General

Q: What is an organization?

An organization is a collection of AWS accounts that you can organize into a hierarchy and manage centrally.

Q: What is an AWS account?

An AWS account is a container for your AWS resources. You create and manage your AWS resources in an AWS account, and the AWS account provides administrative capabilities for access and billing.

Q: What is a master account?

A master account is the AWS account you use to create your organization. From the master account, you can create other accounts in your organization, invite and manage invitations for other accounts to join your organization, and remove accounts from your organization. You can also attach policies to entities such as administrative roots, organizational units (OUs), or accounts within your organization. The master account has the role of a payer account and is responsible for paying all charges accrued by the accounts in its organization. You cannot change which account in your organization is the master account.

Q: What is a member account?

A member account is an AWS account, other than the master account, that is part of an organization. If you are an administrator of an organization, you can create member accounts in the organization and invite existing accounts to join the organization. You also can apply policies to member accounts. A member account can belong to only one organization at a time.

Q: What is an administrative root?

An administrative root is the starting point for organizing your AWS accounts. The administrative root is the top-most container in your organization’s hierarchy. Under this root, you can create OUs to logically group your accounts and organize these OUs into a hierarchy that best matches your business needs.

Q: What is an organizational unit (OU)?

An organizational unit (OU) is a group of AWS accounts within an organization. An OU can also contain other OUs enabling you to create a hierarchy. For example, you can group all accounts that belong to the same department into a departmental OU. Similarly, you can group all accounts running production services into a production OU. OUs are useful when you need to apply the same controls to a subset of accounts in your organization. Nesting OUs enables smaller units of management. For example, in a departmental OU, you can group accounts that belong to individual teams in team-level OUs. These OUs inherit the policies from the parent OU in addition to any controls assigned directly to the team-level OU.

Organizing AWS accounts

Q: Can I define and manage my organization regionally?

You do not need to specify a region when you create and manage your organization. Users in your AWS accounts can use AWS services in any China regions in which that service is available.

Q: Can I change which AWS account is the master account?

No. You cannot change which AWS account is the master account. Therefore, you should select your master account carefully.

Q: How do I add an AWS account to my organization?

Use one of the following two methods to add an AWS account to your organization:

Method 1: Invite an existing account to join your organization

  1. Sign in as an administrator of the master account and navigate to the AWS Organizations console.
  2. Choose the Accounts tab.
  3. Choose Add account and then choose Invite account.
  4. Provide the email address of the account that you want to invite or the AWS account ID of the account.

Note: You can invite more than one AWS account by providing a comma-separated list of email addresses or AWS account IDs.

The specified AWS account receives an email inviting it to join your organization. An administrator in the invited AWS account must accept or reject the request using the AWS Organizations console, AWS CLI, or Organizations API. If the administrator accepts your invitation, the account becomes visible in the list of member accounts in your organization.

Method 2: Create an AWS account in your organization

  1. Sign in as an administrator of your master account and navigate to the AWS Organizations console.
  2. Choose the Accounts tab.
  3. Choose Add account and then choose Create account.
  4. Provide a name for the account and the email address for the account.

You can also create an account by using the AWS SDK or AWS CLI. For both methods, after you add the new account, you can move it to an organizational unit (OU). The new account automatically inherits the policies attached to the OU.

Q: Can an AWS account be a member of more than one organization?

No. An AWS account can be a member of only one organization at a time.

Q: Can I move an AWS account that I have created using AWS Organizations to another organization?

Yes. However, you must first remove the account from your organization and make it a standalone account (see below). After making the account standalone, it can then be invited to join another organization.

Q: Can I remove an AWS account that I created using Organizations and make it a standalone account?

Yes. When you create an account in an organization using the AWS Organizations console, API, or CLI commands, AWS does not collect all of the information required of standalone accounts. For each account that you want to make standalone, you need to update this information, which can include: providing contact information, agreeing to the Sinnet Customer Agreement for AWS (Beijing Region) and Western Cloud Data Customer Agreement for AWS (Ningxia Region), providing a valid payment method, authorizing or supplementing other information required for the AWS account sign-up, and choosing a support plan option. We use the payment method you selected to charge for any billable AWS activity that occurs while the account is not attached to an organization.

Q: How many AWS accounts can I manage in my organization?

This can vary. If you need additional accounts, go to the AWS Support Center and open a support case to request an increase.

Q: How can I remove an AWS member account from an organization?

You can remove a member account by using one of the following two methods. You might have to provide additional information to remove an account that you created using Organizations. If the attempt to remove an account fails, go to the AWS Support Center and ask for help with removing an account.

Method 1: Remove an invited member account by signing in to the master account

  1. Sign in as an administrator of the master account and navigate to the AWS Organizations console.
  2. In the left pane, choose Accounts.
  3. Choose the account that you want to remove and then choose Remove account.
  4. If the account does not have a valid payment method, you must provide one.

Method 2: Remove an invited member account by signing in to the member account

  1. Sign in as an administrator of the member account that you want to remove from the organization.
  2. Navigate to the AWS Organizations console.
  3. Choose Leave organization.
  4. If the account does not have a payment method, you must provide one.

Q: How can I create an organizational unit (OU)?

To create an OU, follow these steps:

  1. Sign in as an administrator of the master account and navigate to the AWS Organizations console.
  2. Choose the Organize accounts tab.
  3. Navigate in the hierarchy to where you want to create the OU. You can create it directly under the root, or you can create it within another OU.
  4. Choose to Create organizational unit and provide a name for your OU. The name must be unique within your organization.

Note: You can rename the OU later.

You now can add AWS accounts to your OU. You can also use the AWS CLI and AWS APIs to create and manage an OU.

Q: How can I add a member AWS account to an OU?

Follow these steps to add member accounts to an OU:

  1. In the AWS Organizations console, choose the Organize accounts tab.
  2. Choose the AWS account, and then choose Move account.
  3. In the dialog box, select the OU to which you want to move the AWS account.

Alternatively, you can use the AWS CLI and AWS APIs to add AWS accounts to an OU.

Q: How many levels can I have in my OU hierarchy?

You can nest your OUs five levels deep. Including root and AWS accounts created in the lowest OUs, your hierarchy can be five levels deep.

Billing

Q: What does AWS Organizations cost?

AWS Organizations is offered at no additional charge.

Q: Who pays for usage incurred by users under an AWS member account in my organization?

The owner of the master account is responsible for paying for all usage, data, and resources used by the accounts in the organization.

Q: Will my bill reflect the organizational unit structure that I created in my organization?

No. For now, your bill will not reflect the structure that you have defined in your organization.