I enabled AWS Organizations and created two new users. I then created an OU and put both users in the OU with no policies attached to either account or OU.

User 1 logged in and created Aurora and EC2 instances. Neither the root account or the User2 account can see any of the instances. I have confirmed that I am in the correct region that they were created in. The root account can see the instances in billing. What has to happen to allow the other accounts to see and access the instances?

What do I need to do to see the Aurora and EC2 instances?

Many thanks

  • I don't think that's the idea behind Organizations. They're still different AWS accounts. May 2, 2017 at 3:30

2 Answers 2


This is a little late, but might be useful for future readers.

The main benefits of AWS Organizations are that you can use it for consolidated billing (i.e. one bill for multiple accounts), logical groups of accounts and service control policies, which limit Access to certain parts of the AWS API on the Basis of a Black- or a Whitelist. Each account in an Organization still has their own users, roles, permissions and resources.

Short form: Organizations make it easier to manage multiple accounts, but these accounts are still isolated.

There are a few patterns to give access to resources in "child" accounts to IAM Users in the Root Account - they mostly depend on Assuming Roles in the child-Accounts with Users in the Root Account.

Here are some links for further research:


No You can't. Even you're are have root AWS organization access. You couldn't access other user's account, because it's a different root AWS account.

I think this is a little complicated.

The best way to avoid this problem is to create other users as IAM users, then they should share the same given resource.

In case this already happening as also in my case.

  1. Access as root user
  2. Select IAM Menu then select Roles
  3. Create A New Role
  4. Select Another AWS Account as your trusted entity
  5. Set Access Permission for that account to access your resources, such as S3FullAccess.

These steps should work. Reference:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .