@aws-sdk/client-organizations 3.281.0 → 3.283.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist-cjs/endpoint/ruleset.js +3 -3
- package/dist-cjs/models/models_0.js +1 -0
- package/dist-es/endpoint/ruleset.js +3 -3
- package/dist-es/models/models_0.js +1 -0
- package/dist-types/Organizations.d.ts +281 -278
- package/dist-types/OrganizationsClient.d.ts +27 -27
- package/dist-types/commands/AcceptHandshakeCommand.d.ts +7 -7
- package/dist-types/commands/AttachPolicyCommand.d.ts +2 -2
- package/dist-types/commands/CancelHandshakeCommand.d.ts +2 -2
- package/dist-types/commands/CloseAccountCommand.d.ts +26 -22
- package/dist-types/commands/CreateAccountCommand.d.ts +20 -20
- package/dist-types/commands/CreateGovCloudAccountCommand.d.ts +33 -35
- package/dist-types/commands/CreateOrganizationCommand.d.ts +2 -2
- package/dist-types/commands/CreateOrganizationalUnitCommand.d.ts +3 -3
- package/dist-types/commands/CreatePolicyCommand.d.ts +3 -3
- package/dist-types/commands/DeclineHandshakeCommand.d.ts +2 -2
- package/dist-types/commands/DeleteOrganizationalUnitCommand.d.ts +1 -1
- package/dist-types/commands/DeletePolicyCommand.d.ts +1 -1
- package/dist-types/commands/DeleteResourcePolicyCommand.d.ts +1 -1
- package/dist-types/commands/DeregisterDelegatedAdministratorCommand.d.ts +4 -4
- package/dist-types/commands/DescribeAccountCommand.d.ts +1 -1
- package/dist-types/commands/DescribeCreateAccountStatusCommand.d.ts +1 -1
- package/dist-types/commands/DescribeEffectivePolicyCommand.d.ts +3 -3
- package/dist-types/commands/DescribeHandshakeCommand.d.ts +2 -2
- package/dist-types/commands/DescribeOrganizationCommand.d.ts +3 -3
- package/dist-types/commands/DescribeOrganizationalUnitCommand.d.ts +1 -1
- package/dist-types/commands/DescribePolicyCommand.d.ts +1 -1
- package/dist-types/commands/DescribeResourcePolicyCommand.d.ts +2 -1
- package/dist-types/commands/DetachPolicyCommand.d.ts +4 -4
- package/dist-types/commands/DisableAWSServiceAccessCommand.d.ts +11 -11
- package/dist-types/commands/DisablePolicyTypeCommand.d.ts +3 -3
- package/dist-types/commands/EnableAWSServiceAccessCommand.d.ts +4 -4
- package/dist-types/commands/EnableAllFeaturesCommand.d.ts +6 -6
- package/dist-types/commands/EnablePolicyTypeCommand.d.ts +3 -3
- package/dist-types/commands/InviteAccountToOrganizationCommand.d.ts +8 -8
- package/dist-types/commands/LeaveOrganizationCommand.d.ts +23 -23
- package/dist-types/commands/ListAWSServiceAccessForOrganizationCommand.d.ts +2 -2
- package/dist-types/commands/ListAccountsCommand.d.ts +2 -2
- package/dist-types/commands/ListAccountsForParentCommand.d.ts +2 -2
- package/dist-types/commands/ListChildrenCommand.d.ts +2 -2
- package/dist-types/commands/ListCreateAccountStatusCommand.d.ts +2 -2
- package/dist-types/commands/ListDelegatedAdministratorsCommand.d.ts +1 -1
- package/dist-types/commands/ListDelegatedServicesForAccountCommand.d.ts +1 -1
- package/dist-types/commands/ListHandshakesForAccountCommand.d.ts +3 -3
- package/dist-types/commands/ListHandshakesForOrganizationCommand.d.ts +3 -3
- package/dist-types/commands/ListOrganizationalUnitsForParentCommand.d.ts +2 -2
- package/dist-types/commands/ListParentsCommand.d.ts +4 -4
- package/dist-types/commands/ListPoliciesCommand.d.ts +2 -2
- package/dist-types/commands/ListPoliciesForTargetCommand.d.ts +2 -2
- package/dist-types/commands/ListRootsCommand.d.ts +4 -4
- package/dist-types/commands/ListTagsForResourceCommand.d.ts +7 -7
- package/dist-types/commands/ListTargetsForPolicyCommand.d.ts +2 -2
- package/dist-types/commands/MoveAccountCommand.d.ts +1 -1
- package/dist-types/commands/PutResourcePolicyCommand.d.ts +1 -1
- package/dist-types/commands/RegisterDelegatedAdministratorCommand.d.ts +2 -2
- package/dist-types/commands/RemoveAccountFromOrganizationCommand.d.ts +10 -10
- package/dist-types/commands/TagResourceCommand.d.ts +7 -7
- package/dist-types/commands/UntagResourceCommand.d.ts +7 -7
- package/dist-types/commands/UpdateOrganizationalUnitCommand.d.ts +1 -1
- package/dist-types/commands/UpdatePolicyCommand.d.ts +1 -1
- package/dist-types/endpoint/EndpointParameters.d.ts +1 -1
- package/dist-types/models/models_0.d.ts +311 -304
- package/dist-types/ts3.4/endpoint/EndpointParameters.d.ts +1 -1
- package/dist-types/ts3.4/models/models_0.d.ts +1 -0
- package/package.json +17 -17
|
@@ -14,7 +14,7 @@ export interface DeleteResourcePolicyCommandOutput extends __MetadataBearer {
|
|
|
14
14
|
}
|
|
15
15
|
/**
|
|
16
16
|
* <p>Deletes the resource policy from your organization.</p>
|
|
17
|
-
*
|
|
17
|
+
* <p>You can only call this operation from the organization's management account.</p>
|
|
18
18
|
* @example
|
|
19
19
|
* Use a bare-bones client and the command you need to make an API call.
|
|
20
20
|
* ```javascript
|
|
@@ -16,18 +16,18 @@ export interface DeregisterDelegatedAdministratorCommandOutput extends __Metadat
|
|
|
16
16
|
/**
|
|
17
17
|
* <p>Removes the specified member Amazon Web Services account as a delegated administrator for the
|
|
18
18
|
* specified Amazon Web Services service.</p>
|
|
19
|
-
*
|
|
19
|
+
* <important>
|
|
20
20
|
* <p>Deregistering a delegated administrator can have unintended impacts on the
|
|
21
21
|
* functionality of the enabled Amazon Web Services service. See the documentation for the enabled
|
|
22
22
|
* service before you deregister a delegated administrator so that you understand any
|
|
23
23
|
* potential impacts.</p>
|
|
24
|
-
*
|
|
25
|
-
*
|
|
24
|
+
* </important>
|
|
25
|
+
* <p>You can run this action only for Amazon Web Services services that support this
|
|
26
26
|
* feature. For a current list of services that support it, see the column <i>Supports
|
|
27
27
|
* Delegated Administrator</i> in the table at <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html">Amazon Web Services Services that you can use with
|
|
28
28
|
* Organizations</a> in the <i>Organizations User Guide.</i>
|
|
29
29
|
* </p>
|
|
30
|
-
*
|
|
30
|
+
* <p>This operation can be called only from the organization's management account.</p>
|
|
31
31
|
* @example
|
|
32
32
|
* Use a bare-bones client and the command you need to make an API call.
|
|
33
33
|
* ```javascript
|
|
@@ -15,7 +15,7 @@ export interface DescribeAccountCommandOutput extends DescribeAccountResponse, _
|
|
|
15
15
|
}
|
|
16
16
|
/**
|
|
17
17
|
* <p>Retrieves Organizations-related information about the specified account.</p>
|
|
18
|
-
*
|
|
18
|
+
* <p>This operation can be called only from the organization's
|
|
19
19
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
20
20
|
* @example
|
|
21
21
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -15,7 +15,7 @@ export interface DescribeCreateAccountStatusCommandOutput extends DescribeCreate
|
|
|
15
15
|
}
|
|
16
16
|
/**
|
|
17
17
|
* <p>Retrieves the current status of an asynchronous request to create an account.</p>
|
|
18
|
-
*
|
|
18
|
+
* <p>This operation can be called only from the organization's
|
|
19
19
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
20
20
|
* @example
|
|
21
21
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -18,11 +18,11 @@ export interface DescribeEffectivePolicyCommandOutput extends DescribeEffectiveP
|
|
|
18
18
|
* The effective policy is the aggregation of any policies of the specified type that the
|
|
19
19
|
* account inherits, plus any policy of that type that is directly attached to the
|
|
20
20
|
* account.</p>
|
|
21
|
-
*
|
|
21
|
+
* <p>This operation applies only to policy types <i>other</i> than service
|
|
22
22
|
* control policies (SCPs).</p>
|
|
23
|
-
*
|
|
23
|
+
* <p>For more information about policy inheritance, see <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies-inheritance.html">How Policy Inheritance
|
|
24
24
|
* Works</a> in the <i>Organizations User Guide</i>.</p>
|
|
25
|
-
*
|
|
25
|
+
* <p>This operation can be called only from the organization's
|
|
26
26
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
27
27
|
* @example
|
|
28
28
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -17,10 +17,10 @@ export interface DescribeHandshakeCommandOutput extends DescribeHandshakeRespons
|
|
|
17
17
|
* <p>Retrieves information about a previously requested handshake. The handshake ID comes
|
|
18
18
|
* from the response to the original <a>InviteAccountToOrganization</a>
|
|
19
19
|
* operation that generated the handshake.</p>
|
|
20
|
-
*
|
|
20
|
+
* <p>You can access handshakes that are <code>ACCEPTED</code>, <code>DECLINED</code>, or
|
|
21
21
|
* <code>CANCELED</code> for only 30 days after they change to that state. They're then
|
|
22
22
|
* deleted and no longer accessible.</p>
|
|
23
|
-
*
|
|
23
|
+
* <p>This operation can be called from any account in the organization.</p>
|
|
24
24
|
* @example
|
|
25
25
|
* Use a bare-bones client and the command you need to make an API call.
|
|
26
26
|
* ```javascript
|
|
@@ -16,12 +16,12 @@ export interface DescribeOrganizationCommandOutput extends DescribeOrganizationR
|
|
|
16
16
|
/**
|
|
17
17
|
* <p>Retrieves information about the organization that the user's account belongs
|
|
18
18
|
* to.</p>
|
|
19
|
-
*
|
|
20
|
-
*
|
|
19
|
+
* <p>This operation can be called from any account in the organization.</p>
|
|
20
|
+
* <note>
|
|
21
21
|
* <p>Even if a policy type is shown as available in the organization, you can disable
|
|
22
22
|
* it separately at the root level with <a>DisablePolicyType</a>. Use <a>ListRoots</a> to see the status of policy types for a specified
|
|
23
23
|
* root.</p>
|
|
24
|
-
*
|
|
24
|
+
* </note>
|
|
25
25
|
* @example
|
|
26
26
|
* Use a bare-bones client and the command you need to make an API call.
|
|
27
27
|
* ```javascript
|
|
@@ -15,7 +15,7 @@ export interface DescribeOrganizationalUnitCommandOutput extends DescribeOrganiz
|
|
|
15
15
|
}
|
|
16
16
|
/**
|
|
17
17
|
* <p>Retrieves information about an organizational unit (OU).</p>
|
|
18
|
-
*
|
|
18
|
+
* <p>This operation can be called only from the organization's
|
|
19
19
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
20
20
|
* @example
|
|
21
21
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -15,7 +15,7 @@ export interface DescribePolicyCommandOutput extends DescribePolicyResponse, __M
|
|
|
15
15
|
}
|
|
16
16
|
/**
|
|
17
17
|
* <p>Retrieves information about a policy.</p>
|
|
18
|
-
*
|
|
18
|
+
* <p>This operation can be called only from the organization's
|
|
19
19
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
20
20
|
* @example
|
|
21
21
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -15,7 +15,8 @@ export interface DescribeResourcePolicyCommandOutput extends DescribeResourcePol
|
|
|
15
15
|
}
|
|
16
16
|
/**
|
|
17
17
|
* <p>Retrieves information about a resource policy.</p>
|
|
18
|
-
*
|
|
18
|
+
* <p>You can only call this operation from the organization's management account or by a
|
|
19
|
+
* member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
19
20
|
* @example
|
|
20
21
|
* Use a bare-bones client and the command you need to make an API call.
|
|
21
22
|
* ```javascript
|
|
@@ -15,12 +15,12 @@ export interface DetachPolicyCommandOutput extends __MetadataBearer {
|
|
|
15
15
|
}
|
|
16
16
|
/**
|
|
17
17
|
* <p>Detaches a policy from a target root, organizational unit (OU), or account.</p>
|
|
18
|
-
*
|
|
18
|
+
* <important>
|
|
19
19
|
* <p>If the policy being detached is a service control policy (SCP), the changes to
|
|
20
20
|
* permissions for Identity and Access Management (IAM) users and roles in affected accounts are
|
|
21
21
|
* immediate.</p>
|
|
22
|
-
*
|
|
23
|
-
*
|
|
22
|
+
* </important>
|
|
23
|
+
* <p>Every root, OU, and account must have at least one SCP attached. If you want to
|
|
24
24
|
* replace the default <code>FullAWSAccess</code> policy with an SCP that limits the
|
|
25
25
|
* permissions that can be delegated, you must attach the replacement SCP before you can
|
|
26
26
|
* remove the default SCP. This is the authorization strategy of an "<a href="https://docs.aws.amazon.com/organizations/latest/userguide/SCP_strategies.html#orgs_policies_allowlist">allow list</a>". If you instead attach a second SCP and
|
|
@@ -28,7 +28,7 @@ export interface DetachPolicyCommandOutput extends __MetadataBearer {
|
|
|
28
28
|
* "Deny"</code> in the second SCP to override the <code>"Effect": "Allow"</code> in
|
|
29
29
|
* the <code>FullAWSAccess</code> policy (or any other attached SCP), you're using the
|
|
30
30
|
* authorization strategy of a "<a href="https://docs.aws.amazon.com/organizations/latest/userguide/SCP_strategies.html#orgs_policies_denylist">deny list</a>".</p>
|
|
31
|
-
*
|
|
31
|
+
* <p>This operation can be called only from the organization's management account.</p>
|
|
32
32
|
* @example
|
|
33
33
|
* Use a bare-bones client and the command you need to make an API call.
|
|
34
34
|
* ```javascript
|
|
@@ -21,7 +21,7 @@ export interface DisableAWSServiceAccessCommandOutput extends __MetadataBearer {
|
|
|
21
21
|
* perform operations on your behalf on any new accounts in your organization. The service
|
|
22
22
|
* can still perform operations in older accounts until the service completes its clean-up
|
|
23
23
|
* from Organizations.</p>
|
|
24
|
-
*
|
|
24
|
+
* <important>
|
|
25
25
|
* <p>We <b>
|
|
26
26
|
* <i>strongly recommend</i>
|
|
27
27
|
* </b> that
|
|
@@ -37,39 +37,39 @@ export interface DisableAWSServiceAccessCommandOutput extends __MetadataBearer {
|
|
|
37
37
|
* occur:</p>
|
|
38
38
|
* <ul>
|
|
39
39
|
* <li>
|
|
40
|
-
*
|
|
40
|
+
* <p>The service can no longer create a service-linked role in the accounts in
|
|
41
41
|
* your organization. This means that the service can't perform operations on
|
|
42
42
|
* your behalf on any new accounts in your organization. The service can still
|
|
43
43
|
* perform operations in older accounts until the service completes its
|
|
44
44
|
* clean-up from Organizations. </p>
|
|
45
|
-
*
|
|
45
|
+
* </li>
|
|
46
46
|
* <li>
|
|
47
|
-
*
|
|
47
|
+
* <p>The service can no longer perform tasks in the member accounts in the
|
|
48
48
|
* organization, unless those operations are explicitly permitted by the IAM
|
|
49
49
|
* policies that are attached to your roles. This includes any data aggregation
|
|
50
50
|
* from the member accounts to the management account, or to a delegated
|
|
51
51
|
* administrator account, where relevant.</p>
|
|
52
|
-
*
|
|
52
|
+
* </li>
|
|
53
53
|
* <li>
|
|
54
|
-
*
|
|
54
|
+
* <p>Some services detect this and clean up any remaining data or resources
|
|
55
55
|
* related to the integration, while other services stop accessing the
|
|
56
56
|
* organization but leave any historical data and configuration in place to
|
|
57
57
|
* support a possible re-enabling of the integration.</p>
|
|
58
|
-
*
|
|
58
|
+
* </li>
|
|
59
59
|
* </ul>
|
|
60
60
|
* <p>Using the other service's console or commands to disable the integration ensures
|
|
61
61
|
* that the other service is aware that it can clean up any resources that are required
|
|
62
62
|
* only for the integration. How the service cleans up its resources in the
|
|
63
63
|
* organization's accounts depends on that service. For more information, see the
|
|
64
64
|
* documentation for the other Amazon Web Services service. </p>
|
|
65
|
-
*
|
|
66
|
-
*
|
|
65
|
+
* </important>
|
|
66
|
+
* <p>After you perform the <code>DisableAWSServiceAccess</code> operation, the specified
|
|
67
67
|
* service can no longer perform operations in your organization's accounts </p>
|
|
68
|
-
*
|
|
68
|
+
* <p>For more information about integrating other services with Organizations, including the
|
|
69
69
|
* list of services that work with Organizations, see <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html">Integrating Organizations with Other
|
|
70
70
|
* Amazon Web Services Services</a> in the <i>Organizations User Guide.</i>
|
|
71
71
|
* </p>
|
|
72
|
-
*
|
|
72
|
+
* <p>This operation can be called only from the organization's management account.</p>
|
|
73
73
|
* @example
|
|
74
74
|
* Use a bare-bones client and the command you need to make an API call.
|
|
75
75
|
* ```javascript
|
|
@@ -19,12 +19,12 @@ export interface DisablePolicyTypeCommandOutput extends DisablePolicyTypeRespons
|
|
|
19
19
|
* perform this operation, you no longer can attach policies of the specified type to that
|
|
20
20
|
* root or to any organizational unit (OU) or account in that root. You can undo this by
|
|
21
21
|
* using the <a>EnablePolicyType</a> operation.</p>
|
|
22
|
-
*
|
|
22
|
+
* <p>This is an asynchronous request that Amazon Web Services performs in the background. If you disable
|
|
23
23
|
* a policy type for a root, it still appears enabled for the organization if <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html">all features</a> are enabled for the organization. Amazon Web Services recommends that you
|
|
24
24
|
* first use <a>ListRoots</a> to see the status of policy types for a specified
|
|
25
25
|
* root, and then use this operation.</p>
|
|
26
|
-
*
|
|
27
|
-
*
|
|
26
|
+
* <p>This operation can be called only from the organization's management account.</p>
|
|
27
|
+
* <p> To view the status of available policy types in the organization, use <a>DescribeOrganization</a>.</p>
|
|
28
28
|
* @example
|
|
29
29
|
* Use a bare-bones client and the command you need to make an API call.
|
|
30
30
|
* ```javascript
|
|
@@ -19,19 +19,19 @@ export interface EnableAWSServiceAccessCommandOutput extends __MetadataBearer {
|
|
|
19
19
|
* the specified service to create a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html">service-linked role</a> in
|
|
20
20
|
* all the accounts in your organization. This allows the service to perform operations on
|
|
21
21
|
* your behalf in your organization and its accounts.</p>
|
|
22
|
-
*
|
|
22
|
+
* <important>
|
|
23
23
|
* <p>We recommend that you enable integration between Organizations and the specified Amazon Web Services
|
|
24
24
|
* service by using the console or commands that are provided by the specified service.
|
|
25
25
|
* Doing so ensures that the service is aware that it can create the resources that are
|
|
26
26
|
* required for the integration. How the service creates those resources in the
|
|
27
27
|
* organization's accounts depends on that service. For more information, see the
|
|
28
28
|
* documentation for the other Amazon Web Services service.</p>
|
|
29
|
-
*
|
|
30
|
-
*
|
|
29
|
+
* </important>
|
|
30
|
+
* <p>For more information about enabling services to integrate with Organizations, see <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html">Integrating
|
|
31
31
|
* Organizations with Other Amazon Web Services Services</a> in the
|
|
32
32
|
* <i>Organizations User Guide.</i>
|
|
33
33
|
* </p>
|
|
34
|
-
*
|
|
34
|
+
* <p>You can only call this operation from the organization's management account and only
|
|
35
35
|
* if the organization has <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html">enabled all
|
|
36
36
|
* features</a>.</p>
|
|
37
37
|
* @example
|
|
@@ -21,25 +21,25 @@ export interface EnableAllFeaturesCommandOutput extends EnableAllFeaturesRespons
|
|
|
21
21
|
* information, see <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_support-all-features.html">Enabling All Features in Your Organization</a> in the
|
|
22
22
|
* <i>Organizations User Guide.</i>
|
|
23
23
|
* </p>
|
|
24
|
-
*
|
|
24
|
+
* <important>
|
|
25
25
|
* <p>This operation is required only for organizations that were created explicitly
|
|
26
26
|
* with only the consolidated billing features enabled. Calling this operation sends a
|
|
27
27
|
* handshake to every invited account in the organization. The feature set change can
|
|
28
28
|
* be finalized and the additional features enabled only after all administrators in
|
|
29
29
|
* the invited accounts approve the change by accepting the handshake.</p>
|
|
30
|
-
*
|
|
31
|
-
*
|
|
30
|
+
* </important>
|
|
31
|
+
* <p>After you enable all features, you can separately enable or disable individual policy
|
|
32
32
|
* types in a root using <a>EnablePolicyType</a> and <a>DisablePolicyType</a>. To see the status of policy types in a root, use
|
|
33
33
|
* <a>ListRoots</a>.</p>
|
|
34
|
-
*
|
|
34
|
+
* <p>After all invited member accounts accept the handshake, you finalize the feature set
|
|
35
35
|
* change by accepting the handshake that contains <code>"Action":
|
|
36
36
|
* "ENABLE_ALL_FEATURES"</code>. This completes the change.</p>
|
|
37
|
-
*
|
|
37
|
+
* <p>After you enable all features in your organization, the management account in the
|
|
38
38
|
* organization can apply policies on all member accounts. These policies can restrict what
|
|
39
39
|
* users and even administrators in those accounts can do. The management account can apply
|
|
40
40
|
* policies that prevent accounts from leaving the organization. Ensure that your account
|
|
41
41
|
* administrators are aware of this.</p>
|
|
42
|
-
*
|
|
42
|
+
* <p>This operation can be called only from the organization's management account.</p>
|
|
43
43
|
* @example
|
|
44
44
|
* Use a bare-bones client and the command you need to make an API call.
|
|
45
45
|
* ```javascript
|
|
@@ -18,11 +18,11 @@ export interface EnablePolicyTypeCommandOutput extends EnablePolicyTypeResponse,
|
|
|
18
18
|
* attach policies of that type to the root, any organizational unit (OU), or account in
|
|
19
19
|
* that root. You can undo this by using the <a>DisablePolicyType</a>
|
|
20
20
|
* operation.</p>
|
|
21
|
-
*
|
|
21
|
+
* <p>This is an asynchronous request that Amazon Web Services performs in the background. Amazon Web Services
|
|
22
22
|
* recommends that you first use <a>ListRoots</a> to see the status of policy
|
|
23
23
|
* types for a specified root, and then use this operation.</p>
|
|
24
|
-
*
|
|
25
|
-
*
|
|
24
|
+
* <p>This operation can be called only from the organization's management account.</p>
|
|
25
|
+
* <p>You can enable a policy type in a root only if that policy type is available in the
|
|
26
26
|
* organization. To view the status of available policy types in the organization, use
|
|
27
27
|
* <a>DescribeOrganization</a>.</p>
|
|
28
28
|
* @example
|
|
@@ -18,28 +18,28 @@ export interface InviteAccountToOrganizationCommandOutput extends InviteAccountT
|
|
|
18
18
|
* Organizations sends email on your behalf to the email address that is associated with the
|
|
19
19
|
* other account's owner. The invitation is implemented as a <a>Handshake</a>
|
|
20
20
|
* whose details are in the response.</p>
|
|
21
|
-
*
|
|
21
|
+
* <important>
|
|
22
22
|
* <ul>
|
|
23
23
|
* <li>
|
|
24
|
-
*
|
|
24
|
+
* <p>You can invite Amazon Web Services accounts only from the same seller as the management
|
|
25
25
|
* account. For example, if your organization's management account was created
|
|
26
26
|
* by Amazon Internet Services Pvt. Ltd (AISPL), an Amazon Web Services seller in India, you
|
|
27
27
|
* can invite only other AISPL accounts to your organization. You can't combine
|
|
28
28
|
* accounts from AISPL and Amazon Web Services or from any other Amazon Web Services seller. For more
|
|
29
29
|
* information, see <a href="https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/useconsolidatedbilliing-India.html">Consolidated
|
|
30
30
|
* Billing in India</a>.</p>
|
|
31
|
-
*
|
|
31
|
+
* </li>
|
|
32
32
|
* <li>
|
|
33
|
-
*
|
|
33
|
+
* <p>If you receive an exception that indicates that you exceeded your account
|
|
34
34
|
* limits for the organization or that the operation failed because your
|
|
35
35
|
* organization is still initializing, wait one hour and then try again. If the
|
|
36
36
|
* error persists after an hour, contact <a href="https://console.aws.amazon.com/support/home#/">Amazon Web Services Support</a>.</p>
|
|
37
|
-
*
|
|
37
|
+
* </li>
|
|
38
38
|
* </ul>
|
|
39
|
-
*
|
|
40
|
-
*
|
|
39
|
+
* </important>
|
|
40
|
+
* <p>If the request includes tags, then the requester must have the
|
|
41
41
|
* <code>organizations:TagResource</code> permission.</p>
|
|
42
|
-
*
|
|
42
|
+
* <p>This operation can be called only from the organization's management account.</p>
|
|
43
43
|
* @example
|
|
44
44
|
* Use a bare-bones client and the command you need to make an API call.
|
|
45
45
|
* ```javascript
|
|
@@ -17,17 +17,17 @@ export interface LeaveOrganizationCommandOutput extends __MetadataBearer {
|
|
|
17
17
|
* is performed by the account that wants to leave. To remove a member account as a user in
|
|
18
18
|
* the management account, use <a>RemoveAccountFromOrganization</a>
|
|
19
19
|
* instead.</p>
|
|
20
|
-
*
|
|
21
|
-
*
|
|
20
|
+
* <p>This operation can be called only from a member account in the organization.</p>
|
|
21
|
+
* <important>
|
|
22
22
|
* <ul>
|
|
23
23
|
* <li>
|
|
24
|
-
*
|
|
24
|
+
* <p>The management account in an organization with all features enabled can
|
|
25
25
|
* set service control policies (SCPs) that can restrict what administrators of
|
|
26
26
|
* member accounts can do. This includes preventing them from successfully
|
|
27
27
|
* calling <code>LeaveOrganization</code> and leaving the organization.</p>
|
|
28
|
-
*
|
|
28
|
+
* </li>
|
|
29
29
|
* <li>
|
|
30
|
-
*
|
|
30
|
+
* <p>You can leave an organization as a member account only if the account is
|
|
31
31
|
* configured with the information required to operate as a standalone account.
|
|
32
32
|
* When you create an account in an organization using the Organizations console,
|
|
33
33
|
* API, or CLI commands, the information required of standalone accounts is
|
|
@@ -35,49 +35,49 @@ export interface LeaveOrganizationCommandOutput extends __MetadataBearer {
|
|
|
35
35
|
* you want to make standalone, you must perform the following steps. If any of
|
|
36
36
|
* the steps are already completed for this account, that step doesn't
|
|
37
37
|
* appear.</p>
|
|
38
|
-
*
|
|
38
|
+
* <ul>
|
|
39
39
|
* <li>
|
|
40
|
-
*
|
|
41
|
-
*
|
|
40
|
+
* <p>Choose a support plan</p>
|
|
41
|
+
* </li>
|
|
42
42
|
* <li>
|
|
43
|
-
*
|
|
44
|
-
*
|
|
43
|
+
* <p>Provide and verify the required contact information</p>
|
|
44
|
+
* </li>
|
|
45
45
|
* <li>
|
|
46
|
-
*
|
|
47
|
-
*
|
|
46
|
+
* <p>Provide a current payment method</p>
|
|
47
|
+
* </li>
|
|
48
48
|
* </ul>
|
|
49
|
-
*
|
|
49
|
+
* <p>Amazon Web Services uses the payment method to charge for any billable (not free tier)
|
|
50
50
|
* Amazon Web Services activity that occurs while the account isn't attached to an
|
|
51
51
|
* organization. Follow the steps at <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html#leave-without-all-info"> To leave an organization when all required account information has not
|
|
52
52
|
* yet been provided</a> in the
|
|
53
53
|
* <i>Organizations User Guide.</i>
|
|
54
54
|
* </p>
|
|
55
|
-
*
|
|
55
|
+
* </li>
|
|
56
56
|
* <li>
|
|
57
|
-
*
|
|
57
|
+
* <p>The account that you want to leave must not be a delegated administrator
|
|
58
58
|
* account for any Amazon Web Services service enabled for your organization. If the account
|
|
59
59
|
* is a delegated administrator, you must first change the delegated
|
|
60
60
|
* administrator account to another account that is remaining in the
|
|
61
61
|
* organization.</p>
|
|
62
|
-
*
|
|
62
|
+
* </li>
|
|
63
63
|
* <li>
|
|
64
|
-
*
|
|
64
|
+
* <p>You can leave an organization only after you enable IAM user access to
|
|
65
65
|
* billing in your account. For more information, see <a href="https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/grantaccess.html#ControllingAccessWebsite-Activate">Activating Access to the Billing and Cost Management Console</a> in the
|
|
66
66
|
* <i>Amazon Web Services Billing and Cost Management User Guide.</i>
|
|
67
67
|
* </p>
|
|
68
|
-
*
|
|
68
|
+
* </li>
|
|
69
69
|
* <li>
|
|
70
|
-
*
|
|
70
|
+
* <p>After the account leaves the organization, all tags that were attached to
|
|
71
71
|
* the account object in the organization are deleted. Amazon Web Services accounts outside
|
|
72
72
|
* of an organization do not support tags.</p>
|
|
73
|
-
*
|
|
73
|
+
* </li>
|
|
74
74
|
* <li>
|
|
75
|
-
*
|
|
75
|
+
* <p>A newly created account has a waiting period before it can be removed from
|
|
76
76
|
* its organization. If you get an error that indicates that a wait period is
|
|
77
77
|
* required, then try again in a few days.</p>
|
|
78
|
-
*
|
|
78
|
+
* </li>
|
|
79
79
|
* </ul>
|
|
80
|
-
*
|
|
80
|
+
* </important>
|
|
81
81
|
* @example
|
|
82
82
|
* Use a bare-bones client and the command you need to make an API call.
|
|
83
83
|
* ```javascript
|
|
@@ -17,11 +17,11 @@ export interface ListAWSServiceAccessForOrganizationCommandOutput extends ListAW
|
|
|
17
17
|
* <p>Returns a list of the Amazon Web Services services that you enabled to integrate with your
|
|
18
18
|
* organization. After a service on this list creates the resources that it requires for
|
|
19
19
|
* the integration, it can perform operations on your organization and its accounts.</p>
|
|
20
|
-
*
|
|
20
|
+
* <p>For more information about integrating other services with Organizations, including the
|
|
21
21
|
* list of services that currently work with Organizations, see <a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html">Integrating Organizations with Other
|
|
22
22
|
* Amazon Web Services Services</a> in the <i>Organizations User Guide.</i>
|
|
23
23
|
* </p>
|
|
24
|
-
*
|
|
24
|
+
* <p>This operation can be called only from the organization's
|
|
25
25
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
26
26
|
* @example
|
|
27
27
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -16,7 +16,7 @@ export interface ListAccountsCommandOutput extends ListAccountsResponse, __Metad
|
|
|
16
16
|
/**
|
|
17
17
|
* <p>Lists all the accounts in the organization. To request only the accounts in a
|
|
18
18
|
* specified root or organizational unit (OU), use the <a>ListAccountsForParent</a> operation instead.</p>
|
|
19
|
-
*
|
|
19
|
+
* <note>
|
|
20
20
|
* <p>Always check the <code>NextToken</code> response parameter
|
|
21
21
|
* for a <code>null</code> value when calling a <code>List*</code> operation. These operations can
|
|
22
22
|
* occasionally return an empty set of results even when there are more results available. The
|
|
@@ -24,7 +24,7 @@ export interface ListAccountsCommandOutput extends ListAccountsResponse, __Metad
|
|
|
24
24
|
* <i>only</i>
|
|
25
25
|
* when there are no more results to display.</p>
|
|
26
26
|
* </note>
|
|
27
|
-
*
|
|
27
|
+
* <p>This operation can be called only from the organization's
|
|
28
28
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
29
29
|
* @example
|
|
30
30
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -19,7 +19,7 @@ export interface ListAccountsForParentCommandOutput extends ListAccountsForParen
|
|
|
19
19
|
* that aren't in any OU. If you specify an OU, you get a list of all the accounts in only
|
|
20
20
|
* that OU and not in any child OUs. To get a list of all accounts in the organization, use
|
|
21
21
|
* the <a>ListAccounts</a> operation.</p>
|
|
22
|
-
*
|
|
22
|
+
* <note>
|
|
23
23
|
* <p>Always check the <code>NextToken</code> response parameter
|
|
24
24
|
* for a <code>null</code> value when calling a <code>List*</code> operation. These operations can
|
|
25
25
|
* occasionally return an empty set of results even when there are more results available. The
|
|
@@ -27,7 +27,7 @@ export interface ListAccountsForParentCommandOutput extends ListAccountsForParen
|
|
|
27
27
|
* <i>only</i>
|
|
28
28
|
* when there are no more results to display.</p>
|
|
29
29
|
* </note>
|
|
30
|
-
*
|
|
30
|
+
* <p>This operation can be called only from the organization's
|
|
31
31
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
32
32
|
* @example
|
|
33
33
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -17,7 +17,7 @@ export interface ListChildrenCommandOutput extends ListChildrenResponse, __Metad
|
|
|
17
17
|
* <p>Lists all of the organizational units (OUs) or accounts that are contained in the
|
|
18
18
|
* specified parent OU or root. This operation, along with <a>ListParents</a>
|
|
19
19
|
* enables you to traverse the tree structure that makes up this root.</p>
|
|
20
|
-
*
|
|
20
|
+
* <note>
|
|
21
21
|
* <p>Always check the <code>NextToken</code> response parameter
|
|
22
22
|
* for a <code>null</code> value when calling a <code>List*</code> operation. These operations can
|
|
23
23
|
* occasionally return an empty set of results even when there are more results available. The
|
|
@@ -25,7 +25,7 @@ export interface ListChildrenCommandOutput extends ListChildrenResponse, __Metad
|
|
|
25
25
|
* <i>only</i>
|
|
26
26
|
* when there are no more results to display.</p>
|
|
27
27
|
* </note>
|
|
28
|
-
*
|
|
28
|
+
* <p>This operation can be called only from the organization's
|
|
29
29
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
30
30
|
* @example
|
|
31
31
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -16,7 +16,7 @@ export interface ListCreateAccountStatusCommandOutput extends ListCreateAccountS
|
|
|
16
16
|
/**
|
|
17
17
|
* <p>Lists the account creation requests that match the specified status that is currently
|
|
18
18
|
* being tracked for the organization.</p>
|
|
19
|
-
*
|
|
19
|
+
* <note>
|
|
20
20
|
* <p>Always check the <code>NextToken</code> response parameter
|
|
21
21
|
* for a <code>null</code> value when calling a <code>List*</code> operation. These operations can
|
|
22
22
|
* occasionally return an empty set of results even when there are more results available. The
|
|
@@ -24,7 +24,7 @@ export interface ListCreateAccountStatusCommandOutput extends ListCreateAccountS
|
|
|
24
24
|
* <i>only</i>
|
|
25
25
|
* when there are no more results to display.</p>
|
|
26
26
|
* </note>
|
|
27
|
-
*
|
|
27
|
+
* <p>This operation can be called only from the organization's
|
|
28
28
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
29
29
|
* @example
|
|
30
30
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -16,7 +16,7 @@ export interface ListDelegatedAdministratorsCommandOutput extends ListDelegatedA
|
|
|
16
16
|
/**
|
|
17
17
|
* <p>Lists the Amazon Web Services accounts that are designated as delegated administrators in this
|
|
18
18
|
* organization.</p>
|
|
19
|
-
*
|
|
19
|
+
* <p>This operation can be called only from the organization's
|
|
20
20
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
21
21
|
* @example
|
|
22
22
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -16,7 +16,7 @@ export interface ListDelegatedServicesForAccountCommandOutput extends ListDelega
|
|
|
16
16
|
/**
|
|
17
17
|
* <p>List the Amazon Web Services services for which the specified account is a delegated
|
|
18
18
|
* administrator.</p>
|
|
19
|
-
*
|
|
19
|
+
* <p>This operation can be called only from the organization's
|
|
20
20
|
* management account or by a member account that is a delegated administrator for an Amazon Web Services service.</p>
|
|
21
21
|
* @example
|
|
22
22
|
* Use a bare-bones client and the command you need to make an API call.
|
|
@@ -16,11 +16,11 @@ export interface ListHandshakesForAccountCommandOutput extends ListHandshakesFor
|
|
|
16
16
|
/**
|
|
17
17
|
* <p>Lists the current handshakes that are associated with the account of the requesting
|
|
18
18
|
* user.</p>
|
|
19
|
-
*
|
|
19
|
+
* <p>Handshakes that are <code>ACCEPTED</code>, <code>DECLINED</code>,
|
|
20
20
|
* <code>CANCELED</code>, or <code>EXPIRED</code> appear in the results of this API for
|
|
21
21
|
* only 30 days after changing to that state. After that, they're deleted and no longer
|
|
22
22
|
* accessible.</p>
|
|
23
|
-
*
|
|
23
|
+
* <note>
|
|
24
24
|
* <p>Always check the <code>NextToken</code> response parameter
|
|
25
25
|
* for a <code>null</code> value when calling a <code>List*</code> operation. These operations can
|
|
26
26
|
* occasionally return an empty set of results even when there are more results available. The
|
|
@@ -28,7 +28,7 @@ export interface ListHandshakesForAccountCommandOutput extends ListHandshakesFor
|
|
|
28
28
|
* <i>only</i>
|
|
29
29
|
* when there are no more results to display.</p>
|
|
30
30
|
* </note>
|
|
31
|
-
*
|
|
31
|
+
* <p>This operation can be called from any account in the organization.</p>
|
|
32
32
|
* @example
|
|
33
33
|
* Use a bare-bones client and the command you need to make an API call.
|
|
34
34
|
* ```javascript
|