CODEWITHSUNDEEP
amazon-web-servicesaws-organizations
夢のの夢
夢のの夢

Reputation: 5816

As a management account/delegated admin in a AWS Organization, how to call AWS services for each member account in AWS SDK?

Say I set up a AWS organization from account 111111111111, and then I create/invite 2 accounts, 222222222222 and 33333333333. As soon as I enabled SCP, I see a FullAWSAccess Policy attached to all members. I am trying to update each account programmatically in AWS SDK, and not having to switch roles on Console each time. For example:

AWSOrganizations client = AWSOrganizationsClientBuilder.standard().build();
ListAccountsResult result = client.listAccounts(new ListAccountsRequest().withMaxResults(10))
result.getAccounts()
      .stream()
      .forEach(account -> {
          // I am not sure what to do with below data
          // account.getArn()
          // account.getId()
      })

Say I want each member to put a s3 object like so:

s3.putObject(..)

Do I need to assume a role (AWS creates a OrganizationAccountAccessRole role by default) for each member account and call AWS service? Or am I missing something?

Upvotes: 1

Views: 457

Answers (1)

b.b3rn4rd
b.b3rn4rd

Reputation: 8830

Your assumption is correct, in order to execute actions in other member accounts you need to assume a role in that account first. AWS Organizations creates OrganizationAccountAccessRole in each newly created account, this role has a trust policy to trust the master account. So as long as you're authenticated to the master account with any role that has sts:AssumeRole action you can assume OrganizationAccountAccessRole in the target account and do the "needfuls".

As the best practise you should your own automation role in each account and a dedicated automation account. This automation role lets say "pipeline-role" will have limited permissions that can be assumed only from your automation account.

This way you're reducing the need to utilise your master account and also making this automation role only as powerful as your automation needs instead of using the full AdministratorAccess policy.

Upvotes: 1

Related Questions