Add table aws_organizations_organizational_unit and aws_organizations_root. closes #1674

aws/plugin.go

@@ -331,8 +331,10 @@ func Plugin(ctx context.Context) *plugin.Plugin {
 			"aws_oam_sink":                                                 tableAwsOAMSink(ctx),
 			"aws_opensearch_domain":                                        tableAwsOpenSearchDomain(ctx),
 			"aws_organizations_account":                                    tableAwsOrganizationsAccount(ctx),
+			"aws_organizations_organizational_unit":                        tableAwsOrganizationsOrganizationalUnit(ctx),
 			"aws_organizations_policy":                                     tableAwsOrganizationsPolicy(ctx),
 			"aws_organizations_policy_target":                              tableAwsOrganizationsPolicyTarget(ctx),
+			"aws_organizations_root":                                       tableAwsOrganizationsRoot(ctx),
 			"aws_pinpoint_app":                                             tableAwsPinpointApp(ctx),
 			"aws_pipes_pipe":                                               tableAwsPipes(ctx),
 			"aws_pricing_product":                                          tableAwsPricingProduct(ctx),

aws/table_aws_organizations_account.go

@@ -25,7 +25,10 @@ func tableAwsOrganizationsAccount(_ context.Context) *plugin.Table {
 		},
 		List: &plugin.ListConfig{
 			Hydrate: listOrganizationsAccounts,
-			Tags:    map[string]string{"service": "organizations", "action": "ListAccounts"},
+			KeyColumns: plugin.KeyColumnSlice{
+				{Name: "parent_id", Require: plugin.Optional},
+			},
+			Tags: map[string]string{"service": "organizations", "action": "ListAccounts"},
 		},
 		HydrateConfig: []plugin.HydrateConfig{
 			{
@@ -45,6 +48,12 @@ func tableAwsOrganizationsAccount(_ context.Context) *plugin.Table {
 				Description: "The unique identifier (account ID) of the member account.",
 				Type:        proto.ColumnType_STRING,
 			},
+			{
+				Name:        "parent_id",
+				Description: "The unique identifier (ID) for the parent root or organization unit (OU) whose accounts you want to list.",
+				Type:        proto.ColumnType_STRING,
+				Transform:   transform.FromQual("parent_id"),
+			},
 			{
 				Name:        "arn",
 				Description: "The Amazon Resource Name (ARN) of the account.",
@@ -104,6 +113,8 @@ func tableAwsOrganizationsAccount(_ context.Context) *plugin.Table {
 //// LIST FUNCTION
 
 func listOrganizationsAccounts(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {
+	parentId := d.EqualsQualString("parent_id")
+
 	// Get Client
 	svc, err := OrganizationClient(ctx, d)
 	if err != nil {
@@ -113,8 +124,7 @@ func listOrganizationsAccounts(ctx context.Context, d *plugin.QueryData, _ *plug
 
 	// The maximum number for MaxResults parameter is not defined by the API
 	// We have set the MaxResults to 1000 based on our test
-	maxItems := int32(20)
-	params := &organizations.ListAccountsInput{}
+	maxItems := int32(1000)
 
 	// Reduce the basic request limit down if the user has only requested a small number of rows
 	if d.QueryContext.Limit != nil {
@@ -128,6 +138,34 @@ func listOrganizationsAccounts(ctx context.Context, d *plugin.QueryData, _ *plug
 		}
 	}
 
+	// Lists the accounts in an organization that are contained by the specified target root or organizational unit (OU).
+	// If you specify the root, you get a list of all the accounts that aren't in any OU.
+	// If you specify an OU, you get a list of all the accounts in only that OU and not in any child OUs.
+	if parentId != "" {
+		maxItem := int32(20) // TODO for limit value in where clause
+		op, err := listOrganizationsAccountsForParent(ctx, d, svc, maxItem, &organizations.ListAccountsForParentInput{
+			ParentId:   &parentId,
+			MaxResults: &maxItems,
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		accounts := op.([]types.Account)
+		for _, account := range accounts {
+			d.StreamListItem(ctx, account)
+
+			// Context may get cancelled due to manual cancellation or if the limit has been reached
+			if d.RowsRemaining(ctx) == 0 {
+				return nil, nil
+			}
+		}
+
+		return nil, nil
+	}
+
+	params := &organizations.ListAccountsInput{}
+
 	params.MaxResults = &maxItems
 	paginator := organizations.NewListAccountsPaginator(svc, params, func(o *organizations.ListAccountsPaginatorOptions) {
 		o.Limit = maxItems
@@ -157,6 +195,28 @@ func listOrganizationsAccounts(ctx context.Context, d *plugin.QueryData, _ *plug
 	return nil, nil
 }
 
+func listOrganizationsAccountsForParent(ctx context.Context, d *plugin.QueryData, svc *organizations.Client, maxItems int32, params *organizations.ListAccountsForParentInput) (interface{}, error) {
+	paginator := organizations.NewListAccountsForParentPaginator(svc, params, func(o *organizations.ListAccountsForParentPaginatorOptions) {
+		o.Limit = maxItems
+		o.StopOnDuplicateToken = true
+	})
+
+	var accounts []types.Account
+	for paginator.HasMorePages() {
+		// apply rate limiting
+		d.WaitForListRateLimit(ctx)
+
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			plugin.Logger(ctx).Error("aws_organizations_account.listOrganizationsAccountsForParent", "api_error", err)
+			return nil, err
+		}
+
+		accounts = append(accounts, output.Accounts...)
+	}
+	return accounts, nil
+}
+
 //// HYDRATE FUNCTIONS
 
 func getOrganizationsAccount(ctx context.Context, d *plugin.QueryData, _ *plugin.HydrateData) (interface{}, error) {

aws/table_aws_organizations_organizational_unit.go

@@ -0,0 +1,194 @@
+package aws
+
+import (
+	"context"
+	"strings"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/organizations"
+	"github.com/aws/aws-sdk-go-v2/service/organizations/types"
+
+	"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin"
+	"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"
+)
+
+// The table will return the Organizational Units for the root account if parent_id is not specified in the query parameter.
+// If parent_id is specified in the query parameter then it will return the Organizational Units for the given parent.
+func tableAwsOrganizationsOrganizationalUnit(_ context.Context) *plugin.Table {
+	return &plugin.Table{
+		Name:        "aws_organizations_organizational_unit",
+		Description: "AWS Organizations Organizational Unit",
+		List: &plugin.ListConfig{
+			ParentHydrate: listOrganizationsRoots,
+			Hydrate:       listOrganizationsOrganizationalUnits,
+			IgnoreConfig: &plugin.IgnoreConfig{
+				ShouldIgnoreErrorFunc: shouldIgnoreErrors([]string{"ParentNotFoundException", "InvalidInputException"}),
+			},
+			KeyColumns: plugin.KeyColumnSlice{
+				{
+					Name:      "parent_id",
+					Require:   plugin.Optional,
+					Operators: []string{"="},
+				},
+			},
+		},
+		Columns: awsGlobalRegionColumns([]*plugin.Column{
+			{
+				Name:        "name",
+				Description: "The friendly name of this OU.",
+				Hydrate:     getOrganizationsOrganizationalUnit,
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "id",
+				Description: "The unique identifier (ID) associated with this OU.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "arn",
+				Description: "The Amazon Resource Name (ARN) of this OU.",
+				Hydrate:     getOrganizationsOrganizationalUnit,
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "parent_id",
+				Description: "The unique identifier (ID) of the root or OU whose child OUs you want to list.",
+				Type:        proto.ColumnType_STRING,
+			},
+			{
+				Name:        "path",
+				Description: "The OU path is a string representation that uniquely identifies the hierarchical location of an Organizational Unit within the AWS Organizations structure.",
+				Type:        proto.ColumnType_LTREE,
+			},
+
+			// Steampipe standard columns
+			{
+				Name:        "title",
+				Description: resourceInterfaceDescription("title"),
+				Type:        proto.ColumnType_STRING,
+				Hydrate:     getOrganizationsOrganizationalUnit,
+				Transform:   transform.FromField("Name"),
+			},
+			{
+				Name:        "akas",
+				Description: resourceInterfaceDescription("akas"),
+				Type:        proto.ColumnType_JSON,
+				Hydrate:     getOrganizationsOrganizationalUnit,
+				Transform:   transform.FromField("Arn").Transform(transform.EnsureStringArray),
+			},
+		}),
+	}
+}
+
+type OrganizationalUnit struct {
+	types.OrganizationalUnit
+	Path     string
+	ParentId string
+}
+
+//// LIST FUNCTION
+
+func listOrganizationsOrganizationalUnits(ctx context.Context, d *plugin.QueryData, h *plugin.HydrateData) (interface{}, error) {
+	parentId := *h.Item.(types.Root).Id
+
+	// Check if the parentId is provided
+	// The unique identifier (ID) of the root or OU whose child OUs you want to list.
+	if d.EqualsQualString("parent_id") != "" {
+		parentId = d.EqualsQualString("parent_id")
+	}
+
+	// empty check
+	if parentId == "" {
+		return nil, nil
+	}
+
+	// Get Client
+	svc, err := OrganizationClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_organizations_organizational_unit.listOrganizationsOrganizationalUnits", "client_error", err)
+		return nil, err
+	}
+
+	// Limiting the result
+	maxItems := int32(20)
+
+	// Reduce the basic request limit down if the user has only requested a small number of rows
+	if d.QueryContext.Limit != nil {
+		limit := int32(*d.QueryContext.Limit)
+		if limit < maxItems {
+			maxItems = int32(limit)
+		}
+	}
+
+	// Call the recursive function to list all nested OUs
+	rootPath := parentId
+	err = listAllNestedOUs(ctx, d, svc, parentId, maxItems, rootPath)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_organizations_organizational_unit.listOrganizationsOrganizationalUnits", "recursive_call_error", err)
+		return nil, err
+	}
+
+	return nil, nil
+}
+
+func listAllNestedOUs(ctx context.Context, d *plugin.QueryData, svc *organizations.Client, parentId string, maxItems int32, currentPath string) error {
+	params := &organizations.ListOrganizationalUnitsForParentInput{
+		ParentId:   aws.String(parentId),
+		MaxResults: &maxItems,
+	}
+
+	paginator := organizations.NewListOrganizationalUnitsForParentPaginator(svc, params, func(o *organizations.ListOrganizationalUnitsForParentPaginatorOptions) {
+		o.Limit = maxItems
+		o.StopOnDuplicateToken = true
+	})
+
+	for paginator.HasMorePages() {
+		output, err := paginator.NextPage(ctx)
+		if err != nil {
+			return err
+		}
+
+		for _, unit := range output.OrganizationalUnits {
+			ouPath := strings.Replace(currentPath, "-", "_", -1) + "." + strings.Replace(*unit.Id, "-", "_", -1)
+			d.StreamListItem(ctx, OrganizationalUnit{unit, ouPath, parentId})
+
+			// Recursively list units for this child
+			err := listAllNestedOUs(ctx, d, svc, *unit.Id, maxItems, ouPath)
+			if err != nil {
+				return err
+			}
+
+			if d.RowsRemaining(ctx) == 0 {
+				return nil
+			}
+		}
+	}
+
+	return nil
+}
+
+//// HYDRATE FUNCTIONS
+
+func getOrganizationsOrganizationalUnit(ctx context.Context, d *plugin.QueryData, h *plugin.HydrateData) (interface{}, error) {
+	orgUnitId := *h.Item.(OrganizationalUnit).Id
+
+	// Get Client
+	svc, err := OrganizationClient(ctx, d)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_organizations_organizational_unit.getOrganizationsOrganizationalUnit", "client_error", err)
+		return nil, err
+	}
+
+	params := &organizations.DescribeOrganizationalUnitInput{
+		OrganizationalUnitId: aws.String(orgUnitId),
+	}
+
+	op, err := svc.DescribeOrganizationalUnit(ctx, params)
+	if err != nil {
+		plugin.Logger(ctx).Error("aws_organizations_organizational_unit.getOrganizationsOrganizationalUnit", "api_error", err)
+		return nil, err
+	}
+
+	return *op.OrganizationalUnit, nil
+}