Accessing Organization Structure from a child account

Question

From the AWS management account, I created a child account, but when I login to the child account as the root user, I cannot see the Organization structure, I get this error - We couldn't load the root of the organization.
You don't have permissions to see this resource, because the management account has not granted you the permissions to view accounts.
What seems to be the issue and how can I fix it?

Answer

The root user of the child account doesn't have permission (organizations:DescribeOrganization) to the organization. You need to sign in as an IAM user, assume in IAM role, or sign in as the root user (not recommended) in the management account to view it.

Answer

Hi there.

The problem in this case is that by default, the organization in AWS Organizations is only accessible from the management account. To allow a member account to see or manage the organization, you need to grant permissions to the account by making it a Delegated administrator for AWS Organizations [1]. In fact, this is the recommended approach so that you have an AWS account that manages the organization as opposed to using the management account.

I hope this helps.

[1] https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html

Accessing Organization Structure from a child account

Relevanter Inhalt