如何访问由次级根帐户创建的AWS资源?

huangapple go评论60阅读模式
英文:

How to access AWS resources created by secondary root account?

问题

背景: 一年半前,我的公司从一家软件公司购买了一个Web开发项目。现在,我尝试访问AWS控制台中的资源,但我无法看到任何已创建和正在运行的资源。例如,我在管理账户中看不到没有激活的 EC2 实例。我只能看到资源正在从成本管理中计费,包括 EC2 实例。

我创建了一个AWS账户(根用户),并将软件公司的人员添加为并行根用户(AWS组织的结构,我的账户是管理账户)。我无法访问其他创建的根账户。

问题: 我如何访问组织中其他账户创建的资源?我想更改EC2正在拉取运行代码的Git仓库等。

我熟悉Azure,但AWS对我来说一直很陌生。

我尝试熟悉AWS的访问策略(IAM),并搜索关于如何执行此操作的最佳实践。然而,我发现创建并行根用户绝对不是最佳实践。因此,我没有找到解决初始问题的方法。

我尝试使用AWS资源管理器来查找资源,但似乎没有帮助,因为创建的资源不会显示在我的管理账户中。

我尝试使用AWS资源资源浏览器来查找资源,但它也没有显示活动资源。

英文:

Background: A year and a half ago my company purchased a web development project from a software company. Now I try to access the recourses in the AWS console, but I can't see any of the created and running resources. E.g. I see no active EC2's using the management account. I only see that the resources are being billed from the cost management, including EC2.

I created an AWS account (root user) and added the software company's personnel as parallel root users (AWS oranization's structure, where my account is the management account). I don't have access to the other created root accounts.

Question: How can I access the resources created by other accounts in the organization? I would like to change the git repo where EC2 is pulling the code it runs etc.

I am familiar with Azure, but AWS has always been very unfamiliar to me.

I tried to familiarize myself with the access policies (IAM) of AWS as well as search for best practices on how this is done. However, I found that creating parallel root users is not definitely the best practice. Thus I did not find any resolution to the initial problem.

I tried to use AWS Resource Manager, to find the resources, but it does not seem to help as the resources created won't show up in my management account.

I tried to use AWS Resource Explorer, to find the resources, but it did not show the active resources either.

答案1

得分: 1

如果您无法访问所包含的组织中的帐户,也无法生成账单,我猜唯一的方式是打开一个支持工单并解释您的问题。

正确的方式是按照AWS组织中访问和管理成员帐户的说明的方法,授予您的辅助帐户对管理组织帐户的跨帐户访问权限。

英文:

If you have no access to the account included in your organization and from where the billings are generated, I guess that the only way is to open a support ticket and explain your problem.

The right way was to grant a cross-account access from you secondary account to the management Organization account, as explained in Accessing and administering the member accounts in your organization - AWS Organizations.

huangapple
  • 本文由 发表于 2023年2月26日 20:50:43
  • 转载请务必保留本文链接:https://go.coder-hub.com/75572093.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定