🏢 AWS Organizations — Cloud Governance Source of Truth¶

# Prerequisites: export AWS_MANAGEMENT_PROFILE (org-wide scope only; for per-account commands see dedicated docs)
set -euo pipefail                                    # fail-fast on any error (CC-ORG-017)
set -a; source .env; set +a

# Phase 0 — Auth pre-check (fail-closed BEFORE 8 stages waste time)
aws sts get-caller-identity --profile "$AWS_MANAGEMENT_PROFILE" > /dev/null \
  || { echo "ERROR: SSO expired — run: aws sso login --profile=$AWS_MANAGEMENT_PROFILE"; exit 2; }

TENANT="${TENANT:-b2b-energy}"                       # multi-tenant friendly
OUT="tenants/${TENANT}/raw/organizations"
mkdir -p "$OUT"                                      # idempotent

# Profile note: all 8 stages use $AWS_MANAGEMENT_PROFILE (envvar auto-bound — see "Migration" admonition above)

# Stage 1-3: Org-wide identity (Mgmt profile auto-loaded via envvar)
uv run runbooks inventory list-org-accounts --output-dir "$OUT"
uv run runbooks inventory list-org-users    --output-dir "$OUT" --iam --idc            # explicit: both IAM + Identity Center
uv run runbooks inventory draw-org          --output-dir "$OUT" --output-format mermaid # explicit format

# Stage 4-5: Delegation
uv run runbooks inventory list-delegated-administrators   --output-dir "$OUT"
uv run runbooks inventory describe-delegated-admin-policy --output-dir "$OUT"

# Stage 6: Enabled services — friendly Name column via botocore catalog (CC-ORG-010)
uv run runbooks inventory list-enabled-services --output-dir "$OUT"

# Stage 7: 5-policy-type loop → outputs under $OUT/policies/ subdir (CC-ORG-002)
for policy_type in SERVICE_CONTROL_POLICY TAG_POLICY BACKUP_POLICY AISERVICES_OPT_OUT_POLICY DECLARATIVE_POLICY_EC2; do
  uv run runbooks inventory list-org-policies --policy-type "$policy_type" --output-dir "$OUT"
done

# Per-account resources (resource-groups, app-registry) live OUTSIDE this org-wide scope.
# See: ./list-resource-groups.md and ./list-app-registry-applications.md

# Stage 8: Aggregate HTML governance dashboard (consumes stages 1-7)
uv run runbooks inventory org-governance-report --output-dir "$OUT"

# Unit test (no AWS required, ~50s)
task test:org:unit

# E2E test with $AWS_MANAGEMENT_PROFILE:
task test:org:e2e

# Collect all — date-stamped JSON exports
DATE=$(date +%Y-%m-%d)
OUT=tenants/b2b-energy/raw/organizations
mkdir -p "$OUT"
for CMD in \
    "describe-organization" \
    "list-accounts" \
    "list-roots" \
    "list-delegated-administrators" \
    "list-policies --filter SERVICE_CONTROL_POLICY" \
    "list-policies --filter TAG_POLICY" \
    "list-policies --filter BACKUP_POLICY" \
    "list-aws-service-access-for-organization"; do
  NAME=$(echo "$CMD" | awk '{print $1}' | tr - _)
  aws organizations $CMD \
    --profile $AWS_MANAGEMENT_PROFILE \
    --output json \
    > "$OUT/${NAME}-${DATE}.json"
done

# Quick verify (single commands)
aws organizations describe-organization --profile $AWS_MANAGEMENT_PROFILE
# Account-scoped (Resource Groups, AppRegistry, RAM)
aws resource-groups list-groups --profile $AWS_OPERATIONS_PROFILE
aws servicecatalog-appregistry list-applications --profile $AWS_OPERATIONS_PROFILE
aws ram list-resources --profile $AWS_OPERATIONS_PROFILE

task notebook:run NOTEBOOK=inventory/organizations PROFILE=$AWS_MANAGEMENT_PROFILE

task notebook:run NOTEBOOK=cxo/aws-org-cxo-dashboard PROFILE=$AWS_MANAGEMENT_PROFILE