Use the guidance

Login page

When you deploy the Hub stack, you provide an initial web UI user email address. The guidance sends an email to that address with the subject WebUI Credentials - Account Assessment for AWS Organizations. The email contains:

You can also retrieve the web UI URL from AWS CloudFormation:

To add or manage additional users, use the Amazon Cognito console.

Welcome page

This page displays after you log in. If applicable, it shows your previous scan job status and assessment type for that job.

Findings

The left pane lists three types of assessments.

Begin an assessment by selecting Start Scan or download the table content as .csv file by selecting Download Results.

Policy Explorer

Beginning with Account Assessment v1.1.0, the Policy Explorer allows you to conduct nuanced searches for policies in your AWS Organization.

You can search for policies

The matching strategy is string contains, e.g. a search input like us- will match policies in all us regions. The search criteria is applied server-side. If your search is too broad, and the amount of result data exceeds what the frontend can handle, you will see a message asking you to narrow down the search with additional criteria.

Use the View Policies button to see the full string representation of any policy.

Dependencies on your AWS Organization

A main use case of the "Resource-based Policy Scan" in Account Assessment prior to v1.1.0 was to find policies that contain a condition with the Organization ID, hinting at a policy that may break when the account is moved to a different AWS Organization.

This use case is now covered by PolicyExplorer. To search for Policies that contain your Organizational ID in the condition, press the button Add OrgId which will prepopulate the Condition search input field with your Org ID. Leave all other fields blank.

Job History

The Job History page helps you review the previous scans and their status. The guidance provides four status possibilities:

Select the Job ID to view specific findings per job.

When you select the Job ID, the Job Details page displays the findings and any failed tasks during your selected job. You can use this information to help you identify the resource and errors. If the error states that a specific account, AWS Region, service, or resource could not be scanned, the guidance might not have assessed all findings. Use your judgment to decide how to proceed.

An AccessDenied error usually means that the Spoke stack was not deployed in that account, so the guidance does not have permission to scan it.

Next steps

We designed this guidance to help you determine specific AWS Organizations dependencies in your underlying resource-based policies. It does not check the validity or correctness of these policies. There are myriad ways in which you can use this data, not limited to common use cases such as consolidating multiple AWS Organizations, preparing for a security audit, or changing your AWS Organization’s management account.

Account migration

One of the common use cases for this guidance is to help you plan for migrating your AWS Organizations accounts, such as with a company merger or acquisition. Migrating your accounts requires careful consideration. Specifically, we recommend:

We recommend that you engage with AWS Solutions Architects, Technical Account Managers, and AWS Professional Services to review your AWS Organizations-based dependencies identified by the guidance before initiating account migration. Additional resources include the following: