Account
Provides a resource to create a member account in the current organization.
Note: Account management must be done from the organization's root account. Note: By default, deleting this resource will only remove an AWS account from an organization. You must set the
close_on_deletionflag to true to close the account. It is worth noting that quotas are enforced when using theclose_on_deletionargument, which can produce a CLOSE_ACCOUNT_QUOTA_EXCEEDED error, and require you to close the account manually.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const account = new aws.organizations.Account("account", {
name: "my_new_account",
email: "john@doe.org",
});import pulumi
import pulumi_aws as aws
account = aws.organizations.Account("account",
name="my_new_account",
email="john@doe.org")using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var account = new Aws.Organizations.Account("account", new()
{
Name = "my_new_account",
Email = "john@doe.org",
});
});package main
import (
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/organizations"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := organizations.NewAccount(ctx, "account", &organizations.AccountArgs{
Name: pulumi.String("my_new_account"),
Email: pulumi.String("john@doe.org"),
})
if err != nil {
return err
}
return nil
})
}package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.organizations.Account;
import com.pulumi.aws.organizations.AccountArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var account = new Account("account", AccountArgs.builder()
.name("my_new_account")
.email("john@doe.org")
.build());
}
}resources:
account:
type: aws:organizations:Account
properties:
name: my_new_account
email: john@doe.orgImport
Using pulumi import, import the AWS member account using the account_id. For example:
$ pulumi import aws:organizations/account:Account my_account 111111111111To import accounts that have set iam_user_access_to_billing, use the following:
$ pulumi import aws:organizations/account:Account my_account 111111111111_ALLOWCertain resource arguments, like role_name, do not have an Organizations API method for reading the information after account creation. If the argument is set in the Pulumi program on an imported resource, Pulumi will always show a difference. To workaround this behavior, either omit the argument from the Pulumi program or use ignore_changes to hide the difference. For example:
Constructors
Properties
If true, a deletion event will close the account. Otherwise, it will only remove from the organization. This is not supported for GovCloud accounts.
Whether to also create a GovCloud account. The GovCloud account is tied to the main (commercial) account this resource creates. If true, the GovCloud account ID is available in the govcloud_id attribute. The only way to manage the GovCloud account with the provider is to subsequently import the account using this resource.
If set to ALLOW, the new account enables IAM users and roles to access account billing information if they have the required permissions. If set to DENY, then only the root user (and no roles) of the new account can access account billing information. If this is unset, the AWS API will default this to ALLOW. If the resource is created and this option is changed, it will try to recreate the account.
The name of an IAM role that Organizations automatically preconfigures in the new member account. This role trusts the root account, allowing users in the root account to assume the role, as permitted by the root account administrator. The role has administrator permissions in the new member account. The Organizations API provides no method for reading this information after account creation, so the provider cannot perform drift detection on its value and will always show a difference for a configured value after import unless ignoreChanges is used.