Organizations
Prefix organizations, 63 actions · Domain Management & Governance
90 AWS managed policies. 7 have reviewed guidance; the rest have authoritative permission data pending editorial review. 47 are service-linked role policies, shown with permission data only.
User access (19)
- AmazonEKSDashboardConsoleReadOnlyReader
- AmazonGuardDutyReadOnlyAccessReader
- AmazonInspector2FullAccess_v2Admin
- AmazonInspector2ReadOnlyAccessReader
- AWSArtifactAgreementsReadOnlyAccessReader
- AWSAuditManagerAdministratorAccessAdmin
- AWSBillingConductorFullAccessAdmin
- AWSBillingConductorReadOnlyAccessReader
- AWSBudgetsActionsWithAWSResourceControlAccessAdmin
- AWSManagedSettingsAdminAccessAdmin
- AWSManagedSettingsReadOnlyAccessReader
- AWSOrganizationsFullAccessHigh privilegeAdmin
- AWSOrganizationsReadOnlyAccessReader
- AWSResourceExplorerOrganizationsAccessAdmin
- AWSSecurityIncidentResponseFullAccessAdmin
- AWSTrustedAdvisorPriorityReadOnlyAccessReader
- IAMAccessAdvisorReadOnlyReader
- IAMAccessAnalyzerFullAccessAdmin
- WellArchitectedConsoleReadOnlyAccessReader
Operator and limited (19)
- AIDevOpsOrganizationsAccessPolicyOperator
- AmazonDetectiveOrganizationsAccessOperator
- AmazonDevOpsGuruOrganizationsAccessOperator
- AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicyOperator
- AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicyOperator
- AWSArtifactAgreementsFullAccessOperator
- AWSBackupOrganizationAdminAccessOperator
- AWSHealthFullAccessOperator
- AWSLakeFormationCrossAccountManagerOperator
- AWSManagedBudgetsSpendLimitManagementAccessOperator
- AWSManagedControlPolicyManagementAccessHigh privilegeOperator
- AWSMarketplaceProcurementSystemAdminFullAccessOperator
- AWSPrivateMarketplaceAdminFullAccessOperator
- AWSSecurityHubOrganizationsAccessOperator
- AWSSSOReadOnlyOperator
- AWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicyOperator
- AWSTransformLandingZoneAgentPolicyOperator
- AWSTrustedAdvisorPriorityFullAccessOperator
- CostOptimizationHubAdminAccessOperator
Service roles (5)
Service-linked roles (47)
- AccessAnalyzerServiceRolePolicyReader
- AccountAccessManagerServiceRolePolicyReader
- AmazonDetectiveServiceLinkedRolePolicyReader
- AmazonEKSDashboardServiceRolePolicyReader
- AmazonInspector2AmiScanServiceRolePolicyOperator
- AWSAgentRegistryServiceRolePolicyOperator
- AWSArtifactServiceRolePolicyReader
- AWSBillingConductorRolePolicyOperator
- AWSCODAServiceRolePolicyReader
- AWSConfigMultiAccountSetupPolicyOperator
- AWSDataExchangeServiceRolePolicyForLicenseManagementOperator
- AWSDataExchangeServiceRolePolicyForOrganizationDiscoveryReader
- AWSEC2CapacityManagerServiceRolePolicyReader
- AWSIPAMServiceRolePolicyOperator
- AWSLicenseManagerLinuxSubscriptionsServiceRolePolicyOperator
- AWSLicenseManagerMasterAccountRolePolicyOperator
- AWSManagedServices_SelfServiceReporting_ServiceRolePolicyReader
- AWSMarketplaceLicenseManagementServiceRolePolicyOperator
- AWSNetworkManagerServiceRolePolicyReader
- AWSObservabilityAdminServiceRolePolicyOperator
- AWSResilienceHubServiceRolePolicyReader
- AWSResourceAccessManagerServiceRolePolicyOperator
- AWSSecurityHubServiceRolePolicyOperator
- AWSSecurityHubV2ServiceRolePolicyOperator
- AWSSecurityIncidentResponseServiceRolePolicyOperator
- AWSServiceCatalogOrgsDataSyncServiceRolePolicyReader
- AWSServiceRoleForPrivateMarketplaceAdminPolicyOperator
- AWSServiceRoleForProcurementInsightsPolicyReader
- AWSSSOServiceRolePolicyOperator
- AWSSupportPlansServiceRolePolicyAdmin
- AWSSystemsManagerAccountDiscoveryServicePolicyReader
- AWSTrustedAdvisorReportingServiceRolePolicyReader
- AWSUserNotificationsServiceLinkedRolePolicyOperator
- AWSWellArchitectedAgentOrganizationsServiceRolePolicyReader
- AWSWellArchitectedOrganizationsServiceRolePolicyReader
- AWSZoneGroupAccessManagementServiceRolePolicyReader
- CloudFormationStackSetsOrgAdminServiceRolePolicyOperator
- CloudWatchNetworkFlowMonitorServiceRolePolicyOperator
- ComputeOptimizerServiceRolePolicyAdmin
- CostOptimizationHubServiceRolePolicyReader
- Health_OrganizationsServiceRolePolicyReader
- NetworkSecurityDirectorServiceLinkedRolePolicyOperator
- S3StorageLensServiceRolePolicyReader
- SecurityLakeServiceLinkedRoleOperator
- SplitCostAllocationDataServiceRolePolicyReader
- SSMQuickSetupRolePolicyOperator
- WAFV2LoggingServiceRolePolicyOperator
Also grants Organizations actions (72)
- AdministratorAccess
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AIOpsConsoleAdminPolicy
- AmazonDataZoneGlueManageAccessRolePolicy
- AmazonDataZoneProjectRolePermissionsBoundary
- AmazonDetectiveFullAccess
- AmazonDetectiveInvestigatorAccess
- AmazonDevOpsGuruServiceRolePolicy
- AmazonGuardDutyFullAccess
- AmazonGuardDutyFullAccess_v2
- AmazonGuardDutyServiceRolePolicy
- AmazonInspector2FullAccess
- AmazonInspector2ServiceRolePolicy
- AmazonMacieServiceRolePolicy
- AmazonMonitronFullAccess
- AmazonQuickSuiteAccessPolicy
- AmazonSecurityLakeAdministrator
- AmazonSSMServiceRolePolicy
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSApplicationMigrationServiceRolePolicy
- AWSAuditManagerServiceRolePolicy
- AWSBackupFullAccess
- AWSBackupOperatorAccess
- AWSBackupServiceLinkedRolePolicyForBackup
- AWSBudgetsSpendLimitMemberRolePolicy
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSControlTowerAccountServiceRolePolicy
- AWSDirectoryServiceFullAccess
- AWSDirectoryServiceReadOnlyAccess
- AWSFinOpsAgentServiceRolePolicy
- AWSFMAdminFullAccess
- AWSFMAdminReadOnlyAccess
- AWSFMMemberReadOnlyAccess
- AWSLicenseManagerServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSMigrationHubRefactorSpaces-EnvironmentsWithoutBridgesFullAccess
- AWSMigrationHubRefactorSpacesFullAccess
- AWSReachabilityAnalyzerServiceRolePolicy
- AWSResourceExplorerFullAccess
- AWSResourceExplorerReadOnlyAccess
- AWSResourceExplorerServiceRolePolicy
- AWSServiceRoleForUserSubscriptions
- AWSSSOMasterAccountAdministrator
- AWSSSOMemberAccountAdministrator
- AWSSupportServiceRolePolicy
- AWSTransformNetworkMigrationAgentPolicy
- AWSTransformServerMigrationAgentPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudTrailServiceRolePolicy
- CloudWatchOmniAWSIntegrationPolicy
- ComputeOptimizerReadOnlyAccess
- FinOpsAgentAgentPolicy
- FMSServiceRolePolicy
- IAMFullAccess
- MultiPartyApprovalFullAccess
- MultiPartyApprovalReadOnlyAccess
- NetworkSecurityManagerServiceRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SecurityAudit
- ServiceQuotasFullAccess
- ServiceQuotasReadOnlyAccess
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
- WellArchitectedConsoleFullAccess
accepthandshake attachpolicy cancelhandshake closeaccount createaccount creategovcloudaccount createorganization createorganizationalunit createpolicy declinehandshake deleteorganization deleteorganizationalunit deletepolicy deleteresourcepolicy deregisterdelegatedadministrator describeaccount describecreateaccountstatus describeeffectivepolicy describehandshake describeorganization describeorganizationalunit describepolicy describeresourcepolicy describeresponsibilitytransfer detachpolicy disableawsserviceaccess disablepolicytype enableawsserviceaccess enableallfeatures enablepolicytype inviteaccounttoorganization inviteorganizationtotransferresponsibility leaveorganization listawsserviceaccessfororganization listaccounts listaccountsforparent listaccountswithinvalideffectivepolicy listchildren listcreateaccountstatus listdelegatedadministrators listdelegatedservicesforaccount listeffectivepolicyvalidationerrors listhandshakesforaccount listhandshakesfororganization listinboundresponsibilitytransfers listorganizationalunitsforparent listoutboundresponsibilitytransfers listparents listpolicies listpoliciesfortarget listroots listtagsforresource listtargetsforpolicy moveaccount putresourcepolicy registerdelegatedadministrator removeaccountfromorganization tagresource terminateresponsibilitytransfer untagresource updateorganizationalunit updatepolicy updateresponsibilitytransfer
Actions (63)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| organizations:AcceptHandshake | Write | 3 | 1 |
| organizations:AttachPolicy | Permissions management | 4 | 7 |
| organizations:CancelHandshake | Write | 3 | 1 |
| organizations:CloseAccount | Write | 4 | 2 |
| organizations:CreateAccount | Write | 4 | 2 |
| organizations:CreateGovCloudAccount | Write | 3 | 1 |
| organizations:CreateOrganization | Write | 3 | 1 |
| organizations:CreateOrganizationalUnit | Write | 3 | 2 |
| organizations:CreatePolicy | Write | 5 | 5 |
| organizations:DeclineHandshake | Write | 3 | 1 |
| organizations:DeleteOrganization | Write | 3 | 1 |
| organizations:DeleteOrganizationalUnit | Write | 3 | 1 |
| organizations:DeletePolicy | Write | 4 | 4 |
| organizations:DeleteResourcePolicy | Permissions management | 3 | 1 |
| organizations:DeregisterDelegatedAdministrator | Write | 3 | 14 |
| organizations:DescribeAccount | Read | 91 | 12 |
| organizations:DescribeCreateAccountStatus | Read | 16 | 1 |
| organizations:DescribeEffectivePolicy | Read | 19 | 5 |
| organizations:DescribeHandshake | Read | 13 | 1 |
| organizations:DescribeOrganization | Read | 134 | 3 |
| organizations:DescribeOrganizationalUnit | Read | 50 | 7 |
| organizations:DescribePolicy | Read | 22 | 6 |
| organizations:DescribeResourcePolicy | Read | 19 | 2 |
| organizations:DescribeResponsibilityTransfer | Read | 15 | 1 |
| organizations:DetachPolicy | Permissions management | 4 | 5 |
| organizations:DisableAWSServiceAccess | Write | 3 | 10 |
| organizations:DisablePolicyType | Write | 3 | 5 |
| organizations:EnableAWSServiceAccess | Write | 7 | 22 |
| organizations:EnableAllFeatures | Write | 3 | 1 |
| organizations:EnablePolicyType | Write | 3 | 4 |
| organizations:InviteAccountToOrganization | Write | 4 | 1 |
| organizations:InviteOrganizationToTransferResponsibility | Write | 3 | 1 |
| organizations:LeaveOrganization | Write | 3 | 1 |
| organizations:ListAWSServiceAccessForOrganization | List | 81 | 2 |
| organizations:ListAccounts | List | 103 | 3 |
| organizations:ListAccountsForParent | List | 48 | 2 |
| organizations:ListAccountsWithInvalidEffectivePolicy | List | 13 | 1 |
| organizations:ListChildren | List | 58 | 2 |
| organizations:ListCreateAccountStatus | List | 14 | 1 |
| organizations:ListDelegatedAdministrators | List | 63 | 28 |
| organizations:ListDelegatedServicesForAccount | List | 23 | 1 |
| organizations:ListEffectivePolicyValidationErrors | List | 13 | 1 |
| organizations:ListHandshakesForAccount | List | 14 | 1 |
| organizations:ListHandshakesForOrganization | List | 14 | 1 |
| organizations:ListInboundResponsibilityTransfers | List | 15 | 1 |
| organizations:ListOrganizationalUnitsForParent | List | 49 | 4 |
| organizations:ListOutboundResponsibilityTransfers | List | 13 | 1 |
| organizations:ListParents | List | 53 | 3 |
| organizations:ListPolicies | List | 27 | 6 |
| organizations:ListPoliciesForTarget | List | 22 | 3 |
| organizations:ListRoots | List | 63 | 3 |
| organizations:ListTagsForResource | List | 20 | 4 |
| organizations:ListTargetsForPolicy | List | 23 | 3 |
| organizations:MoveAccount | Write | 4 | 2 |
| organizations:PutResourcePolicy | Permissions management | 3 | 1 |
| organizations:RegisterDelegatedAdministrator | Write | 5 | 16 |
| organizations:RemoveAccountFromOrganization | Write | 3 | 1 |
| organizations:TagResource | Tagging | 5 | 4 |
| organizations:TerminateResponsibilityTransfer | Write | 3 | 1 |
| organizations:UntagResource | Tagging | 5 | 2 |
| organizations:UpdateOrganizationalUnit | Write | 3 | 1 |
| organizations:UpdatePolicy | Permissions management | 4 | 5 |
| organizations:UpdateResponsibilityTransfer | Write | 3 | 1 |