AWS organizations documentation change
Summary
Replaced detailed steps for updating root user email with a link to external guide
Security assessment
The change consolidates documentation by replacing detailed procedures with a link to another resource. While the original content included security-related processes (OTP verification, permissions), this specific change does not address a security vulnerability or add new security documentation in this file.
Diff
diff --git a/organizations/latest/userguide/orgs_manage_accounts_update_primary_email.md b/organizations/latest/userguide/orgs_manage_accounts_update_primary_email.md index 5c9591d05..a9d176869 100644 --- a/organizations/latest/userguide/orgs_manage_accounts_update_primary_email.md +++ b/organizations/latest/userguide/orgs_manage_accounts_update_primary_email.md @@ -5,2 +4,0 @@ -Update the root user email address for a member account - @@ -15,95 +13 @@ To update the root user email address of a member account in your organization, -## Update the root user email address for a member account - -Use the following procedure to update the root user email address. - -AWS Management Console - - -###### Notes - - * To perform this procedure from the management account or a delegated admin account in an organization against member accounts, you must [enable trusted access for the Account Management service](https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-account.html#integrate-enable-ta-account). - - * You can't use this procedure to access an account in a different organization from the one you're using to call the operation. - - - - -###### To update the root user email address for a member account using the AWS Organizations console - - 1. Sign in to the [AWS Organizations console](https://console.aws.amazon.com/organizations/v2) as the root user of the management account (or equivalent IAM permissions) in your organization. - - 2. On the **AWS accounts** page, choose the member account for which you want to update the root user email address. - - 3. In the **Account details** section, choose the **Actions** button, and then choose **Update email address**. - - 4. Under **Email** , enter the new email address for the root user, and then choose **Save**. This sends a one-time password (OTP) to the new email address. - -###### Note - -If you need to close this page in the Organizations console while you wait for the code, you can return and finish the OTP process within 24 hours from when the code was sent. To do this, while on the **Account details** page, choose the **Actions** button, and then choose **Complete email update**. - - 5. Under **Verification code** , enter the code that was sent to the new email address in the previous step, and then choose **Confirm**. This commits the update to the root user for the account. - - - - -AWS CLI & AWS SDKs - - -You can retrieve, or update the **_root user_** email address (also referred to as the primary email address) by using the following AWS CLI commands or their AWS SDK equivalent operations: - - * [GetPrimaryEmail](https://docs.aws.amazon.com/accounts/latest/reference/API_GetPrimaryEmail.html) - - * [StartPrimaryEmailUpdate](https://docs.aws.amazon.com/accounts/latest/reference/API_StartPrimaryEmailUpdate.html) - - * [AcceptPrimaryEmailUpdate](https://docs.aws.amazon.com/accounts/latest/reference/API_AcceptPrimaryEmailUpdate.html) - - - - -###### Notes - - * To perform these operations from the management account or a delegated admin account in an organization against member accounts, you must [enable trusted access for the Account Management service](https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-account.html#integrate-enable-ta-account). - - * You can't access an account in a different organization from the one you're using to call the operation. - - - - -###### Minimum permissions - -For each operation, you must have the permission that maps to that operation: - - * `account:GetPrimaryEmail` - - * `account:StartPrimaryEmailUpdate` - - * `account:AcceptPrimaryEmailUpdate` - - - - -If you use these individual permissions, you can grant some users the ability to only read the root user email address information, and grant others the ability to both read and write. - -To complete the root user email update process, you must use the primary email APIs together in the order they are shown in the examples below. - -###### Example `GetPrimaryEmail` - -The following example retrieves the root user email address from the specified member account in an organization. The credentials used must be from either the organization's management account, or from the Account Management's delegated admin account. - - - $ aws account get-primary-email --account-id 123456789012 - -###### Example `StartPrimaryEmailUpdate` - -The following example starts the root user email address update process, identifies the new email address, and sends a one-time password (OTP) to the new email address for the specified member account in an organization. The credentials used must be from either the organization's management account, or from the Account Management's delegated admin account. - - - $ aws account start-primary-email-update --account-id 123456789012 --primary-email [email protected] - -###### Example `AcceptPrimaryEmailUpdate` - -The following example accepts the OTP code and sets the new email address to the specified member account in an organization. The credentials used must be from either the organization's management account, or from the Account Management's delegated admin account. - - - $ aws account accept-primary-email-update --account-id 123456789012 --otp 12345678 --primary-email [email protected] +For step-by-step instructions on how to update your member account's root user email address, see [Update the root user email for any AWS account in your organization](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-root-user-email.html#root-user-email-orgs) in the _AWS Account Management Reference Guide_.