aws-organizations

Describe the organization

$ aws organizations describe-organization

$ aws organizations list-accounts

$ aws organizations list-organizational-units-for-parent --parent-id [r-xxxx|ou-xxxx-xxxxxxxx]

$ aws organizations create-account --account-name "[Account Name]" --email [admin@example.com]

$ aws organizations move-account --account-id [123456789012] --source-parent-id [ou-source] --destination-parent-id [ou-dest]

$ aws organizations list-policies --filter SERVICE_CONTROL_POLICY

$ aws organizations attach-policy --policy-id [p-xxxxxxxx] --target-id [account-id|ou-id]

$ aws organizations list-accounts-for-parent --parent-id [ou-xxxx-xxxxxxxx]

aws organizations subcommand [options]

aws organizations is a subcommand of the AWS CLI that manages AWS Organizations, a service for centrally managing multiple AWS accounts. It enables consolidated billing, account creation, and policy-based governance.
Organizations have a hierarchical structure: a root containing organizational units (OUs) and accounts. Service Control Policies (SCPs) set permission guardrails that apply to all principals in target accounts or OUs, restricting what actions can be performed.
The management account (formerly master) creates and controls the organization. Member accounts can be created within the organization or invited from existing accounts.

describe-organization

Get organization details and features.

List all accounts in the organization.

List organization roots.

List OUs under a parent.

List accounts directly in an OU.

Create a new member account.

Create a new OU.

Move account between OUs.

List policies of a given type.

Create a new policy.

Attach policy to a target.

Remove policy from a target.

Get account details.

Root or OU identifier.

12-digit AWS account ID.

Policy identifier.

Account, OU, or root to target.

Policy type filter: SERVICECONTROLPOLICY, TAGPOLICY, BACKUPPOLICY, AISERVICESOPTOUT_POLICY.

Organizations commands must run from the management account. SCPs do not grant permissions, only restrict them. The management account is not affected by SCPs. Account creation is asynchronous; check status with describe-create-account-status. Removing an account from an organization requires it to have payment method configured for standalone billing.

AWS Organizations launched in February 2017 to enable multi-account management. Service Control Policies provided centralized governance. Consolidated Billing merged from the older Consolidated Billing feature. Features expanded to include Tag Policies, Backup Policies, and AI Services Opt-out Policies. AWS Control Tower, launched in 2019, builds on Organizations for landing zone automation.

aws(1), aws-iam(1), aws-sts(1), aws-sso(1)