Creating an organization - Amazon Organizations
Create an organizationEmail address verification
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Creating an organization

You can create an organization that starts with your Amazon Web Services account as the management account. When you create an organization, you can choose whether the organization supports all features (recommended) or only consolidated billing features.

After creating an organization, you can add accounts to your organization in these ways from the management account:

Create an organization

You can create an organization by using either the Amazon Web Services Management Console or by using a command from the Amazon CLI or one of the SDK APIs.

Minimum permissions

To create an organization with your current Amazon Web Services account, you must have the following permissions:

  • organizations:CreateOrganization

  • iam:CreateServiceLinkedRole

    You can restrict this permission to only the service principal organizations.amazonaws.com.

To create an organization

  1. Sign in to the Amazon Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.

  2. By default, the organization is created with all features enabled. However, you can choose either of the following steps:

    • To create an organization with all features enabled, on the introduction page, choose Create an organization.

    • To create an organization with Consolidated Billing features only, on the introduction page and under Create an organization, choose consolidated billing features, and then in the confirmation dialog box, choose Create an organization.

    If you accidentally choose the wrong option, you can immediately go to the Settings page, and then choose Delete organization and start over.

  3. The organization is created and the Amazon Web Services accounts page appears. The only account present is your management account, and it's currently stored in the root organizational unit (OU).

    If required, Organizations automatically sends a verification email to the address that is associated with your management account. There might be a delay before you receive the verification email. Verify your email address within 24 hours. For more information, see Email address verification. You can create accounts to grow your organization without verifying your management account's email address. However, to invite existing accounts, you must first complete email verification.

    Note

    If this account previously verified its email address, then it doesn't happen again when you use the account to create an organization.

The following code examples show how to use CreateOrganization.

.NET
Amazon SDK for .NET
Note

There's more on GitHub. Find the complete example and learn how to set up and run in the Amazon Code Examples Repository. 

    using System;
    using System.Threading.Tasks;
    using Amazon.Organizations;
    using Amazon.Organizations.Model;

    /// <summary>
    /// Creates an organization in AWS Organizations.
    /// </summary>
    public class CreateOrganization
    {
        /// <summary>
        /// Creates an Organizations client object and then uses it to create
        /// a new organization with the default user as the administrator, and
        /// then displays information about the new organization.
        /// </summary>
        public static async Task Main()
        {
            IAmazonOrganizations client = new AmazonOrganizationsClient();

            var response = await client.CreateOrganizationAsync(new CreateOrganizationRequest
            {
                FeatureSet = "ALL",
            });

            Organization newOrg = response.Organization;

            Console.WriteLine($"Organization: {newOrg.Id} Main Accoount: {newOrg.MasterAccountId}");
        }
    }
CLI
Amazon CLI

Example 1: To create a new organization

Bill wants to create an organization using credentials from account 111111111111. The following example shows that the account becomes the master account in the new organization. Because he does not specify a features set, the new organization defaults to all features enabled and service control policies are enabled on the root.

aws organizations create-organization

The output includes an organization object with details about the new organization:

{
        "Organization": {
                "AvailablePolicyTypes": [
                        {
                                "Status": "ENABLED",
                                "Type": "SERVICE_CONTROL_POLICY"
                        }
                ],
                "MasterAccountId": "111111111111",
                "MasterAccountArn": "arn:aws:organizations::111111111111:account/o-exampleorgid/111111111111",
                "MasterAccountEmail": "bill@example.com",
                "FeatureSet": "ALL",
                "Id": "o-exampleorgid",
                "Arn": "arn:aws:organizations::111111111111:organization/o-exampleorgid"
        }
}

Example 2: To create a new organization with only consolidated billing features enabled

The following example creates an organization that supports only the consolidated billing features:

aws organizations create-organization --feature-set CONSOLIDATED_BILLING

The output includes an organization object with details about the new organization:

{
        "Organization": {
                "Arn": "arn:aws:organizations::111111111111:organization/o-exampleorgid",
                "AvailablePolicyTypes": [],
                "Id": "o-exampleorgid",
                "MasterAccountArn": "arn:aws:organizations::111111111111:account/o-exampleorgid/111111111111",
                "MasterAccountEmail": "bill@example.com",
                "MasterAccountId": "111111111111",
                "FeatureSet": "CONSOLIDATED_BILLING"
        }
}

For more information, see Creating an Organization in the Amazon Organizations Users Guide.

Now you can add additional accounts to your organization as follows:

Email address verification

After you create an organization and before you can invite accounts to join, you must verify that you own the email address provided for the management account in the organization.

When you create an organization, if the management account has not been previously verified, Amazon automatically sends a verification email to the specified email address. There might be a delay before you receive the verification email.

Within 24 hours, follow the instructions in the email to verify your email address.

If you don't verify your email address within 24 hours, you can resend the verification request so that you can invite other Amazon Web Services accounts to your organization. If you don't receive the verification email, check that your email address is correct and, if necessary, modify it.

Amazon Web Services Management Console
To resend the verification request

  1. Sign in to the Amazon Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.

  2. Navigate to the Settings page and then choose Send verification request. The option is only present if the management account is not verified.

  3. Verify your email address within 24 hours.

    After verifying your email address, you can invite other Amazon Web Services accounts to your organization. For more information, see Inviting an Amazon Web Services account to join your organization.

If you change the email address of the management account, the account's status reverts to "email unverified," and you must complete the verification process for your new email address.

Note

If you invited accounts to join your organization before you changed the management account's email address and those invitations have not yet been accepted, they can’t be accepted until you verify the management account’s new email address. Use the previous procedure to resend the verification request. After you complete the process by responding to the email, your invited accounts can accept the invitations.