permissions tab and then click on the Add permissions button at the top-right of the permissions block.

Choose Attach policies, then search for and select AWSOrganizationsFullAccess.

Click Add permissions at the bottom-right corner.

If fine-grained permissions are needed, create a custom IAM policy using specific organizations:* actions depending on your use case.

Capabilities

This Connector provides the following capabilities:

Describe Account

Describe Organization

Describe Account

Retrieves AWS Organizations-related information about the specified account.

AWS Organizations's Documentation for this action can be found here.

Describe Organization

Retrieves information about the organization that the user's account belongs to.

AWS Organizations's Documentation for this action can be found here.

Configurations

AWS Organizations Authentication

Authenticates using AWS credentials

Configuration Parameters

Parameter	Description	Type	Required
access_key	AWS Access Key.	string	Required
secret_key	AWS Secret Key .	string	Required
region_name	The AWS Region where you want to create new connections	string	Required
role_arn	Optional Role ARN to assume. Leave blank unless tasks need to assume a different role.	string	Optional
external_id	External ID to assume IAM Role. Optional value used for assuming roles. Can be added, or removed in Trusted Relationships of target role.	string	Optional
session_token	Use if a session token is provided when switching roles	string	Optional
role_session_name	Defaults to SessionFromSwimlane_<HASH> when no value is provide	string	Optional

Actions

Describe Account

Retrieves detailed information about a specified AWS Organizations account using the AccountId.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
AccountId	string	Required	The unique identifier (ID) of the AWS account that you want information about.

Input Example

{"AccountId":"555555555555"}

Output

Parameter	Type	Description
Id	string	Unique identifier
Arn	string	Output field: Arn
Name	string	Name of the resource
Email	string	Output field: Email
JoinedMethod	string	HTTP method to use
JoinedTimeStamp	number	Output field: JoinedTimeStamp
Status	string	Status value

Output Example

{"Id":"555555555555","Arn":"arn:aws:organizations::111111111111:account/o-exampleorgid/555555555555","Name":"Beta account","Email":"[email protected]","JoinedMethod":"INVITED","JoinedTimeStamp":1481756563.134,"Status":"ACTIVE"}

Describe Organization

Retrieves information about the AWS Organization linked to the user's account, including its structure and service control policies.

Endpoint

Method: GET

Output

Parameter	Type	Description
MasterAccountArn	string	Output field: MasterAccountArn
MasterAccountEmail	string	Output field: MasterAccountEmail
MasterAccountId	string	Unique identifier
Id	string	Unique identifier
FeatureSet	string	Output field: FeatureSet
Arn	string	Output field: Arn
AvailablePolicyTypes	array	Type of the resource
AvailablePolicyTypes.Type	string	Type of the resource
AvailablePolicyTypes.Status	string	Type of the resource

Output Example

{"MasterAccountArn":"arn:aws:organizations::111111111111:account/o-exampleorgid/111111111111","MasterAccountEmail":"[email protected]","MasterAccountId":"111111111111","Id":"o-exampleorgid","FeatureSet":"ALL","Arn":"arn:aws:organizations::111111111111:organization/o-exampleorgid","AvailablePolicyTypes":[{"Type":"SERVICE_CONTROL_POLICY","Status":"ENABLED"}]}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT