ignore attach/detach scps to nested OUs (#942)

* ignore attach/detach scps to nested OUs

* Fitler out nested ous from SCP detach/attach

Co-authored-by: hickeydh-aws <hickeydh@amazon.com>

Author: hickeydh-aws

src/core/runtime/src/add-scp-step.ts

@@ -93,9 +93,12 @@ export const handler = async (input: AddScpInput) => {
 
   // Find roots to attach FullAWSAccess
   const rootIds = await scps.organizationRoots();
+  const rootOus = organizationalUnits.filter(ou => {
+    return !ou.ouPath.includes('/');
+  });
 
   // Find Accelerator accounts and OUs to attach FullAWSAccess
-  const acceleratorOuIds = organizationalUnits.map(ou => ou.ouId);
+  const acceleratorOuIds = rootOus.map(ou => ou.ouId);
   const acceleratorAccountIds = accounts.map(a => a.id);
   const acceleratorTargetIds = [...rootIds, ...acceleratorOuIds, ...acceleratorAccountIds];
   const acceleratorTargetOuIds = [...rootIds, ...acceleratorOuIds];

src/deployments/runtime/src/ou-validation-events/policy-changes.ts

@@ -110,11 +110,16 @@ export const handler = async (input: ScheduledEvent) => {
     if (ignoredOus.length > 0) {
       if (targetId.startsWith('ou-')) {
         const destinationOrg = await organizations.getOrganizationalUnitWithPath(targetId);
+        console.log(JSON.stringify(destinationOrg, null, 2));
         const destinationRootOrg = destinationOrg.Name!;
         if (ignoredOus.includes(destinationRootOrg)) {
           console.log(`${eventName} is on ignored-ou from ROOT, no need to reattach`);
           return 'IGNORE';
         }
+        if (destinationOrg.Path.includes('/')) {
+          console.log(`${destinationOrg.Path} is a nested OU under ${destinationOrg.Name}. Ignoring`);
+          return 'IGNORE';
+        }
       } else {
         const accountObject = accounts.find(acc => acc.accountId === targetId);
         if (ignoredOus.includes(accountObject?.organizationalUnit!)) {