Feat/policy refactor #551

StewartW · 2022-10-24T16:35:33Z

Why?

A refactor of how policies (SCP/Tagging) are managed.

Provides backwards compatibility with the current process whilst enabling an additional folder "adf-policies" that allows for SCPs, Tagging policies (and potentially more) to be defined in a central location. Allowing for policies to be-used across multiple targets. (Currently supports OU-names, but also supports extension going forward)

Issue #, if available:

What?

Description of changes:

Creates a new concept called Policy Campaigns. Which is an object used to orchestrate the updating of policies and their targets.

Policy Campaigns have a list of Policies that require creating. (A policy is classed as requiring creation when a policy with the same name does not exist). Policies that require updating (A policy is classed as requiring updating when an existing policy has a different content) and policies that require deleting (Any policy that is ADF managed but does not receive an interaction throughout the campaign is considered for deletion)

Policies themselves do similar logic for targets, and depending on the adf config, a target will either have the default SCP maintained or removed.

The overall logic is the same for the legacy policy management, the primary difference is that adf-policies is now an optional source for policies.

By submitting this pull request, I confirm that you can use, modify, copy, and
redistribute this contribution, under the terms of your choice.

src/template.yml

StewartW · 2022-10-26T13:32:32Z

Still todo:

Address TODO comments
Update documentation
[ ]

…into feat/policy-refactor

sbkok

Thank you for contributing this.

sbkok · 2023-07-24T15:36:59Z

docs/admin-guide.md

+Because of the difference in this approach to applying policies, it is not
+currently the default method and will have to be enabled. In order to enable it,
+you have to update your serverlessrepo stack in the organizational root account
+and set the parameter `EnablePolicyV2' to "TRUE". Once the stack has redeployed,


Shall we move this to the extensions feature?
Or maybe even better, lets say we would merge this for the next v4.0.0 release, should we enable it without a property and explain the different approach in the changelog / steps to upgrade?

Happy to postpone to V4.0.0.

Happy to get your thoughts on this, because the new V2 approach is 100% backwards compatible with old definitions

docs/admin-guide.md

src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/main.py

.../initial_commit/bootstrap_repository/adf-build/shared/python/organization_policy_campaign.py

src/template.yml

Co-authored-by: Simon Kok <[email protected]>

…ild/shared/python/organization_policy_campaign.py Co-authored-by: Simon Kok <[email protected]>

…ild/main.py Co-authored-by: Simon Kok <[email protected]>

…ild/shared/python/organization_policy_campaign.py Co-authored-by: Simon Kok <[email protected]>

sbkok

A few comments still there from the previous review + a few new ones.
Could you look at these via the Files changed tab? That should only show the comments that still apply.

sbkok · 2023-10-31T08:30:40Z

src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/main.py

-        ou_id,
-        [],  # Initial empty array to hold OU Path,
-        cache
+        ou_id, [], cache  # Initial empty array to hold OU Path,


Can you revert this change, as the comment is linked to the empty list. Not the cache or all three arguments together?

src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/organization_policy_v2.py

sbkok · 2023-10-31T08:36:12Z

src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/organization_policy_v2.py

+        status = organizations.get_organization_info()
+        if status.get("feature_set") != "ALL":
+            LOGGER.info(
+                "All Features are currently NOT enabled for this Organization, "


If we are tasked to apply an SCP or Tagging Policy, maybe it would be better to raise this as a warning or even a fatal error. As it might go unnoticed otherwise. What do you think?

src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/organization_policy_v2.py

sbkok · 2023-10-31T08:43:56Z

...t/bootstrap_repository/adf-build/shared/python/tests/test_organizational_policy_campaigns.py

+        stubber.assert_no_pending_responses()
+
+
+class SadTestCases(unittest.TestCase):


Can you add a test case that will test that we throw an error when AWS Organizations is not configured with all features that we require for Tagging and Service Control Policies?

StewartW · 2024-06-14T10:59:00Z

Makefile

-			exit 1 \
-		); \
-	)
+	# @( \


This isn't reliable on mac. Is there a better way to do this @sbkok ?

StewartW · 2024-06-17T14:36:21Z

Closing to favour the v4.0.0 compatible version

StewartW added 4 commits October 17, 2022 12:07

Starting refactor of policy application

092f831

initial testing

670cecc

Unit tests for OrganisationPolicy class

7861202

Linting

b77a469

StewartW commented Oct 25, 2022

View reviewed changes

src/template.yml Outdated Show resolved Hide resolved

StewartW added 3 commits December 20, 2022 14:43

wip

619562f

Merge branch 'master' of github.com:awslabs/aws-deployment-framework …

299bfc4

…into feat/policy-refactor

Merging

1431c06

StewartW marked this pull request as ready for review January 24, 2023 19:02

StewartW added 4 commits January 24, 2023 21:09

sìos leis a' Bheurla

aaaee1e

Resetting generate params

c22988f

Fixing spelling mistakes

b8eda09

Updating documentation

24c05e5

StewartW force-pushed the feat/policy-refactor branch from 30c5c40 to 24c05e5 Compare January 24, 2023 22:33

StewartW added this to the v3.2.1 milestone Jan 25, 2023

sbkok modified the milestones: v3.2.2, v3.3.0 Jan 27, 2023

sbkok and others added 2 commits July 24, 2023 17:32

Merge remote-tracking branch 'upstream/master' into feat/policy-refactor

29c4b36

Merge branch 'master' into feat/policy-refactor

06b972d

sbkok requested changes Jul 24, 2023

View reviewed changes

StewartW and others added 5 commits August 8, 2023 19:11

Merge branch 'master' into feat/policy-refactor

8f763ae

Apply suggestions from code review

789694f

Co-authored-by: Simon Kok <[email protected]>

Update src/lambda_codebase/initial_commit/bootstrap_repository/adf-bu…

50d3426

…ild/shared/python/organization_policy_campaign.py Co-authored-by: Simon Kok <[email protected]>

Update src/lambda_codebase/initial_commit/bootstrap_repository/adf-bu…

0eb96fa

…ild/main.py Co-authored-by: Simon Kok <[email protected]>

Update src/lambda_codebase/initial_commit/bootstrap_repository/adf-bu…

e9a71fc

…ild/shared/python/organization_policy_campaign.py Co-authored-by: Simon Kok <[email protected]>

sbkok requested changes Oct 31, 2023

View reviewed changes

sbkok mentioned this pull request May 17, 2024

[Feat]: deploy multiple SCPs to a single OU or account #724

Open

1 task

StewartW added 2 commits June 12, 2024 10:46

Merge branch 'master' into feat/policy-refactor

d7590ec

fixing tests

bc87fb2

StewartW and others added 8 commits June 12, 2024 13:15

fixing linting

8725d3a

linting again

62045e6

temp remove assertion

23e57c1

updating logging

60b037b

running black with ll 80

665f997

linting

da91c6f

Tox no longer complaining

54293e9

readding assertion

09eba60

StewartW commented Jun 14, 2024

View reviewed changes

Makefile

exit 1 \

); \

)

# @( \

Copy link

Contributor Author

StewartW Jun 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't reliable on mac. Is there a better way to do this @sbkok ?

StewartW closed this Jun 17, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/policy refactor #551

Feat/policy refactor #551

StewartW commented Oct 24, 2022 •

edited

Loading

StewartW commented Oct 26, 2022 •

edited

Loading

sbkok left a comment

sbkok Jul 24, 2023

StewartW Aug 8, 2023

StewartW Jun 13, 2024

sbkok left a comment

sbkok Oct 31, 2023

sbkok Oct 31, 2023

sbkok Oct 31, 2023

StewartW Jun 14, 2024

StewartW commented Jun 17, 2024

		stubber.assert_no_pending_responses()


		class SadTestCases(unittest.TestCase):

Feat/policy refactor #551

Feat/policy refactor #551

Conversation

StewartW commented Oct 24, 2022 • edited Loading

Why?

What?

StewartW commented Oct 26, 2022 • edited Loading

sbkok left a comment

Choose a reason for hiding this comment

sbkok Jul 24, 2023

Choose a reason for hiding this comment

StewartW Aug 8, 2023

Choose a reason for hiding this comment

StewartW Jun 13, 2024

Choose a reason for hiding this comment

sbkok left a comment

Choose a reason for hiding this comment

sbkok Oct 31, 2023

Choose a reason for hiding this comment

sbkok Oct 31, 2023

Choose a reason for hiding this comment

sbkok Oct 31, 2023

Choose a reason for hiding this comment

StewartW Jun 14, 2024

Choose a reason for hiding this comment

StewartW commented Jun 17, 2024

StewartW commented Oct 24, 2022 •

edited

Loading

StewartW commented Oct 26, 2022 •

edited

Loading