Questions tagged with AWS Organizations

We have set up an External AWS Account as an application in AWS IAM Identity Center, and can access the Console via the SSO start page fine. However we can't see how to set up CLI access to the external AWS account via SSO (as we can with accounts under our Organization). We are trying to move an account that is currently under our Organization to its own Organization, as we need to pay the account via a different payment method. However we still want SSO access (via the Console and CLI). We have followed these instructions for setting up an External AWS Account for SSO: https://static.global.sso.amazonaws.com/app-4a24b6fe5e450fa2/instructions/index.htmlg...

We enabled GuardDuty at the Org-level and delegated the primary/management Account. However, in the GD console at the delegated account, the primary/management Account isn't listed. It seems as though the delegate admin doesn't have GuardDuty enabled. How do you enable GD detections on the delegate admin when it is also the primary/management Account? Might be similar to https://repost.aws/questions/QULax-FQ6UQHW0gcW8qwEIPQ/iam-access-analyzer-delegated-admin-and-org-configuration-doesnt-pick-up-root-accountlg...

Looking at the user guide, it seems to imply you can only create the datalake in the management account; which seems counter-intutive since using Control Tower they used to create the combined Cloudtail log in a seperate Log Archive account. Ideally, I'd like to place it in a Security account which seems like where it would belong. Am I missing anything? https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-event-data-store.html > To have your event data store collect events from all accounts in an AWS Organizations organization, select Enable for all accounts in my organization. You must be signed in to the management account for the organization to create an event data store that collects events for an organization.lg...

The issue is our accounts are in control tower environment and in control tower there are no options to add config rules other than Predefined ones, in those predefined ones there is non for security groups. How can we enable more config rules at organization level e.g. *security group verification rule.* I have the option to enable this at per account level but not at aggregator level, but there are hundreds of account and it is not feasible to have this one by one for each account.lg...

We have multiple AWS Accounts that all have their own individual IAM Users/Groups and permissions. These are all from acquisitions. We've created an AWS Organization and enabled all features. My question is, when we add an external IDP for SSO, will the Users/Groups at the Account level IAM remain intact? Based on the documentation I believe they will, and at this point we can start migrating the Users/Groups out of the Account level IAM and into the Org level SSO? Some of these accounts are critical and I just want to be really clear before I potentially make a huge mistake.lg...

I am getting "Landing zone drift detected" while accessing control tower and cause of this issue is listed as The core account, Log archive **** was removed from your organization in AWS Organizations. The core account, Audit (********), was removed from your organization in AWS Organizations. Until you fix this problem, you cannot view or manage your AWS Control Tower landing zone. Provisioning new accounts is not recommended, because logging and auditing may not be functioning. I used repair as suggested by documentation but it does not work.lg...

The typo is {EMAIL_ALIAS}@gmailk.com. Clearly, gmailk is not an actual domain. How can I delete this account?lg...

I know I can assign SCPs to a specific OU. Am I able to apply an SCP at root, but then limit or choose specific OUs within the json file? So for example, restrict resources or services in all OUs except one? It would be useful for us with dev and prod.lg...

I have an AWS Organization account and need to have access to all the accounts' resources like S3,RDS,EC2 in AWS Organization so that I can access it using the access key and secret key of the Master Account using BOTO3 SDK. Please guide me how can i achieve it.lg...

been working on AWS ORGANIZATIONS..i've my root account(management account) under that i've one vendor account now in management account i've 2 ec2 instance resource..with switch role from vendor account to management account..i should only see one ec2 instance among that 2 instance that already available in management account. now how can i apply policies to do this..i tried tag policies to do this which only restrict the vendor to do things..but for my use case i should hide one ec2 instance and show only one ec2 instance by vendor account..how can i do with?lg...

Hi, I am using AWS IAM as IDP from Root account with AWS SSO (not AD or external), so I have AWS SSO and a SAML application for Jenkins configured on the root account. I have configured the SAML Jenkins app with the following attributes:  And i need propagate to Jenkins the groups to which that user belongs in the AWS SSO, to assign permissions in Jenkins according to the groups that the user has. Is it possible? Regards!lg...

Want to delete tags displayed in the "Cost Allocation Tags" panel. I used the "Tag Editor" to search for resources that might be tag using those tags but the Tag Editor did not listed any resource. How can delete the specified tags?   Thankslg...