AWS organizations documentation change
Summary
Expanded documentation about invitations and handshakes with explicit handshake types (INVITE, ENABLE_ALL_FEATURES, APPROVE_ALL_FEATURES)
Security assessment
Clarifies organizational processes but does not introduce security features or address vulnerabilities.
Diff
diff --git a/organizations/latest/userguide/orgs_getting-started_concepts.md b/organizations/latest/userguide/orgs_getting-started_concepts.md index d642be144..7dd642b2d 100644 --- a/organizations/latest/userguide/orgs_getting-started_concepts.md +++ b/organizations/latest/userguide/orgs_getting-started_concepts.md @@ -153 +153,3 @@ We recommend that you use the management account and its users and roles only fo -An _invitation_ is the process of asking another account to join your organization. An invitation can be issued only by the organization's management account. The invitation is extended to either the account ID or the email address that is associated with the invited account. After the invited account accepts an invitation, it becomes a member account in the organization. Invitations also can be sent to all current member accounts when the organization needs all members to approve the change from supporting only consolidated billing features to supporting all features in the organization. Invitations work by accounts exchanging handshakes. You might not see handshakes when you work in the AWS Organizations console. But if you use the AWS CLI or AWS Organizations API, you must work directly with handshakes. +An _invitation_ is a request made by the management account of an organization to another account. For example, the process of asking a standalone account to join an organization is an invitation. + +Invitations are implemented as handshakes. You might not see handshakes when you work in the AWS Organizations console. But if you use the AWS CLI or AWS Organizations API, you must work directly with handshakes. @@ -158 +160,14 @@ An _invitation_ is the process of asking another account to join your organizati -A _handshake_ is a multi-step process of exchanging information between two parties. One of its primary uses in AWS Organizations is to serve as the underlying implementation for invitations. Handshake messages are passed between and responded to by the handshake initiator and the recipient. The messages are passed in a way that helps ensure that both parties know what the current status is. Handshakes also are used when changing the organization from supporting only consolidated billing features to supporting all features that AWS Organizations offers. You generally need to directly interact with handshakes only if you work with the AWS Organizations API or command line tools such as the AWS CLI. +A _handshake_ is the secure exchange of information between two AWS accounts: a sender and a recipient. + +The following handshakes are supported: + + * **INVITE** : Handshake sent to a standalone account for it to join the sender's organization. + + * **ENABLE_ALL_FEATURES** : Handshake sent to invited member accounts to enable all features for the organization. + + * **APPROVE_ALL_FEATURES** : Handshake sent to the management account when all invited member accounts have approved to enable all features. + + + + +You generally need to directly interact with handshakes only if you work with the AWS Organizations API or command line tools such as the AWS CLI.