Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions,
see Getting Started with Amazon Web Services in China
(PDF).
Amazon Account Management and
Amazon Organizations
Amazon Account Management helps you manage the account information and metadata for all of the
Amazon Web Services accounts in your organization. You can set, modify, or delete the alternate contact
information for each of your organization's member accounts. For more information, see
Using
Amazon Account Management in your organization in the Amazon Account Management User
Guide.
Use the following information to help you integrate
Amazon Account Management with Amazon Organizations.
To enable trusted access with
Account Management
For information about the permissions needed to enable trusted
access, see Permissions required to enable trusted
access.
Account Management requires trusted access to Amazon Organizations before you can designate a
member account to be the delegated administrator for this service for your
organization.
You can enable trusted access using only the Organizations
tools.
You can enable trusted access by using either
the Amazon Organizations console, by running a Amazon CLI command, or by calling an API operation in
one of the Amazon SDKs.
- Amazon Web Services Management Console
-
To enable trusted service access using the Organizations console
-
Sign in to the Amazon Organizations console. You must sign in as an IAM user, assume an IAM role, or
sign in as the root user (not
recommended) in the organization’s management account.
-
In the navigation pane, choose Services.
-
Choose Amazon Account Management in the list of services.
-
Choose Enable trusted access.
-
In the Enable trusted access for Amazon Account Management dialog
box, type enable to confirm it, and then choose Enable trusted
access.
-
If you are the administrator of only Amazon Organizations, tell the
administrator of Amazon Account Management that they can now enable that service
using its console to work with Amazon Organizations.
- Amazon CLI, Amazon API
-
To enable trusted service access using the OrganizationsCLI/SDK
You can use the following Amazon CLI commands or API operations to enable
trusted service access:
-
Amazon CLI: enable-aws-service-access
You can run the following command to enable Amazon Account Management as a
trusted service with Organizations.
$
aws organizations enable-aws-service-access \
--service-principal account.amazonaws.com
This command produces no output when successful.
-
Amazon API: EnableAWSServiceAccess
To disable trusted access with
Account Management
For information about the permissions needed to disable trusted
access, see Permissions required to disable
trusted access.
Only an administrator in the Amazon Organizations management account can disable trusted access
with Amazon Account Management.
You can disable trusted access using only the Organizations
tools.
You can disable trusted access by using either the Amazon Organizations console,
by running an Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.
- Amazon Web Services Management Console
-
To disable trusted service access using the Organizations console
-
Sign in to the Amazon Organizations console. You must sign in as an IAM user, assume an IAM role, or
sign in as the root user (not
recommended) in the organization’s management account.
-
In the navigation pane, choose Services.
-
Choose Amazon Account Management in the list of services.
-
Choose Disable trusted access.
-
In the Disable trusted access for Amazon Account Management dialog
box, type disable to confirm it, and then choose Disable trusted
access.
-
If you are the administrator of only Amazon Organizations, tell the
administrator of Amazon Account Management that they can now disable that service
using its console or tools from working with Amazon Organizations.
- Amazon CLI, Amazon API
-
To disable trusted service access using the Organizations CLI/SDK
You can use the following Amazon CLI commands or API operations to disable
trusted service access:
-
Amazon CLI: disable-aws-service-access
You can run the following command to disable Amazon Account Management as a
trusted service with Organizations.
$
aws organizations disable-aws-service-access \
--service-principal account.amazonaws.com
This command produces no output when successful.
-
Amazon API: DisableAWSServiceAccess
Enabling a delegated administrator
account for Account Management
When you designate a member account to be a delegated administrator for the
organization, users and roles from the designated account can manage the Amazon Web Services account
metadata for other member accounts in the organization. If you don't enable a delegated
admin account, then these tasks can be performed only by the organization's management
account. This helps you to separate management of the organization from management of
your account details.
Only a user or role in the Organizations management account can configure a member account
as a delegated administrator for Account Management in the organization
For general instructions on how to configure a delegation policy, see Create or update a resource-based delegation
policy.
- Amazon CLI, Amazon API
-
If you want to configure a delegated administrator account using the Amazon
CLI or one of the Amazon SDKs, you can use the following commands:
-
Amazon CLI:
$
aws organizations register-delegated-administrator \
--account-id 123456789012 \
--service-principal account.amazonaws.com
-
Amazon SDK: Call the Organizations
RegisterDelegatedAdministrator
operation and the
member account's ID number and identify the account service
principal account.amazonaws.com
as parameters.