organization.json

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "This templates Creates one API key for the specified MongoDB Atlas organization. An organization API key grants programmatic access to an organization.",
  "Parameters": {
    "OrgName": {
      "Type": "String",
      "Description": "MongoDB Atlas Organization Name"
    },
    "OrgOwnerId": {
      "Type": "String",
      "Description": "MongoDB Atlas Organization Owner ID"
    },
    "FederatedSettingsId": {
      "Type": "String",
      "Description": "Unique 24-hexadecimal digit string that identifies the federation to link the newly created organization to. If specified, the proposed Organization Owner of the new organization must have the Organization Owner role in an organization associated with the federation."
    },
    "Profile": {
      "Type": "String",
      "Description": "Your MongoDB Atlas Profile Name created in secret manager"
    },
    "AwsSecretName": {
      "Type": "String",
      "Description": "Your MongoDB Atlas Profile Name created in secret manager"
    },
    "OrgRoles": {
      "Type": "List<String>",
      "Description": "Role names",
      "Default": "ORG_TEAM_MEMBERS_ADMIN,ORG_OWNER",
      "ConstraintDescription": "Comma Seperated String with Role names"
    },
    "Description": {
      "Type": "String",
      "Description": "Purpose or explanation provided when someone created this organization API key."
    },
    "ApiAccessListRequired": {
      "Type": "String",
      "Description": "Flag that indicates whether to require API operations to originate from an IP Address added to the API access list for the specified organization.",
      "ConstraintDescription": "boolean",
      "AllowedValues": [
        "true",
        "false"
      ],
      "Default": "false"
    },
    "MultiFactorAuthRequired": {
      "Type": "String",
      "Description": "Flag that indicates whether to require users to set up Multi-Factor Authentication (MFA) before accessing the specified organization. To learn more, see: https://www.mongodb.com/docs/atlas/security-multi-factor-authentication/.",
      "ConstraintDescription": "boolean",
      "AllowedValues": [
        "true",
        "false"
      ],
      "Default": "false"
    },
    "RestrictEmployeeAccess": {
      "Type": "String",
      "Description": "Flag that indicates whether to block MongoDB Support from accessing Atlas infrastructure for any deployment in the specified organization without explicit permission. Once this setting is turned on, you can grant MongoDB Support a 24-hour bypass access to the Atlas deployment to resolve support issues. To learn more, see: https://www.mongodb.com/docs/atlas/security-restrict-support-access/.",
      "ConstraintDescription": "boolean",
      "AllowedValues": [
        "true",
        "false"
      ],
      "Default": "false"
    },
    "SkipDefaultAlertsSettings": {
      "Type": "String",
      "ConstraintDescription": "boolean",
      "AllowedValues": [
        "true",
        "false"
      ],
      "Default": "true",
      "Description": "SkipDefaultAlertsSettings"
    },
    "GenAIFeaturesEnabled": {
      "Type": "String",
      "ConstraintDescription": "boolean",
      "AllowedValues": [
        "true",
        "false"
      ],
      "Default": "true",
      "Description": "Flag that indicates whether this organization has access to generative AI features. This setting only applies to Atlas Commercial and defaults to `true`. With this setting on, Project Owners may be able to enable or disable individual AI features at the project level. To learn more, see https://www.mongodb.com/docs/generative-ai-faq/"
    },
    "SecurityContact": {
      "Type": "String",
      "Description": "Email address of the security contact for the organization.",
      "Default": ""
    }
  },
  "Mappings": {},
  "Resources": {
    "OrgSecret": {
      "Type": "AWS::SecretsManager::Secret",
      "Properties": {
        "Name": {
          "Fn::Sub": [
            "cfn/atlas/profile/${SecretName}",
            {
              "SecretName": {
                "Ref": "AwsSecretName"
              }
            }
          ]
        },
        "Description": "APIKeys Profile will store as Secret in AWS Secrets Manager.",
        "SecretString": "{\"key\":\"value\"}"
      }
    },
    "Organization": {
      "Type": "MongoDB::Atlas::Organization",
      "Properties": {
        "OrgOwnerId": {
          "Ref": "OrgOwnerId"
        },
        "Name": {
          "Ref": "OrgName"
        },
        "APIKey": {
          "Roles": {
            "Ref": "OrgRoles"
          },
          "Description": {
            "Ref": "Description"
          }
        },
        "Profile": {
          "Ref": "Profile"
        },
        "AwsSecretName": {
          "Ref": "OrgSecret"
        },
        "ApiAccessListRequired": {
          "Ref": "ApiAccessListRequired"
        },
        "MultiFactorAuthRequired": {
          "Ref": "MultiFactorAuthRequired"
        },
        "RestrictEmployeeAccess": {
          "Ref": "RestrictEmployeeAccess"
        },
        "SkipDefaultAlertsSettings": {
          "Ref": "SkipDefaultAlertsSettings"
        },
        "GenAIFeaturesEnabled": {
          "Ref": "GenAIFeaturesEnabled"
        },
        "SecurityContact": {
          "Ref": "SecurityContact"
        }
      }
    }
  },
  "Outputs": {
    "OrgID": {
      "Value": {
        "Fn::GetAtt": [
          "Organization",
          "OrgId"
        ]
      }
    },
    "OrgSecretName": {
      "Value": {
        "Fn::Sub": [
          "cfn/atlas/profile/${SecretName}",
          {
            "SecretName": {
              "Ref": "AwsSecretName"
            }
          }
        ]
      }
    }
  }
}