Fixes for multi account.

master-account/accounts.tf

@@ -7,23 +7,18 @@
 // |  |- testing
 // |  |- development
 // |  |- forensics
-
-
-
 // TODO loop over local.subaccounts
 // Docs: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_create.html
 // To set password go to root sign up and enter email
 resource "aws_organizations_account" "main" {
-  count                      = "${length(var.sub_accounts)}"
-  name                       = "${var.sub_accounts[count.index]}"
-  email                      = "${local.account_email_local_part}+${var.sub_accounts[count.index]}@${local.account_email_domain}"
-  iam_user_access_to_billing = "DENY"
+  count = "${length(var.sub_accounts)}"
+  name  = "${var.sub_accounts[count.index]}"
+  email = "${local.account_email_local_part}+${var.sub_accounts[count.index]}@${local.account_email_domain}"
+
+  #iam_user_access_to_billing = "DENY"
 }
 
 # Org Units - TODO https://github.com/terraform-providers/terraform-provider-aws/pull/4207
-
-
-
 // https://www.terraform.io/docs/providers/aws/r/organizations_policy_attachment.html
 //resource "aws_organizations_policy_attachment" "environments" {
 //  policy_id = "${aws_organizations_policy.environments.id}"
@@ -44,3 +39,4 @@ resource "aws_organizations_account" "main" {
 //}
 //POLICY
 //}
+

master-account/main.tf

@@ -1,10 +1,8 @@
-
-resource "aws_organizations_organization" "account" {
-  feature_set = "ALL"
-}
+# resource "aws_organizations_organization" "account" {
+#   feature_set = "ALL"
+# }
 
 resource "aws_iam_account_alias" "alias" {
-  count = "${var.account_alias == "" ? 0 : 1}"
+  count         = "${var.account_alias == "" ? 0 : 1}"
   account_alias = "${var.account_alias}"
 }
-

master-account/variables.tf

@@ -1,13 +1,14 @@
+variable "name" {}
 
 variable "account_alias" {
-  type = "string"
+  type    = "string"
   default = ""
 }
 
 //
 variable "roles" {
-  type = "list"
-  default = ["admin","developer"]
+  type    = "list"
+  default = ["admin", "developer"]
 }
 
 // {username:[role,role]}
@@ -20,19 +21,19 @@ variable "roles" {
 //  type = "string"
 //}
 
-
 variable "account_email" {
   description = "Organization account email"
 }
 
 variable "sub_accounts" {
   type = "list"
+
   default = [
     "operations",
     "production",
     "staging",
     "testing",
     "development",
-    "forensics"
+    "forensics",
   ]
 }

user/send-email.sh

@@ -28,7 +28,7 @@ ENC_PASSWORD="$5"   # PGP encrypted password
 # PASSWORD=$(base64 --decode | keybase pgp decrypt)
 
 # Create a temporary file to store the encrypted binary data.
-password_file=$(mktemp "password.${USERNAME}.gpg")
+password_file=$(mktemp "password.${USERNAME}.gpg.XXXXX")
 
 # Decode the Base64 password and store it in password file.
 echo "$ENC_PASSWORD" | base64 --decode > "$password_file"
@@ -40,7 +40,7 @@ PASSWORD=$(gpg -q --decrypt "$password_file")
 rm "$password_file"
 
 # Create a temporary file to store the HTML email body.
-message_file=$(mktemp "message.${USERNAME}.html")
+message_file=$(mktemp "message.${USERNAME}.html.XXXXX")
 
 # Replace username and passwords with correct values.
 cat "$DIR/send-email.html.tpl" > ${message_file}