Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Organizations

AWS Organizations (service prefix: organizations) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Organizations
Actions defined by AWS Organizations
Resource types defined by AWS Organizations
Condition keys for AWS Organizations

API operations defined by AWS Organizations

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptHandshake	organizations:AcceptHandshake	Write
AcceptHandshake	organizations:LeaveOrganization	Write
AttachPolicy	organizations:AttachPolicy	Permissions management, Write
CancelHandshake	organizations:CancelHandshake	Write
CloseAccount	organizations:CloseAccount	Write
CreateAccount	organizations:CreateAccount	Write
CreateAccount	organizations:TagResource	Tagging, Write
CreateGovCloudAccount	organizations:CreateGovCloudAccount	Write
CreateGovCloudAccount	organizations:TagResource	Tagging, Write
CreateOrganization	organizations:CreateOrganization	Write
CreateOrganizationalUnit	organizations:CreateOrganizationalUnit	Write
CreateOrganizationalUnit	organizations:TagResource	Tagging, Write
CreatePolicy	organizations:CreatePolicy	Write
CreatePolicy	organizations:TagResource	Tagging, Write
DeclineHandshake	organizations:DeclineHandshake	Write
DeleteOrganization	organizations:DeleteOrganization	Write
DeleteOrganizationalUnit	organizations:DeleteOrganizationalUnit	Write
DeletePolicy	organizations:DeletePolicy	Write
DeleteResourcePolicy	organizations:DeleteResourcePolicy	Permissions management, Write
DeregisterDelegatedAdministrator	organizations:DeregisterDelegatedAdministrator	Write
DescribeAccount	organizations:DescribeAccount	Read
DescribeCreateAccountStatus	organizations:DescribeCreateAccountStatus	Read
DescribeEffectivePolicy	organizations:DescribeEffectivePolicy	Read
DescribeHandshake	organizations:DescribeHandshake	Read
DescribeOrganization	organizations:DescribeOrganization	Read
DescribeOrganizationalUnit	organizations:DescribeOrganizationalUnit	Read
DescribePolicy	organizations:DescribePolicy	Read
DescribeResourcePolicy	organizations:DescribeResourcePolicy	Read
DescribeResponsibilityTransfer	organizations:DescribeResponsibilityTransfer	Read
DetachPolicy	organizations:DetachPolicy	Permissions management, Write
DisableAWSServiceAccess	organizations:DisableAWSServiceAccess	Write
DisablePolicyType	organizations:DisablePolicyType	Write
EnableAWSServiceAccess	organizations:EnableAWSServiceAccess	Write
EnableAllFeatures	organizations:EnableAllFeatures	Write
EnablePolicyType	organizations:EnablePolicyType	Write
InviteAccountToOrganization	organizations:InviteAccountToOrganization