runbooks 1.1.7__py3-none-any.whl → 1.1.10__py3-none-any.whl

runbooks/inventory/collectors/aws_management.py

@@ -76,7 +76,7 @@ class ManagementResourceCollector(BaseResourceCollector):
 
             try:
                 if resource_type.startswith("organizations:"):
-                    resources.extend(self._collect_organizations_resources(clients, context, resource_type))
+                    resources.extend(self._collect_organizations_resources(clients, context, resource_type, resource_filters))
                 elif resource_type.startswith("cloudformation:"):
                     resources.extend(self._collect_cloudformation_resources(clients, context, resource_type))
                 elif resource_type.startswith("servicecatalog:"):
@@ -107,15 +107,17 @@ class ManagementResourceCollector(BaseResourceCollector):
         }
 
     def _collect_organizations_resources(
-        self, clients: Dict[str, Any], context: CollectionContext, resource_type: str
+        self, clients: Dict[str, Any], context: CollectionContext, resource_type: str,
+        resource_filters: Optional[Dict[str, Any]] = None
     ) -> List[AWSResource]:
         """Collect AWS Organizations resources."""
         resources = []
+        resource_filters = resource_filters or {}
         org_client = clients["organizations"]
 
         try:
             if resource_type == "organizations:account":
-                resources.extend(self._collect_organization_accounts(org_client, context))
+                resources.extend(self._collect_organization_accounts(org_client, context, resource_filters))
             elif resource_type == "organizations:organizational_unit":
                 resources.extend(self._collect_organizational_units(org_client, context))
             elif resource_type == "organizations:policy":
@@ -130,14 +132,44 @@ class ManagementResourceCollector(BaseResourceCollector):
         return resources
 
     @aws_api_retry
-    def _collect_organization_accounts(self, org_client, context: CollectionContext) -> List[AWSResource]:
-        """Collect organization accounts."""
+    def _collect_organization_accounts(self, org_client, context: CollectionContext,
+                                        resource_filters: Optional[Dict[str, Any]] = None) -> List[AWSResource]:
+        """
+        Collect organization accounts with optional root-only filtering.
+
+        Args:
+            org_client: boto3 Organizations client
+            context: Collection context
+            resource_filters: Optional filters including 'root_only' for management account filtering
+
+        Returns:
+            List of organization account resources
+        """
         resources = []
+        resource_filters = resource_filters or {}
+        root_only = resource_filters.get("root_only", False)
 
         try:
+            # Get management account ID if root-only filter is active
+            management_account_id = None
+            if root_only:
+                try:
+                    org_info = org_client.describe_organization()
+                    management_account_id = org_info["Organization"]["MasterAccountId"]
+                    logger.info(f"root-only filter active: Management account ID = {management_account_id}")
+                except Exception as e:
+                    logger.warning(f"Could not retrieve management account ID for root-only filter: {e}")
+                    root_only = False  # Disable filter if retrieval fails
+
+            # Collect accounts with filtering
             paginator = org_client.get_paginator("list_accounts")
             for page in paginator.paginate():
                 for account in page.get("Accounts", []):
+                    # Apply root-only filter if active
+                    if root_only and account["Id"] != management_account_id:
+                        logger.debug(f"Skipping non-management account: {account['Id']} (root-only filter)")
+                        continue  # Skip non-management accounts
+
                     resource = AWSResource(
                         resource_id=account["Id"],
                         resource_type="organizations:account",
@@ -157,6 +189,8 @@ class ManagementResourceCollector(BaseResourceCollector):
                     )
                     resources.append(resource)
 
+            logger.debug(f"Collected {len(resources)} organization accounts (root_only: {root_only})")
+
         except Exception as e:
             logger.error(f"Error collecting organization accounts: {e}")