How to give access to a user on a service (EC2 or RDS for example) across all accounts in an AWS Organization or OU ?

Question

This policy gives access to RDS describe in an account. But how to extend it to multiple accounts in an AWS Organization ?

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "AllowRDSDescribe",
         "Effect": "Allow",
         "Action": "rds:Describe*",
         "Resource": "*"
      }
   ]
}

Answer

Hello.

If you are using IAM Identity Center to connect to each AWS account, you can create permission sets in IAM Identity Center and associate them with users and groups.  
https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

If you are using IAM users within each AWS account, you can create a CloudFormation template and distribute IAM policies etc. to each AWS account using StackSets.  
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html

Answer

Hello,

You can go directly to the target account with user who has IAM service permission and create a role and attach to user directly.
[https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html]()

If you want to do with another account then you need to create a management access role  in target account to access the role from another account. To do it follow the steps from below link.
[https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html]()

How to give access to a user on a service (EC2 or RDS for example) across all accounts in an AWS Organization or OU ?

Relevant content