Help us shape the future of Go! Take the 2026 Go Developer Survey

organizations

package
v1.8.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 27 Imported by: 0

README

Organizations

Parity grade: A · SDK aws-sdk-go-v2/service/organizations@v1.53.5 · last audited 2026-10-12 (f78c3b7c7)

Coverage

Metric Value
PARITY entries audited 63 (63 ok)
Feature families 5 (5 ok)
Known gaps none
Structural gaps (can't be emulated) 2
Deferred items 0
Resource leaks clean
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • Policy size limits use the AWS default per-type quotas; quota increases (e.g. SCP up to 20480) live in Service Quotas account state, which this repo does not emulate.
  • ResponsibilityTransfer is originate-only (this account as Source): the Target-side Inbound view needs a second organization's backend, which a single-account emulator lacks.

More

Documentation

Overview

Package organizations provides an in-memory stub for the AWS Organizations API.

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrOrgNotFound is returned when no organization exists.
	ErrOrgNotFound = awserr.New(
		"AWSOrganizationsNotInUseException: organization not found",
		awserr.ErrNotFound,
	)
	// ErrOrgAlreadyExists is returned when an organization already exists.
	ErrOrgAlreadyExists = awserr.New(
		"AlreadyInOrganizationException: account is already a member of an organization",
		awserr.ErrAlreadyExists,
	)
	// ErrAccountNotFound is returned when an account does not exist.
	ErrAccountNotFound = awserr.New(
		"AccountNotFoundException: account not found",
		awserr.ErrNotFound,
	)
	// ErrOUNotFound is returned when an OU does not exist.
	ErrOUNotFound = awserr.New(
		"OrganizationalUnitNotFoundException: OU not found",
		awserr.ErrNotFound,
	)
	// ErrPolicyNotFound is returned when a policy does not exist.
	ErrPolicyNotFound = awserr.New("PolicyNotFoundException: policy not found", awserr.ErrNotFound)
	// ErrPolicyTypeAlreadyEnabled is returned when a policy type is already enabled.
	ErrPolicyTypeAlreadyEnabled = awserr.New(
		"PolicyTypeAlreadyEnabledException: policy type already enabled",
		awserr.ErrConflict,
	)
	// ErrPolicyTypeNotEnabled is returned when a policy type is not enabled.
	ErrPolicyTypeNotEnabled = awserr.New(
		"PolicyTypeNotEnabledException: policy type not enabled",
		awserr.ErrConflict,
	)
	// ErrCreateAccountStatusNotFound is returned when a create-account status is not found.
	ErrCreateAccountStatusNotFound = awserr.New(
		"CreateAccountStatusNotFoundException: create account status not found",
		awserr.ErrNotFound,
	)
	// ErrDuplicatePolicyAttachment is returned when a policy is already attached.
	ErrDuplicatePolicyAttachment = awserr.New(
		"DuplicatePolicyAttachmentException: policy already attached",
		awserr.ErrConflict,
	)
	// ErrPolicyNotAttached is returned when a policy is not attached to the target.
	ErrPolicyNotAttached = awserr.New(
		"PolicyNotAttachedException: policy not attached to target",
		awserr.ErrNotFound,
	)
	// ErrInvalidInput is returned for invalid input parameters.
	ErrInvalidInput = awserr.New("InvalidInputException: invalid input", awserr.ErrInvalidParameter)
	// ErrChildNotFound is returned when a child resource is not found.
	ErrChildNotFound = awserr.New("ChildNotFoundException: child not found", awserr.ErrNotFound)
	// ErrDelegatedAdminNotFound is returned when a delegated admin is not found.
	ErrDelegatedAdminNotFound = awserr.New(
		"AccountNotRegisteredException: account is not a registered delegated administrator",
		awserr.ErrNotFound,
	)
	// ErrDelegatedAdminAlreadyExists is returned when a delegated admin already exists.
	ErrDelegatedAdminAlreadyExists = awserr.New(
		"AccountAlreadyRegisteredException: account is already a delegated administrator",
		awserr.ErrAlreadyExists,
	)
	// ErrCannotCloseManagementAccount is returned by CloseAccount for the management account.
	ErrCannotCloseManagementAccount = awserr.New(
		"ConstraintViolationException: CANNOT_CLOSE_MANAGEMENT_ACCOUNT",
		awserr.ErrConflict,
	)
	// ErrParentNotFound is returned when a well-formed parent ID names no root or OU.
	ErrParentNotFound = awserr.New(
		"ParentNotFoundException: parent not found",
		awserr.ErrNotFound,
	)
	// ErrPolicyLimitExceeded is returned when the maximum number of policies per target is exceeded.
	ErrPolicyLimitExceeded = awserr.New(
		"ConstraintViolationException: maximum policies per target exceeded",
		awserr.ErrConflict,
	)
	// ErrHandshakeNotFound is returned when a handshake does not exist.
	ErrHandshakeNotFound = awserr.New(
		"HandshakeNotFoundException: handshake not found",
		awserr.ErrNotFound,
	)
	// ErrHandshakeConstraintViolation is returned when a handshake state transition is invalid.
	ErrHandshakeConstraintViolation = awserr.New(
		"HandshakeConstraintViolationException: handshake is not in a valid state for this transition",
		awserr.ErrConflict,
	)
	// ErrResourcePolicyNotFound is returned when no resource policy exists.
	ErrResourcePolicyNotFound = awserr.New(
		"ResourcePolicyNotFoundException: resource policy not found",
		awserr.ErrNotFound,
	)
	// ErrEffectivePolicyNotFound is returned when no effective policy exists for a target.
	ErrEffectivePolicyNotFound = awserr.New(
		"EffectivePolicyNotFoundException: no effective policy of the given type",
		awserr.ErrNotFound,
	)
	// ErrAccountAlreadyClosed is returned when an account is already in PENDING_CLOSURE or SUSPENDED state.
	ErrAccountAlreadyClosed = awserr.New(
		"ConstraintViolationException: account is already closed or pending closure",
		awserr.ErrConflict,
	)
	// ErrOUDepthLimitExceeded is returned when creating an OU would exceed the depth limit.
	ErrOUDepthLimitExceeded = awserr.New(
		"ConstraintViolationException: OU_DEPTH_LIMIT_EXCEEDED",
		awserr.ErrConflict,
	)
	// ErrDuplicateOrganizationalUnit is returned when an OU with the same name already exists under the same parent.
	ErrDuplicateOrganizationalUnit = awserr.New(
		"DuplicateOrganizationalUnitException: duplicate OU name",
		awserr.ErrAlreadyExists,
	)
	// ErrTargetNotFound is returned when a policy attachment target is not found.
	ErrTargetNotFound = awserr.New(
		"TargetNotFoundException: target not found",
		awserr.ErrNotFound,
	)
	// ErrServiceNotEnabled is returned when registering a delegated admin for a service not enabled for org access.
	ErrServiceNotEnabled = awserr.New(
		"ConstraintViolationException: service principal not enabled for service access",
		awserr.ErrConflict,
	)
	// ErrCannotRegisterManagementAsDelegatedAdmin is returned when the management account is registered.
	ErrCannotRegisterManagementAsDelegatedAdmin = awserr.New(
		"ConstraintViolationException: CANNOT_REGISTER_MASTER_AS_DELEGATED_ADMINISTRATOR",
		awserr.ErrConflict,
	)
	// ErrCannotRegisterSuspendedAsDelegatedAdmin is returned when a suspended or closing account is registered.
	ErrCannotRegisterSuspendedAsDelegatedAdmin = awserr.New(
		"ConstraintViolationException: CANNOT_REGISTER_SUSPENDED_ACCOUNT_AS_DELEGATED_ADMINISTRATOR",
		awserr.ErrConflict,
	)
	// ErrPolicyTypeNotAvailable is returned when a policy type needs all features and the org has only billing.
	ErrPolicyTypeNotAvailable = awserr.New(
		"PolicyTypeNotAvailableForOrganizationException: policy type needs all features",
		awserr.ErrConflict,
	)
	// ErrPolicyInUse is returned when attempting to delete a policy still attached to targets.
	ErrPolicyInUse = awserr.New(
		"PolicyInUseException: policy is still attached to one or more targets",
		awserr.ErrConflict,
	)
	// ErrOrganizationNotEmpty is returned when attempting to delete an org that still has member accounts.
	ErrOrganizationNotEmpty = awserr.New(
		"OrganizationNotEmptyException: organization still contains member accounts",
		awserr.ErrConflict,
	)
	// ErrDuplicateHandshake is returned when an open handshake already exists for the same target.
	ErrDuplicateHandshake = awserr.New(
		"DuplicateHandshakeException: a handshake already exists for the specified account",
		awserr.ErrAlreadyExists,
	)
	// ErrPolicyTypeAttached is returned when disabling a policy type that still has attached policies.
	ErrPolicyTypeAttached = awserr.New(
		"ConstraintViolationException: cannot disable policy type while policies of that type are attached",
		awserr.ErrConflict,
	)
	// ErrMalformedPolicyDocument is returned when a policy's Content is not valid JSON.
	ErrMalformedPolicyDocument = awserr.New(
		"MalformedPolicyDocumentException: policy content is not valid JSON",
		awserr.ErrInvalidParameter,
	)
	// ErrPolicyContentLimitExceeded is returned when a policy's Content exceeds the
	// maximum document size for its policy type.
	ErrPolicyContentLimitExceeded = awserr.New(
		"ConstraintViolationException: POLICY_CONTENT_LIMIT_EXCEEDED",
		awserr.ErrConflict,
	)
	// ErrTagLimitExceeded is returned when tagging a resource would exceed the
	// maximum of 50 tags per resource.
	ErrTagLimitExceeded = awserr.New(
		"ConstraintViolationException: MAX_TAG_LIMIT_EXCEEDED",
		awserr.ErrConflict,
	)
	// ErrInvalidSystemTags is returned when a caller-supplied tag key uses the
	// "aws:" prefix reserved for system tags.
	ErrInvalidSystemTags = awserr.New(
		"InvalidInputException: INVALID_SYSTEM_TAGS_PARAMETER",
		awserr.ErrInvalidParameter,
	)
	// ErrDuplicateTagKey is returned when the same tag key appears more than once
	// in a single request's tag list.
	ErrDuplicateTagKey = awserr.New(
		"InvalidInputException: DUPLICATE_TAG_KEY",
		awserr.ErrInvalidParameter,
	)
	// ErrInvalidTagKeyLength is returned when a tag key is empty or exceeds 128
	// characters (TagKey shape: min 1, max 128).
	ErrInvalidTagKeyLength = awserr.New(
		"InvalidInputException: tag key must be between 1 and 128 characters",
		awserr.ErrInvalidParameter,
	)
	// ErrInvalidTagValueLength is returned when a tag value exceeds 256
	// characters (TagValue shape: max 256).
	ErrInvalidTagValueLength = awserr.New(
		"InvalidInputException: tag value must not exceed 256 characters",
		awserr.ErrInvalidParameter,
	)
	// ErrResponsibilityTransferNotFound is returned when a responsibility
	// transfer does not exist (looked up by its own rt-... Id, not a
	// handshake Id).
	ErrResponsibilityTransferNotFound = awserr.New(
		"ResponsibilityTransferNotFoundException: responsibility transfer not found",
		awserr.ErrNotFound,
	)
	// ErrInvalidResponsibilityTransferTransition is returned by
	// TerminateResponsibilityTransfer when the transfer has never reached
	// ACCEPTED status -- declared on that op's own deserializeOpError switch
	// (deserializers.go), distinct from ErrResponsibilityTransferAlreadyInStatus.
	ErrInvalidResponsibilityTransferTransition = awserr.New(
		"InvalidResponsibilityTransferTransitionException: transfer is not in a state that can be terminated",
		awserr.ErrConflict,
	)
	// ErrResponsibilityTransferAlreadyInStatus is returned by
	// TerminateResponsibilityTransfer when the transfer already has an
	// EndTimestamp (already terminated).
	ErrResponsibilityTransferAlreadyInStatus = awserr.New(
		"ResponsibilityTransferAlreadyInStatusException: transfer has already ended",
		awserr.ErrConflict,
	)
	// ErrOrganizationalUnitNotEmpty is returned by DeleteOrganizationalUnit
	// when the OU still contains accounts or child OUs (own error code, not
	// InvalidInputException -- see DeleteOrganizationalUnit's per-op error
	// switch in deserializers.go).
	ErrOrganizationalUnitNotEmpty = awserr.New(
		"OrganizationalUnitNotEmptyException: organizational unit is not empty",
		awserr.ErrConflict,
	)
	// ErrMasterCannotLeaveOrganization is returned by LeaveOrganization and
	// RemoveAccountFromOrganization when called against the management
	// account (own error code, not InvalidInputException -- see those ops'
	// per-op error switches in deserializers.go).
	ErrMasterCannotLeaveOrganization = awserr.New(
		"MasterCannotLeaveOrganizationException: "+
			"the management account cannot leave or be removed from the organization",
		awserr.ErrConflict,
	)
	// ErrSourceParentNotFound is returned by MoveAccount when SourceParentId
	// does not identify a root or OU that currently holds the account (own
	// error code, not InvalidInputException -- see MoveAccount's per-op
	// error switch in deserializers.go).
	ErrSourceParentNotFound = awserr.New(
		"SourceParentNotFoundException: source parent not found",
		awserr.ErrNotFound,
	)
	// ErrDestinationParentNotFound is returned by MoveAccount when
	// DestinationParentId does not identify an existing root or OU (own
	// error code, not InvalidInputException -- see MoveAccount's per-op
	// error switch in deserializers.go).
	ErrDestinationParentNotFound = awserr.New(
		"DestinationParentNotFoundException: destination parent not found",
		awserr.ErrNotFound,
	)
	// ErrCannotRemoveDelegatedAdministratorFromOrg is returned by
	// RemoveAccountFromOrganization when the target account is still a
	// registered delegated administrator for some service (types/enums.go:
	// ConstraintViolationExceptionReasonCannotRemoveDelegatedAdministratorFromOrg;
	// RemoveAccountFromOrganization's doc comment: "must not be a delegated
	// administrator account ... you must first change the delegated
	// administrator account").
	ErrCannotRemoveDelegatedAdministratorFromOrg = awserr.New(
		"ConstraintViolationException: CANNOT_REMOVE_DELEGATED_ADMINISTRATOR_FROM_ORG",
		awserr.ErrConflict,
	)
	// ErrAccessDeniedManagedPolicy is returned by DeletePolicy and UpdatePolicy
	// for an AWS-managed policy (e.g. p-FullAWSAccess). Neither op's declared
	// error set (deserializers.go) includes ConstraintViolationException, so
	// AccessDeniedException -- declared on both -- is the only fit; see
	// types.PolicySummary.AwsManaged's doc comment ("you can attach the
	// policy ... but you cannot edit it").
	ErrAccessDeniedManagedPolicy = awserr.New(
		"AccessDeniedException: you don't have permissions to modify or delete an AWS managed policy",
		awserr.ErrConflict,
	)
)

Sentinel errors.

View Source 
var ErrNilAppContext = errors.New("organizations: AppContext is nil")

ErrNilAppContext is returned when Init receives a nil AppContext.

Functions

This section is empty.

Types

type Account 

type Account struct {
	JoinedAt               time.Time `json:"joinedAt"`
	ID                     string    `json:"id"`
	ARN                    string    `json:"arn"`
	Name                   string    `json:"name"`
	Email                  string    `json:"email"`
	Status                 string    `json:"status"`
	JoinedMethod           string    `json:"joinedMethod"`
	RoleName               string    `json:"roleName,omitempty"`
	IamUserAccessToBilling string    `json:"iamUserAccessToBilling,omitempty"`
	// Paths is derived from accountParent/ouParent at read time (see
	// paths.go) and deliberately excluded from persistence: it is never
	// source-of-truth state, just a formatting of the tree that is already
	// stored.
	Paths []string `json:"-"`
}

Account represents an AWS account in an organization.

type AccountProvisioner 

type AccountProvisioner interface {
	ProvisionAccessRole(accountID, roleName, trustPolicy string) error
}

AccountProvisioner creates the cross-account access role in a newly created member account.

type ChildSummary 

type ChildSummary struct {
	ID   string `json:"Id"`
	Type string `json:"Type"`
}

ChildSummary describes a child (account or OU) of a parent.

type CreateAccountStatus 

type CreateAccountStatus struct {
	ID                 string  `json:"Id"`
	AccountID          string  `json:"AccountId,omitempty"`
	GovCloudAccountID  string  `json:"GovCloudAccountId,omitempty"`
	AccountName        string  `json:"AccountName"`
	State              string  `json:"State"`
	FailureReason      string  `json:"FailureReason,omitempty"`
	RequestedTimestamp float64 `json:"RequestedTimestamp"`
	CompletedTimestamp float64 `json:"CompletedTimestamp,omitempty"`
}

CreateAccountStatus is the result of a CreateAccount request.

type DelegatedAdmin 

type DelegatedAdmin struct {
	AccountID        string    `json:"Id"`
	ARN              string    `json:"Arn"`
	Name             string    `json:"Name"`
	Email            string    `json:"Email"`
	Status           string    `json:"Status"`
	JoinedMethod     string    `json:"JoinedMethod"`
	JoinedAt         time.Time `json:"JoinedTimestamp"`
	DelegationTime   time.Time `json:"DelegationEnabledDate"`
	ServicePrincipal string    `json:"-"`
}

DelegatedAdmin holds a delegated administrator registration.

type DelegatedService 

type DelegatedService struct {
	DelegationEnabledDate time.Time `json:"DelegationEnabledDate"`
	ServicePrincipal      string    `json:"ServicePrincipal"`
}

DelegatedService holds a service principal for which an account is a delegated administrator.

type EffectivePolicy 

type EffectivePolicy struct {
	LastUpdatedTimestamp time.Time `json:"lastUpdatedTimestamp"`
	PolicyContent        string    `json:"policyContent"`
	PolicyID             string    `json:"policyId"`
	PolicyType           string    `json:"policyType"`
	TargetID             string    `json:"targetId"`
}

EffectivePolicy represents the aggregated effective policy for a target.

type EnabledServicePrincipal 

type EnabledServicePrincipal struct {
	DateEnabled      time.Time `json:"DateEnabled"`
	ServicePrincipal string    `json:"ServicePrincipal"`
}

EnabledServicePrincipal holds a service principal that has been enabled for AWS service access.

type Handler 

type Handler struct {
	Backend StorageBackend
}

Handler is the HTTP handler for the AWS Organizations JSON 1.1 API.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Organizations handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the primary resource identifier from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Organizations operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Organizations requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all backend state (used in tests).

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Organizations JSON 1.1 API requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type Handshake 

type Handshake struct {
	RequestedTimestamp  time.Time `json:"requestedTimestamp"`
	ExpirationTimestamp time.Time `json:"expirationTimestamp"`
	// StateChangedAt is when State last left OPEN (or the zero value while
	// still OPEN). Internal bookkeeping for pruneStaleHandshakesLocked --
	// AWS's Handshake response object has no matching field, so this is
	// never serialized on the wire (see handshakeObject).
	StateChangedAt time.Time           `json:"stateChangedAt"`
	ID             string              `json:"id"`
	ARN            string              `json:"arn"`
	Action         string              `json:"action"`
	State          string              `json:"state"`
	Parties        []HandshakeParty    `json:"parties"`
	Resources      []HandshakeResource `json:"resources"`
	// PendingTags holds InviteAccountToOrganizationInput.Tags until the
	// handshake is accepted, at which point they're applied to the newly
	// created Account. AWS's Handshake response object has no Tags field, so
	// this is internal bookkeeping only -- never serialized on the wire.
	PendingTags []Tag `json:"-"`
}

Handshake represents an AWS Organizations handshake invitation or transfer.

type HandshakeParty 

type HandshakeParty struct {
	ID   string `json:"id"`
	Type string `json:"type"`
}

HandshakeParty is a participant in a handshake.

type HandshakeResource 

type HandshakeResource struct {
	Type      string              `json:"type"`
	Value     string              `json:"value"`
	Resources []HandshakeResource `json:"resources,omitempty"`
}

HandshakeResource holds a resource associated with a handshake.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory storage for the Organizations service.

Phase 3.3 datalayer note: accounts, ous, policies, createStatuses, handshakes, and serviceAccess are store.Table[T]s registered on registry (see store_setup.go); delegatedAdmins is a store.Table[DelegatedAdmin] deliberately NOT registered on registry because its composite key relies on a json:"-" field (see store_setup.go's doc comment). The remaining map fields below (targetPolicies, accountParent, policyTargets, ouParent, tags, emailToAccountID, ousByParent, accountChildrenByParent) are left as plain maps: each holds a bare, non-*T value ([]string, string, map[string]string, or map[string]bool), which does not fit store.Table's keyed-by-*T shape.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory Organizations backend.

func (*InMemoryBackend) AcceptHandshake 

func (b *InMemoryBackend) AcceptHandshake(handshakeID string) (*Handshake, error)

AcceptHandshake accepts an OPEN handshake. For INVITE handshakes, the invited account is added to the organization.

func (*InMemoryBackend) AccountID 

func (b *InMemoryBackend) AccountID() string

AccountID returns the configured AWS account ID.

func (*InMemoryBackend) AddAccountInternal 

func (b *InMemoryBackend) AddAccountInternal(a *Account)

AddAccountInternal seeds an account directly under the root for testing. Requires an organization to have been created first.

func (*InMemoryBackend) AddHandshakeInternal 

func (b *InMemoryBackend) AddHandshakeInternal(h *Handshake)

AddHandshakeInternal seeds a handshake directly for testing. If h.ID is empty, a new ID is generated. If h.ExpirationTimestamp is zero, it is set to now + handshakeExpirationDuration.

func (*InMemoryBackend) AddOUInternal 

func (b *InMemoryBackend) AddOUInternal(ou *OrganizationalUnit)

AddOUInternal seeds an OU directly for testing. Requires an organization to have been created first.

func (*InMemoryBackend) AddPolicyInternal 

func (b *InMemoryBackend) AddPolicyInternal(p *Policy)

AddPolicyInternal seeds a policy directly for testing.

func (*InMemoryBackend) AddResponsibilityTransferInternal added in v1.3.1 

func (b *InMemoryBackend) AddResponsibilityTransferInternal(rt *ResponsibilityTransfer)

AddResponsibilityTransferInternal seeds a responsibility transfer directly for testing. If rt.ID is empty, a new ID is generated. If rt.ARN is empty and an org exists, it is derived assuming the outbound direction (see InviteOrganizationToTransferResponsibility; there is no inbound case for this backend to seed -- ListInboundResponsibilityTransfers).

func (*InMemoryBackend) AttachPolicy 

func (b *InMemoryBackend) AttachPolicy(policyID, targetID string) error

AttachPolicy attaches a policy to a target.

func (*InMemoryBackend) CancelHandshake 

func (b *InMemoryBackend) CancelHandshake(handshakeID string) (*Handshake, error)

CancelHandshake cancels an OPEN handshake.

func (*InMemoryBackend) CloseAccount 

func (b *InMemoryBackend) CloseAccount(accountID string) error

CloseAccount marks an account as PENDING_CLOSURE.

func (*InMemoryBackend) CreateAccount 

func (b *InMemoryBackend) CreateAccount(
	name, email, roleName, iamUserAccessToBilling string,
	tags []Tag,
) (*CreateAccountStatus, error)

CreateAccount creates a new account and returns its status.

func (*InMemoryBackend) CreateGovCloudAccount 

func (b *InMemoryBackend) CreateGovCloudAccount(
	name, email, roleName, iamUserAccessToBilling string,
	tags []Tag,
) (*CreateAccountStatus, error)

CreateGovCloudAccount creates a commercial account paired with a GovCloud account.

func (*InMemoryBackend) CreateOrganization 

func (b *InMemoryBackend) CreateOrganization(featureSet string) (*Organization, *Root, error)

CreateOrganization creates a new organization.

func (*InMemoryBackend) CreateOrganizationalUnit 

func (b *InMemoryBackend) CreateOrganizationalUnit(
	parentID, name string,
	tags []Tag,
) (*OrganizationalUnit, error)

CreateOrganizationalUnit creates a new OU under the given parent.

func (*InMemoryBackend) CreatePolicy 

func (b *InMemoryBackend) CreatePolicy(
	name, description, content, policyType string,
	tags []Tag,
) (*Policy, error)

CreatePolicy creates a new policy.

func (*InMemoryBackend) DeclineHandshake 

func (b *InMemoryBackend) DeclineHandshake(handshakeID string) (*Handshake, error)

DeclineHandshake declines an OPEN handshake.

func (*InMemoryBackend) DeleteOrganization 

func (b *InMemoryBackend) DeleteOrganization() error

DeleteOrganization removes the organization.

func (*InMemoryBackend) DeleteOrganizationalUnit 

func (b *InMemoryBackend) DeleteOrganizationalUnit(ouID string) error

DeleteOrganizationalUnit removes an OU.

func (*InMemoryBackend) DeletePolicy 

func (b *InMemoryBackend) DeletePolicy(policyID string) error

DeletePolicy removes a policy.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy() error

DeleteResourcePolicy removes the organization resource policy.

func (*InMemoryBackend) DeregisterDelegatedAdministrator 

func (b *InMemoryBackend) DeregisterDelegatedAdministrator(
	accountID, servicePrincipal string,
) error

DeregisterDelegatedAdministrator removes a delegated admin.

func (*InMemoryBackend) DescribeAccount 

func (b *InMemoryBackend) DescribeAccount(accountID string) (*Account, error)

DescribeAccount returns an account by ID.

func (*InMemoryBackend) DescribeCreateAccountStatus 

func (b *InMemoryBackend) DescribeCreateAccountStatus(
	requestID string,
) (*CreateAccountStatus, error)

DescribeCreateAccountStatus returns the status of a CreateAccount request.

func (*InMemoryBackend) DescribeEffectivePolicy 

func (b *InMemoryBackend) DescribeEffectivePolicy(
	policyType, targetID string,
) (*EffectivePolicy, error)

DescribeEffectivePolicy returns the effective policy of a given type for a target.

func (*InMemoryBackend) DescribeHandshake 

func (b *InMemoryBackend) DescribeHandshake(handshakeID string) (*Handshake, error)

DescribeHandshake returns a handshake by ID.

func (*InMemoryBackend) DescribeOrganization 

func (b *InMemoryBackend) DescribeOrganization() (*Organization, error)

DescribeOrganization returns the current organization.

func (*InMemoryBackend) DescribeOrganizationalUnit 

func (b *InMemoryBackend) DescribeOrganizationalUnit(ouID string) (*OrganizationalUnit, error)

DescribeOrganizationalUnit returns an OU by ID.

func (*InMemoryBackend) DescribePolicy 

func (b *InMemoryBackend) DescribePolicy(policyID string) (*Policy, error)

DescribePolicy returns a policy by ID.

func (*InMemoryBackend) DescribeResourcePolicy 

func (b *InMemoryBackend) DescribeResourcePolicy() (*ResourcePolicy, error)

DescribeResourcePolicy returns the organization resource policy.

func (*InMemoryBackend) DescribeResponsibilityTransfer 

func (b *InMemoryBackend) DescribeResponsibilityTransfer(transferID string) (*ResponsibilityTransfer, error)

DescribeResponsibilityTransfer returns a responsibility transfer by its own Id (rt-..., not the Id of its ActiveHandshakeId) -- api_op_DescribeResponsibilityTransfer.go's Input.Id and Output.ResponsibilityTransfer (awsAwsjson11_deserializeOpDocumentDescribeResponsibilityTransferOutput, deserializers.go).

func (*InMemoryBackend) DetachPolicy 

func (b *InMemoryBackend) DetachPolicy(policyID, targetID string) error

DetachPolicy detaches a policy from a target.

func (*InMemoryBackend) DisableAWSServiceAccess 

func (b *InMemoryBackend) DisableAWSServiceAccess(servicePrincipal string) error

DisableAWSServiceAccess disables a service principal.

func (*InMemoryBackend) DisablePolicyType 

func (b *InMemoryBackend) DisablePolicyType(rootID, policyType string) (*Root, error)

DisablePolicyType disables a policy type on the root.

func (*InMemoryBackend) EnableAWSServiceAccess 

func (b *InMemoryBackend) EnableAWSServiceAccess(servicePrincipal string) error

EnableAWSServiceAccess enables a service principal for org-wide access.

func (*InMemoryBackend) EnableAllFeatures 

func (b *InMemoryBackend) EnableAllFeatures() (*Handshake, error)

EnableAllFeatures creates an ENABLE_ALL_FEATURES handshake and returns it. Real AWS sends this handshake to all member accounts to approve the feature upgrade.

func (*InMemoryBackend) EnablePolicyType 

func (b *InMemoryBackend) EnablePolicyType(rootID, policyType string) (*Root, error)

EnablePolicyType enables a policy type on the root.

func (*InMemoryBackend) EnsureOrgExists 

func (b *InMemoryBackend) EnsureOrgExists() error

EnsureOrgExists returns ErrOrgNotFound if no org exists (for operations that require it).

func (*InMemoryBackend) InviteAccountToOrganization 

func (b *InMemoryBackend) InviteAccountToOrganization(
	target HandshakeParty,
	notes string,
	tags []Tag,
) (*Handshake, error)

func (*InMemoryBackend) InviteOrganizationToTransferResponsibility 

func (b *InMemoryBackend) InviteOrganizationToTransferResponsibility(
	target HandshakeParty,
	params TransferResponsibilityParams,
) (*Handshake, error)

InviteOrganizationToTransferResponsibility creates an OPEN invitation for org-to-org responsibility transfer. SourceName/StartTimestamp/Type are required InviteOrganizationToTransferResponsibilityInput members with no first-class Handshake field to carry them, so they are embedded as HandshakeResource entries the same way InviteAccountToOrganization/EnableAllFeatures embed their own extra fields (NOTES, MASTER_EMAIL) -- RESPONSIBILITY_TRANSFER/TRANSFER_START_TIMESTAMP/TRANSFER_TYPE are the matching HandshakeResourceType enum values (types/enums.go).

func (*InMemoryBackend) LeaveOrganization 

func (b *InMemoryBackend) LeaveOrganization() error

LeaveOrganization is callable only from a member account (SDK doc comment on the operation), but this backend's caller identity is always the management account (organization.go's CreateOrganization: b.accountID becomes org.MasterAccountID), so it always fails.

func (*InMemoryBackend) LeaveOrganizationAs 

func (b *InMemoryBackend) LeaveOrganizationAs(accountID string) error

LeaveOrganizationAs lets a member account leave; the management account still gets MasterCannotLeaveOrganizationException.

func (*InMemoryBackend) ListAWSServiceAccessForOrganization 

func (b *InMemoryBackend) ListAWSServiceAccessForOrganization() ([]EnabledServicePrincipal, error)

ListAWSServiceAccessForOrganization returns enabled service principals.

func (*InMemoryBackend) ListAccounts 

func (b *InMemoryBackend) ListAccounts() ([]*Account, error)

func (*InMemoryBackend) ListAccountsForParent 

func (b *InMemoryBackend) ListAccountsForParent(parentID string) ([]*Account, error)

ListAccountsForParent returns all accounts directly under a parent.

func (*InMemoryBackend) ListAccountsWithInvalidEffectivePolicy 

func (b *InMemoryBackend) ListAccountsWithInvalidEffectivePolicy(
	policyType string,
) ([]*Account, error)

ListAccountsWithInvalidEffectivePolicy returns accounts with invalid effective policies (always empty for stub).

func (*InMemoryBackend) ListChildren 

func (b *InMemoryBackend) ListChildren(parentID, childType string) ([]ChildSummary, error)

ListChildren returns children of a given type under a parent.

func (*InMemoryBackend) ListCreateAccountStatus 

func (b *InMemoryBackend) ListCreateAccountStatus(states []string) ([]*CreateAccountStatus, error)

ListCreateAccountStatus returns all CreateAccount status records, optionally filtered by state.

func (*InMemoryBackend) ListDelegatedAdministrators 

func (b *InMemoryBackend) ListDelegatedAdministrators(
	servicePrincipal string,
) ([]*DelegatedAdmin, error)

ListDelegatedAdministrators lists delegated admins, optionally filtered by service principal.

func (*InMemoryBackend) ListDelegatedServicesForAccount 

func (b *InMemoryBackend) ListDelegatedServicesForAccount(
	accountID string,
) ([]DelegatedService, error)

ListDelegatedServicesForAccount returns service principals for which an account is a delegated admin.

func (*InMemoryBackend) ListEffectivePolicyValidationErrors 

func (b *InMemoryBackend) ListEffectivePolicyValidationErrors(policyType, _ string) ([]any, error)

ListEffectivePolicyValidationErrors returns validation errors for an effective policy (always empty for stub).

func (*InMemoryBackend) ListHandshakesForAccount 

func (b *InMemoryBackend) ListHandshakesForAccount(actionTypeFilter string) ([]*Handshake, error)

ListHandshakesForAccount returns all handshakes visible to the calling account. actionTypeFilter optionally restricts results to handshakes with the given Action value.

func (*InMemoryBackend) ListHandshakesForOrganization 

func (b *InMemoryBackend) ListHandshakesForOrganization(actionTypeFilter string) ([]*Handshake, error)

ListHandshakesForOrganization returns all handshakes for the organization. actionTypeFilter optionally restricts results to handshakes with the given Action value.

func (*InMemoryBackend) ListInboundResponsibilityTransfers 

func (b *InMemoryBackend) ListInboundResponsibilityTransfers(_, _ string) ([]*ResponsibilityTransfer, error)

ListInboundResponsibilityTransfers returns responsibility transfers where this account manages responsibilities for another organization -- transfers sent TO this account by another organization's management account. InviteOrganizationToTransferResponsibility can only be called from the sending account (api_op_InviteOrganizationToTransferResponsibility.go doc comment), and this single-account backend has no way to simulate a transfer initiated by a foreign account, so every TRANSFER_RESPONSIBILITY handshake this backend ever creates is outbound -- see ListOutboundResponsibilityTransfers. Returning empty here is honest given that structural limit, not a stub: there is no fabricated data to return. transferType/id are accepted (matching ListInboundResponsibilityTransfersInput's Type/Id members) but unused, since the result is always empty.

func (*InMemoryBackend) ListOrganizationalUnitsForParent 

func (b *InMemoryBackend) ListOrganizationalUnitsForParent(
	parentID string,
) ([]*OrganizationalUnit, error)

ListOrganizationalUnitsForParent returns all OUs under a parent.

func (*InMemoryBackend) ListOutboundResponsibilityTransfers 

func (b *InMemoryBackend) ListOutboundResponsibilityTransfers(transferType string) ([]*ResponsibilityTransfer, error)

ListOutboundResponsibilityTransfers returns responsibility transfers initiated by this org, optionally filtered by transferType (ListOutboundResponsibilityTransfersInput.Type).

func (*InMemoryBackend) ListParents 

func (b *InMemoryBackend) ListParents(childID string) ([]ParentSummary, error)

ListParents returns the parents of an account or OU.

func (*InMemoryBackend) ListPolicies 

func (b *InMemoryBackend) ListPolicies(filter string) ([]*Policy, error)

ListPolicies returns all policies of a given type. AWS requires a non-empty Filter; empty filter returns InvalidInputException.

func (*InMemoryBackend) ListPoliciesForTarget 

func (b *InMemoryBackend) ListPoliciesForTarget(targetID, filter string) ([]*Policy, error)

ListPoliciesForTarget returns policies attached to a target, filtered by type. AWS requires a non-empty Filter; empty filter returns InvalidInputException.

func (*InMemoryBackend) ListRoots 

func (b *InMemoryBackend) ListRoots() ([]*Root, error)

ListRoots returns the organization roots.

func (*InMemoryBackend) ListTagsForResource 

func (b *InMemoryBackend) ListTagsForResource(resourceID string) ([]Tag, error)

ListTagsForResource returns all tags for a resource.

func (*InMemoryBackend) ListTargetsForPolicy 

func (b *InMemoryBackend) ListTargetsForPolicy(policyID string) ([]PolicyTargetSummary, error)

ListTargetsForPolicy returns targets that a policy is attached to.

func (*InMemoryBackend) MoveAccount 

func (b *InMemoryBackend) MoveAccount(accountID, sourceParentID, destParentID string) error

MoveAccount moves an account from one parent to another.

func (*InMemoryBackend) OnAccountLeave 

func (b *InMemoryBackend) OnAccountLeave(fn func(accountID string))

OnAccountLeave registers fn to run (outside the backend lock) after an account has left the organization.

func (*InMemoryBackend) OrganizationalUnitIDsForAccount 

func (b *InMemoryBackend) OrganizationalUnitIDsForAccount(accountID string) ([]string, error)

OrganizationalUnitIDsForAccount returns the OU IDs enclosing accountID, nearest first; the root is excluded.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(content string, tags []Tag) (*ResourcePolicy, error)

PutResourcePolicy creates or replaces the organization resource policy. tags is only honored on initial creation (PutResourcePolicyInput doc comment: "Calls with tags apply to the initial creation of the resource policy, otherwise an exception is thrown" -- a subsequent Put reusing the same ID doesn't re-tag, matching real AWS since ListTagsForResource/ TagResource are the documented way to change tags afterward).

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the configured AWS region.

func (*InMemoryBackend) RegisterDelegatedAdministrator 

func (b *InMemoryBackend) RegisterDelegatedAdministrator(accountID, servicePrincipal string) error

RegisterDelegatedAdministrator registers a delegated admin for a service.

func (*InMemoryBackend) RemoveAccountFromOrganization 

func (b *InMemoryBackend) RemoveAccountFromOrganization(accountID string) error

RemoveAccountFromOrganization removes an account from the organization.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all organization state.

func (*InMemoryBackend) ResolveAccountIDsUnderParent added in v1.3.1 

func (b *InMemoryBackend) ResolveAccountIDsUnderParent(parentID string) ([]string, error)

ResolveAccountIDsUnderParent returns every account ID under parentID (an OU or root ID), recursing into child OUs. Used by CloudFormation to expand SERVICE_MANAGED StackSet deployment targets against the real OU tree.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot.

func (*InMemoryBackend) SetAccountProvisioner 

func (b *InMemoryBackend) SetAccountProvisioner(p AccountProvisioner)

SetAccountProvisioner wires the IAM seam; when nil, created accounts get no role.

func (*InMemoryBackend) SetLifecycleDelay 

func (b *InMemoryBackend) SetLifecycleDelay(d time.Duration)

SetLifecycleDelay sets how long CreateAccount/CreateGovCloudAccount stay IN_PROGRESS before settling. Zero settles synchronously.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(resourceID string, tags []Tag) error

TagResource adds or updates tags on a resource.

func (*InMemoryBackend) TagResourceByARN added in v1.3.1 

func (b *InMemoryBackend) TagResourceByARN(resourceARN string, newTags map[string]string) error

TagResourceByARN is TagResource's cross-service tagging entry point: it resolves resourceARN to the internal resourceID TagResource actually keys on.

func (*InMemoryBackend) TaggedResources added in v1.3.1 

func (b *InMemoryBackend) TaggedResources() []TaggedEntry

TaggedResources returns every taggable Organizations resource that carries at least one tag, across all four cross-service-taggable kinds (account, root, OU, policy).

func (*InMemoryBackend) TerminateResponsibilityTransfer 

func (b *InMemoryBackend) TerminateResponsibilityTransfer(
	transferID string, endTimestamp *time.Time,
) (*ResponsibilityTransfer, error)

TerminateResponsibilityTransfer ends an ACCEPTED responsibility transfer, setting EndTimestamp (defaulting to now when the caller doesn't supply one -- TerminateResponsibilityTransferInput.EndTimestamp is optional). ErrInvalidResponsibilityTransferTransition/ErrResponsibilityTransferAlreadyInStatus are both declared on this op's own deserializeOpErrorTerminateResponsibilityTransfer switch (deserializers.go), distinguishing "never accepted" from "already terminated".

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(resourceID string, tagKeys []string) error

UntagResource removes tags from a resource.

func (*InMemoryBackend) UntagResourceByARN added in v1.3.1 

func (b *InMemoryBackend) UntagResourceByARN(resourceARN string, tagKeys []string) error

UntagResourceByARN is UntagResource's cross-service tagging entry point: it resolves resourceARN to the internal resourceID UntagResource actually keys on.

func (*InMemoryBackend) UpdateOrganizationalUnit 

func (b *InMemoryBackend) UpdateOrganizationalUnit(ouID, name string) (*OrganizationalUnit, error)

UpdateOrganizationalUnit renames an OU.

func (*InMemoryBackend) UpdatePolicy 

func (b *InMemoryBackend) UpdatePolicy(
	policyID, name string, description *string, content string,
) (*Policy, error)

UpdatePolicy updates a policy.

func (*InMemoryBackend) UpdateResponsibilityTransfer 

func (b *InMemoryBackend) UpdateResponsibilityTransfer(transferID, name string) (*ResponsibilityTransfer, error)

UpdateResponsibilityTransfer renames a transfer -- the only field UpdateResponsibilityTransferInput carries besides Id (api_op_UpdateResponsibilityTransfer.go's doc comment: "You can update the name assigned to a transfer."). Unlike TerminateResponsibilityTransfer, its error switch declares no transition-related exception, so renaming is allowed at any Status.

type Organization 

type Organization struct {
	ID                   string              `json:"id"`
	ARN                  string              `json:"arn"`
	FeatureSet           string              `json:"featureSet"`
	MasterAccountID      string              `json:"masterAccountID"`
	MasterAccountARN     string              `json:"masterAccountARN"`
	MasterAccountEmail   string              `json:"masterAccountEmail"`
	AvailablePolicyTypes []PolicyTypeSummary `json:"availablePolicyTypes,omitempty"`
}

Organization represents an AWS organization.

type OrganizationalUnit 

type OrganizationalUnit struct {
	ID       string `json:"id"`
	ARN      string `json:"arn"`
	Name     string `json:"name"`
	ParentID string `json:"parentID"`
	// Path is derived from ParentID/ouParent at read time (see paths.go)
	// and deliberately excluded from persistence -- see Account.Paths.
	Path string `json:"-"`
}

OrganizationalUnit represents an OU in the organization hierarchy.

type ParentSummary 

type ParentSummary struct {
	ID   string `json:"Id"`
	Type string `json:"Type"`
}

ParentSummary describes the parent of an account or OU.

type Policy 

type Policy struct {
	Content       string        `json:"content"`
	PolicySummary PolicySummary `json:"policySummary"`
}

Policy represents an Organizations policy.

type PolicySummary 

type PolicySummary struct {
	ID          string `json:"id"`
	ARN         string `json:"arn"`
	Name        string `json:"name"`
	Description string `json:"description"`
	Type        string `json:"type"`
	AwsManaged  bool   `json:"awsManaged"`
}

PolicySummary holds metadata about a policy.

type PolicyTargetSummary 

type PolicyTargetSummary struct {
	TargetID string `json:"targetID"`
	ARN      string `json:"arn"`
	Name     string `json:"name"`
	Type     string `json:"type"`
}

PolicyTargetSummary describes a target of a policy attachment.

type PolicyTypeSummary 

type PolicyTypeSummary struct {
	Type   string `json:"type"`
	Status string `json:"status"`
}

PolicyTypeSummary holds policy type enablement state for a root.

type Provider 

type Provider struct{}

Provider implements service.Provider for the Organizations service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Organizations service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type ResourcePolicy 

type ResourcePolicy struct {
	ID      string `json:"id"`
	ARN     string `json:"arn"`
	Content string `json:"content"`
}

ResourcePolicy represents the organization resource-based policy.

type ResponsibilityTransfer added in v1.3.1 

type ResponsibilityTransfer struct {
	StartTimestamp    time.Time           `json:"startTimestamp"`
	EndTimestamp      time.Time           `json:"endTimestamp"`
	ID                string              `json:"id"`
	ARN               string              `json:"arn"`
	ActiveHandshakeID string              `json:"activeHandshakeID"`
	Name              string              `json:"name"`
	Status            string              `json:"status"`
	Type              string              `json:"type"`
	Source            TransferParticipant `json:"source"`
	Target            TransferParticipant `json:"target"`
}

ResponsibilityTransfer represents a transfer arrangement between two management accounts, one of which designates the other with specified responsibilities (currently only BILLING) for its organization. Distinct from Handshake: types.ResponsibilityTransfer (awsAwsjson11_deserializeDocumentResponsibilityTransfer, deserializers.go) is its own wire shape, not a Handshake. EndTimestamp is the zero time.Time until TerminateResponsibilityTransfer sets it -- a transfer that hasn't ended has no EndTimestamp on the wire, not a fabricated one.

type Root 

type Root struct {
	ID          string              `json:"id"`
	ARN         string              `json:"arn"`
	Name        string              `json:"name"`
	PolicyTypes []PolicyTypeSummary `json:"policyTypes,omitempty"`
}

Root represents the root container in an organization.

type StorageBackend 

type StorageBackend interface {
	// Organization operations
	CreateOrganization(featureSet string) (*Organization, *Root, error)
	DescribeOrganization() (*Organization, error)
	DeleteOrganization() error
	EnsureOrgExists() error

	// Account operations
	CreateAccount(name, email, roleName, iamUserAccessToBilling string, tags []Tag) (*CreateAccountStatus, error)
	CreateGovCloudAccount(
		name, email, roleName, iamUserAccessToBilling string,
		tags []Tag,
	) (*CreateAccountStatus, error)
	DescribeCreateAccountStatus(requestID string) (*CreateAccountStatus, error)
	DescribeAccount(accountID string) (*Account, error)
	ListAccounts() ([]*Account, error)
	RemoveAccountFromOrganization(accountID string) error
	MoveAccount(accountID, sourceParentID, destParentID string) error
	CloseAccount(accountID string) error

	// Root operations
	ListRoots() ([]*Root, error)

	// OU operations
	CreateOrganizationalUnit(parentID, name string, tags []Tag) (*OrganizationalUnit, error)
	DescribeOrganizationalUnit(ouID string) (*OrganizationalUnit, error)
	DeleteOrganizationalUnit(ouID string) error
	UpdateOrganizationalUnit(ouID, name string) (*OrganizationalUnit, error)
	ListOrganizationalUnitsForParent(parentID string) ([]*OrganizationalUnit, error)
	ListAccountsForParent(parentID string) ([]*Account, error)
	ListParents(childID string) ([]ParentSummary, error)
	ListChildren(parentID, childType string) ([]ChildSummary, error)

	// Policy operations
	CreatePolicy(name, description, content, policyType string, tags []Tag) (*Policy, error)
	DescribePolicy(policyID string) (*Policy, error)
	UpdatePolicy(policyID, name string, description *string, content string) (*Policy, error)
	DeletePolicy(policyID string) error
	ListPolicies(filter string) ([]*Policy, error)
	AttachPolicy(policyID, targetID string) error
	DetachPolicy(policyID, targetID string) error
	ListPoliciesForTarget(targetID, filter string) ([]*Policy, error)
	ListTargetsForPolicy(policyID string) ([]PolicyTargetSummary, error)
	EnablePolicyType(rootID, policyType string) (*Root, error)
	DisablePolicyType(rootID, policyType string) (*Root, error)

	// Tag operations
	TagResource(resourceID string, tags []Tag) error
	UntagResource(resourceID string, tagKeys []string) error
	ListTagsForResource(resourceID string) ([]Tag, error)

	// Service access operations
	EnableAWSServiceAccess(servicePrincipal string) error
	DisableAWSServiceAccess(servicePrincipal string) error
	ListAWSServiceAccessForOrganization() ([]EnabledServicePrincipal, error)

	// Delegated admin operations
	RegisterDelegatedAdministrator(accountID, servicePrincipal string) error
	DeregisterDelegatedAdministrator(accountID, servicePrincipal string) error
	ListDelegatedAdministrators(servicePrincipal string) ([]*DelegatedAdmin, error)

	// Handshake operations
	AcceptHandshake(handshakeID string) (*Handshake, error)
	CancelHandshake(handshakeID string) (*Handshake, error)
	DeclineHandshake(handshakeID string) (*Handshake, error)
	DescribeHandshake(handshakeID string) (*Handshake, error)
	DescribeResponsibilityTransfer(transferID string) (*ResponsibilityTransfer, error)
	EnableAllFeatures() (*Handshake, error)
	InviteAccountToOrganization(target HandshakeParty, notes string, tags []Tag) (*Handshake, error)
	InviteOrganizationToTransferResponsibility(
		target HandshakeParty, params TransferResponsibilityParams,
	) (*Handshake, error)
	LeaveOrganization() error
	LeaveOrganizationAs(accountID string) error
	ListHandshakesForAccount(actionTypeFilter string) ([]*Handshake, error)
	ListHandshakesForOrganization(actionTypeFilter string) ([]*Handshake, error)
	ListInboundResponsibilityTransfers(transferType, id string) ([]*ResponsibilityTransfer, error)
	ListOutboundResponsibilityTransfers(transferType string) ([]*ResponsibilityTransfer, error)
	TerminateResponsibilityTransfer(transferID string, endTimestamp *time.Time) (*ResponsibilityTransfer, error)
	UpdateResponsibilityTransfer(transferID, name string) (*ResponsibilityTransfer, error)
	AddHandshakeInternal(h *Handshake)
	AddResponsibilityTransferInternal(rt *ResponsibilityTransfer)

	// Account status operations
	ListCreateAccountStatus(states []string) ([]*CreateAccountStatus, error)
	ListAccountsWithInvalidEffectivePolicy(policyType string) ([]*Account, error)

	// Delegated service operations
	ListDelegatedServicesForAccount(accountID string) ([]DelegatedService, error)

	// Effective policy validation operations
	ListEffectivePolicyValidationErrors(policyType, targetID string) ([]any, error)

	// Resource policy operations
	DeleteResourcePolicy() error
	DescribeResourcePolicy() (*ResourcePolicy, error)
	PutResourcePolicy(content string, tags []Tag) (*ResourcePolicy, error)

	// Effective policy operations
	DescribeEffectivePolicy(policyType, targetID string) (*EffectivePolicy, error)

	// Lifecycle
	Reset()
	AccountID() string
	Region() string
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend defines the interface for the Organizations in-memory backend. All mutating methods must be safe for concurrent use.

type Tag 

type Tag struct {
	Key   string `json:"Key"`
	Value string `json:"Value"`
}

Tag is a key-value pair attached to an Organizations resource.

type TaggedEntry added in v1.3.1 

type TaggedEntry struct {
	Tags map[string]string
	ARN  string
}

TaggedEntry pairs a taggable Organizations resource ARN with its tag set, for cross-service tagging discovery (see cli.go's wireTaggingOrganizations).

type TransferParticipant added in v1.3.1 

type TransferParticipant struct {
	ManagementAccountID    string `json:"managementAccountID"`
	ManagementAccountEmail string `json:"managementAccountEmail"`
}

TransferParticipant identifies one management account on either side of a ResponsibilityTransfer. Fields are independently optional: a participant invited by EMAIL has no known ManagementAccountID until they join, and one invited by ACCOUNT has no known ManagementAccountEmail -- this backend never fabricates the missing half (types.TransferParticipant, awsAwsjson11_deserializeDocumentTransferParticipant, deserializers.go).

type TransferResponsibilityParams added in v1.3.1 

type TransferResponsibilityParams struct {
	StartTimestamp time.Time
	SourceName     string
	Type           string
	Notes          string
}

TransferResponsibilityParams groups InviteOrganizationToTransferResponsibilityInput's fields beyond Target: SourceName, StartTimestamp, and Type are all required members (validateOpInviteOrganizationToTransferResponsibilityInput, validators.go); Notes is optional, matching InviteAccountToOrganization's Notes.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.