Add Property "OrganizationalUnitId" to all Resource Types

awslabs / aws-config-resource-schema

AWS Config resource schema define the properties and types of AWS Config resource configuration items (CIs). Resource CI schema are used by developers when performing advanced resource queries and when processing CI data.

Apache License 2.0

233 stars 60 forks source link

Add Property "OrganizationalUnitId" to all Resource Types #56

Open para0056 opened 1 month ago

para0056 commented 1 month ago

It would be incredibly useful to be able to filter resource queries based on the Organization Unit of the account where the resource resides.

iainelder commented 1 month ago

@para0056 , I agree, but I wouldn't expect that feature any time soon.

The resource schema doesn't even include the account name or its alias (#15), and that's just a simple 1:1 mapping.

The hierarchy of organizational units makes it more complex to model, especially given the limitations of the advanced query language.

iainelder commented 1 month ago

One possible workaround:

Use the Organizations APIs ListAccountsForParent and ListOrganizationalUnitsForParent to collect all the account IDs for a given ancestor OU
Add a filter to your query that includes all the account IDs: accountId IN ('1111', '2222', '3333', ...)