AWS awsaccountbilling high security documentation change
Summary
Restructured billing transfer options with clearer organization titles, added security controls for root account ownership, and specified requirements for organizations in all-features mode.
Security assessment
Added explicit requirement for administrator control over root account (critical security boundary) and enforcement of single-customer workloads after billing transfer. These changes address potential unauthorized access risks and multi-tenant security concerns.
Diff
diff --git a/awsaccountbilling/latest/aboutv2/orgs_transfer_billing-best-practices.md b/awsaccountbilling/latest/aboutv2/orgs_transfer_billing-best-practices.md index 8dd9567bf..0e612a7d3 100644 --- a//awsaccountbilling/latest/aboutv2/orgs_transfer_billing-best-practices.md +++ b//awsaccountbilling/latest/aboutv2/orgs_transfer_billing-best-practices.md @@ -40 +40 @@ There are three options to start using billing transfer: - * You support a single organization and want to split into multiple AWS Organizations + * Option 1: Set up billing transfer for externally owned organizations @@ -42 +42 @@ There are three options to start using billing transfer: - * Transfer ownership when you manage multiple organizations + * Option 2: Create an AWS organization before setting up billing transfer @@ -43,0 +44 @@ There are three options to start using billing transfer: + * Option 3: Transfer ownership of an AWS organization before setting up billing transfer @@ -47 +47,0 @@ There are three options to start using billing transfer: -### Option 1: Take over billing for externally owned organizations @@ -49 +49,3 @@ There are three options to start using billing transfer: -This option involves taking over billing responsibility through billing transfer from AWS Organizations owned by external parties (such as end customers, affiliates, or subsidiaries). You can transfer billing to either an existing organization or create a new organization dedicated to billing and financial management. +### Option 1: Set up billing transfer for externally owned organizations + +This option involves taking over billing responsibility through billing transfer from AWS Organizations owned by external parties (such as end customers, affiliates, or subsidiaries). You may send a billing transfer invite from your existing organization or create a new organization dedicated to billing and financial management to send invites from. @@ -53 +55,3 @@ This option involves taking over billing responsibility through billing transfer -Your organization must meet these requirements: +To set up billing transfer you must meet this requirement: + + * The organizations sending and receiving the invites are on all-features mode @@ -55 +58,0 @@ Your organization must meet these requirements: - * Organization is in all-features mode @@ -57 +59,0 @@ Your organization must meet these requirements: - * Customer has an email address for root account ownership @@ -59 +61,6 @@ Your organization must meet these requirements: - * Organization serves one customer's workloads + +For Channel Partners, you should follow these best practices to comply with channel program terms: + + * The administrator of the organization accepting the invite has control over root account + + * Organizations who transfer away their billing serve one customer's workloads @@ -82 +89 @@ Create new preferences after billing transfer is active, as existing preferences -### Option 2: You support a single organization and want to split into multiple AWS Organizations +### Option 2: Create an AWS organization before setting up billing transfer @@ -84 +91 @@ Create new preferences after billing transfer is active, as existing preferences -This process involves creating a new AWS Organizations, setting up billing transfer, and then migrating member accounts. +This process involves creating a new AWS Organizations, setting up billing transfer, and then migrating member accounts. This process is suitable if you support a single AWS organization and want to split into multiple AWS organizations. For example, you are a channel partner who consolidates multiple end customers into one AWS organizations (multi-tenant organization) and needs to provide them with dedicated AWS organizations; or you are a customer who consolidates multiple business units, affiliates, or subsidiaries into one AWS organizations. @@ -108,2 +114,0 @@ Consider the following requirements before migrating: -We recommend this approach for AWS Partners who consolidate multiple end customers into one AWS Organizations (multi-tenant organization) and for customers who consolidate multiple business units, affiliates, or subsidiaries into one AWS Organizations. - @@ -178 +183,3 @@ This step is required only for channel partners and their reselling end customer -### Option 3: Transfer ownership when you manage multiple organizations +### Option 3: Transfer ownership of an AWS organization before setting up billing transfer + +This option involves handing over account ownership by providing root credentials controls of an existing AWS Organizations to a new owner and then transferring billing responsibility through billing transfer. @@ -180 +187 @@ This step is required only for channel partners and their reselling end customer -This option involves transferring root access of an existing AWS Organizations to a new owner and transferring billing responsibility through billing transfer. You can transfer billing to either an existing organization or create a new organization dedicated to billing and financial management. +You may send a billing transfer invite from your existing organization or create a new organization dedicated to billing and financial management to send invites from.