Activate advanced Amazon features

You are now the administrator of the Amazon organization that contains your projects.

You manage your projects as member accounts in your organization. As the administrator of this organization, you can create member accounts in the organization.

To give member accounts that you invite to join your organization an administrator role, you must create an OrganizationAccountAccessRole. For more information, see Creating the OrganizationAccountAccessRole in an invited member account.

Your team members are referred to as workforce identities and they can still access your Amazon accounts. You can also choose to customize the identity source of your workforce using IAM Identity Center. You can continue to use Amazon Builder ID as the identity source, or you can change this to an external identity source. If you change your identity source from Amazon Builder ID to another identity source, it is irreversible. You can't re-enable Amazon Builder ID as an identity source in the future. For more information, see Change identity source from Amazon Builder ID.

You control Amazon access for users and groups in your IAM Identity Center organization instance using Account access manager. You can use this feature to modify user access, while still allowing your users to sign in using aws login to receive their IAM role session credentials from the browser. For more information, see Amazon Account Access Manager.

Amazon creates a member account in your organization with a delegated administrator role. This role is used to perform most administrative tasks in the IAM Identity Center and account access manager. The delegated administrator role must be used in US East (N. Virginia). For more information, see Delegated administration.

You can now configure Resource Control Policies (RCPs) and Service Control Policies (SCPs) to enforce custom guardrails in your organization. Previously, Amazon managed RCPs and SCPs on your behalf. You can modify those policies after you activate advanced features. For more information, see Remove organization policies.

If you have a spend limit for any of your Amazon accounts, it is removed. You cannot create a spend limit if you activate advanced features. Instead, you have access to the entire suite of Billing and Cost Management Tools. This includes setting budgets, downloading cost explorer reports, and detecting unusual spend with Amazon Cost Anomaly Detection. You can use these advanced tools to analyze, organize, plan, and optimize your costs.

You can access all Amazon services. The available services are listed in Amazon Web Services services not supported for our new Amazon experience. You should plan your architecture and consult the service documentation before enabling these services. In addition, Agent Toolkit provides many skills to work with these services.

You gain access to additional Amazon Web Services Regions, opt-in Regions, and access to multi-Region capabilities. Multi-Region architecture improves resilience for your workloads. We recommend that you plan for how you will constrain and audit your regional footprint. It's important to ensure that resources you create are only present in the Regions you intend to use.

You can turn off IAM role manager for each Amazon Web Services account in your organization. IAM role manager is an optional account setting that automatically provisions roles, so you and your workforce don't need to set them up. For more information, see How to enable and disable role manager (console).

You can use IAM Access Analyzer.

Previously, the Amazon Web Services Management Console showed a simplified view with a menu that you used to change between projects and access Amazon Settings. The Amazon Web Services Management Console expands to include additional features such as Region selector, additional services, and setting a color for account that you can access to visibly distinguish between them. For more information, see Console features.

You can now also do the following:

Access the Billing and Cost Management Console to view your billing information.

Access the Amazon Organization console to modify the SCPs and RCPs that govern your organization.

Access the Amazon Account Access Manager console to modify the fine grain access for your workforce identities.

Access the IAM Identity Center to change your identity source.

Inform all your team members that you will be activating advanced features. Unless you modify any settings, your team members will have the same access to the projects, but the Amazon Web Services Management Console changes from the simplified view to a view that shows Regions and provides access to more services. If you later change the identity source or add new SCPs or RCPs, inform your workforce since those changes can affect how they sign in and what they can access.

View the spend for all your current projects and note if any projects contain costs that significantly fluctuate. Without a spend limit, you will be responsible for all costs incurred by your resources. We recommend that you delete or pause idle resources before you activate advanced features.

Plan what changes you'll be making to your Amazon organizations and research best practices. If you plan on creating resources in a different Amazon Web Services Region, modify the service control policy that is applied for all users to restrict Amazon Web Services Regions. You need to modify the statementID for RegionFloor to include any new Regions. For more information, see Service control policies for projects.

If you followed the steps in Connect an AI coding tool, your AI tool has context only about the new Amazon experience. This can cause problems as you develop using advanced features. We recommend the following:

Manage workforce members

Change identity source from Amazon Builder ID

Remove organization policies

Create an organizational unit

Enable or disable Amazon Web Services Regions in your account

Create IAM roles