Organizations: account vending + SCP attachment for local Terraform `apply` (store + list, not enforce)

[b-rajesh]

AWS Service name

Organizations

Operations needed

Account lifecycle — for aws_organizations_account:

• CreateAccount (return CreateAccountStatus; immediate SUCCEEDED is fine for an emulator, or IN_PROGRESS→poll to mirror AWS)
• DescribeCreateAccountStatus
• MoveAccount (root → target OU)
• ListParents — needed for the round-trip: the provider refreshes parent_id via ListParents, so without it the resource shows perpetual drift after a move (DescribeAccount doesn't return the parent, same as real AWS)

SCP control-plane — store + list, not enforce — for aws_organizations_policy + _policy_attachment:

• CreatePolicy / UpdatePolicy / DeletePolicy / DescribePolicy / ListPolicies (SERVICE_CONTROL_POLICY)
• TagResource / UntagResource / ListTagsForResource — aws_organizations_policy Read calls ListTagsForResource, so once CreatePolicy lands, omitting these moves the hard-stop to the post-create read-back (a Create without its paired Read op fails apply).
• AttachPolicy / DetachPolicy
• ListPoliciesForTarget / ListTargetsForPolicy
• EnablePolicyType / DisablePolicyType
• seed AWS-managed FullAWSAccess attached to root/OUs (real-AWS default, so attach/detach diffs match)

_Out of scope:_ request-time SCP enforcement (per-request deny). This proves the SCP is authored + attached, not that a disallowed call is blocked.

Use case

Validate an AWS Organizations IaC flow locally (Terraform/OpenTofu apply, not just plan): vend a sub-account → place it under an OU → author an SCP → attach it to the OU. Today both aws_organizations_account and aws_organizations_policy(_attachment) fail at apply against MiniStack because these mutation ops are missing, so the flow is plan-only.

MiniStack already maintains the OU tree with parent/child semantics (CreateOrganizationalUnit, ListAccountsForParent filters by parent), so most of this builds on existing machinery. It's pure in-memory control-plane CRUD — the whole flow completes locally (apply → list-accounts-for-parent / list-policies-for-target → assert), with no real infra and nothing to maintain over time (CRUD on user-created resources, not a mirror of AWS data). It mirrors the recently-merged AssociateIamInstanceProfile round-trip (#968) and completes a surface you already ship.

Why-. A landing-zone codebase authors region-pin / data-residency guardrails as Service Control Policies and attaches them to OUs — aws_organizations_policy (SERVICE_CONTROL_POLICY) + aws_organizations_policy_attachment. The value in an emulator: the SCP authoring + attachment flow applys and round-trips locally — author → attach to an OU → read back via aws organizations list-policies-for-target to assert the guardrail is wired — so IaC changes to the org's policy layer are testable without a real organization. Pure in-memory control-plane CRUD on user-created resources (no AWS data to mirror, nothing to maintain), building on the OU tree MiniStack already keeps.

Before opening a PR — is this in scope? One PR, or split account-lifecycle from SCP? And any preference on CreateAccount being immediate-SUCCEEDED vs IN_PROGRESS→poll?

Would you like to contribute this?

• Yes, I'd like to implement this service and open a PR
• I can help review/test an implementation

[b-rajesh]

Proposed answers to the two open questions, to firm up scope before I build:

1. One PR or split? I'd split into two, smallest-first — each stands alone and reviews independently (SCP doesn't depend on account vending):

• PR A — account lifecycle: CreateAccount, DescribeCreateAccountStatus, MoveAccount. Relies on ListParents (Organizations: add ListParents (OU/account parent read-back for Terraform) #990) for the parent_id round-trip so a moved account doesn't show perpetual drift.
• PR B — SCP store/list: CreatePolicy / UpdatePolicy / DeletePolicy / DescribePolicy / ListPolicies, AttachPolicy / DetachPolicy, ListPoliciesForTarget / ListTargetsForPolicy, EnablePolicyType / DisablePolicyType, and seed the AWS-managed FullAWSAccess attached to root/OUs so attach/detach diffs match.

2. CreateAccount immediate-SUCCEEDED vs IN_PROGRESS→poll? I'd go immediate-SUCCEEDED. The emulator has no real provisioning latency, so an IN_PROGRESS→poll cycle is state-machine machinery with no local-testing payoff. CreateAccount returns a CreateAccountStatus with State=SUCCEEDED and the new AccountId; DescribeCreateAccountStatus returns that stored record. (If you'd prefer to mirror AWS's async shape for fidelity, I can return IN_PROGRESS first and flip to SUCCEEDED on the first Describe poll — happy to, just costlier for no local benefit.)

[b-rajesh]

Proof

Verified against a clean MiniStack v1.3.69 (Terraform 1.5.7 + hashicorp/aws ~> 5.0, provider endpoints { organizations = "http://localhost:4566" }). Both legs of the flow hard-stop at apply — not a plan diff, a missing-operation error — so the Organizations IaC flow is plan-only locally.

Account lifecycle — aws_organizations_account:

resource "aws_organizations_account" "workload" {
  name  = "workload-account"
  email = "workload+test@example.com"
}

Error: creating AWS Organizations Account (workload-account): operation error
Organizations: CreateAccount, https response error StatusCode: 400,
api error InvalidAction: Operation 'CreateAccount' not implemented

SCP store + attach — aws_organizations_policy:

resource "aws_organizations_policy" "region_pin" {
  name = "region-pin"
  type = "SERVICE_CONTROL_POLICY"
  content = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid = "DenyOutOfRegion", Effect = "Deny",
      NotAction = ["iam:*", "organizations:*", "sts:*"], Resource = "*",
      Condition = { StringNotEquals = { "aws:RequestedRegion" = ["us-east-1"] } }
    }]
  })
}

Error: creating Organizations Policy (region-pin): operation error
Organizations: CreatePolicy, https response error StatusCode: 400,
api error InvalidAction: Operation 'CreatePolicy' not implemented

Direct API probes confirm the whole #989 surface is absent — each returns InvalidAction: Operation '<op>' not implemented:

CreateAccount · DescribeCreateAccountStatus · MoveAccount
CreatePolicy · AttachPolicy · ListPoliciesForTarget

The moment apply reaches the first mutation it errors out, so neither the account-vending nor the SCP-authoring path can be exercised locally today — only plan (request shape) is reachable.