How can organization accounts be accessed programmatically?

Question

I want to create accounts in an organization programmatically and once created, I would like to programmatically manage resources within the account. How can this be done without having to use the AWS Console to switch accounts or reset the password? Can I use the AWS ~~API~~ SDK with an access key from the organization account to target the sub account?

Accepted Answer

Figured out that I can use the [AWS Security Token Service ](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html)to assume the role of the account in the organization and before the actions I require

Answer

Yes, you can accomplish these tasks using the AWS SDK.

You could take a look at [this AWS Bootstrap Kit example](https://github.com/aws-samples/aws-bootstrap-kit-examples) repository on GitHub. This repository contains examples of using the AWS Bootstrap Kit to set your development and deployment environment on AWS. You can get an impression how such centralized account and resource management could be accomplished.

Using AWS CDK, this example shows you how to create and manage a complete AWS Organization (including multiple accounts). You can also explore how to manage the resources in those accounts using the IaC approach - by deploying CDK constructs into various accounts of the organization. This is one possible approach.

You can also call the AWS API directly to achieve the same results, but the best practice is to use an IaC approach, for example with AWS CloudFormation or AWs CDK.

Essentially, the target accounts you want to manage must allow the central (root) account to do so. You do this by configuring the corresponding IAM roles in the target accounts and assuming them when managing the resources. The Bootstrap Kit example mentioned above shows you how to achieve that using AWS CDK.

How can organization accounts be accessed programmatically?

Relevant content