Organization Policy Types

A policy type has to be enabled at your organization root before you can attach a policy of that family anywhere in the organization. The landing zone enables the families it relies on for you, so there is no config file to edit for this: the organization phase (LandingZoneOrganizationStack) turns them on when it creates the organization.

The actual policies live elsewhere. Service Control Policies, declarative policies, and tag policies are defined in policies/ (Service Control Policies, Declarative Policies, and Tag Policies) and attached in organization-structure.ts.

Enabled by default

Enabling a family only makes it available for attachment. It does not create or attach any policy on its own, so BACKUP_POLICY has no effect until you attach a policy of that type. DECLARATIVE_POLICY_EC2 and TAG_POLICY take effect through the policies the starter attaches. The exception is GUARDDUTY_POLICY: see Things to know.

Changing the enabled families

Pass organizationPolicyTypes into createLandingZoneStacks in src/main.ts. It is optional, and leaving it out gives you the default list above.

To keep the defaults and add a family:

createLandingZoneStacks(app, {
  settings: landingZoneSettings,
  organizationStructure,
  alternateContacts,
  organizationPolicyTypes: {
    additionalPolicyTypes: [PolicyType.AISERVICES_OPT_OUT_POLICY],
  },
  phase: deploymentPhaseFromEnvironment(),
});

Options

organizationPolicyTypes is an OrganizationPolicyTypesProps:

Use the PolicyType enum for the values (for example PolicyType.SERVICE_CONTROL_POLICY). It covers the current Organizations policy families, including newer ones such as RESOURCE_CONTROL_POLICY, SECURITYHUB_POLICY, INSPECTOR_POLICY, and GUARDDUTY_POLICY.

Things to know

• GUARDDUTY_POLICY replaces GuardDuty auto-enablement. Once the policy type is enabled, the Regional GuardDuty auto-enablement settings stop applying, even before a GuardDuty policy is attached (GuardDuty organization policies). The landing zone manages GuardDuty through organization policies, so keep GUARDDUTY_POLICY enabled. Its GuardDuty policies stay attached even with GuardDuty disabled in security-services.ts, so excluding the policy type makes the next deployment fail.
• Keep SERVICE_CONTROL_POLICY enabled. It is what makes the shipped SCPs and any custom SCP you attach in organization-structure.ts work. Only exclude it if you are removing SCPs from the organization entirely.
• Keep DECLARATIVE_POLICY_EC2 and TAG_POLICY enabled while their policies are attached. The starter attaches BlockPublicEc2Sharing and the two environment tag policies, so excluding either type fails the deployment while those policies stay attached. EC2 declarative policies also need TrustedAccessAwsService.EC2 in Trusted Access.
• Enable a family before you attach a policy of that type. If you attach a backup policy while its family is off, the attachment fails at deploy time.
• Removing a policy type requires that no policies of that type are attached. AWS Organizations refuses to disable a policy family while any policy of that family is still attached anywhere in the organization, so detach them first.