Is it safe to delete OrganizationAccountAccessRole after creating an account?

Question

I've created a new account that is intended to hold production infrastructure and is thus meant to be locked down to a small set of users.

However, we have a bunch of stuff already in our (only) management account.

The OrganizationAccountAccessRole as created by AWS Organizations has broad permissions and can be assumed by anyone in my management account. Is it safe to delete that OrganizationAccountAccessRole assuming I have other roles that can be used for day-to-day work in the new prod account?

Riku_Kobayashi · Answer

Hello.

Yes, you can delete it.  
If you have other roles that you can use for your daily work, you can delete them without any problems.  
This is basically an IAM role used by the Organizations management account, so setting an IAM policy such as ReadOnlyAccess will be useful when troubleshooting.    
https://repost.aws/knowledge-center/organizations-member-account-access

Is it safe to delete OrganizationAccountAccessRole after creating an account?

Add your answer

Relevant content