Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions,
see Getting Started with Amazon Web Services in China
(PDF).
Accepting or declining account invitations with Amazon Organizations
If you receive an invitation to join an organization, you can accept
or decline the invitation.
Considerations
An account's status with an organization affects what cost and usage data is visible
A member account can leave an organization and become a standalone account.
It then loses access to cost and usage data from its time in the organization.
It can see only the data that it creates as a standalone account.
A member account can leave organization A to join organization B. It then loses access to cost and usage data
from its time in organization A. It can see only the data that it creates as a member of organization B.
If an account rejoins an organization that it was in before, it gets back access to its past cost and usage data.
Only member accounts and standalone accounts can accept or decline an invitation
Only member accounts and standalone accounts can accept or decline an invitation
to join an organization. A management account that is already part of an organization
can't see an invitation. To see it, that account must first remove all member accounts from its
organization. Then it must delete the
organization.
CloudTrail logging takes place in the account taking the action
When a member account or standalone account accepts or declines an invitation, CloudTrail logs the action in that account. If that account is a member account, the management account's CloudTrail logs don't show the action. Other CloudTrail actions work the same way. For example, CloudTrail logs a member account leaving an organization in that account's trail, and logs the management account removing a member account in the management account's trail.
Accept or decline to an account invitation
To accept
or decline the invitation, complete the following steps.
To accept or decline an invitation to join an organization, you must have
the following permissions:
-
organizations:ListHandshakesForAccount – Required to
see the list of invitations in the Amazon Organizations console.
-
organizations:AcceptHandshake.
-
organizations:DeclineHandshake.
-
organizations:LeaveOrganization – Required only when
your account is already a member of an organization.
If a service control policy
(SCP) in your current organization denies this action, you can't
accept the invitation.
-
iam:CreateServiceLinkedRole – Required only when
accepting the invitation creates a service-linked role in the member
account. This role supports integration with other Amazon Web Services services. For
more information, see Amazon Organizations and service-linked roles.
- Amazon Web Services Management Console
-
To accept or decline an invitation
-
Amazon sends the invitation to the email address of the account
owner. If you get an invitation email, follow the instructions in
the email. You can also open the member account's Invitation page directly
in your browser.
-
If prompted, sign in to the invited account as an IAM user,
assume an IAM role, or sign in as the account's root user (not recommended).
-
The member account's Invitation page displays your account's open
invitations to join organizations.
Choose Accept invitation or Decline
invitation as appropriate.
-
If you chose Accept invitation, you go to the Organization overview page with details about
the organization that your account is now a member of. You
can view the organization's ID and the owner's email
address.
Accepted invitations continue to appear in the list
for 30 days. After that, they are deleted and no longer
appear in the list.
Amazon Organizations automatically creates a service-linked role in
the new member account to support integration between
Amazon Organizations and other Amazon Web Services services. For more information, see
Amazon Organizations and service-linked roles.
Amazon sends an email message to the owner of the
organization's management account stating that you accepted
the invitation. It also sends an email message to the member
account owner stating that the account is now a member of
the organization.
-
If you chose Decline, your account remains on the
member account's Invitation page that lists any other pending
invitations.
Amazon sends an email message to the organization's
management account owner stating that you declined the
invitation.
Declined invitations continue to appear in the list
for 30 days. After that, they are deleted and no longer
appear in the list.
- Amazon CLI & Amazon SDKs
-
To accept or decline an invitation
You can use the following commands to accept or decline an
invitation:
-
Amazon CLI: accept-handshake, decline-handshake
The following example shows how to accept an invitation to join an
organization.
$ aws organizations accept-handshake --handshake-id h-examplehandshakeid111
{
"Handshake": {
"Action": "INVITE",
"Arn": "arn:aws:organizations::111111111111:handshake/o-exampleorgid/invite/h-examplehandshakeid111",
"RequestedTimestamp": 1481656459.257,
"ExpirationTimestamp": 1482952459.257,
"Id": "h-examplehandshakeid111",
"Parties": [
{
"Id": "o-exampleorgid",
"Type": "ORGANIZATION"
},
{
"Id": "juan@example.com",
"Type": "EMAIL"
}
],
"Resources": [
{
"Resources": [
{
"Type": "MASTER_EMAIL",
"Value": "bill@example.com"
},
{
"Type": "MASTER_NAME",
"Value": "Management Account"
},
{
"Type": "ORGANIZATION_FEATURE_SET",
"Value": "ALL"
}
],
"Type": "ORGANIZATION",
"Value": "o-exampleorgid"
},
{
"Type": "EMAIL",
"Value": "juan@example.com"
}
],
"State": "ACCEPTED"
}
}
The following example shows how to decline an invitation to join
an organization.
-
Amazon SDKs: AcceptHandshake, DeclineHandshake