3

I enabled AWS Organizations and created two new users. I then created an OU and put both users in the OU with no policies attached to either account or OU.

User 1 logged in and created Aurora and EC2 instances. Neither the root account or the User2 account can see any of the instances. I have confirmed that I am in the correct region that they were created in. The root account can see the instances in billing. What has to happen to allow the other accounts to see and access the instances?

What do I need to do to see the Aurora and EC2 instances?

Many thanks

  • I don't think that's the idea behind Organizations. They're still different AWS accounts. – Michael - sqlbot May 2 '17 at 3:30
0

This is a little late, but might be useful for future readers.

The main benefits of AWS Organizations are that you can use it for consolidated billing (i.e. one bill for multiple accounts), logical groups of accounts and service control policies, which limit Access to certain parts of the AWS API on the Basis of a Black- or a Whitelist. Each account in an Organization still has their own users, roles, permissions and resources.

Short form: Organizations make it easier to manage multiple accounts, but these accounts are still isolated.

There are a few patterns to give access to resources in "child" accounts to IAM Users in the Root Account - they mostly depend on Assuming Roles in the child-Accounts with Users in the Root Account.

Here are some links for further research:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.