organization.yml file gets too big

[gari199]

HI Olaf & Community!

first of all, thank you very much for the tool, works awesome!
However, i have a question: I am coding the organization for a company with +80 accounts and 7 OUs and the file gets extremely big...... I have been researching if i could reference the accounts from another .yml file as we would do in terraform but cannot find an useful easy way...

Here a example of my code for an OU with some accounts incluided:

StagingOU:
Type: OC::ORG::OrganizationalUnit
Properties:
OrganizationalUnitName: Staging
Accounts:
- !Ref InfraStagingAccount
- !Ref KaufberaterStagingAccount
- !Ref MidasStagingAccount
- !Ref NavsyncStagingAccount
- !Ref NpsintlStagingAccount
- !Ref OraboStagingAccount
- !Ref SdmStagingAccount

InfraStagingAccount:
Type: OC::ORG::Account
Properties:
AccountName: Infrastructure Staging
RootEmail: awsacc-infra-stg@xx.xx
Alias: infra staging

KaufberaterStagingAccount:
Type: OC::ORG::Account
Properties:
AccountName: Kaufberater Staging
RootEmail: awsacc-kaufberater-stg@x.xx
Alias: kaufberater staging

MidasStagingAccount:
Type: OC::ORG::Account
Properties:
AccountName: Midas Staging
RootEmail: awsacc-midas-stg@x.x
Alias: midas staging

NavsyncStagingAccount:
Type: OC::ORG::Account
Properties:
AccountName: Navsync Staging
RootEmail: awsacc-navsync-stg@xx.x
Alias: navsync staging

NpsintlStagingAccount:
Type: OC::ORG::Account
Properties:
AccountName: Npsintl Staging
RootEmail: awsacc-npsintl-stg@xx.xx
Alias: npsintl staging

OraboStagingAccount:
Type: OC::ORG::Account
Properties:
AccountName: Orabo Staging
RootEmail: awsacc-orabo-stg@xxx.xx
Alias: orabo staging

SdmStagingAccount:
Type: OC::ORG::Account
Properties:
AccountName: Sdm staging
RootEmail: awsacc-sdm-stg@xxx
Alias: sdm staging

Would it be possible, for example, to add a stagingaccounts.yml file and reference them concretely in the Organizational Unit? Something like this:
StagingOU:
Type: OC::ORG::OrganizationalUnit
Properties:
OrganizationalUnitName: Staging
Accounts:
- !Ref ./stagingaccounts.yml::{$InfrastructureStaging}
- !Ref ./stagingaccounts.yml::{$InfrastructureStaging}
- !Ref ./stagingaccounts.yml::{$InfrastructureStaging}
- !Ref ./stagingaccounts.yml::{$InfrastructureStaging}

Some kinf of imort of the whole resource from other file?
Would appreciate help!
<3

[OlafConijn]

great idea!

for parameters we use a "merge" (<<) operator:

Parameters:
  <<: !Include "../organization-parameters.yml"

  Additional:
    Type: String
    Default: “parameter-default”

The downside is that the yml parser would only allow for 1 '<<' element per parent (you guessed ~ it is a fake merge operator).
I'll chew on it some more.

thanks for the kind words!

[gari199]

Thanks for the quick reply!

it would be something like this then?

• !Ref <<: !Include "../organization-account1.yml"

Thanks a lot again!

[eduardomourar]

i would expect along the lines of:

StagingOU:
  Type: OC::ORG::OrganizationalUnit
  Properties:
    OrganizationalUnitName: Staging
    Accounts:
      - !Ref InfraStagingAccount
      - !Ref KaufberaterStagingAccount

InfraStagingAccount:
  <<: !Include "../infra-staging-account.yml"

[gari199]

thank you very much! I will try tomorrow if it works.

Shame that the include has to be made to 1 full .yml file instead to a general one (staging-accounts.yml) and then reference every resource...
How do you keep the organization.yml file for big companies small then (under 2000 lines 🥇 )?

All in all thank you so much for the helpful response!

You the best!

[OlafConijn]

the yaml parser supports anchors. that would probably help quite a bit already:
how to here: https://medium.com/@kinghuang/docker-compose-anchors-aliases-extensions-a1e4105d70bd

a newer version of the yaml parser also has proper merge operator support.
there is some breaking changes, but once we get that integrated you would be able to do:

StagingOU:
  Type: OC::ORG::OrganizationalUnit
  Properties:
    OrganizationalUnitName: Staging
    Accounts:
      - !Ref InfraStagingAccount
      - !Ref KaufberaterStagingAccount

<<: !Include "../bunch-of-accounts-1.yml"
<<: !Include "../bunch-of-accounts-2.yml"
<<: !Include "../bunch-of-accounts-3.yml"

where any of the included files can have a 'bunch of accounts'

[gari199]

does not seem to work

[gari199]

just noticed that even though i ran npm i aws-organization-formation@0.9.15-beta.7, org-formation -v is still 0.9.14, that might cause the problem

[OlafConijn]

depending on your local configuration > run with npm i aws-organization-formation@0.9.15-beta.7 --global?

[gari199]

worked!
The includes are recognized but a weird error appears when cresting a new account:

ERROR: failed executing task: Create OC::ORG::Account TeamFrontendAccount AccessDenied: User: arn:aws:iam::1111111111:user/lvazquez is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::1111111111:role/AdminFullAccessFromMainAccount

The account is created but not properly placed in the OU even though the ERROR appears. However, when trying too create more accounts its doesnt work

**Note that there is no such role in the 111111111 and permissions are properly configured. Anyway, why would I need any Cross Account role permission to create an account?

[OlafConijn]

i just digged into this a little, seems to be a completely unrelated bug.
there were a couple of other changes in that same beta.

the reason the tool assumes a role into a newly created account is to read/write some account settings like support level, iam alias, password policy.

[jselsing]

Did this work in the end?

And related - is there a maximum number accounts that can be supported in a single Orgformation Setup?