IAM / management / organizations

AWS Organizations (IAM)

JSON →

AWSorganizationsmanagement

AWS Organizations helps you centrally govern your environment as you grow and scale your AWS resources.

iamaws

docs ↗

Permissions

Actions in this service

organizations:ListAccounts

organizations:ListRoots

organizations:ListOrganizationalUnitsForParent

organizations:DescribeOrganization

organizations:ListPolicies

organizations:ListTagsForResource

organizations:TagResource

organizations:UntagResource

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAccounts", "organizations:ListRoots", "organizations:ListOrganizationalUnitsForParent", "organizations:DescribeOrganization", "organizations:ListPolicies", "organizations:ListTagsForResource", "organizations:TagResource", "organizations:UntagResource" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid organizations:* — grants full control including account creation and policy management

Avoid organizations:CreateAccount and organizations:DeleteOrganization — can lead to account sprawl or accidental deletion

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/organizations/organizations.json ↗