AWS Organisation: IAM openid idp for all accounts in OU?

Hi,

Yes you can create a CloudFormation template that includes the given IAM role, and setup a CloudFormation StackSet. The deployment can be controlled by child account or a specific Organizational Unit inside your organization. Here is a link to the documentation available to setup it [1].

If you want to assure every new account provisioned by Control Tower have this new IAM role, you can use Customizations for Control Tower [2]. This solution will allows you to setup templates or SCP across your organization, and have integration with Control Tower events, that will assure you can manage the versioning and targets of your deployment.

[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html

[2] https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/