Enable trusted access with Amazon Organizations - Amazon CloudFormation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Enable trusted access with Amazon Organizations

To set up the required permissions to create a stack set with self-managed permissions, see Grant self-managed permissions.

Before you create a stack set with service-managed permissions, you must first complete the following tasks:

  • Enable all features in Amazon Organizations. With only consolidated billing features enabled, you cannot create a stack set with service-managed permissions.

  • Enable trusted access with Amazon Organizations. After trusted access is enabled, StackSets creates the necessary IAM roles in the organization's management account and target (member) accounts when you create stack sets with service-managed permissions.

    Note

    The IAM service-linked role created in the management account has the suffix CloudFormationStackSetsOrgAdmin. You can modify or delete this role only if trusted access with Amazon Organizations is disabled. The IAM service-linked role created in each target account has the suffix CloudFormationStackSetsOrgMember. You can modify or delete this role only if trusted access with Amazon Organizations is disabled, or if the account is removed from the target organization or organizational unit (OU).

This topic describes how to manage trusted access with Amazon Organizations.

Note

Enabling trusted access with Amazon Organizations for Amazon CloudFormation StackSets isn't currently supported in the China Beijing and Ningxia Regions.

Only an account administrator in the management account has permissions to enable trusted access. An administrator user is an IAM user with full permissions to your Amazon account. For more information, see IAM best practices and Creating your first IAM admin user and group in the IAM User Guide.

With trusted access enabled, the management account and delegated administrator accounts can create and manage service-managed stack sets for their organization.

To enable trusted access in the Create StackSet wizard

See Create a stack set with service-managed permissions.

To enable trusted access using the Amazon CloudFormation console

  1. Sign in to Amazon as an administrator of the management account and open the Amazon CloudFormation console at https://console.amazonaws.cn/.

  2. From the navigation pane, choose StackSets. If trusted access is disabled, a banner displays that prompts you to enable trusted access.

    
                        Enable trusted access banner.
  3. Choose Enable trusted access.

    Trusted access is successfully enabled when the following banner displays.

    
                        Trusted access is successfully enabled banner.

To enable trusted access in the Trusted access for Amazon services page of the Amazon Organizations console

See Amazon CloudFormation StackSets and Amazon Organizations in the Amazon Organizations User Guide.

To disable trusted access

See Amazon CloudFormation StackSets and Amazon Organizations in the Amazon Organizations User Guide.

Before you can disable trusted access with Amazon Organizations, you must deregister all delegated administrators. For more information, see Register a delegated administrator.