AWS Organizations | Organizing AWS accounts Flashcards
What is a policy?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
A policy is a “document” with one or more statements that define the controls that you want to apply to a group of AWS accounts. In this release, AWS Organizations supports a specific type of policy called a Service Control Policy (SCP). An SCP defines the AWS service actions, such as Amazon EC2 RunInstances, that are available for use in different accounts within an organization.
Can I define and manage my organization regionally?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
No. All organization entities are globally accessible, similar to how AWS Identity and Access Management (IAM) works today. You do not need to specify a region when you create and manage your organization. Users in your AWS accounts can use AWS services in any geographic region in which that service is available.
Can I change which AWS account is the master account?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
No. You cannot change which AWS account is the master account. Therefore, you should select your master account carefully.
How do I add an AWS account to my organization?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
Use one of the following two methods to add an AWS account to your organization:
Method 1: Invite an existing account to join your organization
Sign in as an administrator of the master account and navigate to the AWS Organizations console.
Choose the Accounts tab.
Choose Add account and then choose Invite account.
Provide the email address of the account that you want to invite or the AWS account ID of the account.
Note: You can invite more than one AWS account by providing a comma-separated list of email addresses or AWS account IDs.
The specified AWS account receives an email inviting it to join your organization. An administrator in the invited AWS account must accept or reject the request using the AWS Organizations console, AWS CLI, or Organizations API. If the administrator accepts your invitation, the account becomes visible in the list of member accounts in your organization. Any applicable policies, such as SCPs, will be enforced automatically in the newly added account. For example, if your organization has an SCP attached to the root of your organization it will directly be enforced on the newly created accounts.
Method 2: Create an AWS account in your organization
Sign in as an administrator of your master account and navigate to the AWS Organizations console.
Choose the Accounts tab.
Choose Add account and then choose Create account.
Provide a name for the account and the email address for the account.
You can also create an account by using the AWS SDK or AWS CLI. For both methods, after you add the new account, you can move it to an organizational unit (OU). The new account automatically inherits the policies attached to the OU.
Can an AWS account be a member of more than one organization?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
No. An AWS account can be a member of only one organization at a time.
How can I access an AWS account that was created in my organization?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
As part of AWS account creation, AWS Organizations creates an IAM role with full administrative permissions in the new account. IAM users and IAM roles with appropriate permissions in the master account can assume this IAM role to gain access to the newly created account.
Can I set up multi-factor authentication (MFA) on the AWS account that I create in my organization programmatically?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
No. This currently is not supported.
Can I move an AWS account that I have created using AWS Organizations to another organization?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
Yes. However, you must first remove the account from your organization and make it a standalone account (see below). After making the account standalone, it can then be invited to join another organization.
Can I remove an AWS account that I created using Organizations and make it a standalone account?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
Yes. When you create an account in an organization using the AWS Organizations console, API, or CLI commands, AWS does not collect all of the information required of standalone accounts. For each account that you want to make standalone, you need to update this information, which can include: providing contact information, agreeing to the AWS Customer Agreement, providing a valid payment method, and choosing a support plan option. AWS uses the payment method to charge for any billable (not AWS Free Tier) AWS activity that occurs while the account is not attached to an organization. For more information, see Removing a Member Account from Your Organization.
How many AWS accounts can I manage in my organization?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
This can vary. If you need additional accounts, go to the AWS Support Center and open a support case to request an increase.
How can I remove an AWS member account from an organization?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
You can remove a member account by using one of the following two methods. You might have to provide additional information to remove an account that you created using Organizations. If the attempt to remove an account fails, go to the AWS Support Center and ask for help with removing an account.
Method 1: Remove an invited member account by signing in to the master account
Sign in as an administrator of the master account and navigate to the AWS Organizations console.
In the left pane, choose Accounts.
Choose the account that you want to remove and then choose Remove account.
If the account does not have a valid payment method, you must provide one.
Method 2: Remove an invited member account by signing in to the member account
Sign in as an administrator of the member account that you want to remove from the organization.
Navigate to the AWS Organizations console.
Choose Leave organization.
If the account does not have a payment method, you must provide one.
How can I create an organizational unit (OU)?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
To create an OU, follow these steps:
Sign in as an administrator of the master account and navigate to the AWS Organizations console.
Choose the Organize accounts tab.
Navigate in the hierarchy to where you want to create the OU. You can create it directly under the root, or you can create it within another OU.
Choose to Create organizational unit and provide a name for your OU. The name must be unique within your organization.
Note: You can rename the OU later.
You now can add AWS accounts to your OU. You can also use the AWS CLI and AWS APIs to create and manage an OU.
How can I add a member AWS account to an OU?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
Follow these steps to add member accounts to an OU:
In the AWS Organizations console, choose the Organize accounts tab.
Choose the AWS account, and then choose Move account.
In the dialog box, select the OU to which you want to move the AWS account.
Alternatively, you can use the AWS CLI and AWS APIs to add AWS accounts to an OU.
Can an AWS account be a member of multiple OUs?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
No. An AWS account can be a member of only one OU at a time.
Can an OU be a member of multiple OUs?
Organizing AWS accounts
AWS Organizations | Security, Identity & Compliance
No. An OU can be a member of only one OU at a time.
