diff --git a/aws/resource_aws_organizations_policy.go b/aws/resource_aws_organizations_policy.go index f5983dd9392..c87406da2c3 100644 --- a/aws/resource_aws_organizations_policy.go +++ b/aws/resource_aws_organizations_policy.go @@ -47,6 +47,7 @@ func resourceAwsOrganizationsPolicy() *schema.Resource { ForceNew: true, Default: organizations.PolicyTypeServiceControlPolicy, ValidateFunc: validation.StringInSlice([]string{ + organizations.PolicyTypeAiservicesOptOutPolicy, organizations.PolicyTypeBackupPolicy, organizations.PolicyTypeServiceControlPolicy, organizations.PolicyTypeTagPolicy, diff --git a/aws/resource_aws_organizations_policy_test.go b/aws/resource_aws_organizations_policy_test.go index 152d9e9b71a..af661f67713 100644 --- a/aws/resource_aws_organizations_policy_test.go +++ b/aws/resource_aws_organizations_policy_test.go @@ -113,6 +113,34 @@ func testAccAwsOrganizationsPolicy_description(t *testing.T) { }) } +func testAccAwsOrganizationsPolicy_type_AI_OPT_OUT(t *testing.T) { + var policy organizations.Policy + rName := acctest.RandomWithPrefix("tf-acc-test") + resourceName := "aws_organizations_policy.test" + // Reference: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_ai-opt-out_syntax.html + AiOptOutPolicyContent := `{ "services": { "rekognition": { "opt_out_policy": { "@@assign": "optOut" } }, "lex": { "opt_out_policy": { "@@assign": "optIn" } } } }` + + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t); testAccOrganizationsAccountPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCheckAwsOrganizationsPolicyDestroy, + Steps: []resource.TestStep{ + { + Config: testAccAwsOrganizationsPolicyConfig_Type(rName, AiOptOutPolicyContent, organizations.PolicyTypeAiservicesOptOutPolicy), + Check: resource.ComposeTestCheckFunc( + testAccCheckAwsOrganizationsPolicyExists(resourceName, &policy), + resource.TestCheckResourceAttr(resourceName, "type", organizations.PolicyTypeAiservicesOptOutPolicy), + ), + }, + { + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + }, + }, + }) +} + func testAccAwsOrganizationsPolicy_type_Backup(t *testing.T) { var policy organizations.Policy rName := acctest.RandomWithPrefix("tf-acc-test") diff --git a/aws/resource_aws_organizations_test.go b/aws/resource_aws_organizations_test.go index 91366445016..06659e2e50d 100644 --- a/aws/resource_aws_organizations_test.go +++ b/aws/resource_aws_organizations_test.go @@ -26,12 +26,13 @@ func TestAccAWSOrganizations_serial(t *testing.T) { "DataSource": testAccDataSourceAwsOrganizationsOrganizationalUnits_basic, }, "Policy": { - "basic": testAccAwsOrganizationsPolicy_basic, - "concurrent": testAccAwsOrganizationsPolicy_concurrent, - "Description": testAccAwsOrganizationsPolicy_description, - "Type_Backup": testAccAwsOrganizationsPolicy_type_Backup, - "Type_SCP": testAccAwsOrganizationsPolicy_type_SCP, - "Type_Tag": testAccAwsOrganizationsPolicy_type_Tag, + "basic": testAccAwsOrganizationsPolicy_basic, + "concurrent": testAccAwsOrganizationsPolicy_concurrent, + "Description": testAccAwsOrganizationsPolicy_description, + "Type_AI_OPT_OUT": testAccAwsOrganizationsPolicy_type_AI_OPT_OUT, + "Type_Backup": testAccAwsOrganizationsPolicy_type_Backup, + "Type_SCP": testAccAwsOrganizationsPolicy_type_SCP, + "Type_Tag": testAccAwsOrganizationsPolicy_type_Tag, }, "PolicyAttachment": { "Account": testAccAwsOrganizationsPolicyAttachment_Account, diff --git a/website/docs/r/organizations_policy.html.markdown b/website/docs/r/organizations_policy.html.markdown index fc43f782af1..0d2ec938243 100644 --- a/website/docs/r/organizations_policy.html.markdown +++ b/website/docs/r/organizations_policy.html.markdown @@ -36,7 +36,7 @@ The following arguments are supported: * `content` - (Required) The policy content to add to the new policy. For example, if you create a [service control policy (SCP)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html), this string must be JSON text that specifies the permissions that admins in attached accounts can delegate to their users, groups, and roles. For more information about the SCP syntax, see the [Service Control Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_scp-syntax.html) and for more information on the Tag Policy syntax, see the [Tag Policy Syntax documentation](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_example-tag-policies.html). * `name` - (Required) The friendly name to assign to the policy. * `description` - (Optional) A description to assign to the policy. -* `type` - (Optional) The type of policy to create. Valid values are `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` (SCP), and `TAG_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`. +* `type` - (Optional) The type of policy to create. Valid values are `AISERVICES_OPT_OUT_POLICY`, `BACKUP_POLICY`, `SERVICE_CONTROL_POLICY` (SCP), and `TAG_POLICY`. Defaults to `SERVICE_CONTROL_POLICY`. ## Attribute Reference