AWS.Organizations reference

AcceptHandshake

Source: packages/aws/src/Organizations/AcceptHandshake.ts

Runtime binding for organizations:AcceptHandshake.

Accepts a pending handshake — e.g. an invitation to join an organization, called from the invited member account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.AcceptHandshakeHttp).

AcceptHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const acceptHandshake = yield* AWS.Organizations.AcceptHandshake();

// runtime
const { Handshake } = yield* acceptHandshake({ HandshakeId: handshakeId });

Account

Source: packages/aws/src/Organizations/Account.ts

A member account created and managed by AWS Organizations.

Account creation is asynchronous — the provider polls the vending request until the account ID is assigned. Must be deployed from the organization’s management account. Changing email replaces the account; changing name updates it in place.

Account: Creating Member Accounts

Account Under the Organization Root

const root = yield* Root("Root", {});

const dev = yield* Account("Dev", {
  name: "dev",
  email: "aws-dev@example.com",
  parentId: root.rootId,
});

Account Inside an Organizational Unit

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

const prod = yield* Account("Prod", {
  name: "prod",
  email: "aws-prod@example.com",
  parentId: workloads.ouId,
  roleName: "OrganizationAccountAccessRole",
  tags: { environment: "prod" },
});

Account: Looking up an existing member account

Account.lookup references a member account Alchemy doesn’t manage (created in the console or by another stack), found by accountId or email. It is read during plan/deploy and never created, updated or deleted.

const prod = AWS.Organizations.Account.lookup({ email: "aws-prod@example.com" });
const accountId = prod.accountId;

CancelHandshake

Source: packages/aws/src/Organizations/CancelHandshake.ts

Runtime binding for organizations:CancelHandshake.

Cancels a pending handshake from the originator side — e.g. withdrawing an invitation before the recipient responds. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.CancelHandshakeHttp).

CancelHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const cancelHandshake = yield* AWS.Organizations.CancelHandshake();

// runtime
const { Handshake } = yield* cancelHandshake({ HandshakeId: handshakeId });

DeclineHandshake

Source: packages/aws/src/Organizations/DeclineHandshake.ts

Runtime binding for organizations:DeclineHandshake.

Declines a pending handshake, ending the invitation from the recipient side; the originator can no longer act on it. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DeclineHandshakeHttp).

DeclineHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const declineHandshake = yield* AWS.Organizations.DeclineHandshake();

// runtime
const { Handshake } = yield* declineHandshake({ HandshakeId: handshakeId });

DelegatedAdministrator

Source: packages/aws/src/Organizations/DelegatedAdministrator.ts

Registers a member Account as the delegated administrator for a trusted AWS service, letting that account manage the service org-wide instead of the management account.

Requires trusted access for the same service principal (see TrustedServiceAccess). Existence-only resource: changing accountId or servicePrincipal replaces the registration.

DelegatedAdministrator: Delegating Administration

const security = yield* Account("Security", {
  name: "security",
  email: "aws-security@example.com",
  parentId: root.rootId,
});

const guardDutyAccess = yield* TrustedServiceAccess("GuardDutyAccess", {
  servicePrincipal: "guardduty.amazonaws.com",
});

yield* DelegatedAdministrator("GuardDutyAdmin", {
  accountId: security.accountId,
  servicePrincipal: guardDutyAccess.servicePrincipal,
});

DescribeCreateAccountStatus

Source: packages/aws/src/Organizations/DescribeCreateAccountStatus.ts

Runtime binding for organizations:DescribeCreateAccountStatus.

Retrieves the current status of an asynchronous account-creation request — the polling half of an account-vending workflow. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeCreateAccountStatusHttp).

DescribeCreateAccountStatus: Account Vending

// init — account-level binding, no resource argument
const describeCreateAccountStatus = yield* AWS.Organizations.DescribeCreateAccountStatus();

// runtime
const { CreateAccountStatus } = yield* describeCreateAccountStatus({
  CreateAccountRequestId: requestId,
});

DescribeEffectivePolicy

Source: packages/aws/src/Organizations/DescribeEffectivePolicy.ts

Runtime binding for organizations:DescribeEffectivePolicy.

Returns the contents of the effective policy of the specified type for an account — the aggregation of inherited plus directly attached management policies (tag, backup, AI-services opt-out, …). Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeEffectivePolicyHttp).

DescribeEffectivePolicy: Policies & Effective Policy

// init — account-level binding, no resource argument
const describeEffectivePolicy = yield* AWS.Organizations.DescribeEffectivePolicy();

// runtime
const { EffectivePolicy } = yield* describeEffectivePolicy({
  PolicyType: "TAG_POLICY",
  TargetId: accountId,
});

DescribeHandshake

Source: packages/aws/src/Organizations/DescribeHandshake.ts

Runtime binding for organizations:DescribeHandshake.

Returns the details and current state of a handshake — accepted, declined, or canceled handshakes stay readable for 30 days. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeHandshakeHttp).

DescribeHandshake: Handshakes & Invitations

// init — account-level binding, no resource argument
const describeHandshake = yield* AWS.Organizations.DescribeHandshake();

// runtime
const { Handshake } = yield* describeHandshake({ HandshakeId: handshakeId });

DescribeOrganization

Source: packages/aws/src/Organizations/DescribeOrganization.ts

Runtime binding for organizations:DescribeOrganization.

Retrieves information about the organization that the calling account belongs to — its id, ARN, feature set, and management account. Available from any account in the organization. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.DescribeOrganizationHttp).

DescribeOrganization: Reading the Organization Tree

// init — account-level binding, no resource argument
const describeOrganization = yield* AWS.Organizations.DescribeOrganization();

// runtime
const { Organization } = yield* describeOrganization();
console.log(Organization?.Id, Organization?.MasterAccountId);

InviteAccountToOrganization

Source: packages/aws/src/Organizations/InviteAccountToOrganization.ts

Runtime binding for organizations:InviteAccountToOrganization.

Sends an invitation (handshake) to another account to join the organization as a member account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.InviteAccountToOrganizationHttp).

InviteAccountToOrganization: Handshakes & Invitations

// init — account-level binding, no resource argument
const inviteAccountToOrganization = yield* AWS.Organizations.InviteAccountToOrganization();

// runtime
const { Handshake } = yield* inviteAccountToOrganization({
  Target: { Id: "111122223333", Type: "ACCOUNT" },
});

ListAccounts

Source: packages/aws/src/Organizations/ListAccounts.ts

Runtime binding for organizations:ListAccounts.

Lists all accounts in the organization — the backbone of cross-account automation that iterates every member account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAccountsHttp).

ListAccounts: Reading the Organization Tree

// init — account-level binding, no resource argument
const listAccounts = yield* AWS.Organizations.ListAccounts();

// runtime
const { Accounts } = yield* listAccounts();

ListAccountsForParent

Source: packages/aws/src/Organizations/ListAccountsForParent.ts

Runtime binding for organizations:ListAccountsForParent.

Lists the accounts directly contained by the specified root or organizational unit (not accounts in child OUs). Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAccountsForParentHttp).

ListAccountsForParent: Reading the Organization Tree

// init — account-level binding, no resource argument
const listAccountsForParent = yield* AWS.Organizations.ListAccountsForParent();

// runtime
const { Accounts } = yield* listAccountsForParent({ ParentId: ouId });

ListAccountsWithInvalidEffectivePolicy

Source: packages/aws/src/Organizations/ListAccountsWithInvalidEffectivePolicy.ts

Runtime binding for organizations:ListAccountsWithInvalidEffectivePolicy.

Lists the accounts whose effective policy of the specified type is invalid — e.g. exceeds the size limit after policy inheritance. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAccountsWithInvalidEffectivePolicyHttp).

ListAccountsWithInvalidEffectivePolicy: Policies & Effective Policy

// init — account-level binding, no resource argument
const listAccountsWithInvalidEffectivePolicy = yield* AWS.Organizations.ListAccountsWithInvalidEffectivePolicy();

// runtime
const { Accounts } = yield* listAccountsWithInvalidEffectivePolicy({
  PolicyType: "TAG_POLICY",
});

ListAWSServiceAccessForOrganization

Source: packages/aws/src/Organizations/ListAWSServiceAccessForOrganization.ts

Runtime binding for organizations:ListAWSServiceAccessForOrganization.

Lists the Amazon Web Services services that are enabled for trusted access with the organization. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListAWSServiceAccessForOrganizationHttp).

ListAWSServiceAccessForOrganization: Delegated Administration & Trusted Access

// init — account-level binding, no resource argument
const listAWSServiceAccessForOrganization = yield* AWS.Organizations.ListAWSServiceAccessForOrganization();

// runtime
const { EnabledServicePrincipals } =
  yield* listAWSServiceAccessForOrganization();

ListChildren

Source: packages/aws/src/Organizations/ListChildren.ts

Runtime binding for organizations:ListChildren.

Lists the child accounts or organizational units directly under the specified parent root or OU — one level of the organization tree at a time. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListChildrenHttp).

ListChildren: Reading the Organization Tree

// init — account-level binding, no resource argument
const listChildren = yield* AWS.Organizations.ListChildren();

// runtime
const { Children } = yield* listChildren({
  ParentId: rootId,
  ChildType: "ORGANIZATIONAL_UNIT",
});

ListCreateAccountStatus

Source: packages/aws/src/Organizations/ListCreateAccountStatus.ts

Runtime binding for organizations:ListCreateAccountStatus.

Lists the account-creation requests that match the specified states — auditing in-flight and completed account vending. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListCreateAccountStatusHttp).

ListCreateAccountStatus: Account Vending

// init — account-level binding, no resource argument
const listCreateAccountStatus = yield* AWS.Organizations.ListCreateAccountStatus();

// runtime
const { CreateAccountStatuses } = yield* listCreateAccountStatus({
  States: ["IN_PROGRESS"],
});

ListDelegatedAdministrators

Source: packages/aws/src/Organizations/ListDelegatedAdministrators.ts

Runtime binding for organizations:ListDelegatedAdministrators.

Lists the accounts that are designated as delegated administrators in the organization, optionally filtered by service principal. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListDelegatedAdministratorsHttp).

ListDelegatedAdministrators: Delegated Administration & Trusted Access

// init — account-level binding, no resource argument
const listDelegatedAdministrators = yield* AWS.Organizations.ListDelegatedAdministrators();

// runtime
const { DelegatedAdministrators } = yield* listDelegatedAdministrators();

ListDelegatedServicesForAccount

Source: packages/aws/src/Organizations/ListDelegatedServicesForAccount.ts

Runtime binding for organizations:ListDelegatedServicesForAccount.

Lists the Amazon Web Services services for which the specified account is a delegated administrator. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListDelegatedServicesForAccountHttp).

ListDelegatedServicesForAccount: Delegated Administration & Trusted Access

// init — account-level binding, no resource argument
const listDelegatedServicesForAccount = yield* AWS.Organizations.ListDelegatedServicesForAccount();

// runtime
const { DelegatedServices } = yield* listDelegatedServicesForAccount({
  AccountId: accountId,
});

ListEffectivePolicyValidationErrors

Source: packages/aws/src/Organizations/ListEffectivePolicyValidationErrors.ts

Runtime binding for organizations:ListEffectivePolicyValidationErrors.

Lists the validation errors in an account’s effective policy of the specified type — the reasons the aggregated policy is invalid. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListEffectivePolicyValidationErrorsHttp).

ListEffectivePolicyValidationErrors: Policies & Effective Policy

// init — account-level binding, no resource argument
const listEffectivePolicyValidationErrors = yield* AWS.Organizations.ListEffectivePolicyValidationErrors();

// runtime
const { EffectivePolicyValidationErrors } =
  yield* listEffectivePolicyValidationErrors({
    AccountId: accountId,
    PolicyType: "TAG_POLICY",
  });

ListHandshakesForAccount

Source: packages/aws/src/Organizations/ListHandshakesForAccount.ts

Runtime binding for organizations:ListHandshakesForAccount.

Lists the handshakes that are associated with the calling account — pending and recently concluded invitations. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListHandshakesForAccountHttp).

ListHandshakesForAccount: Handshakes & Invitations

// init — account-level binding, no resource argument
const listHandshakesForAccount = yield* AWS.Organizations.ListHandshakesForAccount();

// runtime
const { Handshakes } = yield* listHandshakesForAccount();

ListHandshakesForOrganization

Source: packages/aws/src/Organizations/ListHandshakesForOrganization.ts

Runtime binding for organizations:ListHandshakesForOrganization.

Lists the handshakes sent by the organization’s management account — outstanding and recently concluded invitations. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListHandshakesForOrganizationHttp).

ListHandshakesForOrganization: Handshakes & Invitations

// init — account-level binding, no resource argument
const listHandshakesForOrganization = yield* AWS.Organizations.ListHandshakesForOrganization();

// runtime
const { Handshakes } = yield* listHandshakesForOrganization();

ListOrganizationalUnitsForParent

Source: packages/aws/src/Organizations/ListOrganizationalUnitsForParent.ts

Runtime binding for organizations:ListOrganizationalUnitsForParent.

Lists the organizational units directly contained by the specified root or parent OU. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListOrganizationalUnitsForParentHttp).

ListOrganizationalUnitsForParent: Reading the Organization Tree

// init — account-level binding, no resource argument
const listOrganizationalUnitsForParent = yield* AWS.Organizations.ListOrganizationalUnitsForParent();

// runtime
const { OrganizationalUnits } = yield* listOrganizationalUnitsForParent({
  ParentId: rootId,
});

ListParents

Source: packages/aws/src/Organizations/ListParents.ts

Runtime binding for organizations:ListParents.

Lists the direct parent (root or OU) of the specified child account or OU — walking the organization tree upward. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListParentsHttp).

ListParents: Reading the Organization Tree

// init — account-level binding, no resource argument
const listParents = yield* AWS.Organizations.ListParents();

// runtime
const { Parents } = yield* listParents({ ChildId: accountId });

ListPolicies

Source: packages/aws/src/Organizations/ListPolicies.ts

Runtime binding for organizations:ListPolicies.

Lists all policies of the specified type (service control, tag, backup, AI-services opt-out, …) in the organization. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListPoliciesHttp).

ListPolicies: Policies & Effective Policy

// init — account-level binding, no resource argument
const listPolicies = yield* AWS.Organizations.ListPolicies();

// runtime
const { Policies } = yield* listPolicies({ Filter: "SERVICE_CONTROL_POLICY" });

ListPoliciesForTarget

Source: packages/aws/src/Organizations/ListPoliciesForTarget.ts

Runtime binding for organizations:ListPoliciesForTarget.

Lists the policies of the specified type that are directly attached to the specified target root, OU, or account. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListPoliciesForTargetHttp).

ListPoliciesForTarget: Policies & Effective Policy

// init — account-level binding, no resource argument
const listPoliciesForTarget = yield* AWS.Organizations.ListPoliciesForTarget();

// runtime
const { Policies } = yield* listPoliciesForTarget({
  TargetId: accountId,
  Filter: "SERVICE_CONTROL_POLICY",
});

ListRoots

Source: packages/aws/src/Organizations/ListRoots.ts

Runtime binding for organizations:ListRoots.

Lists the roots of the organization, including the policy types enabled on each root. The root id is the starting point for walking the organization tree. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListRootsHttp).

ListRoots: Reading the Organization Tree

// init — account-level binding, no resource argument
const listRoots = yield* AWS.Organizations.ListRoots();

// runtime
const { Roots } = yield* listRoots();
const rootId = Roots?.[0]?.Id;

ListTagsForResource

Source: packages/aws/src/Organizations/ListTagsForResource.ts

Runtime binding for organizations:ListTagsForResource.

Lists the tags attached to the specified Organizations resource — an account, root, organizational unit, or policy. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListTagsForResourceHttp).

ListTagsForResource: Tags

// init — account-level binding, no resource argument
const listTagsForResource = yield* AWS.Organizations.ListTagsForResource();

// runtime
const { Tags } = yield* listTagsForResource({ ResourceId: accountId });

ListTargetsForPolicy

Source: packages/aws/src/Organizations/ListTargetsForPolicy.ts

Runtime binding for organizations:ListTargetsForPolicy.

Lists all roots, organizational units, and accounts that the specified policy is attached to. Account-level operation — Organizations is a management-account-scoped global service, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.Organizations.ListTargetsForPolicyHttp).

ListTargetsForPolicy: Policies & Effective Policy

// init — account-level binding, no resource argument
const listTargetsForPolicy = yield* AWS.Organizations.ListTargetsForPolicy();

// runtime
const { Targets } = yield* listTargetsForPolicy({ PolicyId: policyId });

Organization

Source: packages/aws/src/Organizations/Organization.ts

The AWS Organization for the current management account.

This is a singleton-style resource. If an organization already exists, Alchemy adopts and reconciles it instead of creating a second one.

Organization: Creating An Organization

const organization = yield* Organization("Org", {
  featureSet: "ALL",
});

OrganizationalUnit

Source: packages/aws/src/Organizations/OrganizationalUnit.ts

An AWS Organizations organizational unit.

OrganizationalUnit: Creating OUs

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

OrganizationalUnit: Looking up an existing organizational unit

OrganizationalUnit.lookup references an organizational unit Alchemy doesn’t manage (created in the console or by another stack), found by ouId, or parentId and name. It is read during plan/deploy and never created, updated or deleted.

const workloads = AWS.Organizations.OrganizationalUnit.lookup({ parentId: rootId, name: "Workloads" });

yield* AWS.Organizations.OrganizationalUnit("Prod", {
  parentId: workloads.ouId,
});

OrganizationResourcePolicy

Source: packages/aws/src/Organizations/OrganizationResourcePolicy.ts

The singleton AWS Organizations resource policy — an org-level resource-based policy that grants other principals (typically delegated administrator accounts) permission to call Organizations APIs.

There is at most one per organization; Alchemy adopts and reconciles the existing policy if one is already in place.

OrganizationResourcePolicy: Setting the Resource Policy

const security = yield* Account("Security", {
  name: "security",
  email: "aws-security@example.com",
  parentId: root.rootId,
});

yield* OrganizationResourcePolicy("OrgResourcePolicy", {
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: security.accountId },
        Action: [
          "organizations:DescribeOrganization",
          "organizations:ListAccounts",
        ],
        Resource: "*",
      },
    ],
  },
});

Policy

Source: packages/aws/src/Organizations/Policy.ts

An AWS Organizations policy such as an SCP or tag policy.

Attach it to a root, OU, or account with PolicyAttachment. Changing type or name replaces the policy; document and description changes update in place.

Policy: Creating Policies

Service Control Policy (Typed Document)

const denyLeaveOrg = yield* Policy("DenyLeaveOrg", {
  type: "SERVICE_CONTROL_POLICY",
  description: "Prevent member accounts from leaving the organization",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        Action: ["organizations:LeaveOrganization"],
        Resource: "*",
      },
    ],
  },
});

Tag Policy (Raw JSON)

const tagPolicy = yield* Policy("RequireEnvTag", {
  type: "TAG_POLICY",
  document: JSON.stringify({
    tags: {
      environment: {
        tag_key: { "@@assign": "environment" },
        tag_value: { "@@assign": ["dev", "staging", "prod"] },
      },
    },
  }),
});

Policy: Attaching Policies

const root = yield* Root("Root", {});

const scpEnabled = yield* RootPolicyType("ScpEnabled", {
  rootId: root.rootId,
  policyType: "SERVICE_CONTROL_POLICY",
});

yield* PolicyAttachment("DenyLeaveOrgOnRoot", {
  policyId: denyLeaveOrg.policyId,
  targetId: scpEnabled.rootId,
});

Policy: Looking up an existing policy

Policy.lookup references a policy Alchemy doesn’t manage (created in the console or by another stack), found by policyId, or type and name. It is read during plan/deploy and never created, updated or deleted.

const denyRegions = AWS.Organizations.Policy.lookup({ type: "SERVICE_CONTROL_POLICY", name: "deny-regions" });
const policyId = denyRegions.policyId;

PolicyAttachment

Source: packages/aws/src/Organizations/PolicyAttachment.ts

Attaches an Organizations Policy to a root, OU, or account.

Existence-only resource: changing either policyId or targetId replaces the attachment. The policy’s type must already be enabled on the root (see RootPolicyType).

PolicyAttachment: Attaching Policies

Attach an SCP to an Organizational Unit

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

const denyRegions = yield* Policy("DenyOtherRegions", {
  type: "SERVICE_CONTROL_POLICY",
  document: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Deny",
        NotAction: ["iam:*", "organizations:*", "sts:*"],
        Resource: "*",
        Condition: {
          StringNotEquals: { "aws:RequestedRegion": ["us-east-1", "us-west-2"] },
        },
      },
    ],
  },
});

yield* PolicyAttachment("DenyRegionsOnWorkloads", {
  policyId: denyRegions.policyId,
  targetId: workloads.ouId,
});

Attach a Policy to a Member Account

yield* PolicyAttachment("DenyRegionsOnDev", {
  policyId: denyRegions.policyId,
  targetId: devAccount.accountId,
});

Root

Source: packages/aws/src/Organizations/Root.ts

The organization root.

Root is an import-style resource. It discovers the existing root returned by AWS Organizations and can reconcile root tags. Use root.rootId as the parentId for top-level OrganizationalUnits and Accounts, and as the targetId/rootId for PolicyAttachment and RootPolicyType.

Root: Importing the Root

Adopt the Organization Root

const organization = yield* Organization("Org", { featureSet: "ALL" });
const root = yield* Root("Root", {});

Parent OUs and Accounts Under the Root

const workloads = yield* OrganizationalUnit("Workloads", {
  parentId: root.rootId,
  name: "workloads",
});

const sandbox = yield* Account("Sandbox", {
  name: "sandbox",
  email: "aws-sandbox@example.com",
  parentId: root.rootId,
});

RootPolicyType

Source: packages/aws/src/Organizations/RootPolicyType.ts

Enables a policy type on an organization root.

A policy type (SCP, tag policy, …) must be enabled on the root before any Policy of that type can be attached via PolicyAttachment. Existence-only resource: changing rootId or policyType replaces it.

RootPolicyType: Enabling Policy Types

Enable Service Control Policies

const root = yield* Root("Root", {});

const scpEnabled = yield* RootPolicyType("ScpEnabled", {
  rootId: root.rootId,
  policyType: "SERVICE_CONTROL_POLICY",
});

Enable Tag Policies Before Attaching One

const tagPoliciesEnabled = yield* RootPolicyType("TagPoliciesEnabled", {
  rootId: root.rootId,
  policyType: "TAG_POLICY",
});

yield* PolicyAttachment("RequireEnvTagOnRoot", {
  policyId: tagPolicy.policyId,
  // depend on the enablement so attachment happens after it
  targetId: tagPoliciesEnabled.rootId,
});

TenantRoot

Source: packages/aws/src/Organizations/TenantRoot.ts

Compose an opinionated single-tenant landing zone inside the current AWS Organizations management account.

This helper intentionally stays aligned to native AWS semantics: one real Organization, one root, nested OUs, and accounts beneath that tenant root. The broader RootRoot concept is an Alchemy control-plane abstraction over many such tenant roots deployed into separate management accounts, not a nested AWS Organizations feature.

TenantRoot: Creating A Tenant Root

const tenant = yield* TenantRoot("CustomerA", {
  identityCenter: {
    mode: "existing",
    groups: [
      { key: "platform", displayName: "platform-engineers" },
    ],
    permissionSets: [
      {
        key: "admin",
        name: "AdministratorAccess",
        sessionDuration: "8 hours",
      },
    ],
    assignments: [
      {
        permissionSetKey: "admin",
        groupKey: "platform",
        accountKey: "prod",
      },
    ],
  },
});

TrustedServiceAccess

Source: packages/aws/src/Organizations/TrustedServiceAccess.ts

Enables trusted access for an AWS service principal, allowing that service to operate across all accounts in the organization.

Typically paired with a DelegatedAdministrator that hands day-to-day administration of the service to a member account. Existence-only resource: changing servicePrincipal replaces it.

TrustedServiceAccess: Enabling Trusted Access

Enable IAM Identity Center

yield* TrustedServiceAccess("SsoTrustedAccess", {
  servicePrincipal: "sso.amazonaws.com",
});

Trusted Access Plus a Delegated Administrator

const guardDutyAccess = yield* TrustedServiceAccess("GuardDutyAccess", {
  servicePrincipal: "guardduty.amazonaws.com",
});

yield* DelegatedAdministrator("GuardDutyAdmin", {
  accountId: securityAccount.accountId,
  servicePrincipal: guardDutyAccess.servicePrincipal,
});