AWS CDK Landing Zone

Organization Policy Types

Enable AWS Organizations policy families such as SCPs, backup, tag, and resource control policies at the organization root in organization-policy-types.ts.

src/config/organization-policy-types.ts declares which AWS Organizations policy families are enabled at your organization root. A policy type has to be enabled before you can attach a policy of that type anywhere in the organization. This file turns the families on; the actual policies live elsewhere (Service Control Policies in organization-structure.ts and service-control-policies/).

The file exports a single organizationPolicyTypes object. The organization phase (LandingZoneOrganizationStack) reads it and enables each listed policy type at the root.

Options

organizationPolicyTypes is an OrganizationPolicyTypesProps. The starter sets an explicit policyTypes list, but the type also supports adjusting the built-in defaults.

FieldTypeRequiredDescription
policyTypesstring[]NoExact list of policy types to enable. When set, includeDefaults, additionalPolicyTypes, and excludePolicyTypes are ignored.
includeDefaultsbooleanNoStart from the default policy type set. Default true. Only applies when policyTypes is omitted.
additionalPolicyTypesstring[]NoPolicy types to add to the resolved default list.
excludePolicyTypesstring[]NoPolicy types to remove from the resolved list.

Use the OrganizationPolicyTypes constants for the values (for example OrganizationPolicyTypes.SERVICE_CONTROL_POLICY). The constants cover the current Organizations policy families, including newer ones such as RESOURCE_CONTROL_POLICY, SECURITYHUB_POLICY, and INSPECTOR_POLICY.

Example

The starter enables the six policy families the landing zone relies on:

export const organizationPolicyTypes = {
  policyTypes: [
    OrganizationPolicyTypes.BACKUP_POLICY,
    OrganizationPolicyTypes.INSPECTOR_POLICY,
    OrganizationPolicyTypes.RESOURCE_CONTROL_POLICY,
    OrganizationPolicyTypes.SECURITYHUB_POLICY,
    OrganizationPolicyTypes.SERVICE_CONTROL_POLICY,
    OrganizationPolicyTypes.TAG_POLICY,
  ],
} satisfies OrganizationPolicyTypesProps;

SERVICE_CONTROL_POLICY is what makes the shipped SCPs and any custom SCP you attach in organization-structure.ts work. Leave it in place unless you are removing SCPs from the organization entirely.

How it's used

LandingZoneOrganizationStack passes organizationPolicyTypes into OrganizationConstruct, which enables each policy type at the organization root. Enabling a type only makes that family available for attachment. It does not create or attach any policy on its own, so turning on BACKUP_POLICY or TAG_POLICY has no effect until you attach a policy of that type.

Things to know

  • Enable a family before you attach a policy of that type. If you add a new SCP, backup policy, or tag policy, confirm its family is in this list first, or the attachment fails at deploy time.
  • Removing a policy type requires that no policies of that type are attached. AWS Organizations refuses to disable a policy family while any policy of that family is still attached anywhere in the organization, so detach them first.
← Trusted AccessGuides →