chore(aws): remove deprecated `status` field from Organizations sync (deadline: 2026-09-09)

[g-k-s-03]

Summary

In cartography/intel/aws/organizations.py line 189,
there is a TODO comment indicating that the status
field should be removed after AWS retires it on
2026-09-09.

Location

• File: cartography/intel/aws/organizations.py
• Line: 189

Current Code

The current code contains:

TODO: Remove status after AWS retires it on 2026-09-09.

Proposed Fix

Remove the deprecated status field from the
Organizations data ingestion before the AWS
retirement deadline. This includes:

• Removing the field from data transformation
• Updating related Neo4j load queries
• Updating any tests that reference this field

Why This Matters

This is time-sensitive — if not addressed before
2026-09-09, the field will become invalid and
could cause sync failures for users running
Cartography against AWS Organizations.

Additional Notes

I found this while exploring the codebase as a
new contributor. I'd like to work on this fix
if maintainers agree with the approach.

[g-k-s-03]

@jychp I want to work on this project. Should I start

[achantavy]

From AWS:

AWS Organizations has transitioned from the account status (Status field) to the new account state (State field) to provide more detailed account lifecycle information. The new State field offers enhanced granularity with values including PENDING ACTIVATION, ACTIVE, SUSPENDED, PENDING CLOSURE, and CLOSED, available through both the AWS Organizations console and APIs (DescribeAccount, ListAccounts, ListAccountsForParent, ListDelegatedAdministrators).

Starting September 9, 2025, we have begun a one-year transition period where both Status and State fields will be available in the API responses. After September 9, 2026, the Status field will be permanently removed. If you use automated processes for account management, we recommend updating your systems to use the State field before the deprecation date. For more information, see Updates to account status information in AWS Organizations [1] or visit our documentation [2].

If you have any questions, concerns, or require assistance, please do not hesitate to contact AWS Support

[1] https://aws.amazon.com/blogs/mt/updates-to-account-status-information-in-aws-organizations/

[2] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_account_state.html

[3] https://console.aws.amazon.com/support

[g-k-s-03]

Thanks for the detailed context, @achantavy this clarifies the scope precisely.

To summarize what PR #2866 covers based on this:

• Remove "status": account.get("Status") from transform_aws_organization_accounts (along with the TODO comment)
• Remove account.status = null from the stale-metadata cleanup Cypher query in cleanup_stale_aws_account_organization_metadata
• Retain _get_account_state() with its State-first, Status-fallback logic for the duration of the transition window (until 2026-09-09), since both fields are available in the API response during this period

The state field is already being populated correctly in the transform and tests only reference state so no test changes are required beyond removing any assertions on status if present.

Happy to update the PR description to reflect this framing if that would be helpful. Please let me know if the approach looks correct.