resource "aws_organizations_organizational_unit" "root" {
  name      = "root"
  parent_id = aws_organizations_organization.main.roots.0.id
}

resource "aws_organizations_organizational_unit" "id_destination" {
  name      = "id-destination"
  parent_id = aws_organizations_organizational_unit.root.id
}

resource "aws_organizations_organizational_unit" "prod" {
  name      = "prod"
  parent_id = aws_organizations_organizational_unit.id_destination.id
}

resource "aws_organizations_organizational_unit" "suspended" {
  depends_on = [aws_organizations_organization.main]

  name      = "suspended"
  parent_id = aws_organizations_organizational_unit.root.id
}

module "org_scps" {
  source  = "trussworks/org-scp/aws"
  version = "~> 1.6.1"

  # applies to all accounts
  # - don't allow all accounts to be able to leave the org
  # - don't allow access to the root user
  # - require s3 objects be encrypted
  # - restrict region-specific operations to us-west-2
  deny_root_account_target_ids     = [aws_organizations_organizational_unit.root.id]
  deny_leaving_orgs_target_ids     = [aws_organizations_organizational_unit.root.id]
  require_s3_encryption_target_ids = [aws_organizations_organizational_unit.root.id]
  allowed_regions                  = ["us-west-2"]
  restrict_regions_target_ids      = [aws_organizations_organizational_unit.root.id]

  # applies to accounts that are not managing IAM users
  # - don't allow creating IAM users or access keys
  deny_creating_iam_users_target_ids = [aws_organizations_organizational_unit.id_destination.id]

  # applies to all prod accounts
  # - don't allow deleting KMS keys
  # - don't allow deleting Route53 zones
  # - don't allow deleting CloudWatch logs
  # - protect terraform statefile bucket
  # - protect OrganizationAccountAccessRole
  deny_deleting_kms_keys_target_ids        = [aws_organizations_organizational_unit.prod.id]
  deny_deleting_route53_zones_target_ids   = [aws_organizations_organizational_unit.prod.id]
  deny_deleting_cloudwatch_logs_target_ids = [aws_organizations_organizational_unit.prod.id]
  protect_s3_bucket_target_ids             = [aws_organizations_organizational_unit.prod.id]
  protect_iam_role_target_ids              = [aws_organizations_organizational_unit.prod.id]

  protect_s3_bucket_resources = [
    "arn:aws:s3:::prod-terraform-state-us-west-2",
    "arn:aws:s3:::prod-terraform-state-us-west-2/*"
  ]
  protect_iam_role_resources = [
    "arn:aws:iam::*:role/OrganizationAccountAccessRole"
  ]

  # applies to all suspended accounts
  # - don't allow any access
  deny_all_access_target_ids = [aws_organizations_organizational_unit.suspended.id]
}