@beesolve/aws-accounts 1.1.0 → 1.2.1

package/dist-lambda/handler.mjs

@@ -9,7 +9,7 @@ import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 import { OrganizationsClient as OrganizationsClient3 } from "@aws-sdk/client-organizations";
 import { SSOAdminClient as SSOAdminClient3 } from "@aws-sdk/client-sso-admin";
 import { IdentitystoreClient as IdentitystoreClient3 } from "@aws-sdk/client-identitystore";
-import { AccountClient as AccountClient2 } from "@aws-sdk/client-account";
+import { AccountClient as AccountClient3 } from "@aws-sdk/client-account";
 
 // node_modules/valibot/dist/index.mjs
 var store$4;
@@ -792,6 +792,22 @@ var provisionIdcPermissionSetOperationSchema = strictObject({
   permissionSetName: string(),
   targetScope: literal("ALL_PROVISIONED_ACCOUNTS")
 });
+var permissionsBoundaryOperationValueSchema = union([
+  strictObject({ managedPolicyArn: string() }),
+  strictObject({
+    customerManagedPolicyName: string(),
+    customerManagedPolicyPath: string()
+  })
+]);
+var putIdcPermissionSetPermissionsBoundaryOperationSchema = strictObject({
+  kind: literal("putIdcPermissionSetPermissionsBoundary"),
+  permissionSetName: string(),
+  permissionsBoundary: permissionsBoundaryOperationValueSchema
+});
+var deleteIdcPermissionSetPermissionsBoundaryOperationSchema = strictObject({
+  kind: literal("deleteIdcPermissionSetPermissionsBoundary"),
+  permissionSetName: string()
+});
 var grantIdcAccountAssignmentOperationSchema = strictObject({
   kind: literal("grantIdcAccountAssignment"),
   accountName: string(),
@@ -806,6 +822,92 @@ var revokeIdcAccountAssignmentOperationSchema = strictObject({
   principalType: picklist(["GROUP", "USER"]),
   principalName: string()
 });
+var setIdcAccessControlAttributesOperationSchema = strictObject({
+  kind: literal("setIdcAccessControlAttributes"),
+  attributes: array(
+    strictObject({
+      key: string(),
+      source: array(string())
+    })
+  )
+});
+var alternateContactTypeSchema = picklist([
+  "BILLING",
+  "OPERATIONS",
+  "SECURITY"
+]);
+var putAlternateContactOperationSchema = strictObject({
+  kind: literal("putAlternateContact"),
+  accountId: string(),
+  accountName: string(),
+  contactType: alternateContactTypeSchema,
+  name: string(),
+  email: string(),
+  phone: string(),
+  title: optional(string())
+});
+var deleteAlternateContactOperationSchema = strictObject({
+  kind: literal("deleteAlternateContact"),
+  accountId: string(),
+  accountName: string(),
+  contactType: alternateContactTypeSchema
+});
+var registerDelegatedAdministratorOperationSchema = strictObject({
+  kind: literal("registerDelegatedAdministrator"),
+  accountId: string(),
+  accountName: string(),
+  servicePrincipal: string()
+});
+var deregisterDelegatedAdministratorOperationSchema = strictObject({
+  kind: literal("deregisterDelegatedAdministrator"),
+  accountId: string(),
+  accountName: string(),
+  servicePrincipal: string()
+});
+var createOrgPolicyOperationSchema = strictObject({
+  kind: literal("createOrgPolicy"),
+  policyName: string(),
+  policyType: picklist([
+    "SERVICE_CONTROL_POLICY",
+    "RESOURCE_CONTROL_POLICY",
+    "TAG_POLICY",
+    "AISERVICES_OPT_OUT_POLICY",
+    "BACKUP_POLICY"
+  ]),
+  description: string(),
+  content: string()
+});
+var updateOrgPolicyContentOperationSchema = strictObject({
+  kind: literal("updateOrgPolicyContent"),
+  policyId: string(),
+  policyName: string(),
+  content: string()
+});
+var updateOrgPolicyDescriptionOperationSchema = strictObject({
+  kind: literal("updateOrgPolicyDescription"),
+  policyId: string(),
+  policyName: string(),
+  description: string()
+});
+var attachOrgPolicyOperationSchema = strictObject({
+  kind: literal("attachOrgPolicy"),
+  policyId: string(),
+  policyName: string(),
+  targetId: string(),
+  targetName: string()
+});
+var detachOrgPolicyOperationSchema = strictObject({
+  kind: literal("detachOrgPolicy"),
+  policyId: string(),
+  policyName: string(),
+  targetId: string(),
+  targetName: string()
+});
+var deleteOrgPolicyOperationSchema = strictObject({
+  kind: literal("deleteOrgPolicy"),
+  policyId: string(),
+  policyName: string()
+});
 var operationSchema = variant("kind", [
   moveAccountOperationSchema,
   createOuOperationSchema,
@@ -834,8 +936,21 @@ var operationSchema = variant("kind", [
   attachIdcCustomerManagedPolicyReferenceToPermissionSetOperationSchema,
   detachIdcCustomerManagedPolicyReferenceFromPermissionSetOperationSchema,
   provisionIdcPermissionSetOperationSchema,
+  putIdcPermissionSetPermissionsBoundaryOperationSchema,
+  deleteIdcPermissionSetPermissionsBoundaryOperationSchema,
   grantIdcAccountAssignmentOperationSchema,
-  revokeIdcAccountAssignmentOperationSchema
+  revokeIdcAccountAssignmentOperationSchema,
+  createOrgPolicyOperationSchema,
+  updateOrgPolicyContentOperationSchema,
+  updateOrgPolicyDescriptionOperationSchema,
+  attachOrgPolicyOperationSchema,
+  detachOrgPolicyOperationSchema,
+  deleteOrgPolicyOperationSchema,
+  putAlternateContactOperationSchema,
+  deleteAlternateContactOperationSchema,
+  setIdcAccessControlAttributesOperationSchema,
+  registerDelegatedAdministratorOperationSchema,
+  deregisterDelegatedAdministratorOperationSchema
 ]);
 var unsupportedDiffKindSchema = picklist([
   "ambiguousOuRename",
@@ -885,10 +1000,37 @@ var organizationalUnitSchema = strictObject({
   arn: nonEmptyString,
   name: nonEmptyString
 });
+var orgPolicyTypeSchema = picklist([
+  "SERVICE_CONTROL_POLICY",
+  "RESOURCE_CONTROL_POLICY",
+  "TAG_POLICY",
+  "AISERVICES_OPT_OUT_POLICY",
+  "BACKUP_POLICY"
+]);
+var orgPolicySchema = strictObject({
+  id: nonEmptyString,
+  arn: nonEmptyString,
+  name: nonEmptyString,
+  description: string(),
+  type: orgPolicyTypeSchema,
+  content: nonEmptyString
+});
+var orgPolicyAttachmentSchema = strictObject({
+  policyId: nonEmptyString,
+  targetId: nonEmptyString,
+  targetType: picklist(["ROOT", "ORGANIZATIONAL_UNIT", "ACCOUNT"])
+});
 var accountTagSchema = strictObject({
   key: nonEmptyString,
   value: string()
 });
+var alternateContactSchema = strictObject({
+  contactType: picklist(["BILLING", "OPERATIONS", "SECURITY"]),
+  name: string(),
+  email: string(),
+  phone: string(),
+  title: optional(string())
+});
 var accountSchema = strictObject({
   id: nonEmptyString,
   arn: nonEmptyString,
@@ -896,7 +1038,8 @@ var accountSchema = strictObject({
   email: nonEmptyString,
   status: nonEmptyString,
   parentId: nonEmptyString,
-  tags: array(accountTagSchema)
+  tags: array(accountTagSchema),
+  alternateContacts: optional(array(alternateContactSchema))
 });
 var userSchema = strictObject({
   userId: nonEmptyString,
@@ -918,6 +1061,13 @@ var customerManagedPolicyReferenceSchema = strictObject({
   name: nonEmptyString,
   path: nonEmptyString
 });
+var permissionsBoundarySchema = union([
+  strictObject({ managedPolicyArn: nonEmptyString }),
+  strictObject({
+    customerManagedPolicyName: nonEmptyString,
+    customerManagedPolicyPath: nonEmptyString
+  })
+]);
 var permissionSetSchema = strictObject({
   permissionSetArn: nonEmptyString,
   name: nonEmptyString,
@@ -925,7 +1075,8 @@ var permissionSetSchema = strictObject({
   sessionDuration: nullable(string()),
   inlinePolicy: nullable(nonEmptyString),
   awsManagedPolicies: array(nonEmptyString),
-  customerManagedPolicies: array(customerManagedPolicyReferenceSchema)
+  customerManagedPolicies: array(customerManagedPolicyReferenceSchema),
+  permissionsBoundary: nullable(permissionsBoundarySchema)
 });
 var accountAssignmentSchema = strictObject({
   accountId: nonEmptyString,
@@ -940,13 +1091,24 @@ var accessRoleSchema = strictObject({
   principalType: principalTypeSchema,
   roleName: nonEmptyString
 });
+var accessControlAttributeSchema = strictObject({
+  key: nonEmptyString,
+  source: array(nonEmptyString)
+});
+var delegatedAdministratorSchema = strictObject({
+  accountId: nonEmptyString,
+  servicePrincipal: nonEmptyString
+});
 var stateSchema = strictObject({
   version: nonEmptyString,
   generatedAt: nonEmptyString,
   organization: strictObject({
     rootId: nonEmptyString,
     organizationalUnits: array(organizationalUnitSchema),
-    accounts: array(accountSchema)
+    accounts: array(accountSchema),
+    policies: optional(array(orgPolicySchema)),
+    policyAttachments: optional(array(orgPolicyAttachmentSchema)),
+    delegatedAdministrators: optional(array(delegatedAdministratorSchema))
   }),
   identityCenter: strictObject({
     instanceArn: nonEmptyString,
@@ -956,10 +1118,14 @@ var stateSchema = strictObject({
     groupMemberships: array(groupMembershipSchema),
     permissionSets: array(permissionSetSchema),
     accountAssignments: array(accountAssignmentSchema),
-    accessRoles: array(accessRoleSchema)
+    accessRoles: array(accessRoleSchema),
+    accessControlAttributes: array(accessControlAttributeSchema)
   })
 });
 function createWorkingState(props) {
+  const policies = props.state.organization.policies ?? [];
+  const policyAttachments = props.state.organization.policyAttachments ?? [];
+  const delegatedAdministrators = props.state.organization.delegatedAdministrators ?? [];
   return {
     version: props.state.version,
     generatedAt: props.state.generatedAt,
@@ -973,6 +1139,18 @@ function createWorkingState(props) {
       accountsByName: toRecordByProperty(
         props.state.organization.accounts,
         "name"
+      ),
+      policiesById: toRecordByProperty(policies, "id"),
+      policiesByName: toRecordByProperty(policies, "name"),
+      policyAttachments: structuredClone(policyAttachments),
+      policyAttachmentsByKey: toRecordByProperty(
+        policyAttachments,
+        createOrgPolicyAttachmentKey
+      ),
+      delegatedAdministrators: structuredClone(delegatedAdministrators),
+      delegatedAdministratorsByKey: toRecordByProperty(
+        delegatedAdministrators,
+        createDelegatedAdministratorKey
       )
     },
     identityCenter: createWorkingIdentityCenterState({
@@ -989,7 +1167,16 @@ function materializeWorkingState(props) {
       organizationalUnits: Object.values(
         props.workingState.organization.organizationalUnitsById
       ),
-      accounts: Object.values(props.workingState.organization.accountsById)
+      accounts: Object.values(props.workingState.organization.accountsById),
+      policies: Object.values(props.workingState.organization.policiesById),
+      policyAttachments: structuredClone(
+        props.workingState.organization.policyAttachments
+      ),
+      ...props.workingState.organization.delegatedAdministrators.length > 0 ? {
+        delegatedAdministrators: structuredClone(
+          props.workingState.organization.delegatedAdministrators
+        )
+      } : {}
     },
     identityCenter: {
       instanceArn: props.workingState.identityCenter.instanceArn,
@@ -1007,6 +1194,9 @@ function materializeWorkingState(props) {
       ),
       accessRoles: structuredClone(
         props.workingState.identityCenter.accessRoles
+      ),
+      accessControlAttributes: structuredClone(
+        props.workingState.identityCenter.accessControlAttributes
       )
     }
   };
@@ -1219,7 +1409,7 @@ function removeIdcGroupFromWorkingState(props) {
 }
 function upsertIdcPermissionSetInWorkingState(props) {
   const currentPermissionSet = props.workingState.identityCenter.permissionSetsByName[props.permissionSet.name];
-  if (currentPermissionSet != null && currentPermissionSet.permissionSetArn === props.permissionSet.permissionSetArn && currentPermissionSet.name === props.permissionSet.name && currentPermissionSet.description === props.permissionSet.description && currentPermissionSet.sessionDuration === props.permissionSet.sessionDuration && currentPermissionSet.inlinePolicy === props.permissionSet.inlinePolicy && JSON.stringify(currentPermissionSet.awsManagedPolicies) === JSON.stringify(props.permissionSet.awsManagedPolicies) && JSON.stringify(currentPermissionSet.customerManagedPolicies) === JSON.stringify(props.permissionSet.customerManagedPolicies)) {
+  if (currentPermissionSet != null && currentPermissionSet.permissionSetArn === props.permissionSet.permissionSetArn && currentPermissionSet.name === props.permissionSet.name && currentPermissionSet.description === props.permissionSet.description && currentPermissionSet.sessionDuration === props.permissionSet.sessionDuration && currentPermissionSet.inlinePolicy === props.permissionSet.inlinePolicy && JSON.stringify(currentPermissionSet.awsManagedPolicies) === JSON.stringify(props.permissionSet.awsManagedPolicies) && JSON.stringify(currentPermissionSet.customerManagedPolicies) === JSON.stringify(props.permissionSet.customerManagedPolicies) && JSON.stringify(currentPermissionSet.permissionsBoundary) === JSON.stringify(props.permissionSet.permissionsBoundary)) {
     return props.workingState;
   }
   const remainingPermissionSets = props.workingState.identityCenter.permissionSets.filter(
@@ -1361,6 +1551,154 @@ function removeAccountAssignmentFromWorkingState(props) {
     })
   };
 }
+function createOrgPolicyAttachmentKey(props) {
+  return [props.policyId, props.targetId].join("|");
+}
+function upsertOrgPolicyInWorkingState(props) {
+  const currentPolicy = props.workingState.organization.policiesById[props.policy.id];
+  if (currentPolicy != null && currentPolicy.id === props.policy.id && currentPolicy.arn === props.policy.arn && currentPolicy.name === props.policy.name && currentPolicy.description === props.policy.description && currentPolicy.type === props.policy.type && currentPolicy.content === props.policy.content) {
+    return props.workingState;
+  }
+  const remainingPolicies = Object.values(
+    props.workingState.organization.policiesById
+  ).filter((p) => p.id !== props.policy.id);
+  const nextPolicies = [...remainingPolicies, props.policy];
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policiesById: toRecordByProperty(nextPolicies, "id"),
+      policiesByName: toRecordByProperty(nextPolicies, "name")
+    }
+  };
+}
+function removeOrgPolicyFromWorkingState(props) {
+  if (props.workingState.organization.policiesById[props.policyId] == null) {
+    return props.workingState;
+  }
+  const nextPolicies = Object.values(
+    props.workingState.organization.policiesById
+  ).filter((p) => p.id !== props.policyId);
+  const nextAttachments = props.workingState.organization.policyAttachments.filter(
+    (a) => a.policyId !== props.policyId
+  );
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policiesById: toRecordByProperty(nextPolicies, "id"),
+      policiesByName: toRecordByProperty(nextPolicies, "name"),
+      policyAttachments: nextAttachments,
+      policyAttachmentsByKey: toRecordByProperty(
+        nextAttachments,
+        createOrgPolicyAttachmentKey
+      )
+    }
+  };
+}
+function addOrgPolicyAttachmentToWorkingState(props) {
+  const key = createOrgPolicyAttachmentKey({
+    policyId: props.attachment.policyId,
+    targetId: props.attachment.targetId
+  });
+  if (props.workingState.organization.policyAttachmentsByKey[key] != null) {
+    return props.workingState;
+  }
+  const nextAttachments = [
+    ...props.workingState.organization.policyAttachments,
+    props.attachment
+  ];
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policyAttachments: nextAttachments,
+      policyAttachmentsByKey: toRecordByProperty(
+        nextAttachments,
+        createOrgPolicyAttachmentKey
+      )
+    }
+  };
+}
+function removeOrgPolicyAttachmentFromWorkingState(props) {
+  const key = createOrgPolicyAttachmentKey({
+    policyId: props.policyId,
+    targetId: props.targetId
+  });
+  if (props.workingState.organization.policyAttachmentsByKey[key] == null) {
+    return props.workingState;
+  }
+  const nextAttachments = props.workingState.organization.policyAttachments.filter(
+    (a) => createOrgPolicyAttachmentKey({
+      policyId: a.policyId,
+      targetId: a.targetId
+    }) !== key
+  );
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      policyAttachments: nextAttachments,
+      policyAttachmentsByKey: toRecordByProperty(
+        nextAttachments,
+        createOrgPolicyAttachmentKey
+      )
+    }
+  };
+}
+function createDelegatedAdministratorKey(props) {
+  return [props.accountId, props.servicePrincipal].join("|");
+}
+function upsertDelegatedAdministratorInWorkingState(props) {
+  const key = createDelegatedAdministratorKey({
+    accountId: props.delegatedAdministrator.accountId,
+    servicePrincipal: props.delegatedAdministrator.servicePrincipal
+  });
+  if (props.workingState.organization.delegatedAdministratorsByKey[key] != null) {
+    return props.workingState;
+  }
+  const nextDelegatedAdministrators = [
+    ...props.workingState.organization.delegatedAdministrators,
+    props.delegatedAdministrator
+  ];
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      delegatedAdministrators: nextDelegatedAdministrators,
+      delegatedAdministratorsByKey: toRecordByProperty(
+        nextDelegatedAdministrators,
+        createDelegatedAdministratorKey
+      )
+    }
+  };
+}
+function removeDelegatedAdministratorFromWorkingState(props) {
+  const key = createDelegatedAdministratorKey({
+    accountId: props.accountId,
+    servicePrincipal: props.servicePrincipal
+  });
+  if (props.workingState.organization.delegatedAdministratorsByKey[key] == null) {
+    return props.workingState;
+  }
+  const nextDelegatedAdministrators = props.workingState.organization.delegatedAdministrators.filter(
+    (da) => createDelegatedAdministratorKey({
+      accountId: da.accountId,
+      servicePrincipal: da.servicePrincipal
+    }) !== key
+  );
+  return {
+    ...props.workingState,
+    organization: {
+      ...props.workingState.organization,
+      delegatedAdministrators: nextDelegatedAdministrators,
+      delegatedAdministratorsByKey: toRecordByProperty(
+        nextDelegatedAdministrators,
+        createDelegatedAdministratorKey
+      )
+    }
+  };
+}
 function createAccessRoleName(assignment) {
   return `AWSReservedSSO_${assignment.permissionSetArn.split("/").at(-1) ?? "PermissionSet"}_${assignment.accountId}`;
 }
@@ -1395,7 +1733,10 @@ function createWorkingIdentityCenterState(props) {
     ),
     accessRoles: createAccessRoles({
       accountAssignments
-    })
+    }),
+    accessControlAttributes: structuredClone(
+      props.identityCenter.accessControlAttributes ?? []
+    )
   };
 }
 function materializeWorkingIdentityCenterState(props) {
@@ -1409,7 +1750,10 @@ function materializeWorkingIdentityCenterState(props) {
     accountAssignments: structuredClone(
       props.identityCenter.accountAssignments
     ),
-    accessRoles: structuredClone(props.identityCenter.accessRoles)
+    accessRoles: structuredClone(props.identityCenter.accessRoles),
+    accessControlAttributes: structuredClone(
+      props.identityCenter.accessControlAttributes
+    )
   };
 }
 function createAccessRoles(props) {
@@ -1448,28 +1792,43 @@ import {
   ListUsersCommand
 } from "@aws-sdk/client-identitystore";
 import {
+  DescribeOrganizationCommand,
+  DescribePolicyCommand,
   ListAccountsCommand,
+  ListDelegatedAdministratorsCommand,
+  ListDelegatedServicesForAccountCommand,
   ListOrganizationalUnitsForParentCommand,
   ListParentsCommand,
+  ListPoliciesCommand,
   ListRootsCommand,
-  ListTagsForResourceCommand
+  ListTagsForResourceCommand,
+  ListTargetsForPolicyCommand
 } from "@aws-sdk/client-organizations";
 import {
   DescribePermissionSetCommand,
   GetInlinePolicyForPermissionSetCommand,
+  GetPermissionsBoundaryForPermissionSetCommand,
   ListAccountAssignmentsCommand,
   ListAccountsForProvisionedPermissionSetCommand,
   ListCustomerManagedPolicyReferencesInPermissionSetCommand,
+  DescribeInstanceAccessControlAttributeConfigurationCommand,
   ListInstancesCommand,
   ListManagedPoliciesInPermissionSetCommand,
   ListPermissionSetsCommand
 } from "@aws-sdk/client-sso-admin";
+import {
+  GetAlternateContactCommand
+} from "@aws-sdk/client-account";
 async function scanOrganization(props) {
-  const roots = await props.organizationsClient.send(new ListRootsCommand({}));
-  const root = roots.Roots?.[0];
+  const [rootsResponse, orgResponse] = await Promise.all([
+    props.organizationsClient.send(new ListRootsCommand({})),
+    props.organizationsClient.send(new DescribeOrganizationCommand({}))
+  ]);
+  const root = rootsResponse.Roots?.[0];
   if (root?.Id == null) {
     throw new Error("No organization root found.");
   }
+  const managementAccountId = orgResponse.Organization?.MasterAccountId;
   const organizationalUnits = await collectOrganizationalUnits({
     organizationsClient: props.organizationsClient,
     parentId: root.Id
@@ -1493,6 +1852,11 @@ async function scanOrganization(props) {
           ResourceId: account.Id
         })
       );
+      const alternateContacts = await scanAlternateContacts({
+        accountClient: props.accountClient,
+        accountId: account.Id,
+        isManagementAccount: account.Id === managementAccountId
+      });
       accounts.push({
         id: account.Id,
         arn: account.Arn,
@@ -1510,17 +1874,138 @@ async function scanOrganization(props) {
               value: tag.Value ?? ""
             }
           ];
-        })
+        }),
+        alternateContacts: alternateContacts.length > 0 ? alternateContacts : void 0
       });
     }
     nextToken = response.NextToken;
   } while (nextToken != null);
+  const [{ policies, policyAttachments }, delegatedAdministrators] = await Promise.all([
+    scanOrganizationPolicies({
+      organizationsClient: props.organizationsClient
+    }),
+    scanDelegatedAdministrators({
+      organizationsClient: props.organizationsClient
+    })
+  ]);
   return {
     rootId: root.Id,
     organizationalUnits,
-    accounts
+    accounts,
+    policies,
+    policyAttachments,
+    delegatedAdministrators: delegatedAdministrators.length > 0 ? delegatedAdministrators : void 0
   };
 }
+async function scanDelegatedAdministrators(props) {
+  const accountIds = new Array();
+  let nextToken;
+  do {
+    const response = await props.organizationsClient.send(
+      new ListDelegatedAdministratorsCommand({ NextToken: nextToken })
+    );
+    for (const admin of response.DelegatedAdministrators ?? []) {
+      if (admin.Id == null) {
+        continue;
+      }
+      accountIds.push(admin.Id);
+    }
+    nextToken = response.NextToken;
+  } while (nextToken != null);
+  const results = [];
+  for (const accountId of accountIds) {
+    let servicesNextToken;
+    do {
+      const response = await props.organizationsClient.send(
+        new ListDelegatedServicesForAccountCommand({
+          AccountId: accountId,
+          NextToken: servicesNextToken
+        })
+      );
+      for (const service of response.DelegatedServices ?? []) {
+        if (service.ServicePrincipal == null) {
+          continue;
+        }
+        results.push({ accountId, servicePrincipal: service.ServicePrincipal });
+      }
+      servicesNextToken = response.NextToken;
+    } while (servicesNextToken != null);
+  }
+  return results;
+}
+var ORG_POLICY_TYPES = [
+  "SERVICE_CONTROL_POLICY",
+  "RESOURCE_CONTROL_POLICY",
+  "TAG_POLICY",
+  "AISERVICES_OPT_OUT_POLICY",
+  "BACKUP_POLICY"
+];
+async function scanOrganizationPolicies(props) {
+  const policies = [];
+  const policyAttachments = [];
+  for (const policyType of ORG_POLICY_TYPES) {
+    let nextToken;
+    const policyIds = [];
+    do {
+      const response = await props.organizationsClient.send(
+        new ListPoliciesCommand({ Filter: policyType, NextToken: nextToken })
+      );
+      for (const summary of response.Policies ?? []) {
+        if (summary.Id == null || summary.AwsManaged === true) {
+          continue;
+        }
+        policyIds.push(summary.Id);
+      }
+      nextToken = response.NextToken;
+    } while (nextToken != null);
+    for (const policyId of policyIds) {
+      const describeResponse = await props.organizationsClient.send(
+        new DescribePolicyCommand({ PolicyId: policyId })
+      );
+      const policy = describeResponse.Policy;
+      if (policy?.PolicySummary?.Id == null || policy.PolicySummary.Arn == null || policy.PolicySummary.Name == null) {
+        continue;
+      }
+      const content = policy.Content;
+      if (content == null || content.length === 0) {
+        continue;
+      }
+      policies.push({
+        id: policy.PolicySummary.Id,
+        arn: policy.PolicySummary.Arn,
+        name: policy.PolicySummary.Name,
+        description: policy.PolicySummary.Description ?? "",
+        type: policyType,
+        content
+      });
+      let targetsNextToken;
+      do {
+        const targetsResponse = await props.organizationsClient.send(
+          new ListTargetsForPolicyCommand({
+            PolicyId: policyId,
+            NextToken: targetsNextToken
+          })
+        );
+        for (const target of targetsResponse.Targets ?? []) {
+          if (target.TargetId == null || target.Type == null) {
+            continue;
+          }
+          const targetType = target.Type;
+          if (targetType !== "ROOT" && targetType !== "ORGANIZATIONAL_UNIT" && targetType !== "ACCOUNT") {
+            continue;
+          }
+          policyAttachments.push({
+            policyId,
+            targetId: target.TargetId,
+            targetType
+          });
+        }
+        targetsNextToken = targetsResponse.NextToken;
+      } while (targetsNextToken != null);
+    }
+  }
+  return { policies, policyAttachments };
+}
 async function collectOrganizationalUnits(props) {
   const children = [];
   let nextToken;
@@ -1563,7 +2048,7 @@ async function scanIdentityCenter(props) {
     instances,
     requestedInstanceArn: props.requestedInstanceArn
   });
-  const [users, groups, permissionSets] = await Promise.all([
+  const [users, groups, permissionSets, accessControlAttributes] = await Promise.all([
     listIdentityStoreUsers({
       identityStoreClient: props.identityStoreClient,
       identityStoreId: instance.identityStoreId
@@ -1575,6 +2060,10 @@ async function scanIdentityCenter(props) {
     listPermissionSets({
       ssoAdminClient: props.ssoAdminClient,
       instanceArn: instance.instanceArn
+    }),
+    scanAccessControlAttributes({
+      ssoAdminClient: props.ssoAdminClient,
+      instanceArn: instance.instanceArn
     })
   ]);
   const groupMemberships = await listGroupMemberships({
@@ -1599,9 +2088,30 @@ async function scanIdentityCenter(props) {
     groupMemberships,
     permissionSets,
     accountAssignments,
-    accessRoles
+    accessRoles,
+    accessControlAttributes
   };
 }
+async function scanAccessControlAttributes(props) {
+  let response;
+  try {
+    response = await props.ssoAdminClient.send(
+      new DescribeInstanceAccessControlAttributeConfigurationCommand({
+        InstanceArn: props.instanceArn
+      })
+    );
+  } catch (err) {
+    if (err != null && typeof err === "object" && "name" in err && err.name === "ResourceNotFoundException") {
+      return [];
+    }
+    throw err;
+  }
+  const attributes = response.InstanceAccessControlAttributeConfiguration?.AccessControlAttributes ?? [];
+  return attributes.filter((attr) => attr.Key != null).map((attr) => ({
+    key: attr.Key,
+    source: attr.Value?.Source ?? []
+  }));
+}
 function selectIdentityCenterInstance(props) {
   if (props.requestedInstanceArn != null) {
     const selected2 = props.instances.find(
@@ -1752,7 +2262,8 @@ async function listPermissionSets(props) {
       const [
         inlinePolicy,
         awsManagedPolicies,
-        customerManagedPolicies
+        customerManagedPolicies,
+        permissionsBoundary
       ] = await Promise.all([
         getInlinePolicyForPermissionSet({
           ssoAdminClient: props.ssoAdminClient,
@@ -1768,6 +2279,11 @@ async function listPermissionSets(props) {
           ssoAdminClient: props.ssoAdminClient,
           instanceArn: props.instanceArn,
           permissionSetArn: permissionSet.PermissionSetArn
+        }),
+        getPermissionsBoundaryForPermissionSet({
+          ssoAdminClient: props.ssoAdminClient,
+          instanceArn: props.instanceArn,
+          permissionSetArn: permissionSet.PermissionSetArn
         })
       ]);
       return {
@@ -1777,7 +2293,8 @@ async function listPermissionSets(props) {
         sessionDuration: permissionSet.SessionDuration ?? null,
         inlinePolicy,
         awsManagedPolicies,
-        customerManagedPolicies
+        customerManagedPolicies,
+        permissionsBoundary
       };
     })
   );
@@ -1795,6 +2312,29 @@ async function getInlinePolicyForPermissionSet(props) {
   const inlinePolicy = response.InlinePolicy?.trim();
   return inlinePolicy != null && inlinePolicy.length > 0 ? inlinePolicy : null;
 }
+async function getPermissionsBoundaryForPermissionSet(props) {
+  const response = await props.ssoAdminClient.send(
+    new GetPermissionsBoundaryForPermissionSetCommand({
+      InstanceArn: props.instanceArn,
+      PermissionSetArn: props.permissionSetArn
+    })
+  );
+  const boundary = response.PermissionsBoundary;
+  if (boundary == null) {
+    return null;
+  }
+  if (boundary.ManagedPolicyArn != null) {
+    return { managedPolicyArn: boundary.ManagedPolicyArn };
+  }
+  const ref = boundary.CustomerManagedPolicyReference;
+  if (ref?.Name != null) {
+    return {
+      customerManagedPolicyName: ref.Name,
+      customerManagedPolicyPath: ref.Path ?? "/"
+    };
+  }
+  return null;
+}
 async function listManagedPoliciesInPermissionSet(props) {
   const managedPolicies = [];
   let nextToken;
@@ -1892,18 +2432,61 @@ async function listAccountsForPermissionSet(props) {
   } while (nextToken != null);
   return accountIds;
 }
+var ALTERNATE_CONTACT_TYPES = ["BILLING", "OPERATIONS", "SECURITY"];
+async function scanAlternateContacts(props) {
+  const results = await Promise.all(
+    ALTERNATE_CONTACT_TYPES.map(async (contactType) => {
+      try {
+        const response = await props.accountClient.send(
+          new GetAlternateContactCommand({
+            AccountId: props.isManagementAccount ? void 0 : props.accountId,
+            AlternateContactType: contactType
+          })
+        );
+        const c = response.AlternateContact;
+        if (c == null || c.EmailAddress == null || c.Name == null) {
+          return null;
+        }
+        return {
+          contactType,
+          name: c.Name,
+          email: c.EmailAddress,
+          phone: c.PhoneNumber ?? "",
+          ...c.Title != null ? { title: c.Title } : {}
+        };
+      } catch (error) {
+        if (error != null && typeof error === "object" && "name" in error && error.name === "ResourceNotFoundException") {
+          return null;
+        }
+        throw error;
+      }
+    })
+  );
+  return results.filter((c) => c != null);
+}
 
 // src/applyLogic.ts
-import { PutAccountNameCommand } from "@aws-sdk/client-account";
 import {
+  DeleteAlternateContactCommand,
+  PutAccountNameCommand,
+  PutAlternateContactCommand
+} from "@aws-sdk/client-account";
+import {
+  AttachPolicyCommand,
   CreateOrganizationalUnitCommand,
+  CreatePolicyCommand,
+  DeregisterDelegatedAdministratorCommand,
   DeleteOrganizationalUnitCommand,
+  DeletePolicyCommand,
+  DetachPolicyCommand,
   ListAccountsForParentCommand,
   ListOrganizationalUnitsForParentCommand as ListOrganizationalUnitsForParentCommand2,
   MoveAccountCommand as MoveAccountCommand2,
+  RegisterDelegatedAdministratorCommand,
   TagResourceCommand,
   UntagResourceCommand,
-  UpdateOrganizationalUnitCommand
+  UpdateOrganizationalUnitCommand,
+  UpdatePolicyCommand
 } from "@aws-sdk/client-organizations";
 import {
   CreateGroupMembershipCommand,
@@ -1923,6 +2506,7 @@ import {
   CreatePermissionSetCommand,
   DeleteAccountAssignmentCommand,
   DeleteInlinePolicyFromPermissionSetCommand,
+  DeletePermissionsBoundaryFromPermissionSetCommand,
   DeletePermissionSetCommand,
   DescribeAccountAssignmentCreationStatusCommand,
   DescribeAccountAssignmentDeletionStatusCommand,
@@ -1931,6 +2515,8 @@ import {
   DetachManagedPolicyFromPermissionSetCommand,
   ProvisionPermissionSetCommand,
   PutInlinePolicyToPermissionSetCommand,
+  PutPermissionsBoundaryToPermissionSetCommand,
+  UpdateInstanceAccessControlAttributeConfigurationCommand,
   UpdatePermissionSetCommand
 } from "@aws-sdk/client-sso-admin";
 
@@ -2069,39 +2655,38 @@ function isCompleteAccountWithStatus(account, expectedAccountId) {
 
 // src/applyLogic.ts
 async function executeOperation(props) {
-  const operation = props.operation;
-  if (operation.kind === "moveAccount") {
+  if (props.operation.kind === "moveAccount") {
     props.logger.log(
-      `Moving "${operation.accountName}" (${operation.accountId}): ${operation.fromOuName} -> ${operation.toOuName}`
+      `Moving "${props.operation.accountName}" (${props.operation.accountId}): ${props.operation.fromOuName} -> ${props.operation.toOuName}`
     );
     await props.organizationsClient.send(
       new MoveAccountCommand2({
-        AccountId: operation.accountId,
-        SourceParentId: operation.fromOuId,
-        DestinationParentId: operation.toOuId
+        AccountId: props.operation.accountId,
+        SourceParentId: props.operation.fromOuId,
+        DestinationParentId: props.operation.toOuId
       })
     );
-    props.logger.log(`Done: "${operation.accountName}"`);
+    props.logger.log(`Done: "${props.operation.accountName}"`);
     return moveAccountInWorkingState({
       workingState: props.state,
-      accountId: operation.accountId,
-      parentId: operation.toOuId
+      accountId: props.operation.accountId,
+      parentId: props.operation.toOuId
     });
   }
-  if (operation.kind === "createOu") {
+  if (props.operation.kind === "createOu") {
     props.logger.log(
-      `Creating OU "${operation.ouName}" under ${operation.parentOuName}...`
+      `Creating OU "${props.operation.ouName}" under ${props.operation.parentOuName}...`
     );
     const response = await props.organizationsClient.send(
       new CreateOrganizationalUnitCommand({
-        ParentId: operation.parentOuId,
-        Name: operation.ouName
+        ParentId: props.operation.parentOuId,
+        Name: props.operation.ouName
       })
     );
     const createdOu = response.OrganizationalUnit;
     if (createdOu?.Id == null || createdOu.Arn == null || createdOu.Name == null) {
       throw new Error(
-        `CreateOrganizationalUnit for "${operation.ouName}" returned incomplete OU data.`
+        `CreateOrganizationalUnit for "${props.operation.ouName}" returned incomplete OU data.`
       );
     }
     props.logger.log(`Done: "${createdOu.Name}"`);
@@ -2109,55 +2694,55 @@ async function executeOperation(props) {
       workingState: props.state,
       organizationalUnit: {
         id: createdOu.Id,
-        parentId: operation.parentOuId,
+        parentId: props.operation.parentOuId,
         arn: createdOu.Arn,
         name: createdOu.Name
       }
     });
   }
-  if (operation.kind === "renameOu") {
+  if (props.operation.kind === "renameOu") {
     props.logger.log(
-      `Renaming OU "${operation.fromOuName}" -> "${operation.toOuName}"...`
+      `Renaming OU "${props.operation.fromOuName}" -> "${props.operation.toOuName}"...`
     );
     await props.organizationsClient.send(
       new UpdateOrganizationalUnitCommand({
-        OrganizationalUnitId: operation.ouId,
-        Name: operation.toOuName
+        OrganizationalUnitId: props.operation.ouId,
+        Name: props.operation.toOuName
       })
     );
-    props.logger.log(`Done: "${operation.toOuName}"`);
+    props.logger.log(`Done: "${props.operation.toOuName}"`);
     return renameOrganizationalUnitInWorkingState({
       workingState: props.state,
-      organizationalUnitId: operation.ouId,
-      name: operation.toOuName
+      organizationalUnitId: props.operation.ouId,
+      name: props.operation.toOuName
     });
   }
-  if (operation.kind === "deleteOu") {
-    props.logger.log(`Deleting OU "${operation.ouName}"...`);
+  if (props.operation.kind === "deleteOu") {
+    props.logger.log(`Deleting OU "${props.operation.ouName}"...`);
     await assertOrganizationalUnitIsEmpty({
       organizationsClient: props.organizationsClient,
-      organizationalUnitId: operation.ouId,
-      organizationalUnitName: operation.ouName
+      organizationalUnitId: props.operation.ouId,
+      organizationalUnitName: props.operation.ouName
     });
     await props.organizationsClient.send(
       new DeleteOrganizationalUnitCommand({
-        OrganizationalUnitId: operation.ouId
+        OrganizationalUnitId: props.operation.ouId
       })
     );
-    props.logger.log(`Done: "${operation.ouName}"`);
+    props.logger.log(`Done: "${props.operation.ouName}"`);
     return removeOrganizationalUnitFromWorkingState({
       workingState: props.state,
-      organizationalUnitId: operation.ouId
+      organizationalUnitId: props.operation.ouId
     });
   }
-  if (operation.kind === "createAccount") {
+  if (props.operation.kind === "createAccount") {
     const result = await createAccountAndMoveToOu({
       organizationsClient: props.organizationsClient,
       logger: props.logger,
-      accountName: operation.accountName,
-      accountEmail: operation.accountEmail,
+      accountName: props.operation.accountName,
+      accountEmail: props.operation.accountEmail,
       sourceParentId: props.context.organization.rootId,
-      destinationParentId: operation.targetOuId,
+      destinationParentId: props.operation.targetOuId,
       timeoutInMs: props.runtime.createAccount.timeoutInMs,
       pollIntervalInMs: props.runtime.createAccount.pollIntervalInMs
     });
@@ -2169,33 +2754,33 @@ async function executeOperation(props) {
         name: result.account.name,
         email: result.account.email,
         status: result.account.status,
-        parentId: operation.targetOuId,
+        parentId: props.operation.targetOuId,
         tags: []
       }
     });
   }
-  if (operation.kind === "updateAccountTags") {
-    const account = props.state.organization.accountsById[operation.accountId];
+  if (props.operation.kind === "updateAccountTags") {
+    const account = props.state.organization.accountsById[props.operation.accountId];
     if (account == null) {
       throw new Error(
-        `Could not resolve account "${operation.accountName}" (${operation.accountId}) in working state.`
+        `Could not resolve account "${props.operation.accountName}" (${props.operation.accountId}) in working state.`
       );
     }
     const currentTags = new Map(
       (account.tags ?? []).map((tag) => [tag.key, tag.value])
     );
-    const desiredTags = new Map(Object.entries(operation.tags));
+    const desiredTags = new Map(Object.entries(props.operation.tags));
     const tagsToApply = [...desiredTags.entries()].filter(([key, value]) => currentTags.get(key) !== value).map(([Key, Value]) => ({ Key, Value }));
     const tagKeysToRemove = [...currentTags.keys()].filter(
       (key) => desiredTags.has(key) === false
     );
     props.logger.log(
-      `Updating account tags "${operation.accountName}" (${operation.accountId})...`
+      `Updating account tags "${props.operation.accountName}" (${props.operation.accountId})...`
     );
     if (tagsToApply.length > 0) {
       await props.organizationsClient.send(
         new TagResourceCommand({
-          ResourceId: operation.accountId,
+          ResourceId: props.operation.accountId,
           Tags: tagsToApply
         })
       );
@@ -2203,84 +2788,84 @@ async function executeOperation(props) {
     if (tagKeysToRemove.length > 0) {
       await props.organizationsClient.send(
         new UntagResourceCommand({
-          ResourceId: operation.accountId,
+          ResourceId: props.operation.accountId,
           TagKeys: tagKeysToRemove
         })
       );
     }
-    props.logger.log(`Done: tags updated for "${operation.accountName}"`);
+    props.logger.log(`Done: tags updated for "${props.operation.accountName}"`);
     return upsertAccountInWorkingState({
       workingState: props.state,
       account: {
         ...account,
-        tags: Object.entries(operation.tags).map(([key, value]) => ({
+        tags: Object.entries(props.operation.tags).map(([key, value]) => ({
           key,
           value
         }))
       }
     });
   }
-  if (operation.kind === "updateAccountName") {
+  if (props.operation.kind === "updateAccountName") {
     props.logger.log(
-      `Renaming account (${operation.accountId}): "${operation.fromAccountName}" -> "${operation.toAccountName}"...`
+      `Renaming account (${props.operation.accountId}): "${props.operation.fromAccountName}" -> "${props.operation.toAccountName}"...`
     );
     await props.accountClient.send(
       new PutAccountNameCommand({
-        AccountId: operation.accountId,
-        AccountName: operation.toAccountName
+        AccountId: props.operation.accountId,
+        AccountName: props.operation.toAccountName
       })
     );
     props.logger.log(
-      `Done: account "${operation.toAccountName}" (${operation.accountId})`
+      `Done: account "${props.operation.toAccountName}" (${props.operation.accountId})`
     );
-    const account = props.state.organization.accountsById[operation.accountId];
+    const account = props.state.organization.accountsById[props.operation.accountId];
     if (account == null) {
       throw new Error(
-        `Could not resolve account (${operation.accountId}) in working state after rename.`
+        `Could not resolve account (${props.operation.accountId}) in working state after rename.`
       );
     }
     return upsertAccountInWorkingState({
       workingState: props.state,
       account: {
         ...account,
-        name: operation.toAccountName
+        name: props.operation.toAccountName
       }
     });
   }
-  if (operation.kind === "removeAccount") {
+  if (props.operation.kind === "removeAccount") {
     props.logger.log(
-      `Moving removed account "${operation.accountName}" (${operation.accountId}) to ${operation.toOuName}...`
+      `Moving removed account "${props.operation.accountName}" (${props.operation.accountId}) to ${props.operation.toOuName}...`
     );
     await props.organizationsClient.send(
       new MoveAccountCommand2({
-        AccountId: operation.accountId,
-        SourceParentId: operation.fromOuId,
-        DestinationParentId: operation.toOuId
+        AccountId: props.operation.accountId,
+        SourceParentId: props.operation.fromOuId,
+        DestinationParentId: props.operation.toOuId
       })
     );
     props.logger.log(
-      `Done: "${operation.accountName}" -> ${operation.toOuName}`
+      `Done: "${props.operation.accountName}" -> ${props.operation.toOuName}`
     );
     return moveAccountInWorkingState({
       workingState: props.state,
-      accountId: operation.accountId,
-      parentId: operation.toOuId
+      accountId: props.operation.accountId,
+      parentId: props.operation.toOuId
     });
   }
-  if (operation.kind === "createIdcUser") {
-    props.logger.log(`Creating IdC user "${operation.userName}"...`);
+  if (props.operation.kind === "createIdcUser") {
+    props.logger.log(`Creating IdC user "${props.operation.userName}"...`);
     const response = await props.identityStoreClient.send(
       new CreateUserCommand({
         IdentityStoreId: props.state.identityCenter.identityStoreId,
-        UserName: operation.userName,
-        DisplayName: operation.displayName,
+        UserName: props.operation.userName,
+        DisplayName: props.operation.displayName,
         Name: buildIdentityStoreUserName({
-          userName: operation.userName,
-          displayName: operation.displayName
+          userName: props.operation.userName,
+          displayName: props.operation.displayName
         }),
-        Emails: operation.email.length > 0 ? [
+        Emails: props.operation.email.length > 0 ? [
           {
-            Value: operation.email,
+            Value: props.operation.email,
             Type: "Work",
             Primary: true
           }
@@ -2289,45 +2874,45 @@ async function executeOperation(props) {
     );
     if (response.UserId == null) {
       throw new Error(
-        `CreateUser for "${operation.userName}" returned no user id.`
+        `CreateUser for "${props.operation.userName}" returned no user id.`
       );
     }
-    props.logger.log(`Done: "${operation.userName}"`);
+    props.logger.log(`Done: "${props.operation.userName}"`);
     return upsertIdcUserInWorkingState({
       workingState: props.state,
       user: {
         userId: response.UserId,
-        userName: operation.userName,
-        displayName: operation.displayName,
-        email: operation.email
+        userName: props.operation.userName,
+        displayName: props.operation.displayName,
+        email: props.operation.email
       }
     });
   }
-  if (operation.kind === "updateIdcUser") {
+  if (props.operation.kind === "updateIdcUser") {
     const user = resolveUserByName({
       state: props.state,
-      userName: operation.userName
+      userName: props.operation.userName
     });
     const operations = [];
-    if (user.displayName !== operation.displayName) {
+    if (user.displayName !== props.operation.displayName) {
       operations.push({
         AttributePath: "displayName",
-        AttributeValue: operation.displayName
+        AttributeValue: props.operation.displayName
       });
       operations.push({
         AttributePath: "name",
         AttributeValue: buildIdentityStoreUserName({
-          userName: operation.userName,
-          displayName: operation.displayName
+          userName: props.operation.userName,
+          displayName: props.operation.displayName
         })
       });
     }
-    if (user.email !== operation.email && operation.email.length > 0) {
+    if (user.email !== props.operation.email && props.operation.email.length > 0) {
       operations.push({
         AttributePath: "emails",
         AttributeValue: [
           {
-            Value: operation.email,
+            Value: props.operation.email,
             Type: "Work",
             Primary: true
           }
@@ -2337,7 +2922,7 @@ async function executeOperation(props) {
     if (operations.length === 0) {
       return props.state;
     }
-    props.logger.log(`Updating IdC user "${operation.userName}"...`);
+    props.logger.log(`Updating IdC user "${props.operation.userName}"...`);
     await props.identityStoreClient.send(
       new UpdateUserCommand({
         IdentityStoreId: props.state.identityCenter.identityStoreId,
@@ -2345,65 +2930,65 @@ async function executeOperation(props) {
         Operations: operations
       })
     );
-    props.logger.log(`Done: "${operation.userName}"`);
+    props.logger.log(`Done: "${props.operation.userName}"`);
     return upsertIdcUserInWorkingState({
       workingState: props.state,
       user: {
         ...user,
-        displayName: operation.displayName,
-        email: operation.email.length > 0 ? operation.email : user.email
+        displayName: props.operation.displayName,
+        email: props.operation.email.length > 0 ? props.operation.email : user.email
       }
     });
   }
-  if (operation.kind === "deleteIdcUser") {
+  if (props.operation.kind === "deleteIdcUser") {
     const user = resolveUserByName({
       state: props.state,
-      userName: operation.userName
+      userName: props.operation.userName
     });
-    props.logger.log(`Deleting IdC user "${operation.userName}"...`);
+    props.logger.log(`Deleting IdC user "${props.operation.userName}"...`);
     await props.identityStoreClient.send(
       new DeleteUserCommand({
         IdentityStoreId: props.state.identityCenter.identityStoreId,
         UserId: user.userId
       })
     );
-    props.logger.log(`Done: "${operation.userName}"`);
+    props.logger.log(`Done: "${props.operation.userName}"`);
     return removeIdcUserFromWorkingState({
       workingState: props.state,
-      userName: operation.userName
+      userName: props.operation.userName
     });
   }
-  if (operation.kind === "createIdcGroup") {
-    props.logger.log(`Creating IdC group "${operation.groupDisplayName}"...`);
+  if (props.operation.kind === "createIdcGroup") {
+    props.logger.log(`Creating IdC group "${props.operation.groupDisplayName}"...`);
     const response = await props.identityStoreClient.send(
       new CreateGroupCommand({
         IdentityStoreId: props.state.identityCenter.identityStoreId,
-        DisplayName: operation.groupDisplayName,
-        Description: operation.description.trim().length > 0 ? operation.description : void 0
+        DisplayName: props.operation.groupDisplayName,
+        Description: props.operation.description.trim().length > 0 ? props.operation.description : void 0
       })
     );
     if (response.GroupId == null) {
       throw new Error(
-        `CreateGroup for "${operation.groupDisplayName}" returned no group id.`
+        `CreateGroup for "${props.operation.groupDisplayName}" returned no group id.`
       );
     }
-    props.logger.log(`Done: "${operation.groupDisplayName}"`);
+    props.logger.log(`Done: "${props.operation.groupDisplayName}"`);
     return upsertIdcGroupInWorkingState({
       workingState: props.state,
       group: {
         groupId: response.GroupId,
-        displayName: operation.groupDisplayName,
-        description: operation.description
+        displayName: props.operation.groupDisplayName,
+        description: props.operation.description
       }
     });
   }
-  if (operation.kind === "updateIdcGroupDescription") {
+  if (props.operation.kind === "updateIdcGroupDescription") {
     const group = resolveGroupByDisplayName({
       state: props.state,
-      groupDisplayName: operation.groupDisplayName
+      groupDisplayName: props.operation.groupDisplayName
     });
     props.logger.log(
-      `Updating IdC group description for "${operation.groupDisplayName}"...`
+      `Updating IdC group description for "${props.operation.groupDisplayName}"...`
     );
     await props.identityStoreClient.send(
       new UpdateGroupCommand({
@@ -2412,46 +2997,46 @@ async function executeOperation(props) {
         Operations: [
           {
             AttributePath: "description",
-            AttributeValue: operation.description
+            AttributeValue: props.operation.description
           }
         ]
       })
     );
-    props.logger.log(`Done: group "${operation.groupDisplayName}"`);
+    props.logger.log(`Done: group "${props.operation.groupDisplayName}"`);
     return upsertIdcGroupInWorkingState({
       workingState: props.state,
       group: {
         ...group,
-        description: operation.description
+        description: props.operation.description
       }
     });
   }
-  if (operation.kind === "deleteIdcGroup") {
+  if (props.operation.kind === "deleteIdcGroup") {
     const group = resolveGroupByDisplayName({
       state: props.state,
-      groupDisplayName: operation.groupDisplayName
+      groupDisplayName: props.operation.groupDisplayName
     });
-    props.logger.log(`Deleting IdC group "${operation.groupDisplayName}"...`);
+    props.logger.log(`Deleting IdC group "${props.operation.groupDisplayName}"...`);
     await props.identityStoreClient.send(
       new DeleteGroupCommand({
         IdentityStoreId: props.state.identityCenter.identityStoreId,
         GroupId: group.groupId
       })
     );
-    props.logger.log(`Done: "${operation.groupDisplayName}"`);
+    props.logger.log(`Done: "${props.operation.groupDisplayName}"`);
     return removeIdcGroupFromWorkingState({
       workingState: props.state,
-      groupDisplayName: operation.groupDisplayName
+      groupDisplayName: props.operation.groupDisplayName
     });
   }
-  if (operation.kind === "addIdcGroupMembership") {
+  if (props.operation.kind === "addIdcGroupMembership") {
     const resolvedMembership = resolveGroupMembershipDependencies({
       state: props.state,
-      groupDisplayName: operation.groupDisplayName,
-      userName: operation.userName
+      groupDisplayName: props.operation.groupDisplayName,
+      userName: props.operation.userName
     });
     props.logger.log(
-      `Adding user "${operation.userName}" to IdC group "${operation.groupDisplayName}"...`
+      `Adding user "${props.operation.userName}" to IdC group "${props.operation.groupDisplayName}"...`
     );
     const response = await props.identityStoreClient.send(
       new CreateGroupMembershipCommand({
@@ -2464,11 +3049,11 @@ async function executeOperation(props) {
     );
     if (response.MembershipId == null) {
       throw new Error(
-        `CreateGroupMembership for group "${operation.groupDisplayName}" and user "${operation.userName}" returned no membership id.`
+        `CreateGroupMembership for group "${props.operation.groupDisplayName}" and user "${props.operation.userName}" returned no membership id.`
       );
     }
     props.logger.log(
-      `Done: user "${operation.userName}" -> group "${operation.groupDisplayName}"`
+      `Done: user "${props.operation.userName}" -> group "${props.operation.groupDisplayName}"`
     );
     return addGroupMembershipToWorkingState({
       workingState: props.state,
@@ -2479,93 +3064,94 @@ async function executeOperation(props) {
       }
     });
   }
-  if (operation.kind === "createIdcPermissionSet") {
+  if (props.operation.kind === "createIdcPermissionSet") {
     props.logger.log(
-      `Creating IdC permission set "${operation.permissionSetName}"...`
+      `Creating IdC permission set "${props.operation.permissionSetName}"...`
     );
     const response = await props.ssoAdminClient.send(
       new CreatePermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
-        Name: operation.permissionSetName,
-        Description: operation.description.length > 0 ? operation.description : void 0,
-        SessionDuration: operation.sessionDuration ?? void 0
+        Name: props.operation.permissionSetName,
+        Description: props.operation.description.length > 0 ? props.operation.description : void 0,
+        SessionDuration: props.operation.sessionDuration ?? void 0
       })
     );
     const permissionSetArn = response.PermissionSet?.PermissionSetArn;
     if (permissionSetArn == null) {
       throw new Error(
-        `CreatePermissionSet for "${operation.permissionSetName}" returned no permission set arn.`
+        `CreatePermissionSet for "${props.operation.permissionSetName}" returned no permission set arn.`
       );
     }
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertIdcPermissionSetInWorkingState({
       workingState: props.state,
       permissionSet: {
         permissionSetArn,
-        name: operation.permissionSetName,
-        description: operation.description,
-        sessionDuration: operation.sessionDuration,
+        name: props.operation.permissionSetName,
+        description: props.operation.description,
+        sessionDuration: props.operation.sessionDuration,
         inlinePolicy: null,
         awsManagedPolicies: [],
-        customerManagedPolicies: []
+        customerManagedPolicies: [],
+        permissionsBoundary: null
       }
     });
   }
-  if (operation.kind === "updateIdcPermissionSetDescription") {
+  if (props.operation.kind === "updateIdcPermissionSetDescription") {
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Updating IdC permission set description for "${operation.permissionSetName}"...`
+      `Updating IdC permission set description for "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new UpdatePermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
-        Description: operation.description.trim().length > 0 ? operation.description : void 0
+        Description: props.operation.description.trim().length > 0 ? props.operation.description : void 0
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertIdcPermissionSetInWorkingState({
       workingState: props.state,
       permissionSet: {
         ...permissionSet,
-        description: operation.description
+        description: props.operation.description
       }
     });
   }
-  if (operation.kind === "updateIdcPermissionSetSessionDuration") {
+  if (props.operation.kind === "updateIdcPermissionSetSessionDuration") {
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Updating IdC permission set session duration for "${operation.permissionSetName}"...`
+      `Updating IdC permission set session duration for "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new UpdatePermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
-        SessionDuration: operation.sessionDuration ?? void 0
+        SessionDuration: props.operation.sessionDuration ?? void 0
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertIdcPermissionSetInWorkingState({
       workingState: props.state,
       permissionSet: {
         ...permissionSet,
-        sessionDuration: operation.sessionDuration
+        sessionDuration: props.operation.sessionDuration
       }
     });
   }
-  if (operation.kind === "deleteIdcPermissionSet") {
+  if (props.operation.kind === "deleteIdcPermissionSet") {
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Deleting IdC permission set "${operation.permissionSetName}"...`
+      `Deleting IdC permission set "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new DeletePermissionSetCommand({
@@ -2573,44 +3159,45 @@ async function executeOperation(props) {
         PermissionSetArn: permissionSet.permissionSetArn
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return removeIdcPermissionSetFromWorkingState({
       workingState: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
   }
-  if (operation.kind === "putIdcPermissionSetInlinePolicy") {
+  if (props.operation.kind === "putIdcPermissionSetInlinePolicy") {
+    const { inlinePolicy } = props.operation;
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Putting inline policy on IdC permission set "${operation.permissionSetName}"...`
+      `Putting inline policy on IdC permission set "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new PutInlinePolicyToPermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
-        InlinePolicy: operation.inlinePolicy
+        InlinePolicy: inlinePolicy
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertPermissionSetPolicyState({
       state: props.state,
-      permissionSetName: operation.permissionSetName,
+      permissionSetName: props.operation.permissionSetName,
       update: (currentPermissionSet) => ({
         ...currentPermissionSet,
-        inlinePolicy: operation.inlinePolicy
+        inlinePolicy
       })
     });
   }
-  if (operation.kind === "deleteIdcPermissionSetInlinePolicy") {
+  if (props.operation.kind === "deleteIdcPermissionSetInlinePolicy") {
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Deleting inline policy from IdC permission set "${operation.permissionSetName}"...`
+      `Deleting inline policy from IdC permission set "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new DeleteInlinePolicyFromPermissionSetCommand({
@@ -2618,154 +3205,158 @@ async function executeOperation(props) {
         PermissionSetArn: permissionSet.permissionSetArn
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertPermissionSetPolicyState({
       state: props.state,
-      permissionSetName: operation.permissionSetName,
+      permissionSetName: props.operation.permissionSetName,
       update: (currentPermissionSet) => ({
         ...currentPermissionSet,
         inlinePolicy: null
       })
     });
   }
-  if (operation.kind === "attachIdcManagedPolicyToPermissionSet") {
+  if (props.operation.kind === "attachIdcManagedPolicyToPermissionSet") {
+    const { managedPolicyArn } = props.operation;
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Attaching managed policy "${operation.managedPolicyArn}" to IdC permission set "${operation.permissionSetName}"...`
+      `Attaching managed policy "${managedPolicyArn}" to IdC permission set "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new AttachManagedPolicyToPermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
-        ManagedPolicyArn: operation.managedPolicyArn
+        ManagedPolicyArn: managedPolicyArn
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertPermissionSetPolicyState({
       state: props.state,
-      permissionSetName: operation.permissionSetName,
+      permissionSetName: props.operation.permissionSetName,
       update: (currentPermissionSet) => ({
         ...currentPermissionSet,
         awsManagedPolicies: [
           ...currentPermissionSet.awsManagedPolicies,
-          operation.managedPolicyArn
+          managedPolicyArn
         ]
       })
     });
   }
-  if (operation.kind === "detachIdcManagedPolicyFromPermissionSet") {
+  if (props.operation.kind === "detachIdcManagedPolicyFromPermissionSet") {
+    const { managedPolicyArn } = props.operation;
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Detaching managed policy "${operation.managedPolicyArn}" from IdC permission set "${operation.permissionSetName}"...`
+      `Detaching managed policy "${managedPolicyArn}" from IdC permission set "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new DetachManagedPolicyFromPermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
-        ManagedPolicyArn: operation.managedPolicyArn
+        ManagedPolicyArn: managedPolicyArn
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertPermissionSetPolicyState({
       state: props.state,
-      permissionSetName: operation.permissionSetName,
+      permissionSetName: props.operation.permissionSetName,
       update: (currentPermissionSet) => ({
         ...currentPermissionSet,
         awsManagedPolicies: currentPermissionSet.awsManagedPolicies.filter(
-          (managedPolicyArn) => managedPolicyArn !== operation.managedPolicyArn
+          (arn) => arn !== managedPolicyArn
         )
       })
     });
   }
-  if (operation.kind === "attachIdcCustomerManagedPolicyReferenceToPermissionSet") {
+  if (props.operation.kind === "attachIdcCustomerManagedPolicyReferenceToPermissionSet") {
+    const { customerManagedPolicyName, customerManagedPolicyPath } = props.operation;
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Attaching customer-managed policy "${operation.customerManagedPolicyPath}${operation.customerManagedPolicyName}" to IdC permission set "${operation.permissionSetName}"...`
+      `Attaching customer-managed policy "${customerManagedPolicyPath}${customerManagedPolicyName}" to IdC permission set "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new AttachCustomerManagedPolicyReferenceToPermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
         CustomerManagedPolicyReference: {
-          Name: operation.customerManagedPolicyName,
-          Path: operation.customerManagedPolicyPath
+          Name: customerManagedPolicyName,
+          Path: customerManagedPolicyPath
         }
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertPermissionSetPolicyState({
       state: props.state,
-      permissionSetName: operation.permissionSetName,
+      permissionSetName: props.operation.permissionSetName,
       update: (currentPermissionSet) => ({
         ...currentPermissionSet,
         customerManagedPolicies: [
           ...currentPermissionSet.customerManagedPolicies,
           {
-            name: operation.customerManagedPolicyName,
-            path: operation.customerManagedPolicyPath
+            name: customerManagedPolicyName,
+            path: customerManagedPolicyPath
           }
         ]
       })
     });
   }
-  if (operation.kind === "detachIdcCustomerManagedPolicyReferenceFromPermissionSet") {
+  if (props.operation.kind === "detachIdcCustomerManagedPolicyReferenceFromPermissionSet") {
+    const { customerManagedPolicyName, customerManagedPolicyPath } = props.operation;
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Detaching customer-managed policy "${operation.customerManagedPolicyPath}${operation.customerManagedPolicyName}" from IdC permission set "${operation.permissionSetName}"...`
+      `Detaching customer-managed policy "${customerManagedPolicyPath}${customerManagedPolicyName}" from IdC permission set "${props.operation.permissionSetName}"...`
     );
     await props.ssoAdminClient.send(
       new DetachCustomerManagedPolicyReferenceFromPermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
         CustomerManagedPolicyReference: {
-          Name: operation.customerManagedPolicyName,
-          Path: operation.customerManagedPolicyPath
+          Name: customerManagedPolicyName,
+          Path: customerManagedPolicyPath
         }
       })
     );
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return upsertPermissionSetPolicyState({
       state: props.state,
-      permissionSetName: operation.permissionSetName,
+      permissionSetName: props.operation.permissionSetName,
       update: (currentPermissionSet) => ({
         ...currentPermissionSet,
         customerManagedPolicies: currentPermissionSet.customerManagedPolicies.filter(
-          (customerManagedPolicy) => customerManagedPolicy.name !== operation.customerManagedPolicyName || customerManagedPolicy.path !== operation.customerManagedPolicyPath
+          (policy) => policy.name !== customerManagedPolicyName || policy.path !== customerManagedPolicyPath
         )
       })
     });
   }
-  if (operation.kind === "provisionIdcPermissionSet") {
+  if (props.operation.kind === "provisionIdcPermissionSet") {
     const permissionSet = resolvePermissionSetByName({
       state: props.state,
-      permissionSetName: operation.permissionSetName
+      permissionSetName: props.operation.permissionSetName
     });
     props.logger.log(
-      `Provisioning IdC permission set "${operation.permissionSetName}" to all provisioned accounts...`
+      `Provisioning IdC permission set "${props.operation.permissionSetName}" to all provisioned accounts...`
     );
     const response = await props.ssoAdminClient.send(
       new ProvisionPermissionSetCommand({
         InstanceArn: props.state.identityCenter.instanceArn,
         PermissionSetArn: permissionSet.permissionSetArn,
-        TargetType: operation.targetScope
+        TargetType: props.operation.targetScope
       })
     );
     const requestId = response.PermissionSetProvisioningStatus?.RequestId ?? void 0;
     if (requestId == null) {
       throw new Error(
-        `ProvisionPermissionSet for "${operation.permissionSetName}" returned no request id.`
+        `ProvisionPermissionSet for "${props.operation.permissionSetName}" returned no request id.`
       );
     }
     await waitForPermissionSetProvisioningSuccess({
@@ -2775,16 +3366,63 @@ async function executeOperation(props) {
       requestId,
       timeoutInMs: props.runtime.permissionSetProvisioning.timeoutInMs,
       pollIntervalInMs: props.runtime.permissionSetProvisioning.pollIntervalInMs,
-      operationLabel: `"${operation.permissionSetName}"`
+      operationLabel: `"${props.operation.permissionSetName}"`
     });
-    props.logger.log(`Done: "${operation.permissionSetName}"`);
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
     return props.state;
   }
-  if (operation.kind === "removeIdcGroupMembership") {
+  if (props.operation.kind === "putIdcPermissionSetPermissionsBoundary") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: props.operation.permissionSetName
+    });
+    props.logger.log(
+      `Putting permissions boundary on IdC permission set "${props.operation.permissionSetName}"...`
+    );
+    const boundary = props.operation.permissionsBoundary;
+    await props.ssoAdminClient.send(
+      new PutPermissionsBoundaryToPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn,
+        PermissionsBoundary: "managedPolicyArn" in boundary ? { ManagedPolicyArn: boundary.managedPolicyArn } : {
+          CustomerManagedPolicyReference: {
+            Name: boundary.customerManagedPolicyName,
+            Path: boundary.customerManagedPolicyPath
+          }
+        }
+      })
+    );
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
+    return upsertIdcPermissionSetInWorkingState({
+      workingState: props.state,
+      permissionSet: { ...permissionSet, permissionsBoundary: boundary }
+    });
+  }
+  if (props.operation.kind === "deleteIdcPermissionSetPermissionsBoundary") {
+    const permissionSet = resolvePermissionSetByName({
+      state: props.state,
+      permissionSetName: props.operation.permissionSetName
+    });
+    props.logger.log(
+      `Deleting permissions boundary from IdC permission set "${props.operation.permissionSetName}"...`
+    );
+    await props.ssoAdminClient.send(
+      new DeletePermissionsBoundaryFromPermissionSetCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        PermissionSetArn: permissionSet.permissionSetArn
+      })
+    );
+    props.logger.log(`Done: "${props.operation.permissionSetName}"`);
+    return upsertIdcPermissionSetInWorkingState({
+      workingState: props.state,
+      permissionSet: { ...permissionSet, permissionsBoundary: null }
+    });
+  }
+  if (props.operation.kind === "removeIdcGroupMembership") {
     const resolvedMembership = resolveGroupMembershipDependencies({
       state: props.state,
-      groupDisplayName: operation.groupDisplayName,
-      userName: operation.userName
+      groupDisplayName: props.operation.groupDisplayName,
+      userName: props.operation.userName
     });
     const membershipId = await resolveGroupMembershipId({
       state: props.state,
@@ -2793,7 +3431,7 @@ async function executeOperation(props) {
       userId: resolvedMembership.userId
     });
     props.logger.log(
-      `Removing user "${operation.userName}" from IdC group "${operation.groupDisplayName}"...`
+      `Removing user "${props.operation.userName}" from IdC group "${props.operation.groupDisplayName}"...`
     );
     await props.identityStoreClient.send(
       new DeleteGroupMembershipCommand({
@@ -2802,7 +3440,7 @@ async function executeOperation(props) {
       })
     );
     props.logger.log(
-      `Done: user "${operation.userName}" x group "${operation.groupDisplayName}"`
+      `Done: user "${props.operation.userName}" x group "${props.operation.groupDisplayName}"`
     );
     return removeGroupMembershipFromWorkingState({
       workingState: props.state,
@@ -2812,21 +3450,21 @@ async function executeOperation(props) {
       }
     });
   }
-  if (operation.kind === "grantIdcAccountAssignment") {
+  if (props.operation.kind === "grantIdcAccountAssignment") {
     const resolvedAssignment = resolveAssignmentDependencies({
       state: props.state,
-      accountName: operation.accountName,
-      permissionSetName: operation.permissionSetName,
-      principalType: operation.principalType,
-      principalName: operation.principalName
+      accountName: props.operation.accountName,
+      permissionSetName: props.operation.permissionSetName,
+      principalType: props.operation.principalType,
+      principalName: props.operation.principalName
     });
     props.logger.log(
-      `Granting IdC assignment "${operation.permissionSetName}" to ${formatPrincipalLabel(
+      `Granting IdC assignment "${props.operation.permissionSetName}" to ${formatPrincipalLabel(
         {
-          principalType: operation.principalType,
-          principalName: operation.principalName
+          principalType: props.operation.principalType,
+          principalName: props.operation.principalName
         }
-      )} on "${operation.accountName}"...`
+      )} on "${props.operation.accountName}"...`
     );
     const response = await props.ssoAdminClient.send(
       new CreateAccountAssignmentCommand({
@@ -2841,7 +3479,7 @@ async function executeOperation(props) {
     const requestId = response.AccountAssignmentCreationStatus?.RequestId;
     if (requestId == null) {
       throw new Error(
-        `CreateAccountAssignment for "${operation.permissionSetName}" on "${operation.accountName}" returned no request id.`
+        `CreateAccountAssignment for "${props.operation.permissionSetName}" on "${props.operation.accountName}" returned no request id.`
       );
     }
     await waitForAccountAssignmentCreationSuccess({
@@ -2851,10 +3489,10 @@ async function executeOperation(props) {
       requestId,
       timeoutInMs: props.runtime.accountAssignment.timeoutInMs,
       pollIntervalInMs: props.runtime.accountAssignment.pollIntervalInMs,
-      operationLabel: `"${operation.permissionSetName}" on "${operation.accountName}"`
+      operationLabel: `"${props.operation.permissionSetName}" on "${props.operation.accountName}"`
     });
     props.logger.log(
-      `Done: "${operation.permissionSetName}" -> "${operation.accountName}"`
+      `Done: "${props.operation.permissionSetName}" -> "${props.operation.accountName}"`
     );
     return addAccountAssignmentToWorkingState({
       workingState: props.state,
@@ -2866,21 +3504,21 @@ async function executeOperation(props) {
       }
     });
   }
-  if (operation.kind === "revokeIdcAccountAssignment") {
+  if (props.operation.kind === "revokeIdcAccountAssignment") {
     const resolvedAssignment = resolveAssignmentDependencies({
       state: props.state,
-      accountName: operation.accountName,
-      permissionSetName: operation.permissionSetName,
-      principalType: operation.principalType,
-      principalName: operation.principalName
+      accountName: props.operation.accountName,
+      permissionSetName: props.operation.permissionSetName,
+      principalType: props.operation.principalType,
+      principalName: props.operation.principalName
     });
     props.logger.log(
-      `Revoking IdC assignment "${operation.permissionSetName}" from ${formatPrincipalLabel(
+      `Revoking IdC assignment "${props.operation.permissionSetName}" from ${formatPrincipalLabel(
         {
-          principalType: operation.principalType,
-          principalName: operation.principalName
+          principalType: props.operation.principalType,
+          principalName: props.operation.principalName
         }
-      )} on "${operation.accountName}"...`
+      )} on "${props.operation.accountName}"...`
     );
     const response = await props.ssoAdminClient.send(
       new DeleteAccountAssignmentCommand({
@@ -2895,7 +3533,7 @@ async function executeOperation(props) {
     const requestId = response.AccountAssignmentDeletionStatus?.RequestId;
     if (requestId == null) {
       throw new Error(
-        `DeleteAccountAssignment for "${operation.permissionSetName}" on "${operation.accountName}" returned no request id.`
+        `DeleteAccountAssignment for "${props.operation.permissionSetName}" on "${props.operation.accountName}" returned no request id.`
       );
     }
     await waitForAccountAssignmentDeletionSuccess({
@@ -2905,10 +3543,10 @@ async function executeOperation(props) {
       requestId,
       timeoutInMs: props.runtime.accountAssignment.timeoutInMs,
       pollIntervalInMs: props.runtime.accountAssignment.pollIntervalInMs,
-      operationLabel: `"${operation.permissionSetName}" on "${operation.accountName}"`
+      operationLabel: `"${props.operation.permissionSetName}" on "${props.operation.accountName}"`
     });
     props.logger.log(
-      `Done: "${operation.permissionSetName}" x "${operation.accountName}"`
+      `Done: "${props.operation.permissionSetName}" x "${props.operation.accountName}"`
     );
     return removeAccountAssignmentFromWorkingState({
       workingState: props.state,
@@ -2920,7 +3558,271 @@ async function executeOperation(props) {
       }
     });
   }
-  assertUnreachable(operation, "Unsupported operation kind in apply.");
+  if (props.operation.kind === "createOrgPolicy") {
+    props.logger.log(
+      `Creating org policy "${props.operation.policyName}" (${props.operation.policyType})...`
+    );
+    const response = await props.organizationsClient.send(
+      new CreatePolicyCommand({
+        Name: props.operation.policyName,
+        Description: props.operation.description.length > 0 ? props.operation.description : void 0,
+        Content: props.operation.content,
+        Type: props.operation.policyType
+      })
+    );
+    const policy = response.Policy?.PolicySummary;
+    if (policy?.Id == null || policy.Arn == null) {
+      throw new Error(
+        `CreatePolicy for "${props.operation.policyName}" returned incomplete data.`
+      );
+    }
+    props.logger.log(`Done: "${props.operation.policyName}"`);
+    return upsertOrgPolicyInWorkingState({
+      workingState: props.state,
+      policy: {
+        id: policy.Id,
+        arn: policy.Arn,
+        name: props.operation.policyName,
+        description: props.operation.description,
+        type: props.operation.policyType,
+        content: props.operation.content
+      }
+    });
+  }
+  if (props.operation.kind === "updateOrgPolicyContent") {
+    props.logger.log(
+      `Updating org policy content "${props.operation.policyName}"...`
+    );
+    await props.organizationsClient.send(
+      new UpdatePolicyCommand({
+        PolicyId: props.operation.policyId,
+        Content: props.operation.content
+      })
+    );
+    props.logger.log(`Done: "${props.operation.policyName}"`);
+    const currentPolicy = props.state.organization.policiesById[props.operation.policyId];
+    if (currentPolicy == null) {
+      return props.state;
+    }
+    return upsertOrgPolicyInWorkingState({
+      workingState: props.state,
+      policy: { ...currentPolicy, content: props.operation.content }
+    });
+  }
+  if (props.operation.kind === "updateOrgPolicyDescription") {
+    props.logger.log(
+      `Updating org policy description "${props.operation.policyName}"...`
+    );
+    await props.organizationsClient.send(
+      new UpdatePolicyCommand({
+        PolicyId: props.operation.policyId,
+        Description: props.operation.description
+      })
+    );
+    props.logger.log(`Done: "${props.operation.policyName}"`);
+    const currentPolicy = props.state.organization.policiesById[props.operation.policyId];
+    if (currentPolicy == null) {
+      return props.state;
+    }
+    return upsertOrgPolicyInWorkingState({
+      workingState: props.state,
+      policy: { ...currentPolicy, description: props.operation.description }
+    });
+  }
+  if (props.operation.kind === "attachOrgPolicy") {
+    props.logger.log(
+      `Attaching org policy "${props.operation.policyName}" to "${props.operation.targetName}"...`
+    );
+    const resolvedPolicyId = resolvePolicyId({
+      state: props.state,
+      policyId: props.operation.policyId,
+      policyName: props.operation.policyName
+    });
+    await props.organizationsClient.send(
+      new AttachPolicyCommand({
+        PolicyId: resolvedPolicyId,
+        TargetId: props.operation.targetId
+      })
+    );
+    props.logger.log(
+      `Done: "${props.operation.policyName}" -> "${props.operation.targetName}"`
+    );
+    const targetType = props.operation.targetId === props.context.organization.rootId ? "ROOT" : props.state.organization.organizationalUnitsById[props.operation.targetId] != null ? "ORGANIZATIONAL_UNIT" : "ACCOUNT";
+    return addOrgPolicyAttachmentToWorkingState({
+      workingState: props.state,
+      attachment: {
+        policyId: resolvedPolicyId,
+        targetId: props.operation.targetId,
+        targetType
+      }
+    });
+  }
+  if (props.operation.kind === "detachOrgPolicy") {
+    props.logger.log(
+      `Detaching org policy "${props.operation.policyName}" from "${props.operation.targetName}"...`
+    );
+    await props.organizationsClient.send(
+      new DetachPolicyCommand({
+        PolicyId: props.operation.policyId,
+        TargetId: props.operation.targetId
+      })
+    );
+    props.logger.log(
+      `Done: "${props.operation.policyName}" x "${props.operation.targetName}"`
+    );
+    return removeOrgPolicyAttachmentFromWorkingState({
+      workingState: props.state,
+      policyId: props.operation.policyId,
+      targetId: props.operation.targetId
+    });
+  }
+  if (props.operation.kind === "deleteOrgPolicy") {
+    props.logger.log(`Deleting org policy "${props.operation.policyName}"...`);
+    await props.organizationsClient.send(
+      new DeletePolicyCommand({ PolicyId: props.operation.policyId })
+    );
+    props.logger.log(`Done: "${props.operation.policyName}"`);
+    return removeOrgPolicyFromWorkingState({
+      workingState: props.state,
+      policyId: props.operation.policyId
+    });
+  }
+  if (props.operation.kind === "putAlternateContact") {
+    const { contactType } = props.operation;
+    props.logger.log(
+      `Setting ${contactType} alternate contact for "${props.operation.accountName}" (${props.operation.accountId})...`
+    );
+    await props.accountClient.send(
+      new PutAlternateContactCommand({
+        AccountId: props.operation.accountId,
+        AlternateContactType: contactType,
+        Name: props.operation.name,
+        EmailAddress: props.operation.email,
+        PhoneNumber: props.operation.phone,
+        Title: props.operation.title
+      })
+    );
+    props.logger.log(
+      `Done: ${contactType} contact for "${props.operation.accountName}"`
+    );
+    const account = props.state.organization.accountsById[props.operation.accountId];
+    if (account == null) {
+      throw new Error(
+        `Could not resolve account (${props.operation.accountId}) in working state.`
+      );
+    }
+    const updatedContacts = [
+      ...(account.alternateContacts ?? []).filter(
+        (c) => c.contactType !== contactType
+      ),
+      {
+        contactType,
+        name: props.operation.name,
+        email: props.operation.email,
+        phone: props.operation.phone,
+        title: props.operation.title
+      }
+    ];
+    return upsertAccountInWorkingState({
+      workingState: props.state,
+      account: { ...account, alternateContacts: updatedContacts }
+    });
+  }
+  if (props.operation.kind === "deleteAlternateContact") {
+    const { contactType } = props.operation;
+    props.logger.log(
+      `Deleting ${contactType} alternate contact for "${props.operation.accountName}" (${props.operation.accountId})...`
+    );
+    await props.accountClient.send(
+      new DeleteAlternateContactCommand({
+        AccountId: props.operation.accountId,
+        AlternateContactType: contactType
+      })
+    );
+    props.logger.log(
+      `Done: removed ${contactType} contact for "${props.operation.accountName}"`
+    );
+    const account = props.state.organization.accountsById[props.operation.accountId];
+    if (account == null) {
+      throw new Error(
+        `Could not resolve account (${props.operation.accountId}) in working state.`
+      );
+    }
+    return upsertAccountInWorkingState({
+      workingState: props.state,
+      account: {
+        ...account,
+        alternateContacts: (account.alternateContacts ?? []).filter(
+          (c) => c.contactType !== contactType
+        )
+      }
+    });
+  }
+  if (props.operation.kind === "setIdcAccessControlAttributes") {
+    props.logger.log(
+      `Setting IdC access control attributes (${props.operation.attributes.length} attribute(s))...`
+    );
+    await props.ssoAdminClient.send(
+      new UpdateInstanceAccessControlAttributeConfigurationCommand({
+        InstanceArn: props.state.identityCenter.instanceArn,
+        InstanceAccessControlAttributeConfiguration: {
+          AccessControlAttributes: props.operation.attributes.map((attr) => ({
+            Key: attr.key,
+            Value: { Source: attr.source }
+          }))
+        }
+      })
+    );
+    props.logger.log(`Done: access control attributes updated`);
+    return {
+      ...props.state,
+      identityCenter: {
+        ...props.state.identityCenter,
+        accessControlAttributes: props.operation.attributes
+      }
+    };
+  }
+  if (props.operation.kind === "registerDelegatedAdministrator") {
+    props.logger.log(
+      `Registering delegated administrator "${props.operation.accountName}" (${props.operation.accountId}) for ${props.operation.servicePrincipal}...`
+    );
+    await props.organizationsClient.send(
+      new RegisterDelegatedAdministratorCommand({
+        AccountId: props.operation.accountId,
+        ServicePrincipal: props.operation.servicePrincipal
+      })
+    );
+    props.logger.log(
+      `Done: "${props.operation.accountName}" for ${props.operation.servicePrincipal}`
+    );
+    return upsertDelegatedAdministratorInWorkingState({
+      workingState: props.state,
+      delegatedAdministrator: {
+        accountId: props.operation.accountId,
+        servicePrincipal: props.operation.servicePrincipal
+      }
+    });
+  }
+  if (props.operation.kind === "deregisterDelegatedAdministrator") {
+    props.logger.log(
+      `Deregistering delegated administrator "${props.operation.accountName}" (${props.operation.accountId}) for ${props.operation.servicePrincipal}...`
+    );
+    await props.organizationsClient.send(
+      new DeregisterDelegatedAdministratorCommand({
+        AccountId: props.operation.accountId,
+        ServicePrincipal: props.operation.servicePrincipal
+      })
+    );
+    props.logger.log(
+      `Done: removed "${props.operation.accountName}" for ${props.operation.servicePrincipal}`
+    );
+    return removeDelegatedAdministratorFromWorkingState({
+      workingState: props.state,
+      accountId: props.operation.accountId,
+      servicePrincipal: props.operation.servicePrincipal
+    });
+  }
+  assertUnreachable(props.operation, "Unsupported operation kind in apply.");
 }
 function resolveAssignmentDependencies(props) {
   const account = props.state.organization.accountsByName[props.accountName];
@@ -2980,6 +3882,16 @@ function resolveGroupByDisplayName(props) {
   }
   return group;
 }
+function resolvePolicyId(props) {
+  if (props.policyId !== "__pending_creation__") return props.policyId;
+  const policy = props.state.organization.policiesByName[props.policyName];
+  if (policy == null) {
+    throw new Error(
+      `Could not resolve policy "${props.policyName}" in working state.`
+    );
+  }
+  return policy.id;
+}
 function resolvePermissionSetByName(props) {
   const permissionSet = props.state.identityCenter.permissionSetsByName[props.permissionSetName];
   if (permissionSet == null) {
@@ -3269,7 +4181,9 @@ var scanResponseSchema = strictObject({
     users: number(),
     groups: number(),
     permissionSets: number(),
-    accountAssignments: number()
+    accountAssignments: number(),
+    policies: number(),
+    policyAttachments: number()
   }),
   state: stateSchema
 });
@@ -3339,7 +4253,7 @@ var s3Client = new S3Client({});
 var organizationsClient = new OrganizationsClient3({});
 var ssoAdminClient = new SSOAdminClient3({});
 var identityStoreClient = new IdentitystoreClient3({});
-var accountClient = new AccountClient2({});
+var accountClient = new AccountClient3({});
 async function handler(event) {
   try {
     const parseResult = safeParse(lambdaRequestSchema, event);
@@ -3364,7 +4278,7 @@ async function handler(event) {
       return validateResponse(response);
     }
     if (request.action === "scan") {
-      const response = await handleScan({ s3Client, bucket, organizationsClient, ssoAdminClient, identityStoreClient });
+      const response = await handleScan({ s3Client, bucket, organizationsClient, ssoAdminClient, identityStoreClient, accountClient });
       return validateResponse(response);
     }
     if (request.action === "getStateUrl") {
@@ -3453,7 +4367,7 @@ function isS3PreconditionFailed(error) {
 async function handleScan(props) {
   const identityCenterInstanceArn = process.env.IDENTITY_CENTER_INSTANCE_ARN || void 0;
   const [organization, identityCenter] = await Promise.all([
-    scanOrganization({ organizationsClient: props.organizationsClient }),
+    scanOrganization({ organizationsClient: props.organizationsClient, accountClient: props.accountClient }),
     scanIdentityCenter({
       ssoAdminClient: props.ssoAdminClient,
       identityStoreClient: props.identityStoreClient,
@@ -3480,7 +4394,9 @@ async function handleScan(props) {
       users: state.identityCenter.users.length,
       groups: state.identityCenter.groups.length,
       permissionSets: state.identityCenter.permissionSets.length,
-      accountAssignments: state.identityCenter.accountAssignments.length
+      accountAssignments: state.identityCenter.accountAssignments.length,
+      policies: state.organization.policies?.length ?? 0,
+      policyAttachments: state.organization.policyAttachments?.length ?? 0
     },
     state
   };