Manage Organization Member Accounts via AWS CLI

When you create an organization and add existing accounts as members, the OrganizationAccountAccessRole is not automatically created in those invited member accounts. This role is crucial for managing resources across member accounts using the AWS CLI from the management account.

To enable efficient management of resources in multiple member accounts using a single set of management account credentials with MFA via the CLI, you should:

1. Manually create the OrganizationAccountAccessRole in each invited member account. This role grants administrative access to the management account.

2. In the management account, create an IAM policy that allows assuming the OrganizationAccountAccessRole in the member accounts. Attach this policy to the IAM users or groups that need to manage the member accounts.

3. Configure your AWS CLI profile in the management account to use your IAM credentials with MFA.

4. When you need to access a member account via CLI, use the AWS STS (Security Token Service) assume-role command to obtain temporary credentials for the OrganizationAccountAccessRole in the target member account.

This approach allows you to manage resources across multiple member accounts efficiently using a single set of management account credentials with MFA protection. It provides a secure way to switch between accounts without needing separate credentials for each account.

Remember to follow the principle of least privilege when setting up roles and policies, granting only the permissions necessary for the required tasks.
Sources
Accessing member accounts in an organization with AWS Organizations - AWS Organizations
Manage member accounts - AWS Prescriptive Guidance
Accessing a member account that has OrganizationAccountAccessRole with AWS Organizations - AWS Organizations
Creating OrganizationAccountAccessRole for an invited account with AWS Organizations - AWS Organizations