Creating a member account in your organization
An organization is a collection of AWS accounts that you centrally manage.
This page describes how to create AWS accounts within your organization in AWS Organizations.
For information about creating a single AWS account, see the Getting Started Resource Center
You can do the following procedures to manage the accounts that are part of your organization:
Considerations before creating a member account
Organizations automatically creates an IAM role for the member account
When you create a member account in your organization, Organizations automatically
creates an AWS Identity and Access Management (IAM) role OrganizationAccountAccessRole
in
the member account that enables users and roles in the management account to
exercise full administrative control over the member account. Any additional accounts attached to the same
managed policy will be updated automatically whenever the policy gets updated. This role is
subject to any service control
policies (SCPs) that apply to the member account.
Organizations automatically creates an service-linked role for the member account
When you create a member account in your organization, Organizations automatically, automatically creates service-linked role
AWSServiceRoleForOrganizations
in the member accunt that that enables integration with select AWS
services. You must configure the other services to allow the integration. For
more information, see AWS Organizations and service-linked
roles.
Member accounts can require additional information to operate as a standalone account
AWS does not automatically collect all the information required for a member account to operate as a standalone account. If you ever need to remove a member account from an organization and make it a standalone account, you must provide that information for the account before you can remove it. For more information, see Leave an organization from your member account.
Member accounts only be created in the root of an organization
Member accounts in an organization can only be created in the root of an organization, and not in any other organizational units (OUs). After you create a member account root of an organization, you can move it between OUs. For more information, see Moving accounts to an OU or between the root and OUs.
Member accounts for organizations managed by AWS Control Tower should be created in AWS Control Tower
If your organization is managed by AWS Control Tower, then create your member accounts using the AWS Control Tower account factory in the AWS Control Tower console or using the AWS Control Tower APIs. If you create an member account in Organizations when the organization is managed by AWS Control Tower, the account won't be enrolled with AWS Control Tower. For more information, see Referring to Resources Outside of AWS Control Tower in the AWS Control Tower User Guide.
Member accounts must opt in to receive marketing emails
Member accounts that you create as part of an organization are not automatically
subscribed to AWS marketing emails. To opt-in your accounts to receive marketing
emails, see https://pages.awscloud.com/communication-preferences
Creating an AWS account that is part of your organization
After you sign in to the organization's management account, you can create member accounts that are automatically part of your organization. When you create an account using the following procedure, AWS Organizations automatically copies the following Primary contact information from the management account to the new member account:
-
Phone number
-
Company name
-
Website URL
-
Address
It also copies the communication language and Marketplace information (vendor of the account in some AWS Regions) from the management account.
Minimum permissions
To create a member account in your organization, you must have the following permissions:
-
organizations:CreateAccount
-
organizations:DescribeOrganization
– required only when using the Organizations console -
iam:CreateServiceLinkedRole
(granted to principalorganizations.amazonaws.com
to enable creating the required service-linked role in the member accounts).
To create an AWS account that is automatically part of your organization
-
Sign in to the AWS Organizations console
. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account. -
On the AWS accounts
page, choose Add an AWS account. -
On the Add an AWS account
page, choose Create an AWS account (it is chosen by default). -
On the Create an AWS account
page, for AWS account name enter the name that you want to assign to the account. This name helps you distinguish the account from all other accounts in the organization and is separate from the IAM alias or the email name of the owner. -
For Email address of the account's owner, enter the email address of the account's owner. This email address cannot already be associated with another AWS account because it becomes the user name credential for the root user of the account.
-
(Optional) Specify the name to assign to the IAM role that is automatically created in the new account. This role grants the organization's management account permission to access the newly created member account. If you don't specify a name, AWS Organizations gives the role a default name of
OrganizationAccountAccessRole
. We recommend that you use the default name across all of your accounts for consistency.Important
Remember this role name. You need it later to grant access to the new account for users and roles in the management account.
-
(Optional) In the Tags section, add one or more tags to the new account by choosing Add tag and then entering a key and an optional value. Leaving the value blank sets it to an empty string; it isn't
null
. You can attach up to 50 tags to an account. -
Choose Create AWS account.
-
If you get an error that indicates that you exceeded your account quota for the organization, see I get a "quota exceeded" message when I try to add an account to my organization.
-
If you get an error that indicates that you can't add an account because your organization is still initializing, wait one hour and try again.
-
You can also check the AWS CloudTrail log for information on whether the account creation was successful. For more information, see Logging and monitoring in AWS Organizations.
-
If the error persists, contact AWS Support
.
The AWS accounts
page appears, with your new account added to the list. -
-
Now that the account exists and has an IAM role that grants administrator access to users in the management account, you can access the account by following the steps in Accessing member accounts in your organization.
Note
When you create an account, AWS Organizations initially assigns a long (64 characters), complex, randomly generated password to the root user. You can't retrieve this initial password. To access the account as the root user for the first time, you must go through the process for password recovery. For more information, see Accessing a member account as the root user.
The following code examples show how to use CreateAccount
.