Docs
PackagesTry AWS Native preview for resources not in the classic version.
aws.organizations.Account
Explore with Pulumi AI
Try AWS Native preview for resources not in the classic version.
Provides a resource to create a member account in the current organization.
Note: Account management must be done from the organization’s root account.
Note: By default, deleting this resource will only remove an AWS account from an organization. You must set the
close_on_deletionflag to true to close the account. It is worth noting that quotas are enforced when using theclose_on_deletionargument, which can produce a CLOSE_ACCOUNT_QUOTA_EXCEEDED error, and require you to close the account manually.
Example Usage
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var account = new Aws.Organizations.Account("account", new()
{
Email = "john@doe.org",
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := organizations.NewAccount(ctx, "account", &organizations.AccountArgs{
Email: pulumi.String("john@doe.org"),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.organizations.Account;
import com.pulumi.aws.organizations.AccountArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var account = new Account("account", AccountArgs.builder()
.email("john@doe.org")
.build());
}
}
import pulumi
import pulumi_aws as aws
account = aws.organizations.Account("account", email="john@doe.org")
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const account = new aws.organizations.Account("account", {email: "john@doe.org"});
resources:
account:
type: aws:organizations:Account
properties:
email: john@doe.org
Create Account Resource
new Account(name: string, args: AccountArgs, opts?: CustomResourceOptions);@overload
def Account(resource_name: str,
opts: Optional[ResourceOptions] = None,
close_on_deletion: Optional[bool] = None,
create_govcloud: Optional[bool] = None,
email: Optional[str] = None,
iam_user_access_to_billing: Optional[str] = None,
name: Optional[str] = None,
parent_id: Optional[str] = None,
role_name: Optional[str] = None,
tags: Optional[Mapping[str, str]] = None)
@overload
def Account(resource_name: str,
args: AccountArgs,
opts: Optional[ResourceOptions] = None)func NewAccount(ctx *Context, name string, args AccountArgs, opts ...ResourceOption) (*Account, error)public Account(string name, AccountArgs args, CustomResourceOptions? opts = null)
public Account(String name, AccountArgs args)
public Account(String name, AccountArgs args, CustomResourceOptions options)
type: aws:organizations:Account
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AccountArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args AccountArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args AccountArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AccountArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args AccountArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Account Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The Account resource accepts the following input properties:
- Email string
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- Close
On boolDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- Create
Govcloud bool Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- Iam
User stringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- Name string
Friendly name for the member account.
The following arguments are optional:
- Parent
Id string Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- Role
Name string The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- Dictionary<string, string>
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.
- Email string
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- Close
On boolDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- Create
Govcloud bool Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- Iam
User stringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- Name string
Friendly name for the member account.
The following arguments are optional:
- Parent
Id string Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- Role
Name string The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- map[string]string
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.
- email String
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- close
On BooleanDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create
Govcloud Boolean Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- iam
User StringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- name String
Friendly name for the member account.
The following arguments are optional:
- parent
Id String Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role
Name String The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- Map<String,String>
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.
- email string
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- close
On booleanDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create
Govcloud boolean Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- iam
User stringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- name string
Friendly name for the member account.
The following arguments are optional:
- parent
Id string Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role
Name string The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- {[key: string]: string}
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.
- email str
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- close_
on_ booldeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create_
govcloud bool Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- iam_
user_ straccess_ to_ billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- name str
Friendly name for the member account.
The following arguments are optional:
- parent_
id str Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role_
name str The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- Mapping[str, str]
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.
- email String
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- close
On BooleanDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create
Govcloud Boolean Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- iam
User StringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- name String
Friendly name for the member account.
The following arguments are optional:
- parent
Id String Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role
Name String The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- Map<String>
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.
Outputs
All input properties are implicitly available as output properties. Additionally, the Account resource produces the following output properties:
- Arn string
The ARN for this account.
- Govcloud
Id string ID for a GovCloud account created with the account.
- Id string
The provider-assigned unique ID for this managed resource.
- Joined
Method string - Joined
Timestamp string - Status string
- Dictionary<string, string>
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- Arn string
The ARN for this account.
- Govcloud
Id string ID for a GovCloud account created with the account.
- Id string
The provider-assigned unique ID for this managed resource.
- Joined
Method string - Joined
Timestamp string - Status string
- map[string]string
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn String
The ARN for this account.
- govcloud
Id String ID for a GovCloud account created with the account.
- id String
The provider-assigned unique ID for this managed resource.
- joined
Method String - joined
Timestamp String - status String
- Map<String,String>
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn string
The ARN for this account.
- govcloud
Id string ID for a GovCloud account created with the account.
- id string
The provider-assigned unique ID for this managed resource.
- joined
Method string - joined
Timestamp string - status string
- {[key: string]: string}
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn str
The ARN for this account.
- govcloud_
id str ID for a GovCloud account created with the account.
- id str
The provider-assigned unique ID for this managed resource.
- joined_
method str - joined_
timestamp str - status str
- Mapping[str, str]
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn String
The ARN for this account.
- govcloud
Id String ID for a GovCloud account created with the account.
- id String
The provider-assigned unique ID for this managed resource.
- joined
Method String - joined
Timestamp String - status String
- Map<String>
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
Look up Existing Account Resource
Get an existing Account resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AccountState, opts?: CustomResourceOptions): Account@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
arn: Optional[str] = None,
close_on_deletion: Optional[bool] = None,
create_govcloud: Optional[bool] = None,
email: Optional[str] = None,
govcloud_id: Optional[str] = None,
iam_user_access_to_billing: Optional[str] = None,
joined_method: Optional[str] = None,
joined_timestamp: Optional[str] = None,
name: Optional[str] = None,
parent_id: Optional[str] = None,
role_name: Optional[str] = None,
status: Optional[str] = None,
tags: Optional[Mapping[str, str]] = None,
tags_all: Optional[Mapping[str, str]] = None) -> Accountfunc GetAccount(ctx *Context, name string, id IDInput, state *AccountState, opts ...ResourceOption) (*Account, error)public static Account Get(string name, Input<string> id, AccountState? state, CustomResourceOptions? opts = null)public static Account get(String name, Output<String> id, AccountState state, CustomResourceOptions options)Resource lookup is not supported in YAML- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Arn string
The ARN for this account.
- Close
On boolDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- Create
Govcloud bool Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- Email string
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- Govcloud
Id string ID for a GovCloud account created with the account.
- Iam
User stringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- Joined
Method string - Joined
Timestamp string - Name string
Friendly name for the member account.
The following arguments are optional:
- Parent
Id string Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- Role
Name string The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- Status string
- Dictionary<string, string>
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.- Dictionary<string, string>
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- Arn string
The ARN for this account.
- Close
On boolDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- Create
Govcloud bool Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- Email string
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- Govcloud
Id string ID for a GovCloud account created with the account.
- Iam
User stringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- Joined
Method string - Joined
Timestamp string - Name string
Friendly name for the member account.
The following arguments are optional:
- Parent
Id string Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- Role
Name string The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- Status string
- map[string]string
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.- map[string]string
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn String
The ARN for this account.
- close
On BooleanDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create
Govcloud Boolean Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- email String
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- govcloud
Id String ID for a GovCloud account created with the account.
- iam
User StringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- joined
Method String - joined
Timestamp String - name String
Friendly name for the member account.
The following arguments are optional:
- parent
Id String Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role
Name String The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- status String
- Map<String,String>
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.- Map<String,String>
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn string
The ARN for this account.
- close
On booleanDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create
Govcloud boolean Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- email string
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- govcloud
Id string ID for a GovCloud account created with the account.
- iam
User stringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- joined
Method string - joined
Timestamp string - name string
Friendly name for the member account.
The following arguments are optional:
- parent
Id string Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role
Name string The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- status string
- {[key: string]: string}
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.- {[key: string]: string}
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn str
The ARN for this account.
- close_
on_ booldeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create_
govcloud bool Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- email str
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- govcloud_
id str ID for a GovCloud account created with the account.
- iam_
user_ straccess_ to_ billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- joined_
method str - joined_
timestamp str - name str
Friendly name for the member account.
The following arguments are optional:
- parent_
id str Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role_
name str The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- status str
- Mapping[str, str]
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.- Mapping[str, str]
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
- arn String
The ARN for this account.
- close
On BooleanDeletion If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
- create
Govcloud Boolean Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If
true, the GovCloud account ID is available in thegovcloud_idattribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.- email String
Email address of the owner to assign to the new member account. This email address must not already be associated with another AWS account.
- govcloud
Id String ID for a GovCloud account created with the account.
- iam
User StringAccess To Billing If set to
ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set toDENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this toALLOW. If the resource is created and this option is changed, it will try to recreate the account.- joined
Method String - joined
Timestamp String - name String
Friendly name for the member account.
The following arguments are optional:
- parent
Id String Parent Organizational Unit ID or Root ID for the account. Defaults to the Organization default Root ID. A configuration must be present for this argument to perform drift detection.
- role
Name String The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless
ignoreChangesis used.- status String
- Map<String>
Key-value map of resource tags. If configured with a provider
default_tagsconfiguration block present, tags with matching keys will overwrite those defined at the provider-level.- Map<String>
A map of tags assigned to the resource, including those inherited from the provider
default_tagsconfiguration block.Please use
tagsinstead.
Import
Using pulumi import, import the AWS member account using the account_id. For example:
$ pulumi import aws:organizations/account:Account my_account 111111111111
Certain resource arguments, like role_name, do not have an Organizations API method for reading the information after account creation. If the argument is set in the TODO configuration on an imported resource, TODO will always show a difference. To workaround this behavior, either omit the argument from the TODO configuration or use ignore_changes to hide the difference. For example:
Package Details
- Repository
- AWS Classic pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
awsTerraform Provider.
Try AWS Native preview for resources not in the classic version.