From e4aa445f67e146698a99b67c2a9140f6149c7222 Mon Sep 17 00:00:00 2001
From: badra001 <donald.e.badrak.ii@census.gov>
Date: Fri, 16 Jan 2026 12:14:19 -0500
Subject: [PATCH] start common-policies

---
 policies/sc-servicecatalog-t1/README.md       | 49 +++++++++++++++++++
 policies/sc-servicecatalog-t1/data.tf         |  1 +
 policies/sc-servicecatalog-t1/defaults.tf     |  1 +
 policies/sc-servicecatalog-t1/locals.tf       | 12 +++++
 policies/sc-servicecatalog-t1/main.tf         |  2 +
 policies/sc-servicecatalog-t1/module_name.tf  |  3 ++
 policies/sc-servicecatalog-t1/outputs.tf      | 24 +++++++++
 policies/sc-servicecatalog-t1/policy.tf       | 13 +++++
 policies/sc-servicecatalog-t1/prefixes.tf     |  1 +
 policies/sc-servicecatalog-t1/settings.tf     |  6 +++
 .../sc-servicecatalog-t1/variables.common.tf  |  1 +
 .../variables.settings.tf                     |  1 +
 policies/sc-servicecatalog-t1/variables.tf    | 29 +++++++++++
 policies/sc-servicecatalog-t1/version.tf      |  1 +
 policies/sc-servicecatalog-t1/versions.tf     |  1 +
 15 files changed, 145 insertions(+)
 create mode 100644 policies/sc-servicecatalog-t1/README.md
 create mode 120000 policies/sc-servicecatalog-t1/data.tf
 create mode 120000 policies/sc-servicecatalog-t1/defaults.tf
 create mode 100644 policies/sc-servicecatalog-t1/locals.tf
 create mode 100644 policies/sc-servicecatalog-t1/main.tf
 create mode 100644 policies/sc-servicecatalog-t1/module_name.tf
 create mode 100644 policies/sc-servicecatalog-t1/outputs.tf
 create mode 100644 policies/sc-servicecatalog-t1/policy.tf
 create mode 120000 policies/sc-servicecatalog-t1/prefixes.tf
 create mode 100644 policies/sc-servicecatalog-t1/settings.tf
 create mode 120000 policies/sc-servicecatalog-t1/variables.common.tf
 create mode 120000 policies/sc-servicecatalog-t1/variables.settings.tf
 create mode 100644 policies/sc-servicecatalog-t1/variables.tf
 create mode 120000 policies/sc-servicecatalog-t1/version.tf
 create mode 120000 policies/sc-servicecatalog-t1/versions.tf

diff --git a/policies/sc-servicecatalog-t1/README.md b/policies/sc-servicecatalog-t1/README.md
new file mode 100644
index 0000000..c8eed4b
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/README.md
@@ -0,0 +1,49 @@
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.66.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.66.0 |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_arn.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/arn) | data source |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.inline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_account_alias"></a> [account\_alias](#input\_account\_alias) | AWS Account Alias | `string` | `""` | no |
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | AWS Account ID (default will pull from current user) | `string` | `""` | no |
+| <a name="input_customer_managed_policy_names"></a> [customer\_managed\_policy\_names](#input\_customer\_managed\_policy\_names) | Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset | `map(string)` | `{}` | no |
+| <a name="input_inline_policy"></a> [inline\_policy](#input\_inline\_policy) | AWS Policy document for the single allowed inline policy | `string` | `null` | no |
+| <a name="input_managed_policy_names"></a> [managed\_policy\_names](#input\_managed\_policy\_names) | Names of AWS Managed Policy to attach to the permissionset | `list(string)` | `[]` | no |
+| <a name="input_name"></a> [name](#input\_name) | Permission Set Name for which all settings apply | `string` | `null` | no |
+| <a name="input_override_prefixes"></a> [override\_prefixes](#input\_override\_prefixes) | Override built-in prefixes by component. This should be used primarily for common infrastructure things | `map(string)` | `{}` | no |
+| <a name="input_relay_state"></a> [relay\_state](#input\_relay\_state) | Relay State to pass along to permissionset | `string` | `null` | no |
+| <a name="input_settings_file"></a> [settings\_file](#input\_settings\_file) | File name and path to YAML with users(list), account\_ids(list), org\_ous(list), and all(bool). See sample.yml in code. | `string` | `null` | no |
+| <a name="input_tags"></a> [tags](#input\_tags) | AWS Tags to apply to appropriate resources | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_customer_managed_policy_names"></a> [customer\_managed\_policy\_names](#output\_customer\_managed\_policy\_names) | Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset |
+| <a name="output_inline_policy"></a> [inline\_policy](#output\_inline\_policy) | AWS Policy document for the single allowed inline policy (use .json to get policy) |
+| <a name="output_managed_policy_names"></a> [managed\_policy\_names](#output\_managed\_policy\_names) | Names of AWS Managed Policy to attach to the permissionset |
+| <a name="output_name"></a> [name](#output\_name) | Permission Set Name for which all settings apply |
+| <a name="output_relay_state"></a> [relay\_state](#output\_relay\_state) | Relay State to pass along to permissionset |
diff --git a/policies/sc-servicecatalog-t1/data.tf b/policies/sc-servicecatalog-t1/data.tf
new file mode 120000
index 0000000..37fff16
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/data.tf
@@ -0,0 +1 @@
+../../common/data.tf
\ No newline at end of file
diff --git a/policies/sc-servicecatalog-t1/defaults.tf b/policies/sc-servicecatalog-t1/defaults.tf
new file mode 120000
index 0000000..1227df3
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/defaults.tf
@@ -0,0 +1 @@
+../../common/defaults.tf
\ No newline at end of file
diff --git a/policies/sc-servicecatalog-t1/locals.tf b/policies/sc-servicecatalog-t1/locals.tf
new file mode 100644
index 0000000..5cba936
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/locals.tf
@@ -0,0 +1,12 @@
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+  region              = data.aws_region.current.name
+  region_short        = join("", [for c in split("-", local.region) : substr(c, 0, 1)])
+
+  base_tags = {
+    "boc:tf_module_version" = local._module_version
+    "boc:tf_module_name"    = local._module_name
+    "boc:created_by"        = "terraform"
+  }
+}
diff --git a/policies/sc-servicecatalog-t1/main.tf b/policies/sc-servicecatalog-t1/main.tf
new file mode 100644
index 0000000..3c91f4a
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/main.tf
@@ -0,0 +1,2 @@
+/*
+*/
diff --git a/policies/sc-servicecatalog-t1/module_name.tf b/policies/sc-servicecatalog-t1/module_name.tf
new file mode 100644
index 0000000..4240482
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/module_name.tf
@@ -0,0 +1,3 @@
+locals {
+  _module_name = "aws-sso/policies/sc-servicecatalog-t1"
+}
diff --git a/policies/sc-servicecatalog-t1/outputs.tf b/policies/sc-servicecatalog-t1/outputs.tf
new file mode 100644
index 0000000..ef99006
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/outputs.tf
@@ -0,0 +1,24 @@
+output "name" {
+  description = "Permission Set Name for which all settings apply"
+  value       = var.name
+}
+
+output "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  value       = var.managed_policy_names
+}
+
+output "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  value       = var.customer_managed_policy_names
+}
+
+output "inline_policy" {
+  description = "AWS Policy document for the single allowed inline policy (use .json to get policy)"
+  value       = var.inline_policy
+}
+
+output "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  value       = var.relay_state
+}
diff --git a/policies/sc-servicecatalog-t1/policy.tf b/policies/sc-servicecatalog-t1/policy.tf
new file mode 100644
index 0000000..425ab7f
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/policy.tf
@@ -0,0 +1,13 @@
+data "aws_iam_policy_document" "inline" {
+  statement {
+    sid    = "OnlyReadOperationsOnOrganizations"
+    effect = "Allow"
+    actions = [
+      "organizations:Describe*",
+      "organizations:List*",
+      "account:Get*",
+      "account:List*"
+    ]
+    resources = ["*"]
+  }
+}
diff --git a/policies/sc-servicecatalog-t1/prefixes.tf b/policies/sc-servicecatalog-t1/prefixes.tf
new file mode 120000
index 0000000..5bc256c
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/prefixes.tf
@@ -0,0 +1 @@
+../../common/prefixes.tf
\ No newline at end of file
diff --git a/policies/sc-servicecatalog-t1/settings.tf b/policies/sc-servicecatalog-t1/settings.tf
new file mode 100644
index 0000000..14c7a78
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/settings.tf
@@ -0,0 +1,6 @@
+locals {
+  settings          = var.settings_file != null ? (fileexists(var.settings_file) ? yamldecode(file(var.settings_file)) : null) : null
+  name              = coalesce(var.name, try(local.settings.group, null))
+  description       = coalesce(var.description, try(local.settings.description, null), local.name)
+  auto_policy_count = try(local.settings.auto_policy_count, var.auto_policy_count)
+}
diff --git a/policies/sc-servicecatalog-t1/variables.common.tf b/policies/sc-servicecatalog-t1/variables.common.tf
new file mode 120000
index 0000000..e01226c
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/variables.common.tf
@@ -0,0 +1 @@
+../../common/variables.common.tf
\ No newline at end of file
diff --git a/policies/sc-servicecatalog-t1/variables.settings.tf b/policies/sc-servicecatalog-t1/variables.settings.tf
new file mode 120000
index 0000000..1326193
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/variables.settings.tf
@@ -0,0 +1 @@
+../../common/variables.settings.tf
\ No newline at end of file
diff --git a/policies/sc-servicecatalog-t1/variables.tf b/policies/sc-servicecatalog-t1/variables.tf
new file mode 100644
index 0000000..c331403
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/variables.tf
@@ -0,0 +1,29 @@
+variable "name" {
+  description = "Permission Set Name for which all settings apply"
+  type        = string
+  default     = null
+}
+
+variable "managed_policy_names" {
+  description = "Names of AWS Managed Policy to attach to the permissionset"
+  type        = list(string)
+  default     = []
+}
+
+variable "customer_managed_policy_names" {
+  description = "Map of policy name to permission boundary of Customer Managed Policy to attach to the permissionset"
+  type        = map(string)
+  default     = {}
+}
+
+variable "inline_policy" {
+  description = "AWS Policy document for the single allowed inline policy"
+  type        = string
+  default     = null
+}
+
+variable "relay_state" {
+  description = "Relay State to pass along to permissionset"
+  type        = string
+  default     = null
+}
diff --git a/policies/sc-servicecatalog-t1/version.tf b/policies/sc-servicecatalog-t1/version.tf
new file mode 120000
index 0000000..4950c91
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/version.tf
@@ -0,0 +1 @@
+../../common/version.tf
\ No newline at end of file
diff --git a/policies/sc-servicecatalog-t1/versions.tf b/policies/sc-servicecatalog-t1/versions.tf
new file mode 120000
index 0000000..cbeda73
--- /dev/null
+++ b/policies/sc-servicecatalog-t1/versions.tf
@@ -0,0 +1 @@
+../../common/versions.tf
\ No newline at end of file