How do I remove a member account from an organization in AWS Organizations when I can't sign in to the member account?

Short Description

To remove a member account from your organization, you must sign into the member account. Additionally, the member account must have the AWS Identity and Access Management (IAM) role OrganizationAccountAccessRole for removal.

Once removed from your organization, the member account becomes a standalone account.

Resolution

To gain access to a member account in an organization, take one of the following actions:

• Contact the administrator of the member account and ask them to grant you access.
• If you have access to the email address associated with the account but don't know the password, reset the password.
• If you don’t have access to the email address, change the email address of the member account in Organizations to an accessible email address.

If the previous steps don't work, you need to use the IAM Console to assume an administrator's role for the account.

Verify that the member account has the OrganizationAccountAccessRole permissions

The member account needs the IAM OrganizationAccountAccessRole with administrative permissions.

If you created the member account with the AWS Organizations Console, then AWS Organizations automatically grants the IAM role OrganizationAccountAccessRole with administrative permissions to the management account.

If the account was invited to the organization, then the IAM role OrganizationAccountAccessRole wasn't automatically created. To create the AWS Organizations administrative role for an invited member account, see Creating OrganizationAccountAccessRole for an invited account with AWS Organizations.

Assume the administrator's IAM role

First, add permissions to assume an administrator's IAM role for the member account. For more information, see Accessing member accounts in an organization with AWS Organizations.

Then, switch from a user to an IAM role with the AWS console. After you assume the OrganizationAccountAccessRole for the member account, complete the following steps:

1. Open the IAM console.
2. Choose Users in the navigation pane, and then choose Add user.
3. Enter a username, and then select AWS Management Console access.
4. Select Custom password, and then enter a password.
5. Clear Require password reset.
6. Choose Next: Permissions.
7. Choose Attach existing policies directly, and then choose AdministratorAccess from the list of policies.
8. Choose Next: Tags.
9. (Optional) On the Add tags page, enter the values for Key and Value.
10. Choose Next: Review.
11. Review the details of your new IAM user, and then choose Create user.

Verify the account details, and then remove the member account from the organization.

Note: If you want to close a member account and make sure that additional charges aren't incurred, open the AWS Organizations console. Then, close a member account in an organization with AWS Organizations. You can also close the account by signing in as the root user of your member account. For more information, see AWS security credentials.

Related information

How do I remove a member account from an organization?