AWS account is a member of an active AWS Organization

Check ID: organizations_account_part_of_organizations
Provider: AWS
Service: organizations
Severity: MEDIUM
Categories: identity-access
Resource type: Other

Risk

Absence of AWS Organizations weakens governance across accounts. Without SCP guardrails and centralized policy, excessive permissions, unsafe network settings, or risky services may be enabled, threatening confidentiality and integrity. Fragmented logging and response slow containment, impacting availability and increasing cost exposure.

Recommendation

Operate all accounts under AWS Organizations (preferably with all features). Structure OUs, enforce SCPs for least privilege, and apply separation of duties between management and member accounts. Centralize logging and billing to support defense-in-depth, and routinely review org membership and policies.

Remediation

CLI
Terraform
Dashboard steps

aws organizations create-organization

# Creates an AWS Organization so this account becomes a member (status ACTIVE)
resource "aws_organizations_organization" "<example_resource_name>" {
  # Critical: creating this resource makes the account part of an active AWS Organization
}

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_account_part_of_organizations. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

AWS account is a member of an active AWS Organization

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires