resource/aws_organizations_policy: Support AISERVICES_OPT_OUT_POLICY …

…for the organization policy (#14528)
hashicorp · Aug 12, 2020 · 6e798fb · 6e798fb
1 parent 3bf83a9
commit 6e798fb
Show file tree

Hide file tree

Showing 4 changed files with 37 additions and 7 deletions.
diff --git a/aws/resource_aws_organizations_policy.go b/aws/resource_aws_organizations_policy.go
@@ -47,6 +47,7 @@ func resourceAwsOrganizationsPolicy() *schema.Resource {
 				ForceNew: true,
 				Default:  organizations.PolicyTypeServiceControlPolicy,
 				ValidateFunc: validation.StringInSlice([]string{
+					organizations.PolicyTypeAiservicesOptOutPolicy,
 					organizations.PolicyTypeBackupPolicy,
 					organizations.PolicyTypeServiceControlPolicy,
 					organizations.PolicyTypeTagPolicy,

diff --git a/aws/resource_aws_organizations_policy_test.go b/aws/resource_aws_organizations_policy_test.go
@@ -113,6 +113,34 @@ func testAccAwsOrganizationsPolicy_description(t *testing.T) {
 	})
 }
 
+func testAccAwsOrganizationsPolicy_type_AI_OPT_OUT(t *testing.T) {
+	var policy organizations.Policy
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_organizations_policy.test"
+	// Reference: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out_syntax.html
+	AiOptOutPolicyContent := `{ "services": { "rekognition": { "opt_out_policy": { "@@assign": "optOut" } }, "lex": { "opt_out_policy": { "@@assign": "optIn" } } } }`
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t); testAccOrganizationsAccountPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAwsOrganizationsPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAwsOrganizationsPolicyConfig_Type(rName, AiOptOutPolicyContent, organizations.PolicyTypeAiservicesOptOutPolicy),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAwsOrganizationsPolicyExists(resourceName, &policy),
+					resource.TestCheckResourceAttr(resourceName, "type", organizations.PolicyTypeAiservicesOptOutPolicy),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
 func testAccAwsOrganizationsPolicy_type_Backup(t *testing.T) {
 	var policy organizations.Policy
 	rName := acctest.RandomWithPrefix("tf-acc-test")

diff --git a/aws/resource_aws_organizations_test.go b/aws/resource_aws_organizations_test.go
@@ -26,12 +26,13 @@ func TestAccAWSOrganizations_serial(t *testing.T) {
 			"DataSource": testAccDataSourceAwsOrganizationsOrganizationalUnits_basic,
 		},
 		"Policy": {
-			"basic":       testAccAwsOrganizationsPolicy_basic,
-			"concurrent":  testAccAwsOrganizationsPolicy_concurrent,
-			"Description": testAccAwsOrganizationsPolicy_description,
-			"Type_Backup": testAccAwsOrganizationsPolicy_type_Backup,
-			"Type_SCP":    testAccAwsOrganizationsPolicy_type_SCP,
-			"Type_Tag":    testAccAwsOrganizationsPolicy_type_Tag,
+			"basic":           testAccAwsOrganizationsPolicy_basic,
+			"concurrent":      testAccAwsOrganizationsPolicy_concurrent,
+			"Description":     testAccAwsOrganizationsPolicy_description,
+			"Type_AI_OPT_OUT": testAccAwsOrganizationsPolicy_type_AI_OPT_OUT,
+			"Type_Backup":     testAccAwsOrganizationsPolicy_type_Backup,
+			"Type_SCP":        testAccAwsOrganizationsPolicy_type_SCP,
+			"Type_Tag":        testAccAwsOrganizationsPolicy_type_Tag,
 		},
 		"PolicyAttachment": {
 			"Account":            testAccAwsOrganizationsPolicyAttachment_Account,

diff --git a/website/docs/r/organizations_policy.html.markdown b/website/docs/r/organizations_policy.html.markdown
@@ -36,7 +36,7 @@ The following arguments are supported:
 * `content` - (Required) The policy content to add to the new policy. For example, if you create a [service control policy (SCP)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html), this string must be JSON text that specifies the permissions that admins in attached accounts can delegate to their users, groups, and roles. For more information about the SCP syntax, see the [Service Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.html) and for more information on the Tag Policy syntax, see the [Tag Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html).
 * `name` - (Required) The friendly name to assign to the policy.
 * `description` - (Optional) A description to assign to the policy.
-* `type` - (Optional) The type of policy to create. Valid values are `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` (SCP), and `TAG_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`.
+* `type` - (Optional) The type of policy to create. Valid values are `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` (SCP), and `TAG_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`.
 
 ## Attribute Reference