{"id":24838647,"url":"https://github.com/plus3it/terraform-aws-tardigrade-org-centralized-root-access","last_synced_at":"2025-07-01T23:05:04.939Z","repository":{"id":271945640,"uuid":"914914222","full_name":"plus3it/terraform-aws-tardigrade-org-centralized-root-access","owner":"plus3it","description":"Terraform module to manage centralized root management in an AWS Organization","archived":false,"fork":false,"pushed_at":"2025-06-30T08:51:02.000Z","size":46,"stargazers_count":0,"open_issues_count":0,"forks_count":2,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-06-30T09:41:11.006Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/plus3it.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-01-10T15:12:54.000Z","updated_at":"2025-06-30T08:51:05.000Z","dependencies_parsed_at":"2025-01-10T23:24:09.905Z","dependency_job_id":"34599c1b-265a-4915-9b9e-bbec3c03205e","html_url":"https://github.com/plus3it/terraform-aws-tardigrade-org-centralized-root-access","commit_stats":null,"previous_names":["plus3it/terraform-aws-tardigrade-org-centralized-root-access"],"tags_count":1,"template":false,"template_full_name":"plus3it/repo-template","purl":"pkg:github/plus3it/terraform-aws-tardigrade-org-centralized-root-access","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-tardigrade-org-centralized-root-access","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-tardigrade-org-centralized-root-access/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-tardigrade-org-centralized-root-access/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-tardigrade-org-centralized-root-access/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/plus3it","download_url":"https://codeload.github.com/plus3it/terraform-aws-tardigrade-org-centralized-root-access/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/plus3it%2Fterraform-aws-tardigrade-org-centralized-root-access/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263047660,"owners_count":23405280,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-31T06:21:19.896Z","updated_at":"2025-07-01T23:05:04.893Z","avatar_url":"https://github.com/plus3it.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-tardigrade-org-centralized-root-access\n\nTerraform module to manage centralized root access for an AWS Organization.\n\nTo configure centralized root access for an AWS Organization, the Organization\nmust enable service access for the IAM principal, `iam.amazonaws.com`. Currently,\nthe Terraform AWS Provider does not have a resource that *only* enables service\naccess for an Organization. Therefore, it is up to the user to coordinate the enablement\nof IAM service access before using this module.\n\n\u003e NOTE: There is the resource `aws_organizations_organization`, which *can* enable\n\u003e service access. However, it expects *exclusive* control over all enabled services\n\u003e and features and other attributes of the resource. It cannot be used to enable\n\u003e *just* a single service, i.e. `iam.amazonaws.com`, while ignoring any other enabled\n\u003e or disabled service. Anything it is not configured to enable, it will disable!\n\u003e It is not appropriate to use this resource in a module like this one that is\n\u003e designed to manage a single Organization feature.\n\nTo determine if IAM service access is enabled for the Organization, run this command\nusing a credential for the AWS Organization account:\n\n```bash\naws organizations list-aws-service-access-for-organization --query 'EnabledServicePrincipals[? ServicePrincipal == `iam.amazonaws.com`]'\n```\n\nIf enabled, it will return something like:\n\n```bash\n[\n    {\n        \"ServicePrincipal\": \"iam.amazonaws.com\",\n        \"DateEnabled\": \"2025-01-10T14:30:07.609000-08:00\"\n    }\n]\n```\n\nIf not enabled, it will simply return an empty list:\n\n```bash\n[]\n```\n\nTo enable IAM service access for the AWS Organization, run this command:\n\n```bash\naws organizations enable-aws-service-access --service-principal iam.amazonaws.com\n```\n\n\u003c!-- BEGIN TFDOCS --\u003e\n## Requirements\n\nNo requirements.\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | n/a |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |\n| [aws_organizations_organization.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organization) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_org_centralized_root_access\"\u003e\u003c/a\u003e [org\\_centralized\\_root\\_access](#input\\_org\\_centralized\\_root\\_access) | Object containing configuration details to manage centralized root access for the AWS Organization | \u003cpre\u003eobject({\u003cbr/\u003e    organization_features = optional(object({\u003cbr/\u003e      enabled_features = optional(list(string), [\"RootCredentialsManagement\", \"RootSessions\"])\u003cbr/\u003e    }), {})\u003cbr/\u003e\u003cbr/\u003e    delegated_administrator = optional(object({\u003cbr/\u003e      account_id = string\u003cbr/\u003e    }))\u003cbr/\u003e  })\u003c/pre\u003e | `{}` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_iam_organizations_features\"\u003e\u003c/a\u003e [iam\\_organizations\\_features](#output\\_iam\\_organizations\\_features) | Object with attributes of the AWS IAM Organizations features |\n| \u003ca name=\"output_organizations_delegated_administrator\"\u003e\u003c/a\u003e [organizations\\_delegated\\_administrator](#output\\_organizations\\_delegated\\_administrator) | Object with attributes of the AWS Organizations delegated administrator |\n\n\u003c!-- END TFDOCS --\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fterraform-aws-tardigrade-org-centralized-root-access","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplus3it%2Fterraform-aws-tardigrade-org-centralized-root-access","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplus3it%2Fterraform-aws-tardigrade-org-centralized-root-access/lists"}