如何通过AWS Terraform列出指定子OU（ou-4）中的子账户

AWS账户架构 #

.
└── Root account = r-abc
    └── Cloud OU = ou-1
        ├── Dev OU = ou-2
        │   ├── Acc1
        │   └── Acc2
        ├── Stage OU = ou-3
        │   ├── AccA
        │   └── AccB
        └── Prod OU = ou-4
            ├── AccX
            └── AccY

需求 #

基于OU ID ou-4（对应Prod OU），编写Terraform配置获取该OU下的所有账户列表，输出仅包含Prod OU及其子账户。

尝试过的代码 #

data "aws_organizations_organization" "org" {}

data "aws_organizations_organizational_units" "ou" {
  parent_id = data.aws_organizations_organization.org.roots[0].id
}

data "aws_organizations_organizational_unit_descendant_accounts" "org" {
  for_each  = { for ou in data.aws_organizations_organizational_units.ou.children : ou.name => ou.id }
  parent_id = each.value
}

output "accounts_nested_by_ou" {
  description = "nested map of all accounts (except master) by child OU if no nested OUs in org"
  value       = { for ou_name, ou_attributes in data.aws_organizations_organizational_unit_descendant_accounts.org: ou_name => 
    {
     for accounts in ou_attributes.accounts: accounts.name => accounts.id
    }
  }
}

当前输出 #

Changes to Outputs:
  + accounts_nested_by_ou = {
      + Cloud OU           = {
          + Acc1                     = "111111111111"
          + Acc2                     = "222222222222"
          + AccA                     = "AAAAAAAAAAAA"
          + AccB                     = "BBBBBBBBBBBB"
          + AccX                     = "XXXXXXXXXXXX"
          + AccY                     = "YYYYYYYYYYYY"
        }
    }

You can apply this plan to save these new output values to the Terraform state, without changing any real
infrastructure.

期望输出 #

Changes to Outputs:
  + accounts_nested_by_ou = {
      + Prod OU           = {
          + AccX                     = "XXXXXXXXXXXX"
          + AccY                     = "YYYYYYYYYYYY"
        }
    }

You can apply this plan to save these new output values to the Terraform state, without changing any real
infrastructure.

解决方案 #

原代码遍历了根节点下的所有OU，且aws_organizations_organizational_unit_descendant_accounts会返回指定OU下所有层级的子孙账户，导致输出包含Cloud OU下的全部账户。修正后的代码直接指定目标OU ID，仅获取该OU下的账户：

# 可选：用变量存储目标OU ID，便于后续修改
variable "target_ou_id" {
  type        = string
  description = "目标OU的ID"
  default     = "ou-4"
}

# 获取目标OU的名称，用于输出的键名
data "aws_organizations_organizational_unit" "prod_ou" {
  id = var.target_ou_id
}

# 获取指定OU下的所有子孙账户
data "aws_organizations_organizational_unit_descendant_accounts" "prod_ou_accounts" {
  parent_id = var.target_ou_id
}

output "accounts_nested_by_ou" {
  description = "指定OU下的账户列表"
  value = {
    data.aws_organizations_organizational_unit.prod_ou.name = {
      for account in data.aws_organizations_organizational_unit_descendant_accounts.prod_ou_accounts.accounts :
      account.name => account.id
    }
  }
}

代码说明 #

1. 使用变量target_ou_id存储目标OU ID，后续调整目标OU时只需修改变量值即可
2. aws_organizations_organizational_unit用于获取目标OU的名称，确保输出的键名为"Prod OU"而非OU ID
3. aws_organizations_organizational_unit_descendant_accounts直接以ou-4作为父ID，仅返回该OU下的所有子孙账户（本例中Prod OU无嵌套OU，即AccX和AccY）
4. 输出格式与期望一致，键为OU名称，值为账户名到账户ID的映射

内容的提问来源于stack exchange，提问作者Pravïn