CODEWITHSUNDEEP
pythonamazon-web-servicesboto3
tavor999
tavor999

Reputation: 477

boto3 EC2 client for each sub account

I am trying to use the python boto3 AWS SDK to loop through sub accounts to determine in-use CIDR ranges for VPCs. From the root account I can see all the sub accounts using the following:

organizations = boto3.client('organizations')
response = organizations.list_accounts_for_parent(
    ParentId='FOO'
)

I would then like to use the EC2 -> describe_vpcs to identify in-use CIDR ranges. Can someone give me some advice on connecting these two pieces?

Upvotes: 1

Views: 591

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269666

Your code would need to assume a role in each sub-account. This will then provide temporary credentials that can be used to make API calls in the sub-account.

From Accessing and Administering the Member Accounts in Your Organization - AWS Organizations:

When you create an account in your organization, AWS Organizations automatically creates a root user and an IAM role for the account. ... If you create an account in your organization, you can access the account by using the preconfigured role that exists in all new accounts that are created this way.

...

When you create a member account using the AWS Organizations console, AWS Organizations automatically creates an IAM role in the account. This role has full administrative permissions in the member account. The role is also configured to grant that access to the organization's master account.

Upvotes: 2

Related Questions