AWS - Organizations

Manage Amazon Web Services accounts and their resources.

Identity and Access Management · AWS Organizations

Details

IDAWS - Organizations
ProviderAmazon
CategoryIdentity and Access Management
From Version6.10.0
Docker Imagedemisto/boto3py3:1.0.0.10221838
Supported ModulesAgentix XSIAM

README

Manage Amazon Web Services accounts and their resources.
For AWS Organizations quotas, guidelines and restrictions, see the AWS Organizations Quotas page.

Configure AWS - Organizations in Cortex

Parameter Description Required
Role Arn The Amazon Resource Name (ARN) of the role to assume. False
Role Session Name An identifier for the assumed role session. False
Role Session Duration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. False
Access Key   False
Secret Key   False
Timeout The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used. False
Retries The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time. False
Trust any certificate (not secure)   False
Use system proxy settings   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

aws-org-root-list

List the roots that are defined in the current organization.

Base Command

aws-org-root-list

Input

Argument Name Description Required
limit The number of roots to return. Default is 50. Optional
page_size The number of roots to return per page. The maximum is 1000. Optional
next_token The token denoting the next page of roots, as given by the response of the previous run of this command under the context key “AWS.Organizations.RootNextToken”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Root.Id String The unique identifier (ID) of the root.
AWS.Organizations.Root.Arn String The Amazon Resource Name (ARN) of the root.
AWS.Organizations.Root.Name String The friendly name of the root.
AWS.Organizations.Root.PolicyTypes.Type String The name of the policy type.
AWS.Organizations.Root.PolicyTypes.Status String The status of the policy type as it relates to the associated root.
AWS.Organizations.RootNextToken String If not null, indicates that more output is available than is included in the current response. Use this value in the next_token argument in a subsequent call of the command to get the next part of the output.

Command example


#### Context Example

```json
{
    "AWS": {
        "Organizations": {
            "Root": {
                "Arn": "arn:aws:organizations::111222333444:root/o-abcde12345/r-ab12",
                "Id": "r-ab12",
                "Name": "Root",
                "PolicyTypes": [
                    {
                        "Status": "ENABLED",
                        "Type": "BACKUP_POLICY"
                    },
                    {
                        "Status": "ENABLED",
                        "Type": "SERVICE_CONTROL_POLICY"
                    }
                ]
            },
            "RootNextToken": null
        }
    }
}

Human Readable Output

AWS Organization Roots

Id Arn Name
r-ab12 arn:aws:organizations::111222333444:root/o-abcde12345/r-ab12 Root

aws-org-children-list

List all of the organizational units (OUs) or accounts that are contained in the specified parent OU or root.

Base Command

aws-org-children-list

Input

Argument Name Description Required
parent_id The unique identifier (ID) for the parent root or organizational unit whose children are to be listed. Required
child_type Filters the output to include only the specified child type. Possible values are: Account, OrganizationalUnit. Required
limit The number of children to return. Default is 50. Optional
page_size The number of children to return per page. The maximum is 1000. Optional
next_token The token denoting the next page of children as given by the response of the previous run of this command under the context key “AWS.Organizations.ChildrenNextToken”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Children.Id String The unique identifier (ID) of the child entity.
AWS.Organizations.Children.Type String The type of the child entity.
AWS.Organizations.Children.ParentId String The unique identifier (ID) for the parent root or organizational unit of the child entity.
AWS.Organizations.ChildrenNextToken String If not null, indicates that more output is available than is included in the current response. Use this value in the next_token argument in a subsequent call of the command to get the next part of the output.

Command example

!aws-org-children-list parent_id="r-ab12" child_type="OrganizationalUnit"

Context Example

{
    "AWS": {
        "Organizations": {
            "Children": {
                "Id": "ou-ab12-abcd1234",
                "ParentId": "r-ab12",
                "Type": "ORGANIZATIONAL_UNIT"
            },
            "ChildrenNextToken": null
        }
    }
}

Human Readable Output

AWS Account r-ab12 Children

Id Type
ou-ab12-abcd1234 ORGANIZATIONAL_UNIT

aws-org-parent-list

Lists all of the organizational units (OUs) or accounts that are a parent OU or root of the specified child.
This command returns only the immediate parents in the hierarchy.

Base Command

aws-org-parent-list

Input

Argument Name Description Required
child_id The unique identifier (ID) of the organizational unit or account whose parent containers you want to list. Don’t specify a root.
This value can be retrieved by running the command “aws-org-account-list”.		 Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Parent.Id String The unique identifier (ID) of the parent entity.
AWS.Organizations.Parent.Type String The type of the parent entity.
AWS.Organizations.Parent.ChildId String The unique identifier (ID) of the organizational unit or account of the child of the parent entity.

Command example

!aws-org-parent-list child_id="ou-ab12-abcd1234"

Context Example

{
    "AWS": {
        "Organizations": {
            "Parent": {
                "ChildId": "ou-ab12-abcd1234",
                "Id": "r-ab12",
                "Type": "ROOT"
            }
        }
    }
}

Human Readable Output

AWS Account ou-ab12-abcd1234 Parent

Id Type
r-ab12 ROOT

aws-org-organization-unit-get

Retrieve information about an organizational unit (OU).
This command can be called only from the organization’s management account or by a member account that is a delegated administrator for an Amazon Web Services service.

Base Command

aws-org-organization-unit-get

Input

Argument Name Description Required
organization_unit_id The unique identifier (ID) of the organizational unit to retrieve details about. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.OrganizationUnit.Id String The unique identifier (ID) associated with the organizational unit.
AWS.Organizations.OrganizationUnit.Arn String The Amazon Resource Name (ARN) of the organizational unit.
AWS.Organizations.OrganizationUnit.Name String The friendly name of the organizational unit.

Command example

!aws-org-organization-unit-get organization_unit_id=ou-ab12-abcd1234

Context Example

{
    "AWS": {
        "Organizations": {
            "OrganizationUnit": {
                "Arn": "arn:aws:organizations::111222333444:ou/o-abcde12345/ou-ab12-abcd1234",
                "Id": "ou-ab12-abcd1234",
                "Name": "Name OU"
            }
        }
    }
}

Human Readable Output

AWS Organization Unit

Id Arn Name
ou-ab12-abcd1234 arn:aws:organizations::111222333444:ou/o-abcde12345/ou-ab12-abcd1234 Name OU

aws-org-account-list

Lists all the accounts in the organization or a specific account by ID.

Base Command

aws-org-account-list

Input

Argument Name Description Required
account_id Get a specific account by ID. Optional
limit The number of accounts to return. Default is 50. Optional
page_size The number of accounts to return per page. The maximum is 1000. Optional
next_token The token denoting the next page of accounts, as given by the response of the previous run of this command under the context key “AWS.Organizations.AccountNextToken”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Account.Id String The unique identifier (ID) of the account.
AWS.Organizations.Account.Arn String The Amazon Resource Name (ARN) of the account.
AWS.Organizations.Account.Email String The email address associated with the Amazon Web Services account.
AWS.Organizations.Account.Name String The friendly name of the account.
AWS.Organizations.Account.Status String The status of the account in the organization.
AWS.Organizations.Account.JoinedMethod String The method by which the account joined the organization.
AWS.Organizations.Account.JoinedTimestamp Date The date the account became a part of the organization.
AWS.Organizations.AccountNextToken String If not null, indicates that more output is available than is included in the current response. Use this value in the next_token argument in a subsequent call of the command to get the next part of the output.

Command example

!aws-org-account-list account_id=111222333444

Context Example

{
    "AWS": {
        "Organizations": {
            "Account": {
                "Arn": "arn:aws:organizations::111222333444:account/o-abcde12345/111222333444",
                "Email": "user@xsoar.com",
                "Id": "111222333444",
                "JoinedMethod": "CREATED",
                "JoinedTimestamp": "2023-09-04 09:17:14.299000+00:00",
                "Name": "Name",
                "Status": "ACTIVE"
            }
        }
    }
}

Human Readable Output

AWS Organization Accounts

Id Arn Name Email JoinedMethod JoinedTimestamp Status
111222333444 arn:aws:organizations::111222333444:account/o-abcde12345/111222333444 Name user@xsoar.com CREATED 2023-09-04 09:17:14.299000+00:00 ACTIVE

Command example

Human Readable Output

AWS Organization Accounts

Id Arn Name Email JoinedMethod JoinedTimestamp Status
111222333444 arn:aws:organizations::111222333444:account/o-abcde12345/111222333444 Name user@xsoar.com CREATED 2023-09-04 09:17:14.299000+00:00 ACTIVE
111222333444 arn:aws:organizations::111222333444:account/o-abcde12345/111222333444 john-doe user@xsoar.com INVITED 2022-07-25 09:11:23.528000+00:00 SUSPENDED

aws-org-organization-get

Retrieves information about the organization that the user’s account belongs to.

Base Command

aws-org-organization-get

Input

Argument Name Description Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Organization.Id String The unique identifier (ID) of the organization.
AWS.Organizations.Organization.Arn String The Amazon Resource Name (ARN) of the organization.
AWS.Organizations.Organization.FeatureSet String Specifies the functionality that currently is available to the organization. If set to “ALL”, then all features are enabled and policies can be applied to accounts in the organization. If set to “CONSOLIDATED_BILLING”, then only consolidated billing functionality is available.
AWS.Organizations.Organization.MasterAccountArn String The Amazon Resource Name (ARN) of the account that is designated as the management account for the organization.
AWS.Organizations.Organization.MasterAccountId String The unique identifier (ID) of the management account of the organization.
AWS.Organizations.Organization.MasterAccountEmail String The email address that is associated with the Amazon Web Services account that is designated as the management account for the organization.

Command example


#### Context Example

```json
{
    "AWS": {
        "Organizations": {
            "Organization": {
                "Arn": "arn:aws:organizations::111222333444:organization/o-abcde12345",
                "AvailablePolicyTypes": [
                    {
                        "Status": "ENABLED",
                        "Type": "SERVICE_CONTROL_POLICY"
                    }
                ],
                "FeatureSet": "ALL",
                "Id": "o-abcde12345",
                "MasterAccountArn": "arn:aws:organizations::111222333444:account/o-abcde12345/111222333444",
                "MasterAccountEmail": "user@xsoar.com",
                "MasterAccountId": "111222333444"
            }
        }
    }
}

Human Readable Output

AWS Organization

Id Arn FeatureSet MasterAccountArn MasterAccountId MasterAccountEmail
o-abcde12345 arn:aws:organizations::111222333444:organization/o-abcde12345 ALL arn:aws:organizations::111222333444:account/o-abcde12345/111222333444 111222333444 user@xsoar.com

aws-org-organization-unit-create

Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables the organization of accounts to apply policies according to business requirements. The number of levels deep that OUs can be nested is dependent upon the policy types enabled for that root. For service control policies, the limit is five.

Base Command

aws-org-organization-unit-create

Input

Argument Name Description Required
name The friendly name to assign to the new organizational unit. Required
parent_id The unique identifier (ID) of the parent root or organizational unit to create the new organizational unit in. This value can be retrieved by running the command “aws-org-root-list”. Required
tags A comma-separated list of tags to attach to the newly created organizational unit. Each tag should be in the format: “key=value”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.OrganizationUnit.Id String The unique identifier (ID) associated with this organizational unit.
AWS.Organizations.OrganizationUnit.Arn String The Amazon Resource Name (ARN) of this organizational unit.
AWS.Organizations.OrganizationUnit.Name String The friendly name of this organizational unit.

Command example

!aws-org-organization-unit-create name=test parent_id=r-12ab tags="new=true,key=value"

Context Example

{
    "AWS": {
        "Organizations": {
            "OrganizationUnit": {
                "Arn": "arn:aws:organizations::111222333444:ou/o-abcde12345/ou-ab12-abcd1234",
                "Id": "ou-ab12-abcd1234",
                "Name": "test"
            }
        }
    }
}

Human Readable Output

AWS Organization Unit

Id Name Arn
ou-ab12-abcd1234 test arn:aws:organizations::111222333444:ou/o-abcde12345/ou-ab12-abcd1234

aws-org-organization-unit-rename

Renames the specified organizational unit (OU). The ID and ARN don’t change. The child OUs and accounts remain in place, and any attached policies of the OU remain attached.

Base Command

aws-org-organization-unit-rename

Input

Argument Name Description Required
organizational_unit_id The unique identifier (ID) of the OU to rename. This value can be retrieved by running the command “aws-org-parent-list”. Required
name The new name to assign to the organizational unit. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-organization-unit-rename name=new_name organizational_unit_id=ou-ab12-abcd1234

Human Readable Output

AWS organization unit ou-ab12-abcd1234 successfully renamed to new_name.

aws-org-organization-unit-delete

Deletes an organizational unit (OU) from a root or another OU. All accounts and child OUs must first be removed.

Base Command

aws-org-organization-unit-delete

Input

Argument Name Description Required
organizational_unit_id The unique identifier (ID) of the organizational unit that you want to delete. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-organization-unit-delete organizational_unit_id=ou-ab12-abcd1234

Human Readable Output

AWS organizational unit ou-ab12-abcd1234 deleted successfully.

aws-org-policy-list

Retrieves the list of all policies in an organization of a specified type.

Base Command

aws-org-policy-list

Input

Argument Name Description Required
policy_type Specifies the type of policy to include in the response. Possible values are: Service Control Policy, Tag Policy, Backup Policy, AI Services Opt Out Policy. Required
limit The number of policies to return. Default is 50. Optional
page_size The number of policies to return per page. The maximum is 1000. Optional
next_token The token denoting the next page of policies, as given by the response of the previous run of this command under the context key “AWS.Organizations.PolicyNextToken”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Policy.Id String The unique identifier (ID) of the policy.
AWS.Organizations.Policy.Arn String The Amazon Resource Name (ARN) of the policy.
AWS.Organizations.Policy.Name String The friendly name of the policy.
AWS.Organizations.Policy.Description String The description of the policy.
AWS.Organizations.Policy.Type String The type of policy.
AWS.Organizations.Policy.AwsManaged Boolean Indicates whether the specified policy is an Amazon Web Services managed policy. If true, the policy can be attached to roots, organizational units, or accounts, but cannot be edited.
AWS.Organizations.PolicyNextToken String If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.

Command example

!aws-org-policy-list policy_type="Service Control Policy"

Context Example

{
    "AWS": {
        "Organizations": {
            "Policy": [
                {
                    "Arn": "arn:aws:organizations::aws:policy/service_control_policy/p-FullAWSAccess",
                    "AwsManaged": true,
                    "Description": "Allows access to every operation",
                    "Id": "p-FullAWSAccess",
                    "Name": "FullAWSAccess",
                    "Type": "SERVICE_CONTROL_POLICY"
                },
                {
                    "Arn": "arn:aws:organizations::111222333444:policy/o-abcde12345/service_control_policy/p-1234abcd",
                    "AwsManaged": false,
                    "Description": "Used for test purposes",
                    "Id": "p-1234abcd",
                    "Name": "Test",
                    "Type": "SERVICE_CONTROL_POLICY"
                }
            ],
            "PolicyNextToken": null
        }
    }
}

Human Readable Output

AWS Organization Policies

Id Arn Name Description Type AwsManaged
p-FullAWSAccess arn:aws:organizations::aws:policy/service_control_policy/p-FullAWSAccess FullAWSAccess Allows access to every operation SERVICE_CONTROL_POLICY true
p-1234abcd arn:aws:organizations::111222333444:policy/o-abcde12345/service_control_policy/p-1234abcd Test Used for test purposes SERVICE_CONTROL_POLICY false

aws-org-policy-get

Retrieves information about a policy.

Base Command

aws-org-policy-get

Input

Argument Name Description Required
policy_id The unique identifier (ID) of the policy that you want details about. This value can be retrieved by running the command “aws-org-policy-list”. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Policy.Id String The unique identifier (ID) of the policy.
AWS.Organizations.Policy.Arn String The Amazon Resource Name (ARN) of the policy.
AWS.Organizations.Policy.Name String The friendly name of the policy.
AWS.Organizations.Policy.Description String The description of the policy.
AWS.Organizations.Policy.Type String The type of policy.
AWS.Organizations.Policy.AwsManaged Boolean Indicates whether the specified policy is an Amazon Web Services managed policy. If true, the policy can be attached to roots, organizational units, or accounts, but cannot be edited.

Command example

!aws-org-policy-get policy_id=p-1234abcd

Context Example

{
    "AWS": {
        "Organizations": {
            "Policy": {
                "Arn": "arn:aws:organizations::111222333444:policy/o-abcde12345/service_control_policy/p-1234abcd",
                "AwsManaged": false,
                "Description": "Used for test purposes",
                "Id": "p-1234abcd",
                "Name": "Test",
                "Type": "SERVICE_CONTROL_POLICY"
            }
        }
    }
}

Human Readable Output

AWS Organization Policies

Id Arn Name Description Type AwsManaged
p-1234abcd arn:aws:organizations::111222333444:policy/o-abcde12345/service_control_policy/p-1234abcd Test Used for test purposes SERVICE_CONTROL_POLICY false

aws-org-policy-attach

Attaches a policy to a root, an organizational unit (OU), or an individual account.

Base Command

aws-org-policy-attach

Input

Argument Name Description Required
policy_id The unique identifier (ID) of the policy to attach to the target. This value can be retrieved by running the command “aws-org-policy-list”. Required
target_id The unique identifier (ID) of the root, organizational unit, or account to attach the policy to. This value can be retrieved by running the command “aws-org-root-list” or “aws-org-account-list”. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-policy-attach policy_id=p-1234abcd target_id=ou-ab12-abcd1234

Human Readable Output

AWS Organizations policy p-1234abcd successfully attached.

aws-org-policy-target-list

Lists all the roots, organizational units (OUs), and accounts that the specified policy is attached to.

Base Command

aws-org-policy-target-list

Input

Argument Name Description Required
policy_id The unique identifier (ID) of the policy whose attachments are to be listed. Required
limit The number of policies to return. Default is 50. Optional
page_size The number of policies to return per page. The maximum is 1000. Optional
next_token The token denoting the next page of policies, as given by the response of the previous run of this command under the context key “AWS.Organizations.PolicyTargetNextToken”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.PolicyTarget.TargetId String The unique identifier (ID) of the policy target.
AWS.Organizations.PolicyTarget.Arn String The Amazon Resource Name (ARN) of the policy target.
AWS.Organizations.PolicyTarget.Name String The friendly name of the policy target.
AWS.Organizations.PolicyTarget.Type String The type of the policy target.
AWS.Organizations.PolicyTarget.PolicyId String The unique identifier (ID) of the policy.
AWS.Organizations.PolicyTargetNextToken String If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.

Command example

!aws-org-policy-target-list policy_id=p-1234abcd

Context Example

{
    "AWS": {
        "Organizations": {
            "PolicyTarget": {
                "Arn": "arn:aws:organizations::111222333444:ou/o-abcde12345/ou-ab12-abcd1234",
                "Name": "to_add_policy",
                "PolicyId": "p-1234abcd",
                "TargetId": "ou-ab12-abcd1234",
                "Type": "ORGANIZATIONAL_UNIT"
            },
            "PolicyTargetNextToken": null
        }
    }
}

Human Readable Output

AWS Organization p-1234abcd Targets

TargetId Arn Name Type
ou-ab12-abcd1234 arn:aws:organizations::111222333444:ou/o-abcde12345/ou-ab12-abcd1234 to_add_policy ORGANIZATIONAL_UNIT

aws-org-target-policy-list

Lists the policies that are directly attached to the specified target root, organizational unit (OU), or account.

Base Command

aws-org-target-policy-list

Input

Argument Name Description Required
policy_type The type of policy to include in the returned list. Possible values are: Service Control Policy, Tag Policy, Backup Policy, AI Services Opt Out Policy. Required
target_id The unique identifier (ID) of the root, organizational unit, or account whose policies are to be listed. Required
limit The number of policies to return. Default is 50. Optional
page_size The number of policies to return per page. The maximum is 1000. Optional
next_token The token denoting the next page of policies, as given by the response of the previous run of this command under the context key “AWS.Organizations.PolicyNextToken”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.TargetPolicy.Id String The unique identifier (ID) of the policy.
AWS.Organizations.TargetPolicy.Arn String The Amazon Resource Name (ARN) of the policy.
AWS.Organizations.TargetPolicy.Name String The friendly name of the policy.
AWS.Organizations.TargetPolicy.Description String The description of the policy.
AWS.Organizations.TargetPolicy.Type String The type of policy.
AWS.Organizations.TargetPolicy.AwsManaged Boolean Indicates whether the specified policy is an Amazon Web Services managed policy. If true, the policy can be attached to roots, organizational units, or accounts, but cannot be edited.
AWS.Organizations.TargetId String The unique identifier (ID) of the target.
AWS.Organizations.TargetPolicyNextToken String If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.

Command example

!aws-org-target-policy-list target_id=ou-ab12-abcd1234 policy_type="Service Control Policy"

Context Example

{
    "AWS": {
        "Organizations": {
            "TargetPolicy": [
                {
                    "Arn": "arn:aws:organizations::111222333444:policy/o-abcde12345/service_control_policy/p-1234abcd",
                    "AwsManaged": false,
                    "Description": "Used for test purposes",
                    "Id": "p-1234abcd",
                    "Name": "Test",
                    "TargetId": "ou-ab12-abcd1234",
                    "Type": "SERVICE_CONTROL_POLICY"
                },
                {
                    "Arn": "arn:aws:organizations::aws:policy/service_control_policy/p-FullAWSAccess",
                    "AwsManaged": true,
                    "Description": "Allows access to every operation",
                    "Id": "p-FullAWSAccess",
                    "Name": "FullAWSAccess",
                    "TargetId": "ou-ab12-abcd1234",
                    "Type": "SERVICE_CONTROL_POLICY"
                }
            ],
            "TargetPolicyNextToken": null
        }
    }
}

Human Readable Output

AWS Organization ou-ab12-abcd1234 Policies

Id Arn Name Description Type AwsManaged
p-1234abcd arn:aws:organizations::111222333444:policy/o-abcde12345/service_control_policy/p-1234abcd Test Used for test purposes SERVICE_CONTROL_POLICY false
p-FullAWSAccess arn:aws:organizations::aws:policy/service_control_policy/p-FullAWSAccess FullAWSAccess Allows access to every operation SERVICE_CONTROL_POLICY true

aws-org-policy-delete

Deletes the specified policy from the organization. Before performing this operation, the policy must be detached from all organizational units (OUs), roots, and accounts.

Base Command

aws-org-policy-delete

Input

Argument Name Description Required
policy_id The unique identifier (ID) of the policy that you want to delete. This value can be retrieved by running the command “aws-org-policy-list”. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-policy-delete policy_id=p-1234abcd

Human Readable Output

AWS Organizations policy p-1234abcd successfully deleted.

aws-org-resource-tag-add

Adds one or more tags to the specified resource.

Base Command

aws-org-resource-tag-add

Input

Argument Name Description Required
resource_id The ID of the resource to add a tag to. This value can be retrieved by running the command “aws-org-root-list”, “aws-org-account-list”, “aws-org-root-list”, or “aws-org-policy-list”. Required
tags A comma-separated list of tags to attach to the resource. Each tag should be in the format: “key=value”. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-resource-tag-add resource_id=ou-ab12-abcd1234 tags="test=true,key=value"

Human Readable Output

AWS Organizations resource ou-ab12-abcd1234 successfully tagged.

aws-org-resource-tag-list

Lists tags that are attached to the specified resource.

Base Command

aws-org-resource-tag-list

Input

Argument Name Description Required
resource_id The ID of the resource with the tags to list. This value can be retrieved by running the command “aws-org-root-list”, “aws-org-account-list”, “aws-org-root-list”, or “aws-org-policy-list”. Required
next_token The token denoting the next page of tags, as given by the response of the previous run of this command under the context key “AWS.Organizations.TagNextToken”. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Tag.Key String The key identifier, or name, of the tag.
AWS.Organizations.Tag.Value String The string value that’s associated with the key of the tag.
AWS.Organizations.Tag.ResourceId String The unique identifier (ID) of the resource.
AWS.Organizations.TagNextToken String If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.

Command example

!aws-org-resource-tag-list resource_id=ou-ab12-abcd1234

Context Example

{
    "AWS": {
        "Organizations": {
            "Tag": [
                {
                    "Key": "test",
                    "ResourceId": "ou-ab12-abcd1234",
                    "Value": "true"
                },
                {
                    "Key": "new",
                    "ResourceId": "ou-ab12-abcd1234",
                    "Value": "true"
                },
                {
                    "Key": "key",
                    "ResourceId": "ou-ab12-abcd1234",
                    "Value": "value"
                }
            ],
            "TagNextToken": null
        }
    }
}

Human Readable Output

AWS Organization ou-ab12-abcd1234 Tags

Key Value
test true
new true
key value

aws-org-account-create

Creates an AWS Account that is automatically a member of the organization.

Base Command

aws-org-account-create

Input

Argument Name Description Required
account_name The friendly name of the member account. Required
email The email address of the owner to assign to the new member account. This email address must not already be associated with another Amazon Web Services account. Use a valid email address to complete account creation. Required
iam_user_access_to_billing If set to ALLOW, the new account enables IAM users to access account billing information if they have the required permissions. If set to DENY, only the root user of the new account can access account billing information. Possible values are: Allow, Deny. Default is Allow. Optional
role_name The name of an IAM role that AWS Organizations automatically pre-configures in the new member account. This role trusts the management account, allowing users in the management account to assume the role, as permitted by the management account administrator. The role has administrator permissions in the new member account. Default is OrganizationAccountAccessRole. Optional
tags A comma-separated list of tags to attach to the newly created account. Each tag should be in the format: “key=value”. Optional
request_id The ID of the create request that is used for polling. Optional
interval_in_seconds Indicates how long to wait between command executions (in seconds) when the ‘polling’ argument is true. Minimum value is 10 seconds. Default is 30. Optional
timeout Indicates the time in seconds until the polling sequence times out. Default is 600. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

Path Type Description
AWS.Organizations.Account.Id String The unique identifier (ID) of the account.
AWS.Organizations.Account.Arn String The Amazon Resource Name (ARN) of the account.
AWS.Organizations.Account.Email String The email address associated with the Amazon Web Services account.
AWS.Organizations.Account.Name String The friendly name of the account.
AWS.Organizations.Account.Status String The status of the account in the organization.
AWS.Organizations.Account.JoinedMethod String The method by which the account joined the organization.
AWS.Organizations.Account.JoinedTimestamp Date The date the account became a part of the organization.

Command example

!aws-org-account-create account_name="New" email="user@xsoar.com" tags="new=true,test=yes" iam_user_access_to_billing=Deny

Context Example

{
    "AWS": {
        "Organizations": {
            "Account": {
                "Arn": "arn:aws:organizations::111222333444:account/o-abcde12345/111222333444",
                "Email": "user@xsoar.com",
                "Id": "111222333444",
                "JoinedMethod": "CREATED",
                "JoinedTimestamp": "2023-09-04 09:17:14.299000+00:00",
                "Name": "New",
                "Status": "ACTIVE"
            }
        }
    }
}

Human Readable Output

Creating account:

AWS Organization Accounts

Id Arn Name Email JoinedMethod JoinedTimestamp Status
111222333444 arn:aws:organizations::111222333444:account/o-abcde12345/111222333444 New user@xsoar.com CREATED 2023-09-04 09:17:14.299000+00:00 ACTIVE

aws-org-account-move

Moves an account from one parent to another.

Base Command

aws-org-account-move

Input

Argument Name Description Required
account_id The unique identifier (ID) of the member account move. This value can be retrieved by running the command “aws-org-account-list”. Required
destination_parent_id The unique identifier (ID) of the root or organizational unit to move the account to.
This value can be retrieved by running the command “aws-org-root-list”.
.		 Required
source_parent_id The unique identifier (ID) of the root or organizational unit to move the account from.
This value can be retrieved by running the command “aws-org-parent-list” with the child_id set to the account_id.
.		 Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-account-move source_parent_id=r-12ab account_id=111222333444 destination_parent_id=ou-ab12-abcd1234

Human Readable Output

AWS account 111222333444 moved successfully.

aws-org-account-remove

Removes an account from the organization.
For more information on this action: https://docs.aws.amazon.com/organizations/latest/APIReference/API_RemoveAccountFromOrganization.html

Base Command

aws-org-account-remove

Input

Argument Name Description Required
account_id The unique identifier (ID) of the member account to be removed from the organization. This can be obtained with the command “aws-organizations-account-list”. Required
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-account-remove account_id=111222333444

Human Readable Output

AWS account 111222333444 removed successfully.

aws-org-account-close

Closes an AWS member account within an organization.

Base Command

aws-org-account-close

Input

Argument Name Description Required
account_id The unique identifier (ID) of the member account to close. This can be obtained with the command “aws-organizations-account-list”. Required
interval_in_seconds Indicates how long to wait between command executions (in seconds) when the ‘polling’ argument is true. Minimum value is 10 seconds. Default is 30. Optional
timeout Indicates the time in seconds until the polling sequence times out. Default is 600. Optional
roleArn The Amazon Resource Name (ARN) of the role to assume. Optional
roleSessionName An identifier for the assumed role session. Optional
roleSessionDuration The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role. Optional

Context Output

There is no context output for this command.

Command example

!aws-org-account-close account_id=111222333444

Human Readable Output

Closing account:

AWS account 111222333444 closed successfully.

Configuration parameters

  • role_arn — Role Arn
  • role_session_name — Role Session Name
  • role_session_duration — Role Session Duration
  • credentials — Access Key
  • timeout — Timeout
  • retries — Retries
  • sts_regional_endpoint — AWS STS Regional Endpoints
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (21)

  • aws-org-account-close

    Closes an AWS member account within an organization.

  • aws-org-account-create

    Creates an AWS Account that is automatically a member of the organization.

  • aws-org-account-list

    Lists all the accounts in the organization or a specific account by ID.

  • aws-org-account-move

    Moves an account from one parent to another.

  • aws-org-account-remove

    Removes an account from the organization. For more information on this action: https://docs.aws.amazon.com/organizations/latest/APIReference/API_RemoveAccountFromOrganization.html

  • aws-org-children-list

    List all of the organizational units (OUs) or accounts that are contained in the specified parent OU or root.

  • aws-org-organization-get

    Retrieves information about the organization that the user's account belongs to.

  • aws-org-organization-unit-create

    Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables the organization of accounts to apply policies according to business requirements. The number of levels deep that OUs can be nested is dependent upon the policy types enabled for that root. For service control policies, the limit is five.

  • aws-org-organization-unit-delete

    Deletes an organizational unit (OU) from a root or another OU. All accounts and child OUs must first be removed.

  • aws-org-organization-unit-get

    Retrieve information about an organizational unit (OU). This command can be called only from the organization's management account or by a member account that is a delegated administrator for an Amazon Web Services service.

  • aws-org-organization-unit-rename

    Renames the specified organizational unit (OU). The ID and ARN don't change. The child OUs and accounts remain in place, and any attached policies of the OU remain attached.

  • aws-org-parent-list

    Lists all of the organizational units (OUs) or accounts that are a parent OU or root of the specified child. This command returns only the immediate parents in the hierarchy.

  • aws-org-policy-attach

    Attaches a policy to a root, an organizational unit (OU), or an individual account.

  • aws-org-policy-delete

    Deletes the specified policy from the organization. Before performing this operation, the policy must be detached from all organizational units (OUs), roots, and accounts.

  • aws-org-policy-get

    Retrieves information about a policy.

  • aws-org-policy-list

    Retrieves the list of all policies in an organization of a specified type.

  • aws-org-policy-target-list

    Lists all the roots, organizational units (OUs), and accounts that the specified policy is attached to.

  • aws-org-resource-tag-add

    Adds one or more tags to the specified resource.

  • aws-org-resource-tag-list

    Lists tags that are attached to the specified resource.

  • aws-org-root-list

    List the roots that are defined in the current organization.

  • aws-org-target-policy-list

    Lists the policies that are directly attached to the specified target root, organizational unit (OU), or account.

Source

AWSOrganizations.py AWSOrganizations_test.py AWSOrganizations.yml AWSOrganizations_description.md command_examples.txt
Download History Raw 
category: Identity and Access Management
provider: Amazon
commonfields:
  id: AWS - Organizations
  version: -1
sectionorder:
- Connect
configuration:
- display: Role Arn
  name: role_arn
  type: 0
  section: Connect
  additionalinfo: The Amazon Resource Name (ARN) of the role to assume.
- display: Role Session Name
  name: role_session_name
  type: 0
  additionalinfo: An identifier for the assumed role session.
  section: Connect
- display: Role Session Duration
  name: role_session_duration
  type: 0
  advanced: true
  additionalinfo: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
  section: Connect
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  required: false
  section: Connect
- display: Timeout
  name: timeout
  defaultvalue: 60,10
  additionalinfo: "The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used."
  type: 0
  required: false
  section: Connect
- display: Retries
  name: retries
  type: 0
  defaultvalue: 5
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  required: false
  section: Connect
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  advanced: true
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  advanced: true
  section: Connect
description: Manage Amazon Web Services accounts and their resources.
display: AWS - Organizations
name: AWS - Organizations
script:
  commands:
  - name: aws-org-root-list
    arguments:
    - description: The number of roots to return.
      name: limit
      defaultValue: '50'
    - description: The number of roots to return per page. The maximum is 1000.
      name: page_size
    - description: The token denoting the next page of roots, as given by the response of the previous run of this command under the context key "AWS.Organizations.RootNextToken".
      name: next_token
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: List the roots that are defined in the current organization.
    outputs:
    - contextPath: AWS.Organizations.Root.Id
      description: The unique identifier (ID) of the root.
      type: String
    - contextPath: AWS.Organizations.Root.Arn
      description: The Amazon Resource Name (ARN) of the root.
      type: String
    - contextPath: AWS.Organizations.Root.Name
      description: The friendly name of the root.
      type: String
    - contextPath: AWS.Organizations.Root.PolicyTypes.Type
      description: The name of the policy type.
      type: String
    - contextPath: AWS.Organizations.Root.PolicyTypes.Status
      description: The status of the policy type as it relates to the associated root.
      type: String
    - contextPath: AWS.Organizations.RootNextToken
      description: If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.
      type: String
  - name: aws-org-children-list
    arguments:
    - description: The unique identifier (ID) for the parent root or organizational unit (OU) whose children are to be listed.
      name: parent_id
      required: true
    - auto: PREDEFINED
      description: Filters the output to include only the specified child type.
      name: child_type
      predefined:
      - Account
      - OrganizationalUnit
      required: true
    - description: The number of children to return.
      name: limit
      defaultValue: '50'
    - description: The number of children to return per page. The maximum is 1000.
      name: page_size
    - description: The token denoting the next page of children as given by the response of the previous run of this command under the context key "AWS.Organizations.ChildrenNextToken".
      name: next_token
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: List all of the organizational units (OUs) or accounts that are contained in the specified parent OU or root.
    outputs:
    - contextPath: AWS.Organizations.Children.Id
      description: The unique identifier (ID) of the child entity.
      type: String
    - contextPath: AWS.Organizations.Children.Type
      description: The type of the child entity.
      type: String
    - contextPath: AWS.Organizations.Children.ParentId
      description: The unique identifier (ID) for the parent root or organizational unit of the child entity.
      type: String
    - contextPath: AWS.Organizations.ChildrenNextToken
      description: If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.
      type: String
  - name: aws-org-parent-list
    arguments:
    - description: |
        The unique identifier (ID) of the organizational unit or account whose parent containers you want to list. Don't specify a root.
        This value can be retrieved by running the command "aws-org-account-list".
      name: child_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: |
      Lists all of the organizational units (OUs) or accounts that are a parent OU or root of the specified child.
      This command returns only the immediate parents in the hierarchy.
    outputs:
    - contextPath: AWS.Organizations.Parent.Id
      description: The unique identifier (ID) of the parent entity.
      type: String
    - contextPath: AWS.Organizations.Parent.Type
      description: The type of the parent entity.
      type: String
    - contextPath: AWS.Organizations.Parent.ChildId
      description: The unique identifier (ID) of the organizational unit or account of the child of the parent entity.
      type: String
  - name: aws-org-organization-unit-get
    arguments:
    - description: The unique identifier (ID) of the organizational unit to retrieve details about.
      name: organization_unit_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: |
      Retrieve information about an organizational unit (OU).
      This command can be called only from the organization's management account or by a member account that is a delegated administrator for an Amazon Web Services service.
    outputs:
    - contextPath: AWS.Organizations.OrganizationUnit.Id
      description: The unique identifier (ID) associated with the organizational unit.
      type: String
    - contextPath: AWS.Organizations.OrganizationUnit.Arn
      description: The Amazon Resource Name (ARN) of the organizational unit.
      type: String
    - contextPath: AWS.Organizations.OrganizationUnit.Name
      description: The friendly name of the organizational unit.
      type: String
  - name: aws-org-account-list
    arguments:
    - description: Get a specific account by ID.
      name: account_id
    - description: The number of accounts to return.
      name: limit
      defaultValue: '50'
    - description: The number of accounts to return per page. The maximum is 1000.
      name: page_size
    - description: The token denoting the next page of accounts, as given by the response of the previous run of this command under the context key "AWS.Organizations.AccountNextToken".
      name: next_token
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists all the accounts in the organization or a specific account by ID.
    outputs:
    - contextPath: AWS.Organizations.Account.Id
      description: The unique identifier (ID) of the account.
      type: String
    - contextPath: AWS.Organizations.Account.Arn
      description: The Amazon Resource Name (ARN) of the account.
      type: String
    - contextPath: AWS.Organizations.Account.Email
      description: The email address associated with the Amazon Web Services account.
      type: String
    - contextPath: AWS.Organizations.Account.Name
      description: The friendly name of the account.
      type: String
    - contextPath: AWS.Organizations.Account.Status
      description: The status of the account in the organization.
      type: String
    - contextPath: AWS.Organizations.Account.JoinedMethod
      description: The method by which the account joined the organization.
      type: String
    - contextPath: AWS.Organizations.Account.JoinedTimestamp
      description: The date the account became a part of the organization.
      type: Date
    - contextPath: AWS.Organizations.AccountNextToken
      description: If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.
      type: String
  - name: aws-org-organization-get
    arguments:
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about the organization that the user's account belongs to.
    outputs:
    - contextPath: AWS.Organizations.Organization.Id
      description: The unique identifier (ID) of the organization.
      type: String
    - contextPath: AWS.Organizations.Organization.Arn
      description: The Amazon Resource Name (ARN) of the organization.
      type: String
    - contextPath: AWS.Organizations.Organization.FeatureSet
      description: |
        Specifies the functionality that currently is available to the organization.
        If set to “ALL”, then all features are enabled and policies can be applied to accounts in the organization.
        If set to “CONSOLIDATED_BILLING”, then only consolidated billing functionality is available.
      type: String
    - contextPath: AWS.Organizations.Organization.MasterAccountArn
      description: The Amazon Resource Name (ARN) of the account that is designated as the management account for the organization.
      type: String
    - contextPath: AWS.Organizations.Organization.MasterAccountId
      description: The unique identifier (ID) of the management account of the organization.
      type: String
    - contextPath: AWS.Organizations.Organization.MasterAccountEmail
      description: The email address that is associated with the Amazon Web Services account that is designated as the management account for the organization.
      type: String
  - name: aws-org-account-remove
    arguments:
    - description: The unique identifier (ID) of the member account to be removed from the organization. This can be obtained with the command "aws-organizations-account-list".
      name: account_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: 'Removes an account from the organization. For more information on this action: https://docs.aws.amazon.com/organizations/latest/APIReference/API_RemoveAccountFromOrganization.html'
    outputs: []
  - name: aws-org-account-move
    arguments:
    - description: The unique identifier (ID) of the member account move. This value can be retrieved by running the command "aws-org-account-list".
      name: account_id
      required: true
    - description: |
        The unique identifier (ID) of the root or organizational unit to move the account to.
        This value can be retrieved by running the command "aws-org-root-list".
      name: destination_parent_id
      required: true
    - description: |
        The unique identifier (ID) of the root or organizational unit to move the account from.
        This value can be retrieved by running the command "aws-org-parent-list" with the child_id set to the account_id.
      name: source_parent_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Moves an account from one parent to another.
    outputs: []
  - name: aws-org-account-create
    polling: true
    arguments:
    - description: The friendly name of the member account.
      name: account_name
      required: true
    - description: The email address of the owner to assign to the new member account. This email address must not already be associated with another Amazon Web Services account. Use a valid email address to complete account creation.
      name: email
      required: true
    - auto: PREDEFINED
      defaultValue: Allow
      description: If set to ALLOW, the new account enables IAM users to access account billing information if they have the required permissions. If set to DENY, only the root user of the new account can access account billing information.
      name: iam_user_access_to_billing
      predefined:
      - Allow
      - Deny
    - defaultValue: OrganizationAccountAccessRole
      description: The name of an IAM role that AWS Organizations automatically pre-configures in the new member account. This role trusts the management account, allowing users in the management account to assume the role, as permitted by the management account administrator. The role has administrator permissions in the new member account.
      name: role_name
    - description: 'A comma-separated list of tags to attach to the newly created account. Each tag should be in the format: "key=value".'
      name: tags
      isArray: true
    - description: The ID of the create request that is used for polling.
      name: request_id
      hidden: true
    - defaultValue: '30'
      description: Indicates how long to wait between command executions (in seconds) when the 'polling' argument is true. Minimum value is 10 seconds.
      name: interval_in_seconds
    - defaultValue: '600'
      description: Indicates the time in seconds until the polling sequence times out.
      name: timeout
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - name: hide_polling_output
      hidden: true
      description: ''
    description: Creates an AWS Account that is automatically a member of the organization.
    outputs:
    - contextPath: AWS.Organizations.Account.Id
      description: The unique identifier (ID) of the account.
      type: String
    - contextPath: AWS.Organizations.Account.Arn
      description: The Amazon Resource Name (ARN) of the account.
      type: String
    - contextPath: AWS.Organizations.Account.Email
      description: The email address associated with the Amazon Web Services account.
      type: String
    - contextPath: AWS.Organizations.Account.Name
      description: The friendly name of the account.
      type: String
    - contextPath: AWS.Organizations.Account.Status
      description: The status of the account in the organization.
      type: String
    - contextPath: AWS.Organizations.Account.JoinedMethod
      description: The method by which the account joined the organization.
      type: String
    - contextPath: AWS.Organizations.Account.JoinedTimestamp
      description: The date the account became a part of the organization.
      type: Date
  - name: aws-org-account-close
    polling: true
    arguments:
    - description: The unique identifier (ID) of the member account to close. This can be obtained with the command "aws-organizations-account-list".
      name: account_id
      required: true
    - defaultValue: '30'
      description: Indicates how long to wait between command executions (in seconds) when the 'polling' argument is true. Minimum value is 10 seconds.
      name: interval_in_seconds
    - defaultValue: '600'
      description: Indicates the time in seconds until the polling sequence times out.
      name: timeout
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    - description: whether the initial API call to close the account has been executed.
      name: is_closed
      hidden: true
      defaultValue: false
    - name: hide_polling_output
      hidden: true
      description: ''
    description: Closes an AWS member account within an organization.
    outputs: []
  - name: aws-org-organization-unit-create
    arguments:
    - description: The friendly name to assign to the new organizational unit.
      name: name
      required: true
    - description: The unique identifier (ID) of the parent root or organizational unit to create the new organizational unit in. This value can be retrieved by running the command "aws-org-root-list".
      name: parent_id
      required: true
    - description: 'A comma-separated list of tags to attach to the newly created organizational unit. Each tag should be in the format: "key=value".'
      name: tags
      isArray: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables the organization of accounts to apply policies according to business requirements. The number of levels deep that OUs can be nested is dependent upon the policy types enabled for that root. For service control policies, the limit is five.
    outputs:
    - contextPath: AWS.Organizations.OrganizationUnit.Id
      description: The unique identifier (ID) associated with this organizational unit.
      type: String
    - contextPath: AWS.Organizations.OrganizationUnit.Arn
      description: The Amazon Resource Name (ARN) of this organizational unit.
      type: String
    - contextPath: AWS.Organizations.OrganizationUnit.Name
      description: The friendly name of this organizational unit.
      type: String
  - name: aws-org-organization-unit-delete
    arguments:
    - description: The unique identifier (ID) of the organizational unit that you want to delete.
      name: organizational_unit_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes an organizational unit (OU) from a root or another OU. All accounts and child OUs must first be removed.
    outputs: []
  - name: aws-org-organization-unit-rename
    arguments:
    - description: The unique identifier (ID) of the OU to rename. This value can be retrieved by running the command "aws-org-parent-list".
      name: organizational_unit_id
      required: true
    - description: The new name to assign to the organizational unit.
      name: name
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Renames the specified organizational unit (OU). The ID and ARN don't change. The child OUs and accounts remain in place, and any attached policies of the OU remain attached.
    outputs: []
  - name: aws-org-policy-list
    arguments:
    - auto: PREDEFINED
      description: Specifies the type of policy to include in the response.
      name: policy_type
      predefined:
      - Service Control Policy
      - Tag Policy
      - Backup Policy
      - AI Services Opt Out Policy
      required: true
    - description: The number of policies to return.
      name: limit
      defaultValue: '50'
    - description: The number of policies to return per page. The maximum is 1000.
      name: page_size
    - description: The token denoting the next page of policies, as given by the response of the previous run of this command under the context key "AWS.Organizations.PolicyNextToken".
      name: next_token
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves the list of all policies in an organization of a specified type.
    outputs:
    - contextPath: AWS.Organizations.Policy.Id
      description: The unique identifier (ID) of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Arn
      description: The Amazon Resource Name (ARN) of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Name
      description: The friendly name of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Description
      description: The description of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Type
      description: The type of policy.
      type: String
    - contextPath: AWS.Organizations.Policy.AwsManaged
      description: Indicates whether the specified policy is an Amazon Web Services managed policy. If true, the policy can be attached to roots, organizational units, or accounts, but cannot be edited.
      type: Boolean
    - contextPath: AWS.Organizations.PolicyNextToken
      description: If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.
      type: String
  - name: aws-org-target-policy-list
    arguments:
    - auto: PREDEFINED
      description: The type of policy to include in the returned list.
      name: policy_type
      predefined:
      - Service Control Policy
      - Tag Policy
      - Backup Policy
      - AI Services Opt Out Policy
      required: true
    - description: The unique identifier (ID) of the root, organizational unit, or account whose policies are to be listed.
      name: target_id
      required: true
    - description: The number of policies to return.
      name: limit
      defaultValue: '50'
    - description: The number of policies to return per page. The maximum is 1000.
      name: page_size
    - description: The token denoting the next page of policies, as given by the response of the previous run of this command under the context key "AWS.Organizations.PolicyNextToken".
      name: next_token
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists the policies that are directly attached to the specified target root, organizational unit (OU), or account.
    outputs:
    - contextPath: AWS.Organizations.TargetPolicy.Id
      description: The unique identifier (ID) of the policy.
      type: String
    - contextPath: AWS.Organizations.TargetPolicy.Arn
      description: The Amazon Resource Name (ARN) of the policy.
      type: String
    - contextPath: AWS.Organizations.TargetPolicy.Name
      description: The friendly name of the policy.
      type: String
    - contextPath: AWS.Organizations.TargetPolicy.Description
      description: The description of the policy.
      type: String
    - contextPath: AWS.Organizations.TargetPolicy.Type
      description: The type of policy.
      type: String
    - contextPath: AWS.Organizations.TargetPolicy.AwsManaged
      description: Indicates whether the specified policy is an Amazon Web Services managed policy. If true, the policy can be attached to roots, organizational units, or accounts, but cannot be edited.
      type: Boolean
    - contextPath: AWS.Organizations.TargetId
      description: The unique identifier (ID) of the target.
      type: String
    - contextPath: AWS.Organizations.TargetPolicyNextToken
      description: If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.
      type: String
  - name: aws-org-policy-get
    arguments:
    - description: The unique identifier (ID) of the policy that you want details about. This value can be retrieved by running the command "aws-org-policy-list".
      name: policy_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about a policy.
    outputs:
    - contextPath: AWS.Organizations.Policy.Id
      description: The unique identifier (ID) of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Arn
      description: The Amazon Resource Name (ARN) of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Name
      description: The friendly name of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Description
      description: The description of the policy.
      type: String
    - contextPath: AWS.Organizations.Policy.Type
      description: The type of policy.
      type: String
    - contextPath: AWS.Organizations.Policy.AwsManaged
      description: Indicates whether the specified policy is an Amazon Web Services managed policy. If true, the policy can be attached to roots, organizational units, or accounts, but cannot be edited.
      type: Boolean
  - name: aws-org-policy-delete
    arguments:
    - description: The unique identifier (ID) of the policy that you want to delete. This value can be retrieved by running the command "aws-org-policy-list".
      name: policy_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Deletes the specified policy from the organization. Before performing this operation, the policy must be detached from all organizational units (OUs), roots, and accounts.
    outputs: []
  - name: aws-org-policy-attach
    arguments:
    - description: The unique identifier (ID) of the policy to attach to the target. This value can be retrieved by running the command "aws-org-policy-list".
      name: policy_id
      required: true
    - description: The unique identifier (ID) of the root, organizational unit, or account to attach the policy to. This value can be retrieved by running the command "aws-org-root-list" or "aws-org-account-list".
      name: target_id
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Attaches a policy to a root, an organizational unit (OU), or an individual account.
    outputs: []
  - name: aws-org-policy-target-list
    arguments:
    - description: The unique identifier (ID) of the policy whose attachments are to be listed.
      name: policy_id
      required: true
    - description: The number of policies to return.
      name: limit
      defaultValue: '50'
    - description: The number of policies to return per page. The maximum is 1000.
      name: page_size
    - description: The token denoting the next page of policies, as given by the response of the previous run of this command under the context key "AWS.Organizations.PolicyTargetNextToken".
      name: next_token
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists all the roots, organizational units (OUs), and accounts that the specified policy is attached to.
    outputs:
    - contextPath: AWS.Organizations.PolicyTarget.TargetId
      description: The unique identifier (ID) of the policy target.
      type: String
    - contextPath: AWS.Organizations.PolicyTarget.Arn
      description: The Amazon Resource Name (ARN) of the policy target.
      type: String
    - contextPath: AWS.Organizations.PolicyTarget.Name
      description: The friendly name of the policy target.
      type: String
    - contextPath: AWS.Organizations.PolicyTarget.Type
      description: The type of the policy target.
      type: String
    - contextPath: AWS.Organizations.PolicyTarget.PolicyId
      description: The unique identifier (ID) of the policy.
      type: String
    - contextPath: AWS.Organizations.PolicyTargetNextToken
      description: If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.
      type: String
  - name: aws-org-resource-tag-add
    arguments:
    - description: The ID of the resource to add a tag to. This value can be retrieved by running the command "aws-org-root-list", "aws-org-account-list", "aws-org-root-list", or "aws-org-policy-list".
      name: resource_id
      required: true
    - description: 'A comma-separated list of tags to attach to the resource. Each tag should be in the format: "key=value".'
      name: tags
      isArray: true
      required: true
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Adds one or more tags to the specified resource.
    outputs: []
  - name: aws-org-resource-tag-list
    arguments:
    - description: The ID of the resource with the tags to list. This value can be retrieved by running the command "aws-org-root-list", "aws-org-account-list", "aws-org-root-list" or "aws-org-policy-list".
      name: resource_id
      required: true
    - description: The token denoting the next page of tags, as given by the response of the previous run of this command under the context key "AWS.Organizations.TagNextToken".
      name: next_token
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Lists tags that are attached to the specified resource.
    outputs:
    - contextPath: AWS.Organizations.Tag.Key
      description: The key identifier, or name, of the tag.
      type: String
    - contextPath: AWS.Organizations.Tag.Value
      description: The string value that's associated with the key of the tag.
      type: String
    - contextPath: AWS.Organizations.Tag.ResourceId
      description: The unique identifier (ID) of the resource.
      type: String
    - contextPath: AWS.Organizations.TagNextToken
      description: If not null, indicates that more output is available than is included in the current response. Use this value as the next_token argument in a subsequent call of the command to get the next part of the output.
      type: String
  dockerimage: demisto/boto3py3:1.0.0.10221838
  feed: false
  longRunning: false
  longRunningPort: false
  runonce: false
  script: '-'
  subtype: python3
  type: python
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- xpanse
- platform
tests:
- Test - AWS_Organizations