fix: account "State" field over deprecated "Status" - #815
Open
monicamico wants to merge 1 commit into
Open
Conversation
AWS Organizations is replacing the account 'Status' field with the more granular 'State' field (PENDING_ACTIVATION, ACTIVE, SUSPENDED, PENDING_CLOSURE, CLOSED). The legacy 'Status' field is deprecated and will be removed after September 2026. Once removed, ADF's account filtering (which checks Status == 'ACTIVE') would treat every account as inactive and skip it, breaking bootstrapping and account management. This change makes ADF prefer the 'State' field and fall back to 'Status' for backward compatibility, across all account-filtering locations: - adf-build/shared/python/organizations.py - adf-build/shared/python/target.py - adf-build/shared/helpers/retrieve_organization_accounts.py - adf-build/shared/helpers/terraform/get_accounts.py - lambda_codebase/account/main.py Adds tests covering State-based filtering and State precedence over Status. Ref: https://aws.amazon.com/blogs/mt/updates-to-account-status-information-in-aws-organizations/ Signed-off-by: Monica Amico <moniami@amazon.it>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
AWS Organizations has introduced a new account
Statefield that replaces thelegacy
Statusfield, providing more granular account lifecycle information(AWS Cloud Operations Blog, 15 Sep 2025).
Statusfield exposes only three values:ACTIVE,SUSPENDED,PENDING_CLOSURE.Statefield exposes five:PENDING_ACTIVATION,ACTIVE,SUSPENDED,PENDING_CLOSURE,CLOSED.DescribeAccount,ListAccounts,ListAccountsForParent, andListDelegatedAdministratorsbetweenSeptember 2025 and September 2026.
Statusfield is removed from API responses,leaving only
State.ADF filters accounts using
Status == "ACTIVE"in several places. OnceStatusis removed,account.get("Status")returnsNone, so every accountwould be treated as inactive and skipped, breaking account bootstrapping,
account management, deployment-map target resolution, and the Terraform
helper org-wide.
Preferring
Stateis also more correct today: an account can reportStatus == "ACTIVE"while still completing sign-up, whereasStatedistinguishes
PENDING_ACTIVATIONfromACTIVE. Filtering onState == "ACTIVE"therefore avoids treating not-yet-activated accounts asready.
Reference:
https://aws.amazon.com/blogs/mt/updates-to-account-status-information-in-aws-organizations/
Issue #, if available: Resolve: #812
What?
Description of changes:
Statefield and fall back to the deprecatedStatusfield(
account.get("State", account.get("Status"))) everywhere ADF filtersaccounts by activity, keeping full backward compatibility during the
transition window and for SDK versions that do not yet return
State:State-based filtering (includingPENDING_CLOSUREand
SUSPENDEDexclusion) andStatetaking precedence overStatus.Note: the
Statefield is only returned by botocore/boto3 versions releasedafter 9 September 2025; the
Statusfallback keeps ADF working on older SDKversions until the shared Lambda layer dependencies are bumped.
By submitting this pull request, I confirm that you can use, modify, copy, and
redistribute this contribution, under the terms of your choice.