/AWS1/IF_ORG=>ATTACHPOLICY()

About AttachPolicy

Attaches a policy to a root, an organizational unit (OU), or an individual account. How the policy affects accounts depends on the type of policy. Refer to the Organizations User Guide for information about each policy type:

• SERVICE_CONTROL_POLICY

• RESOURCE_CONTROL_POLICY

• DECLARATIVE_POLICY_EC2

• BACKUP_POLICY

• TAG_POLICY

• CHATBOT_POLICY

• AISERVICES_OPT_OUT_POLICY

• SECURITYHUB_POLICY

This operation can be called only from the organization's management account or by a member account that is a delegated administrator.

Method Signature

IMPORTING

Required arguments:

iv_policyid TYPE /AWS1/ORGPOLICYID /AWS1/ORGPOLICYID

The unique identifier (ID) of the policy that you want to attach to the target. You can get the ID for the policy by calling the ListPolicies operation.

The regex pattern for a policy ID string requires "p-" followed by from 8 to 128 lowercase or uppercase letters, digits, or the underscore character (_).

iv_targetid TYPE /AWS1/ORGPOLICYTARGETID /AWS1/ORGPOLICYTARGETID

The unique identifier (ID) of the root, OU, or account that you want to attach the policy to. You can get the ID by calling the ListRoots, ListOrganizationalUnitsForParent, or ListAccounts operations.

The regex pattern for a target ID string requires one of the following:

• Root - A string that begins with "r-" followed by from 4 to 32 lowercase letters or digits.

• Account - A string that consists of exactly 12 digits.

• Organizational unit (OU) - A string that begins with "ou-" followed by from 4 to 32 lowercase letters or digits (the ID of the root that the OU is in). This string is followed by a second "-" dash and from 8 to 32 additional lowercase letters or digits.

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

lo_client->/aws1/if_org~attachpolicy(
  iv_policyid = |string|
  iv_targetid = |string|
).

To attach a policy to an account

The following example shows how to attach a service control policy (SCP) to an account:

lo_client->/aws1/if_org~attachpolicy(
  iv_policyid = |p-examplepolicyid111|
  iv_targetid = |333333333333|
).

To attach a policy to an OU

The following example shows how to attach a service control policy (SCP) to an OU:

lo_client->/aws1/if_org~attachpolicy(
  iv_policyid = |p-examplepolicyid111|
  iv_targetid = |ou-examplerootid111-exampleouid111|
).