Skip to main content
Sponsor @cloudposse

Module: organization-access-role

Terraform module to create an IAM Role to grant permissions to delegated IAM users in the master account to access an invited member account

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html

Screenshots​

OrganizationAccountAccessRole Organization Account Access Role as Viewed from the AWS Web Console

Introduction​

By default, when you create a member account as part of your Organization, AWS automatically creates OrganizationAccountAccessRole in the member account.

The role grants admin permissions to the member account to delegated IAM users in the master account.

However, member accounts that you invite to join your Organization do not automatically get the role created.

This module creates OrganizationAccountAccessRole role in an invited member account.

AWS recommends using the same name, OrganizationAccountAccessRole, for the created role for consistency and ease of remembering.


Usage​

module "organization_access_role" {
  source            = "git::https://github.com/cloudposse/terraform-aws-organization-access-role.git?ref=master"
  master_account_id = "XXXXXXXXXXXX"
  role_name         = "OrganizationAccountAccessRole"
  policy_arn        = "arn:aws:iam::aws:policy/AdministratorAccess"

After the role has been created in the invited member account, login to the master account and create the following policy:

(change YYYYYYYYYYYY to the ID of the invited member account)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "sts:AssumeRole"
            ],
            "Resource": [
                "arn:aws:iam::YYYYYYYYYYYY:role/OrganizationAccountAccessRole"
            ]
        }
    ]
}

Then attach the policy to a master account Group that you want to delegate administration of the invited member account.

After that, users who are members of the Group in the master account will be able to assume the role and administer the invited member account by going here:

(change YYYYYYYYYYYY to the ID of the invited member account)

https://signin.aws.amazon.com/switchrole
                ?account=YYYYYYYYYYYY
                &roleName=OrganizationAccountAccessRole
                &displayName=Dev

NOTE: You can use terraform-aws-organization-access-group module to create an IAM Group and Policy to grant permissions to delegated IAM users in the Organization's master account to access a member account.

Variables​

Required Variables​

master_account_id (string) required

The ID of the master account to grant permissions to access the current account

Optional Variables​

policy_arn (string) optional

Policy ARN to attach to the role. By default it attaches AdministratorAccess managed policy to grant full access to AWS services and resources in the current account


Default value: "arn:aws:iam::aws:policy/AdministratorAccess"

role_name (string) optional

The name of the role to grant permissions to delegated IAM users in the master account to the current account


Default value: "OrganizationAccountAccessRole"

Context Variables​

The following variables are defined in the context.tf file of this module and part of the terraform-null-label pattern.

Outputs​

role_arn

The Amazon Resource Name (ARN) specifying the role

role_id

The stable and unique string identifying the role

role_name

The name of the crated role

Dependencies​

Providers​

  • aws

Resources​

The following resources are used by this module:

Data Sources​

The following data sources are used by this module: