Creating an AWS account in your organization - AWS Organizations

Creating an AWS account in your organization

This page describes how to create accounts within your organization in AWS Organizations. To learn about getting started with AWS and creating a single AWS account, see the Getting Started Resource Center.

An organization is a collection of AWS accounts that you centrally manage. You can perform the following procedures to manage the accounts that are part of your organization:

Important
  • When you create a member account in your organization, AWS Organizations automatically creates an AWS Identity and Access Management (IAM) role in the member account. This role enables IAM users in the management account (formerly known as the "master account") to exercise full administrative control over the member account. This role is subject to any service control policies (SCPs) that apply to the member account.

    AWS Organizations also automatically creates a service-linked role named AWSServiceRoleForOrganizations that enables integration with select AWS services. You must configure the other services to allow the integration. For more information, see AWS Organizations and service-linked roles.

  • If this organization is managed with AWS Control Tower, then create your accounts by using the AWS Control Tower account factory in the AWS Control Tower console or APIs. If you create the account in Organizations, then that account isn't enrolled with AWS Control Tower. For more information, see Referring to Resources Outside of AWS Control Tower in the AWS Control Tower User Guide.

Creating an AWS account that is part of your organization

When signed in to the organization's management account, you can create member accounts that are automatically part of your organization. To do this, complete the following steps.

When you create an account using the following procedure, Organizations automatically copies the following information from the management account to the new member account:

  • Account name

  • Phone number

  • Company name

  • Customer URL

  • Company contact email

  • Communication language

  • Marketplace (vendor of the account in some AWS Regions)

AWS does not automatically collect all the information required for an account to operate as a standalone account. If you ever need to remove the account from the organization and make it a standalone account, you must provide that information for the account before you can remove it. For more information, see Leaving an organization as a member account.

Minimum permissions

To create a member account in your organization, you must have the following permissions:

  • organizations:CreateAccount

  • organizations:DescribeOrganization (console only)

  • iam:CreateServiceLinkedRole (granted to principal organizations.amazonaws.com to enable creating the required service-linked role in the member accounts).

AWS Management Console

To create an AWS account that automatically is part of your organization

  1. Sign in to the AWS Organizations console at https://console.aws.amazon.com/organizations/. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization's management account.

  2. On the Accounts tab, choose Add account.

  3. Choose Create account.

  4. Enter the name that you want to assign to the account. This name helps you distinguish the account from all other accounts in the organization and is separate from the IAM alias or the email name of the owner.

  5. Enter the email address for the owner of the new account. This address must be unique to this account because it can be used to sign in as the root user of the account.

  6. (Optional) Specify the name to assign to the IAM role that is automatically created in the new account. This role grants the organization's management account permission to access the newly created member account. If you don't specify a name, AWS Organizations gives the role a default name of OrganizationAccountAccessRole.

    Important

    Remember this role name. You need it later to grant access to the new account for IAM users in the management account.

  7. (Optional) You can add one or more tags to the new account by choosing Add tag and then entering a key and an optional value. Leaving the value blank sets it to an empty string; it isn't null. You can attach up to 50 tags to an account.

  8. Choose Create.

  9. You are redirected to the Accounts/All accounts tab, showing your new account at the top of the list with its status set to Pending creation. When the account is created, this status changes to Active.

    Note

    By default, the Accounts tab hides account creation requests that failed. To show them, choose the switch at the top of the list and change it to Show.

  10. Now that the account exists and has an IAM role that grants administrator access to users in the management account, you can access the account by following the steps in Accessing and administering the member accounts in your organization.

    When you create an account, AWS Organizations initially assigns a long (64 characters), complex, randomly generated password to the root user. You can't retrieve this initial password. To access the account as the root user for the first time, you must go through the process for password recovery. For more information, see Accessing a member account as the root user.

AWS CLI, AWS API

To create an AWS account that automatically is part of your organization

You can use one of the following commands to create an account: