Feat/enable aws nuke scp for nuke role (#301)

* feat: update name and description * feat: enable aws nuke protection on scratch OU * fix: fmt
cds-snc · Jul 24, 2024 · b863f5d · b863f5d
1 parent 87dc4c5
commit b863f5d
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/terragrunt/org_account/organization/organizations.tf b/terragrunt/org_account/organization/organizations.tf
@@ -66,6 +66,11 @@ resource "aws_organizations_policy_attachment" "Sandbox-cds_snc_universal_guardr
   target_id = aws_organizations_organizational_unit.Sandbox.id
 }
 
+resource "aws_organizations_policy_attachment" "Sandbox-aws_nuke_guardrails" {
+  policy_id = aws_organizations_policy.aws_nuke_guardrails.id
+  target_id = aws_organizations_organizational_unit.Sandbox.id
+}
+
 
 resource "aws_organizations_organizational_unit" "Security" {
   name      = "Security"

diff --git a/terragrunt/org_account/organization/scp.tf b/terragrunt/org_account/organization/scp.tf
@@ -265,7 +265,8 @@ data "aws_iam_policy_document" "aws_nuke_guardrails" {
 }
 
 resource "aws_organizations_policy" "aws_nuke_guardrails" {
-  name    = "Control Tower Guardrails"
-  type    = "SERVICE_CONTROL_POLICY"
-  content = data.aws_iam_policy_document.aws_nuke_guardrails.json
+  name        = "AWS Nuke Guardrails"
+  description = "Guardrails to protect AWS Control Tower and AWS SSO resources"
+  type        = "SERVICE_CONTROL_POLICY"
+  content     = data.aws_iam_policy_document.aws_nuke_guardrails.json
 }