Creating a member account in your organization
This page describes how to create AWS accounts within your organization in AWS Organizations. To learn
about getting started with AWS and creating a single AWS account, see the Getting Started Resource Center
An organization is a collection of AWS accounts that you centrally manage. You can perform the following procedures to manage the accounts that are part of your organization:
Important
-
When you create a member account in your organization, AWS Organizations automatically creates an AWS Identity and Access Management (IAM) role
OrganizationAccountAccessRole
in the member account that enables users and roles in the management account to exercise full administrative control over the member account. This role is subject to any service control policies (SCPs) that apply to the member account.AWS Organizations also automatically adds a managed policy with the
OrganizationAccountAccessRole
role to the member account. This allows centralized control, so that any additional accounts attached to the same managed policy will be updated automatically whenever the policy gets updated. Previously, new accounts created within an organization got an inline policy added that only applied to that single account. To learn more about inline and managed policies, see Managed policies and inline policies in the IAM User Guide.AWS Organizations also automatically creates a service-linked role named
AWSServiceRoleForOrganizations
that enables integration with select AWS services. You must configure the other services to allow the integration. For more information, see AWS Organizations and service-linked roles. -
If this organization is managed with AWS Control Tower, then create your accounts by using the AWS Control Tower account factory in the AWS Control Tower console or APIs. If you create an account in Organizations, then that account isn't enrolled with AWS Control Tower. For more information, see Referring to Resources Outside of AWS Control Tower in the AWS Control Tower User Guide.
Note
AWS accounts that you create as part of an organization are not automatically
subscribed to AWS marketing emails. To opt-in your accounts to receive marketing
emails, see https://pages.awscloud.com/communication-preferences
Creating an AWS account that is part of your organization
When you sign in to the organization's management account, you can create member accounts that are automatically part of your organization. To do this, complete the following steps.
When you create an account using the following procedure, Organizations automatically copies the following information from the management account to the new member account:
-
Account name
-
Phone number
-
Company name
-
Customer URL
-
Company contact email
-
Communication language
-
Marketplace (vendor of the account in some AWS Regions)
AWS does not automatically collect all the information required for an account to operate as a standalone account. If you ever need to remove the account from the organization and make it a standalone account, you must provide that information for the account before you can remove it. For more information, see Leave an organization from your member account.
Minimum permissions
To create a member account in your organization, you must have the following permissions:
-
organizations:CreateAccount
-
organizations:DescribeOrganization
– required only when using the Organizations console -
iam:CreateServiceLinkedRole
(granted to principalorganizations.amazonaws.com
to enable creating the required service-linked role in the member accounts).