Organization Policy Types | AWS CDK Landing Zone

A policy type has to be enabled at your organization root before you can attach a policy of that family anywhere in the organization. The landing zone enables the families it relies on for you, so there is no config file to edit for this: the organization phase (LandingZoneOrganizationStack) turns them on when it creates the organization.

The actual policies live elsewhere. Service Control Policies are defined in service-control-policies/ and attached in organization-structure.ts.

Enabled by default

Policy type	What it lets you attach
`SERVICE_CONTROL_POLICY`	Service Control Policies, including every SCP the landing zone ships
`RESOURCE_CONTROL_POLICY`	Resource control policies
`BACKUP_POLICY`	AWS Backup policies
`TAG_POLICY`	Tag policies
`SECURITYHUB_POLICY`	Security Hub configuration policies
`INSPECTOR_POLICY`	Amazon Inspector policies

Enabling a family only makes it available for attachment. It does not create or attach any policy on its own, so BACKUP_POLICY and TAG_POLICY have no effect until you attach a policy of that type.

Changing the enabled families

Pass organizationPolicyTypes into createLandingZoneStacks in src/main.ts. It is optional, and leaving it out gives you the default list above.

To keep the defaults and add a family:

createLandingZoneStacks(app, {
  settings: landingZoneSettings,
  organizationStructure,
  alternateContacts,
  organizationPolicyTypes: {
    additionalPolicyTypes: [OrganizationPolicyTypes.AISERVICES_OPT_OUT_POLICY],
  },
  phase: deploymentPhaseFromEnvironment(),
});

Options

organizationPolicyTypes is an OrganizationPolicyTypesProps:

Field	Type	Required	Description
`policyTypes`	`string[]`	No	Exact list of policy types to enable. When set, `includeDefaults`, `additionalPolicyTypes`, and `excludePolicyTypes` are ignored.
`includeDefaults`	`boolean`	No	Start from the default policy type set. Default `true`. Only applies when `policyTypes` is omitted.
`additionalPolicyTypes`	`string[]`	No	Policy types to add to the resolved default list.
`excludePolicyTypes`	`string[]`	No	Policy types to remove from the resolved list.

Use the OrganizationPolicyTypes constants for the values (for example OrganizationPolicyTypes.SERVICE_CONTROL_POLICY). They cover the current Organizations policy families, including newer ones such as RESOURCE_CONTROL_POLICY, SECURITYHUB_POLICY, and INSPECTOR_POLICY.

Things to know

Keep SERVICE_CONTROL_POLICY enabled. It is what makes the shipped SCPs and any custom SCP you attach in organization-structure.ts work. Only exclude it if you are removing SCPs from the organization entirely.
Enable a family before you attach a policy of that type. If you attach a backup or tag policy while its family is off, the attachment fails at deploy time.
Removing a policy type requires that no policies of that type are attached. AWS Organizations refuses to disable a policy family while any policy of that family is still attached anywhere in the organization, so detach them first.