英文:
How to access AWS resources created by secondary root account?
问题
背景: 一年半前,我的公司从一家软件公司购买了一个Web开发项目。现在,我尝试访问AWS控制台中的资源,但我无法看到任何已创建和正在运行的资源。例如,我在管理账户中看不到没有激活的 EC2 实例。我只能看到资源正在从成本管理中计费,包括 EC2 实例。
我创建了一个AWS账户(根用户),并将软件公司的人员添加为并行根用户(AWS组织的结构,我的账户是管理账户)。我无法访问其他创建的根账户。
问题: 我如何访问组织中其他账户创建的资源?我想更改EC2正在拉取运行代码的Git仓库等。
我熟悉Azure,但AWS对我来说一直很陌生。
我尝试熟悉AWS的访问策略(IAM),并搜索关于如何执行此操作的最佳实践。然而,我发现创建并行根用户绝对不是最佳实践。因此,我没有找到解决初始问题的方法。
我尝试使用AWS资源管理器来查找资源,但似乎没有帮助,因为创建的资源不会显示在我的管理账户中。
我尝试使用AWS资源资源浏览器来查找资源,但它也没有显示活动资源。
英文:
Background: A year and a half ago my company purchased a web development project from a software company. Now I try to access the recourses in the AWS console, but I can't see any of the created and running resources. E.g. I see no active EC2's using the management account. I only see that the resources are being billed from the cost management, including EC2.
I created an AWS account (root user) and added the software company's personnel as parallel root users (AWS oranization's structure, where my account is the management account). I don't have access to the other created root accounts.
Question: How can I access the resources created by other accounts in the organization? I would like to change the git repo where EC2 is pulling the code it runs etc.
I am familiar with Azure, but AWS has always been very unfamiliar to me.
I tried to familiarize myself with the access policies (IAM) of AWS as well as search for best practices on how this is done. However, I found that creating parallel root users is not definitely the best practice. Thus I did not find any resolution to the initial problem.
I tried to use AWS Resource Manager, to find the resources, but it does not seem to help as the resources created won't show up in my management account.
I tried to use AWS Resource Explorer, to find the resources, but it did not show the active resources either.
答案1
得分: 1
如果您无法访问所包含的组织中的帐户,也无法生成账单,我猜唯一的方式是打开一个支持工单并解释您的问题。
正确的方式是按照AWS组织中访问和管理成员帐户的说明的方法,授予您的辅助帐户对管理组织帐户的跨帐户访问权限。
英文:
If you have no access to the account included in your organization and from where the billings are generated, I guess that the only way is to open a support ticket and explain your problem.
The right way was to grant a cross-account access from you secondary account to the management Organization account, as explained in Accessing and administering the member accounts in your organization - AWS Organizations.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论