Managing access permissions for your Amazon organization

The root and the OUs that make up the hierarchical structure of an organization

The accounts that are members of the organization

The policies that you attach to the entities in the organization

The handshakes that you use to change the state of the organization

aws:PrincipalOrgID – Simplifies specifying the Principal element in a resource-based policy. This global key provides an alternative to listing all the account IDs for all Amazon Web Services accounts in an organization. Instead of listing all of the accounts that are members of an organization, you can specify the organization ID in the Condition element.

For more information, see the description of PrincipalOrgID in Amazon global condition context keys in the IAM User Guide.

aws:PrincipalOrgPaths – Use this condition key to match members of a specific organization root, an OU, or its children. The aws:PrincipalOrgPaths condition key returns true when the principal (root user, IAM user, or role) making the request is in the specified organization path. A path is a text representation of the structure of an Amazon Organizations entity. For more information about paths, see Understand the Amazon Organizations entity path in the IAM User Guide. For more information about using this condition key, see aws:PrincipalOrgPaths in the IAM User Guide.

For example, the following condition element matches for members of either of two OUs in the same organization.

            "Condition": {
                "ForAnyValue:StringLike": {
                    "aws:PrincipalOrgPaths": [
                        "o-a1b2c3d4e5/r-f6g7h8i9j0example/ou-def0-awsbbbbb/",
                        "o-a1b2c3d4e5/r-f6g7h8i9j0example/ou-jkl0-awsddddd/"
                    ]
                }
            }

organizations:PolicyType – You can use this condition key to restrict the Organizations policy-related API operations to work on only Organizations policies of the specified type. You can apply this condition key to any policy statement that includes an action that interacts with Organizations policies.

You can use the following values with this condition key:

For example, the following example policy allows the user to perform any Organizations operation. However, if the user performs an operation that takes a policy argument, the operation is allowed only if the specified policy is a tagging policy. The operation fails if the user specifies any other type of policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IfTaggingAPIThenAllowOnOnlyTaggingPolicies",
            "Effect": "Allow",
            "Action": "organizations:*",
            "Resource": "*",
            "Condition": { 
                "StringLikeIfExists": {
                    "organizations:PolicyType": [ "TAG_POLICY" ]
                }
            }
        }
    ]
}

organizations:ServicePrincipal – Available as a condition if you use the EnableAWSServiceAccess or DisableAWSServiceAccess operations to enable or disable trusted access with other Amazon services. You can use organizations:ServicePrincipal to restrict requests that those operations make to a list of approved service principal names.

For example, the following policy allows the user to specify only Amazon Firewall Manager when enabling and disabling trusted access with Amazon Organizations.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowOnlyAWSFirewallIntegration",
            "Effect": "Allow",
            "Action": [
                "organizations:EnableAWSServiceAccess",
                "organizations:DisableAWSServiceAccess"
            ],
            "Resource": "*",
            "Condition": { 
                "StringLikeIfExists": {
                    "organizations:ServicePrincipal": [ "fms.amazonaws.com" ]
                }
            }
        }
    ]
}

If you use the root account credentials of your management account to create an OU, your management account is the owner of the resource. (In Amazon Organizations, the resource is the OU.)

If you create an IAM user in your management account and grant permissions to create an OU to that user, the user can create an OU. However, the management account, to which the user belongs, owns the OU resource.

If you create an IAM role in your management account with permissions to create an OU, anyone who can assume the role can create an OU. The management account, to which the role (not the assuming user) belongs, owns the OU resource.

Attach a permissions policy to a user or a group in your account – To grant a user permissions to create an Amazon Organizations resource, such as a service control policy (SCP) or an OU, you can attach a permissions policy to a user or a group that the user belongs to. The user or group must be in the organization's management account.

Attach a permissions policy to a role (grant cross-account permissions) – You can attach an identity-based permissions policy to an IAM role to grant cross-account access to an organization. For example, the administrator in the management account can create a role to grant cross-account permissions to a user in a member account as follows:

For more information about using IAM to delegate permissions, see Access Management in the IAM User Guide.

AttachPolicy and DetachPolicy

CreateOrganizationalUnit and DeleteOrganizationalUnit

ListOrganizationalUnits and DescribeOrganizationalUnit

Action – Use this keyword to identify the operations (actions) that you want to allow or deny. For example, depending on the specified Effect, organizations:CreateAccount allows or denies the user permissions to perform the Amazon Organizations CreateAccount operation. For more information, see IAM JSON policy elements: Action in the IAM User Guide.

Resource – Use this keyword to specify the ARN of the resource that the policy statement applies to. For more information, see IAM JSON policy elements: Resource in the IAM User Guide.

Condition – Use this keyword to specify a condition that must be met for the policy statement to apply. Condition usually specifies additional circumstances that must be true for the policy to match. For more information, see IAM JSON policy elements: Condition in the IAM User Guide.

Effect – Use this keyword to specify whether the policy statement allows or denies the action on the resource. If you don't explicitly grant access to (or allow) a resource, access is implicitly denied. You also can explicitly deny access to a resource, which you might do to ensure that a user can't perform the specified action on the specified resource, even if a different policy grants access. For more information, see IAM JSON policy elements: Effect in the IAM User Guide.

Principal – In identity-based policies (IAM policies), the user that the policy is attached to is automatically and implicitly the principal. For resource-based policies, you specify the user, account, service, or other entity that you want to receive permissions (applies to resource-based policies only). Amazon Organizations currently supports only identity-based policies, not resource-based policies.