OrganizationTopology and inventory-organization.json¶

Section 17 · From docs/INVENTORY_REFERENCE.md on GitHub

cloudg.inventory.organization.OrganizationTopology, returned by discover_organization() and available as InventoryMapper.organization after a run. inventory-organization.json and InventoryResult.organization are topology.to_dict(): dataclasses.asdict() of the topology plus control_tower_enabled.

17.1 Top-level fields¶

Field	Type	Meaning
`organization_id`	`str \\| None`	`o-…`.
`organization_arn`	`str \\| None`	Organization ARN.
`management_account_id`	`str \\| None`	Management account.
`caller_account_id`	`str \\| None`	Account of the credentials that ran discovery (the management account or a delegated administrator).
`feature_set`	`str \\| None`	`ALL` or `CONSOLIDATED_BILLING`.
`roots`	`list[OrgUnit]`	Organization roots (normally one).
`ous`	`dict[str, OrgUnit]`	Every OU by ID, at any depth.
`accounts`	`dict[str, OrgAccount]`	Every account by ID (before selection filters).
`policies`	`list[OrgPolicy]`	SCPs, RCPs, tag, backup and AI services opt-out policies of the policy types enabled on the root.
`delegated_administrators`	`dict[str, list[str]]`	Service short name (`guardduty`, `securityhub`, `inspector2`, `config`, `access-analyzer`, `macie`, `detective`, `fms`, `sso`) → delegated administrator account IDs. Only services that have one.
`enabled_services`	`list[str]`	Service principals with trusted access (`guardduty.amazonaws.com`, ...).
`landing_zone`	`dict \\| None`	Control Tower `GetLandingZone` output without the manifest, or `None` without Control Tower (17.3).
`governed_regions`	`list[str]`	Control Tower governed regions.
`shared_accounts`	`dict[str, str]`	Control Tower role → account ID: `log_archive`, `audit`, `config_aggregator`, `backup_admin`, `central_backup` (those present in the manifest).
`enabled_controls`	`list[dict]`	`ListEnabledControls` items (17.3).
`enabled_baselines`	`list[dict]`	`ListEnabledBaselines` items.
`control_tower_region`	`str \\| None`	Home region where the landing zone was found.
`errors`	`list[str]`	Non-fatal discovery errors (`"controltower:get_landing_zone: …"`).
`control_tower_enabled`	`bool`	`to_dict()` only: `landing_zone is not None`.

17.2 OrgUnit, OrgAccount, OrgPolicy¶

OrgUnit (roots and OUs):

Field	Type	Meaning
`id`	`str`	`r-…` or `ou-…`.
`name`	`str`	OU name, `Root` for roots.
`arn`	`str`	ARN.
`parent_id`	`str \\| None`	Parent root / OU; `None` for roots.
`path`	`list[str]`	Names from the root down, including itself: `["Root", "Workloads", "Prod"]`.
`is_root`	`bool`	Root.

OrgAccount:

Field	Type	Meaning
`id`	`str`	Account ID.
`name`	`str`	Account name.
`arn`	`str`	Organizations account ARN (`arn:aws:organizations::<mgmt>:account/o-…/<id>`).
`status`	`str`	`ACTIVE`, `SUSPENDED`, `PENDING_CLOSURE`, ... (the `State` field, falling back to `Status`).
`parent_id`	`str`	Root or OU directly above.
`ou_path`	`list[str]`	Names of the parent's path: `["Root", "Workloads", "Prod"]`.
`email`	`str \\| None`	Root user email.
`joined_method`	`str \\| None`	`CREATED` or `INVITED`.
`joined`	`str \\| None`	Join timestamp as a string.

OrgPolicy:

Field	Type	Meaning
`id`	`str`	`p-…`.
`name`	`str`	Policy name.
`arn`	`str`	ARN.
`type`	`str`	`SERVICE_CONTROL_POLICY`, `RESOURCE_CONTROL_POLICY`, `TAG_POLICY`, `BACKUP_POLICY`, `AISERVICES_OPT_OUT_POLICY`.
`aws_managed`	`bool`	AWS managed (`FullAWSAccess`).
`targets`	`list[str]`	Root, OU and account IDs it is attached to.

17.3 Control Tower fields¶

landing_zone holds the GetLandingZone response fields other than manifest, typically arn, version, latestAvailableVersion, status, driftStatus ({"status": "IN_SYNC"}). When the call failed it is {"arn": …} and the error is in errors.

enabled_controls items are the raw API items: arn, controlIdentifier, targetIdentifier (the OU ARN), statusSummary ({"status": "SUCCEEDED"}), driftStatusSummary ({"driftStatus": "IN_SYNC"}). enabled_baselines items: arn, baselineIdentifier, baselineVersion, targetIdentifier, statusSummary.

17.4 Methods¶

Method	Returns	Meaning
`target_accounts(include_ous=None, exclude_accounts=None, include_management_account=True, include_suspended=False)`	`list[str]` (sorted)	Account IDs to collect. `include_ous` takes OU IDs, ARNs or names (case-insensitive) and includes nested OUs; an unmatched name logs a warning. Non-`ACTIVE` accounts are skipped unless `include_suspended`.
`to_assets()`	`list[CloudAsset]`	Section 18.
`to_dict()`	`dict`	The JSON form above.
`control_tower_enabled` (property)	`bool`	A landing zone was found.

17.5 Example (abridged)¶

{
  "organization_id": "o-1wietecbs4",
  "organization_arn": "arn:aws:organizations::123456789012:organization/o-1wietecbs4",
  "management_account_id": "123456789012",
  "caller_account_id": "123456789012",
  "feature_set": "ALL",
  "roots": [
    {"id": "r-7h3o", "name": "Root",
     "arn": "arn:aws:organizations::123456789012:root/o-1wietecbs4/r-7h3o",
     "parent_id": null, "path": ["Root"], "is_root": true}
  ],
  "ous": {
    "ou-7h3o-ljevwujv": {"id": "ou-7h3o-ljevwujv", "name": "Workloads", "arn": "…",
                         "parent_id": "r-7h3o", "path": ["Root", "Workloads"], "is_root": false},
    "ou-7h3o-bqhq9yxz": {"id": "ou-7h3o-bqhq9yxz", "name": "Prod", "arn": "…",
                         "parent_id": "ou-7h3o-ljevwujv", "path": ["Root", "Workloads", "Prod"],
                         "is_root": false}
  },
  "accounts": {
    "552289857375": {"id": "552289857375", "name": "prod-app", "arn": "…", "status": "ACTIVE",
                     "parent_id": "ou-7h3o-bqhq9yxz", "ou_path": ["Root", "Workloads", "Prod"],
                     "email": "…", "joined_method": "CREATED", "joined": "…"}
  },
  "policies": [
    {"id": "p-FullAWSAccess", "name": "FullAWSAccess", "arn": "…",
     "type": "SERVICE_CONTROL_POLICY", "aws_managed": true, "targets": ["r-7h3o"]}
  ],
  "delegated_administrators": {},
  "enabled_services": [],
  "landing_zone": null,
  "governed_regions": [],
  "shared_accounts": {},
  "enabled_controls": [],
  "enabled_baselines": [],
  "control_tower_region": null,
  "errors": [],
  "control_tower_enabled": false
}

With Control Tower the same file carries, for example:

{
  "landing_zone": {"arn": "arn:aws:controltower:us-east-1:123456789012:landingzone/…",
                   "version": "3.3", "latestAvailableVersion": "3.3", "status": "ACTIVE",
                   "driftStatus": {"status": "IN_SYNC"}},
  "governed_regions": ["us-east-1", "eu-west-1"],
  "shared_accounts": {"log_archive": "222222222222", "audit": "333333333333"},
  "enabled_controls": [
    {"arn": "…", "controlIdentifier": "arn:aws:controltower:us-east-1::control/AWS-GR_RESTRICT_ROOT_USER",
     "targetIdentifier": "arn:aws:organizations::123456789012:ou/o-…/ou-…",
     "statusSummary": {"status": "SUCCEEDED"}, "driftStatusSummary": {"driftStatus": "IN_SYNC"}}
  ],
  "control_tower_region": "us-east-1",
  "control_tower_enabled": true
}