Remove unsupported services and use uniq policy names

CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## 0.19.1 (2022-12-14)
+
+ENHANCEMENTS
+
+- Generate unique names for tag policies and remove services that are not supported from the enforcement list. ([#155](https://github.com/schubergphilis/terraform-aws-mcaf-landing-zone/pull/155))
+
 ## 0.19.0 (2022-12-13)
 
 ENHANCEMENTS

modules/tag-policy-assignment/README.md

@@ -17,6 +17,7 @@
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | aws\_ou\_tags | Map of AWS OU names and their tag policies | <pre>map(object({<br>    values       = optional(list(string))<br>    enforced_for = optional(list(string))<br>  }))</pre> | n/a | yes |
+| ou\_path | Path of the organizational unit (OU) | `string` | n/a | yes |
 | target\_id | The unique identifier (ID) organizational unit (OU) that you want to attach the policy to. | `string` | n/a | yes |
 | tags | Map of AWS resource tags | `map(string)` | `{}` | no |
 

modules/tag-policy-assignment/locals.tf

@@ -18,7 +18,11 @@ locals {
     "auditmanager:assessmentControlSet",
     "auditmanager:assessmentFramework",
     "auditmanager:control",
-    "backup:*",
+    "backup:backupPlan",
+    "backup:backupVault",
+    "backup-gateway:gateway",
+    "backup-gateway:hypervisor",
+    "backup-gateway:vm",
     "batch:job",
     "batch:job-definition",
     "batch:job-queue",
@@ -100,7 +104,8 @@ locals {
     "elasticloadbalancing:*",
     "elasticloadbalancing:loadbalancer",
     "elasticloadbalancing:targetgroup",
-    "elasticmapreduce:*",
+    "elasticmapreduce:cluster",
+    "elasticmapreduce:editor",
     "es:domain",
     "events:*",
     "firehose:*",
@@ -225,7 +230,6 @@ locals {
     "wisdom:assistant",
     "wisdom:association",
     "wisdom:content",
-    "wisdom:knowledge",
     "wisdom:session",
     "worklink:fleet",
     "workspaces:*",

modules/tag-policy-assignment/main.tf

@@ -1,8 +1,12 @@
+locals {
+  ou_path = replace(var.ou_path, "/", "-")
+}
+
 // https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_supported-resources-enforcement.html
 resource "aws_organizations_policy" "required_tags" {
   for_each = var.aws_ou_tags
 
-  name = "LandingZone-RequiredTags-${each.key}"
+  name = "LandingZone-RequiredTags-${local.ou_path}-${each.key}"
   type = "TAG_POLICY"
   tags = var.tags
 

modules/tag-policy-assignment/variables.tf

@@ -16,3 +16,8 @@ variable "target_id" {
   type        = string
   description = "The unique identifier (ID) organizational unit (OU) that you want to attach the policy to."
 }
+
+variable "ou_path" {
+  type        = string
+  description = "Path of the organizational unit (OU)"
+}

organizations_policy.tf

@@ -75,5 +75,6 @@ module "tag_policy_assignment" {
   source      = "./modules/tag-policy-assignment"
   aws_ou_tags = { for k, v in var.aws_required_tags[each.key] : v.name => v }
   target_id   = each.value.id
+  ou_path     = each.key
   tags        = var.tags
 }