Feature createorganizationalunit

[ethanBaird]

Why?

In our existing Account Creation workflow, we are required to create new organizational units via the Organizations console in our master account. This requires us to sign in to our master account with heightened priveleges for every new account (that has a new path)

We run a multi account strategy so this happens reasonably often.

We'd prefer for this to be automated. This change will programmatically create any new Organizational Units if a new path is defined in the adf-accounts configuration.

Response to Issue: (#263)

What?

Description of changes:

• Updated permissions on adf-codebuild-role in master account
• Added a new method Organizations.create_ou()
• Refactored existing method Organizations.get_ou_id()
• • refactor while loop to for loop
• • refactor logic in for/else to create OU if not found as defined by the path
• stubbed tests for both methods

---

By submitting this pull request, I confirm that you can use, modify, copy, and
redistribute this contribution, under the terms of your choice.

[StewartW]

Thanks for contributing. A few nits and comments but otherwise a great addition.

The only question I have is if there should be a flag around this functionality to let customers keep the existing behavior.

[javydekoning]

@ethanBaird , can you please fix these linter findings?

  src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/shared/python/organizations.py:
  	493: Trailing whitespace
  	497: Trailing whitespace
  	500: Trailing whitespace
  src/lambda_codebase/initial_commit/bootstrap_repository/adf-build/shared/python/tests/stubs/stub_organizations.py:
  	Wrong line endings or no final newline

[ethanBaird]

Hey @StewartW 👋

Sorry, been a while since I've looked at this, but I have updated the create_ou method to throw an Organizations exception when encountering a boto ClientError and tested the method for this. 🚀

Regarding making this an optional flag in the adf_config.yml. I'm not sure what the best way to do this is.

I understand that we have the SSM Parameter config which we can read in. But should we be passing an ssm_client to every Organizations() object in order to read this?

Something like... in organizations.py

self.config = ssm_client.get_parameter('config')

Or I see we use the ParameterStore class in a few instances. Is it better to pass this to the Org Class and so something more like

self.config = parameter_store.fetch_parameter('config')

Let me know what you think.

[StewartW]

self.config = parameter_store.fetch_parameter('config')

This is the better approach yeah.