Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Organizations

AWS Organizations (service prefix: organizations) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Organizations
Actions defined by AWS Organizations
Resource types defined by AWS Organizations
Condition keys for AWS Organizations

API operations defined by AWS Organizations

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptHandshake	organizations:AcceptHandshake	Write
AcceptHandshake	organizations:LeaveOrganization	Write
AttachPolicy	organizations:AttachPolicy	Permissions management, Write
CancelHandshake	organizations:CancelHandshake	Write
CloseAccount	organizations:CloseAccount	Write
CreateAccount	organizations:CreateAccount	Write
CreateAccount	organizations:TagResource	Tagging, Write
CreateGovCloudAccount	organizations:CreateGovCloudAccount	Write
CreateGovCloudAccount	organizations:TagResource	Tagging, Write
CreateOrganization	organizations:CreateOrganization	Write
CreateOrganizationalUnit	organizations:CreateOrganizationalUnit	Write
CreateOrganizationalUnit	organizations:TagResource	Tagging, Write
CreatePolicy	organizations:CreatePolicy	Write
CreatePolicy	organizations:TagResource	Tagging, Write
DeclineHandshake	organizations:DeclineHandshake	Write
DeleteOrganization	organizations:DeleteOrganization	Write
DeleteOrganizationalUnit	organizations:DeleteOrganizationalUnit	Write
DeletePolicy	organizations:DeletePolicy	Write
DeleteResourcePolicy	organizations:DeleteResourcePolicy	Permissions management, Write
DeregisterDelegatedAdministrator	organizations:DeregisterDelegatedAdministrator	Write
DescribeAccount	organizations:DescribeAccount	Read
DescribeCreateAccountStatus	organizations:DescribeCreateAccountStatus	Read
DescribeEffectivePolicy	organizations:DescribeEffectivePolicy	Read
DescribeHandshake	organizations:DescribeHandshake	Read
DescribeOrganization	organizations:DescribeOrganization	Read
DescribeOrganizationalUnit	organizations:DescribeOrganizationalUnit	Read
DescribePolicy	organizations:DescribePolicy	Read
DescribeResourcePolicy	organizations:DescribeResourcePolicy	Read
DescribeResponsibilityTransfer	organizations:DescribeResponsibilityTransfer	Read
DetachPolicy	organizations:DetachPolicy	Permissions management, Write
DisableAWSServiceAccess	organizations:DisableAWSServiceAccess	Write
DisablePolicyType	organizations:DisablePolicyType	Write
EnableAWSServiceAccess	organizations:EnableAWSServiceAccess	Write
EnableAllFeatures	organizations:EnableAllFeatures	Write
EnablePolicyType	organizations:EnablePolicyType	Write
InviteAccountToOrganization	organizations:InviteAccountToOrganization	Write
InviteAccountToOrganization	organizations:TagResource	Tagging, Write
InviteOrganizationToTransferResponsibility	organizations:InviteOrganizationToTransferResponsibility	Write
InviteOrganizationToTransferResponsibility	organizations:TagResource	Tagging, Write
LeaveOrganization	organizations:LeaveOrganization	Write
ListAWSServiceAccessForOrganization	organizations:ListAWSServiceAccessForOrganization	List
ListAccounts	organizations:ListAccounts	List
ListAccountsForParent	organizations:ListAccountsForParent	List
ListAccountsWithInvalidEffectivePolicy	organizations:ListAccountsWithInvalidEffectivePolicy	List
ListChildren	organizations:ListChildren	List
ListCreateAccountStatus	organizations:ListCreateAccountStatus	List
ListDelegatedAdministrators	organizations:ListDelegatedAdministrators	List
ListDelegatedServicesForAccount	organizations:ListDelegatedServicesForAccount	List
ListEffectivePolicyValidationErrors	organizations:ListEffectivePolicyValidationErrors	List
ListHandshakesForAccount	organizations:ListHandshakesForAccount	List
ListHandshakesForOrganization	organizations:ListHandshakesForOrganization	List
ListInboundResponsibilityTransfers	organizations:ListInboundResponsibilityTransfers	List
ListOrganizationalUnitsForParent	organizations:ListOrganizationalUnitsForParent	List
ListOutboundResponsibilityTransfers	organizations:ListOutboundResponsibilityTransfers	List
ListParents	organizations:ListParents	List
ListPolicies	organizations:ListPolicies	List
ListPoliciesForTarget	organizations:ListPoliciesForTarget	List
ListRoots	organizations:ListRoots	List
ListTagsForResource	organizations:ListTagsForResource	List
ListTargetsForPolicy	organizations:ListTargetsForPolicy	List
MoveAccount	organizations:MoveAccount	Write
PutResourcePolicy	organizations:PutResourcePolicy	Permissions management, Write
PutResourcePolicy	organizations:TagResource