Create buckets in different accounts in organization

Question

I have an organization and 2 accounts in it.
Main-Account (management account)
Member-Account

My software will have N Users and I need for each user (from my software) to have a Member-Account (on AWS) that will belong in my Organization (managed by Main-Account).

The Member-Accounts will be created through API using 'organizations' service and ACCESS_KEY for the Root user on Main-Account, or IAM User in Main-Account.

My idea is when a user is created on my software, to create Member-Account (on AWS) and create a bucket for this account. All of this needs to be created through API.

I don't know how to implement this. I tried: 
- IAM Users, but whenever I create an IAM User using my root user (Main-Account) the IAM User belongs to Main-Account. So this will not work
- Identity center Users, but I cannot create ACCESS_KEY for this kind of user, so I cannot use this user through API
- I tried to use the root user of the Member-Account, but I need to set up a password for this user -> login into the Console -> create ACCESS_KEY and then use the ACCESS_KEY for API, but until I create the ACCESS_KEY, I must use the Console.

Is there any way of achieving this ?

Answer

Some options/ideas

1) Use OrganizationAccountAccessRole or Create a role in each memeber account and assume that role from the management account to create the S3 Bucket

2) Use cloudformation stack that automaticlly creates an S3 bucket in member accounts whent they join the org

3) Use IAC (Cloudformation/Terraform) to create the new member account and S3 bucket at the same time.

Answer

Best practice is to not use the root account or create root access keys unless absolutely necessary. You can use roles within both accounts to accomplish what you want to do.

Create buckets in different accounts in organization

Relevant content