Amazon managed policies available for use with Amazon Organizations
This section identifies the Amazon-managed policies provided for your use to manage your organization. You can't modify or delete an Amazon managed policy, but you can attach or detach them to entities in your organization as needed.
Amazon Organizations managed policies for use with Amazon Identity and Access Management (IAM)
An IAM managed policy is provided and maintained by Amazon. A managed policy provides
permissions for common tasks that you can assign to your users by attaching the managed
policy to the appropriate IAM user or role object. You don't have to write the policy
yourself, and when Amazon updates the policy as appropriate to support new services, you
automatically and immediately get the benefit of the update. You can see the list of
Amazon managed policies in Policies
You can use the following managed policies to grant permissions to users in your organization.
Policy name | Description | ARN |
---|---|---|
AWSOrganizationsFullAccess |
Provides all of the permissions required to create and fully
administer an organization. The content of this policy statement is
shown in the following snippet:
|
arn:aws-cn:iam::aws:policy/AWSOrganizationsFullAccess |
AWSOrganizationsReadOnlyAccess |
Provides read only access to information about the organization. It
doesn't permit the user to make any changes. The content of this policy
statement is shown in the following snippet:
|
arn:aws-cn:iam::aws:policy/AWSOrganizationsReadOnlyAccess |
Updates to Organizations Amazon managed policies
The following table details updates to Amazon managed policies since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the Amazon Organizations Document History page.
Change | Description | Date |
---|---|---|
AWSOrganizationsReadOnlyAccess |
Organizations added the |
June 6, 2024 |
AWSOrganizationsFullAccess |
Organizations added |
February 6, 2024 |
AWSOrganizationsReadOnlyAccess |
Organizations added |
February 6, 2024 |
AWSOrganizationsFullAccess |
Organizations added the |
December 22, 2022 |
AWSOrganizationsReadOnlyAccess |
Organizations added the |
December 22, 2022 |
AWSOrganizationsFullAccess |
Organizations added the |
October 21, 2022 |
AWSOrganizationsReadOnlyAccess |
Organizations added the |
October 21, 2022 |
AWSOrganizationsFullAccess |
Organizations added the |
August 24, 2022 |
AWSOrganizationsFullAccess |
Organizations added the |
February 22, 2022 |
AWSOrganizationsReadOnlyAccess |
Organizations added the |
February 22, 2022 |
Amazon Organizations managed service control policies
Service control policies (SCPs) are
similar to IAM permission policies, but are a feature of Amazon Organizations rather than IAM.
You use SCPs to specify maximum permissions for affected entities. You can attach SCPs
to roots, organizational units (OUs), or accounts in your organization. You can create
your own, or you can use the policies that IAM defines. You can see the list of
policies in your organization on the Policies
Important
Every root, OU, and account must have at least one SCP attached at all times.
Policy name | Description | ARN |
---|---|---|
FullAWSAccess |
Provides Amazon Organizations management account access to member accounts. | arn:aws-cn:organizations::aws:policy/service_control_policy/p-FullAWSAccess |