How to Attach an AWS Organization Policy to a Child Account or OU

Scenario:-
To attach a policy to a child account or an Organizational Unit (OU) in AWS Organizations, follow these steps:

Log In to AWS Management Console:
- Use the management account or a delegated administrator account for AWS Organizations.
Navigate to AWS Organizations:
- Open the AWS Organizations Console.
Access Policies:
- In the left-hand menu, click on Policies and choose the type of policy (e.g., Service Control Policies, Tag Policies, etc.).
Select and Attach Policy:
- Find the policy you want to attach and click on it.
- Click Attach Policy, then select the target (OU or child account) from the list.
- Confirm the action by clicking Attach again.
Review Effective Policies:
- Navigate to the Accounts section in AWS Organizations.
- Select the account or OU and click Effective Policies to verify the applied policies.

Scenario:

When you log in with a child account and attempt to add an organization-level policy, you receive the error:

"You don't have permission to see this page because the management account has not granted you permission to view policies."

Resolution:

This error occurs because organization-level policies can only be managed by the management account or delegated administrator accounts. Child accounts do not have default permissions to view or add these policies.

Steps to Resolve:

Verify Account Roles and Permissions:
- Ensure you are logged in with a child account.
- Check if there are Service Control Policies (SCPs) applied to the child account that restrict access.
Contact the Management Account Administrator:
- Request the management account administrator to grant permissions to your child account for viewing policies.

Example SCP to allow policy viewing:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "organizations:DescribePolicy",
                    "organizations:ListPolicies",
                    "organizations:AttachPolicy"
                ],
                "Resource": "*"
            }
        ]
    }

Use the Management Account for Policy Management:
- If permissions cannot be granted, ask the management account administrator to log in and perform the required actions.

Delegate Access with IAM Roles:

The management account can create a role with necessary permissions and allow the child account to assume the role.
Example Role Policy for Delegation:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "organizations:DescribePolicy",
                    "organizations:ListPolicies",
                    "organizations:AttachPolicy"
                ],
                "Resource": "*"
            }
        ]
    }

Attach Policies Through Delegated Access:
- Once access is delegated, the child account can assume the role and attach policies to specific OUs or accounts.

Important Notes:

Policies must be attached from the management account unless permissions are explicitly delegated.
SCPs applied at the root or OU level might restrict child account permissions.

How can I attach an AWS Organization policy to a child account or Organizational Unit (OU)?

Comments

Ops Fix Hub

AWS EFS Backup and Restore: Step-by-Step Guide & Best Practices

More from this blog

Cost Optimization with Planned Downtime Migrating an EBS-Backed StatefulSet from Multi-AZ to Single-AZ in Amazon EKS (Production Pattern)

From Provisioning to Control Plane: Designing a Hybrid Terraform + Crossplane Architecture at Scale

Cross-Cloud VM Migration: GCP → AWS Using AWS Application Migration Service (MGN)

AWS DevOps Agent: Real Testing, Architecture & Practical Insights

Production-Grade GCS to S3 Migration: Secure, Private, and Zero-Egress Architecture

Scenario:

"You don't have permission to see this page because the management account has not granted you permission to view policies."

Resolution:

Steps to Resolve:

Important Notes:

Command Palette

Comments

Ops Fix Hub

AWS EFS Backup and Restore: Step-by-Step Guide & Best Practices

More from this blog

Scenario:

"You don't have permission to see this page because the management account has not granted you permission to view policies."

Resolution:

Steps to Resolve:

Important Notes: