How do you create and view instances in an Organization in AWS?

Viewed 2315

I share an organization with other members but we are not able to see each other's instances. Is it possible to view and create other member's instances within one organization?

2 Answers

When you create an AWS organization you are not given access to other accounts in the organization automatically. To gain access to resources in another account you create a role in the other account and then "Switch Role" to assume the permissions of that role.

Let's say that you login to account nicknamed "Development". You want to access EC2 instances in the "Production" account. Once you have created a role in the Production account that you can assume, then at the top right of the Amazon Management Console click on your username / account number. A menu appears, then select "Switch Role". If you have previously done this, the previous role will be remembered, otherwise you enter the account number and role name for "Production".

This sounds complicated, but once you do this, it will appear simple and logical. Just remember that when you switch roles, you are temporarily giving up access to one account to obtain access to another account. Your "identity" basically switches. Sort of like the Linux command "su" to switch login identities.

Here is a link to help walk you thru setting up cross account access.

Tutorial: Delegate Access Across AWS Accounts Using IAM Roles

Cloudformation stack for creating cross-account roles

Easing the Creation of Cross-Account Roles for Customers

AWS Organizations are primarily used for consolidated billing. You can apply SCPs to child accounts. You cannot view resources of one account from other account. You can access them using Cross Account IAM roles.

Please read the service description at https://aws.amazon.com/organizations/

Related