By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

why does my OU of one organization get listed in another aws account which has no link with that organization??

0

i have setup organization and have more than 10 OU associated with it. It is obvious to show OU assoicated with that organization in related OU or the management account but why does the OU appears as the list in anothe aws account which has no link withthe organization. The list does not even appear in OU accounts but if you login to another aws account which is not associated with the organazation it appears the 5 or 6 OU names which can trigger a switch but no credentials are saved(luckily), maybe because the unrelated account doesnot have session to do so. The main point is , is it obvious to leak the partial information of the unrelated organization OU's even if you login in diffrent browser session??

  • 0xn0b174
    2 months ago

    yes the trace is it shows the OU account names that you give it when you are managing them from the managment account. But it might be the borwser as you mentioned, i am not sure if this is a good way to handle the accounts info. but anyway thank you for replying. please do comment on this if you give a try and check it for yourself Leo

Topics
Management & Governance
Tags
AWS Organizations
Language
English
0xn0b174
asked 2 months ago129 views
1 Answer
0

Do you mean that the AWS Organizations management console shows something about the OU hierarchy when you switch your role away from the management account and into one of the member accounts or even an account outside the organisation?

AWS Organizations doesn't support that type of cross-account access. The Organizations APIs cannot be authorised to be called by principals in accounts other than the management account. This is documented in this article: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html in that resource-based policies aren't supported.

If your browser console shows some traces of the contents showed while you were logged in to the management account, that's just the browser retaining some of what it loaded before. There's no way an external account could query data about your AWS Organizations org.

EXPERT
Leo K
answered 2 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content