Merge pull request #1037 from brucehoff/IT-3322

IT-3322 remove athena and application-manager roles from Organizations account
Sage-Bionetworks-IT · Nov 29, 2023 · 617cb11 · 617cb11
2 parents c9f6b8b + 3524ee8
commit 617cb11
Showing 1 changed file with 7 additions and 7 deletions.
diff --git a/org-formation/700-aws-sso/_tasks.yaml b/org-formation/700-aws-sso/_tasks.yaml
@@ -531,7 +531,7 @@ SsoApplicationManager:
   TerminationProtection: false
   DefaultOrganizationBindingRegion: !Ref primaryRegion
   DefaultOrganizationBinding:
-    IncludeMasterAccount: true
+    IncludeMasterAccount: false
   OrganizationBindings:
     TargetBinding:
       Account: '*'
@@ -574,7 +574,7 @@ SsoSynapseDWDevAthenaUser:
   TerminationProtection: false
   DefaultOrganizationBindingRegion: !Ref primaryRegion
   DefaultOrganizationBinding:
-    IncludeMasterAccount: true
+    IncludeMasterAccount: false
   OrganizationBindings:
     TargetBinding:
       Account: !Ref SynapseDevAccount
@@ -597,7 +597,7 @@ SsoSynapseDWProdAthenaUser:
   TerminationProtection: false
   DefaultOrganizationBindingRegion: !Ref primaryRegion
   DefaultOrganizationBinding:
-    IncludeMasterAccount: true
+    IncludeMasterAccount: false
   OrganizationBindings:
     TargetBinding:
       Account: !Ref SynapseProdAccount
@@ -1559,7 +1559,7 @@ SsoDntDevApplicationManager:
   StackDescription: 'SSO: Application Manager role used by DntDev application-manager group'
   DefaultOrganizationBindingRegion: !Ref primaryRegion
   DefaultOrganizationBinding:
-    IncludeMasterAccount: true
+    IncludeMasterAccount: false
   OrganizationBindings:
     TargetBinding:
       Account: !Ref DnTDevAccount
@@ -1730,7 +1730,7 @@ SsoDCAProdApplicationManager:
   StackDescription: 'SSO: Application Manager role used by DCA application-manager group'
   DefaultOrganizationBindingRegion: !Ref primaryRegion
   DefaultOrganizationBinding:
-    IncludeMasterAccount: true
+    IncludeMasterAccount: false
   OrganizationBindings:
     TargetBinding:
       Account: !Ref DCAProdAccount
@@ -1781,7 +1781,7 @@ SsoGenieProdApplicationManager:
   StackDescription: 'SSO: Application Manager role used by Genie application-manager group'
   DefaultOrganizationBindingRegion: !Ref primaryRegion
   DefaultOrganizationBinding:
-    IncludeMasterAccount: true
+    IncludeMasterAccount: false
   OrganizationBindings:
     TargetBinding:
       Account: !Ref GenieProdAccount
@@ -1969,7 +1969,7 @@ SsoDccValidatorProdApplicationManager:
   StackDescription: 'SSO: Application Manager role used by DccValidator-Prod application-manager group'
   DefaultOrganizationBindingRegion: !Ref primaryRegion
   DefaultOrganizationBinding:
-    IncludeMasterAccount: true
+    IncludeMasterAccount: false
   OrganizationBindings:
     TargetBinding:
       Account: !Ref DccvalidatorProdAccount