AWS organizations documentation change
Summary
Removed redundant sections about member account requirements, reorganized AWS Control Tower guidance, and adjusted permissions documentation formatting.
Security assessment
Changes involve content reorganization and formatting adjustments to permissions (e.g., moving AWS Control Tower guidance, reordering IAM permissions). No explicit security vulnerability or incident is addressed. The IAM permission changes are structural, not substantive.
Diff
diff --git a/organizations/latest/userguide/orgs_manage_accounts_create.md b/organizations/latest/userguide/orgs_manage_accounts_create.md index 4da62b503..43c4b5ff4 100644 --- a//organizations/latest/userguide/orgs_manage_accounts_create.md +++ b//organizations/latest/userguide/orgs_manage_accounts_create.md @@ -21,4 +20,0 @@ When you create a member account in your organization, Organizations automatical -**Member accounts can require additional information to operate as a standalone account** - -AWS does not automatically collect all the information required for a member account to operate as a standalone account. If you ever need to remove a member account from an organization and make it a standalone account, you must provide that information for the account before you can remove it. For more information, see [Leave an organization from a member account with AWS Organizations](./orgs_manage_accounts_leave-as-member.html). - @@ -27 +23 @@ AWS does not automatically collect all the information required for a member acc -Member accounts in an organization can only be created in the root of an organization, and not in any other organizational units (OUs). After you create a member account root of an organization, you can move it between OUs. For more information, see [Moving accounts to an organizational unit (OU) or between the root and OUs with AWS Organizations](./move_account_to_ou.html). +Member accounts in an organization can only be created in the root of an organization. After you create a member account root of an organization, you can move it between OUs. For more information, see [Moving accounts to an organizational unit (OU) or between the root and OUs with AWS Organizations](./move_account_to_ou.html). @@ -35,4 +30,0 @@ If you have [enabled service trust for another AWS service](./orgs_integrate_ser -**Member accounts for organizations managed by AWS Control Tower should be created in AWS Control Tower** - -If your organization is managed by AWS Control Tower, then create your member accounts using the AWS Control Tower account factory in the AWS Control Tower console or using the AWS Control Tower APIs. If you create an member account in Organizations when the organization is managed by AWS Control Tower, the account won't be enrolled with AWS Control Tower. For more information, see [Referring to Resources Outside of AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/external-resources.html#ungoverned-resources) in the _AWS Control Tower User Guide_. - @@ -42,0 +35,6 @@ Member accounts that you create as part of an organization are not automatically +**Member accounts for organizations managed by AWS Control Tower should be created in AWS Control Tower** + +If your organization is managed by AWS Control Tower, we recommend that you create your member accounts using the AWS Control Tower account factory in the AWS Control Tower console or using the AWS Control Tower APIs. + +If you create an member account in Organizations when the organization is managed by AWS Control Tower, the account won't be enrolled with AWS Control Tower. For more information, see [Referring to Resources Outside of AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/external-resources.html#ungoverned-resources) in the _AWS Control Tower User Guide_. + @@ -66,2 +63,0 @@ To create a member account in your organization, you must have the following per - * `organizations:CreateAccount` - @@ -70 +66,3 @@ To create a member account in your organization, you must have the following per - * `iam:CreateServiceLinkedRole` (granted to principal `organizations.amazonaws.com` to enable creating the required service-linked role in the member accounts). + * `organizations:CreateAccount` + + * `iam:CreateServiceLinkedRole`