Can the root user of an organization top-level account access resources in child accounts?

0

I have an OU structure with a top-level payer account. All child accounts in the OU have the root user disabled.

In an emergency, could the root user of the top-level account access the child account to perform any action?

1개 답변
2
수락된 답변

The root user of an AWS account can't directly access its child accounts. AWS Organizations allows managing multiple accounts but it doesn't give root users automatic access to child accounts.

To access a child account from the top-level one in an emergency, you would have had to set up cross-account access in advance. This typically involves creating a special role in the child accounts that the top-level account can assume.

Below is some related documentation that should help.

AWS Organizations: This is the general overview page for AWS Organizations which talks about managing multiple accounts: https://aws.amazon.com/organizations/

Creating a Role to Delegate Permissions to an IAM User: This guide walks you through creating a role for cross-account access: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html

Tutorial: Delegate Access Across AWS Accounts Using IAM Roles: This tutorial is specifically about delegating access across multiple AWS accounts: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

I hope this was helpful, if so please remember to mark this answer as accepted. Good luck!

profile pictureAWS
답변함 9달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠