如何通过Terraform递归收集AWS Organizations中所有OU？

你当前的配置只能获取根节点下的一级OU，要收集所有层级的子OU，可以用以下两种方案：

方案1：纯Terraform固定层级实现（无需外部工具） #

这种方法通过逐层声明数据源来获取各级OU，适合OU层级固定的场景：

data "aws_organizations_organization" "this" {}

# 获取根节点下的一级OU
data "aws_organizations_organizational_units" "level_1" {
  parent_id = data.aws_organizations_organization.this.roots[0].id
}

# 获取一级OU下的所有二级OU
data "aws_organizations_organizational_units" "level_2" {
  for_each = { for ou in data.aws_organizations_organizational_units.level_1.children : ou.id => ou }
  parent_id = each.value.id
}

# 获取二级OU下的所有三级OU（如果有更多层级，可继续复制此结构扩展）
data "aws_organizations_organizational_units" "level_3" {
  for_each = flatten([
    for ou_set in data.aws_organizations_organizational_units.level_2 : {
      for child in ou_set.children : child.id => child
    }
  ])
  parent_id = each.value.id
}

locals {
  # 整合所有层级的OU列表
  all_ous = concat(
    data.aws_organizations_organizational_units.level_1.children,
    flatten([for ou_set in data.aws_organizations_organizational_units.level_2 : ou_set.children]),
    flatten([for ou_set in data.aws_organizations_organizational_units.level_3 : ou_set.children])
  )

  # 转换为名称到ID的映射
  oulist = { for ou in local.all_ous : ou.name => ou.id }
}

如果你的OU层级超过3层，只需继续添加level_4、level_5等数据源，并在all_ous中追加对应的子OU即可。

方案2：依赖外部工具实现无限递归（更灵活） #

如果OU层级不固定，可通过external数据源调用AWS CLI和jq工具，递归获取所有OU：

data "aws_organizations_organization" "this" {}

data "external" "all_ous" {
  program = [
    "bash",
    "-c",
    <<EOF
aws organizations list-organizational-units-for-parent --parent-id ${data.aws_organizations_organization.this.roots[0].id} --output json | jq -c '
  def get_ous(parent_id):
    [
      (aws organizations list-organizational-units-for-parent --parent_id \$parent_id --output json | fromjson).OrganizationalUnits[]
    ] + [
      for ou in get_ous(parent_id): get_ous(ou.Id)[]
    ];
  get_ous("${data.aws_organizations_organization.this.roots[0].id}") | map({name: .Name, id: .Id})
'
EOF
  ]
}

locals {
  # 解析外部数据源结果并生成名称到ID的映射
  oulist = { for ou in jsondecode(data.external.all_ous.result) : ou.name => ou.id }
}

注意：此方案要求运行Terraform的环境已安装AWS CLI（且配置了有效权限）和jq工具。

内容的提问来源于stack exchange，提问作者Alex Jamerton