Skip to content

fix: account "State" field over deprecated "Status" - #815

Open
monicamico wants to merge 1 commit into
awslabs:masterfrom
monicamico:fix/account-state-field-deprecation
Open

fix: account "State" field over deprecated "Status"#815
monicamico wants to merge 1 commit into
awslabs:masterfrom
monicamico:fix/account-state-field-deprecation

Conversation

@monicamico

@monicamico monicamico commented Jul 1, 2026

Copy link
Copy Markdown

Why?

AWS Organizations has introduced a new account State field that replaces the
legacy Status field, providing more granular account lifecycle information
(AWS Cloud Operations Blog, 15 Sep 2025).

  • The legacy Status field exposes only three values: ACTIVE, SUSPENDED,
    PENDING_CLOSURE.
  • The new State field exposes five: PENDING_ACTIVATION, ACTIVE,
    SUSPENDED, PENDING_CLOSURE, CLOSED.
  • Both fields are returned by DescribeAccount, ListAccounts,
    ListAccountsForParent, and ListDelegatedAdministrators between
    September 2025 and September 2026.
  • After 9 September 2026 the Status field is removed from API responses,
    leaving only State.

ADF filters accounts using Status == "ACTIVE" in several places. Once
Status is removed, account.get("Status") returns None, so every account
would be treated as inactive and skipped, breaking account bootstrapping,
account management, deployment-map target resolution, and the Terraform
helper org-wide.

Preferring State is also more correct today: an account can report
Status == "ACTIVE" while still completing sign-up, whereas State
distinguishes PENDING_ACTIVATION from ACTIVE. Filtering on
State == "ACTIVE" therefore avoids treating not-yet-activated accounts as
ready.

Reference:
https://aws.amazon.com/blogs/mt/updates-to-account-status-information-in-aws-organizations/

Issue #, if available: Resolve: #812

What?

Description of changes:

  • Prefer the new State field and fall back to the deprecated Status field
    (account.get("State", account.get("Status"))) everywhere ADF filters
    accounts by activity, keeping full backward compatibility during the
    transition window and for SDK versions that do not yet return State:
    • adf-build/shared/python/organizations.py
    • adf-build/shared/python/target.py
    • adf-build/shared/helpers/retrieve_organization_accounts.py
    • adf-build/shared/helpers/terraform/get_accounts.py
    • lambda_codebase/account/main.py
  • Add unit tests covering State-based filtering (including PENDING_CLOSURE
    and SUSPENDED exclusion) and State taking precedence over Status.

Note: the State field is only returned by botocore/boto3 versions released
after 9 September 2025; the Status fallback keeps ADF working on older SDK
versions until the shared Lambda layer dependencies are bumped.


By submitting this pull request, I confirm that you can use, modify, copy, and
redistribute this contribution, under the terms of your choice.

AWS Organizations is replacing the account 'Status' field with the more
granular 'State' field (PENDING_ACTIVATION, ACTIVE, SUSPENDED,
PENDING_CLOSURE, CLOSED). The legacy 'Status' field is deprecated and will
be removed after September 2026. Once removed, ADF's account filtering
(which checks Status == 'ACTIVE') would treat every account as inactive and
skip it, breaking bootstrapping and account management.

This change makes ADF prefer the 'State' field and fall back to 'Status'
for backward compatibility, across all account-filtering locations:
- adf-build/shared/python/organizations.py
- adf-build/shared/python/target.py
- adf-build/shared/helpers/retrieve_organization_accounts.py
- adf-build/shared/helpers/terraform/get_accounts.py
- lambda_codebase/account/main.py

Adds tests covering State-based filtering and State precedence over Status.

Ref: https://aws.amazon.com/blogs/mt/updates-to-account-status-information-in-aws-organizations/
Signed-off-by: Monica Amico <moniami@amazon.it>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Deprecation of Status field in AWS Organizations API

2 participants