Back to Checks
aws

AWS account is a member of an active AWS Organization

organizations_account_part_of_organizations
Service: organizationsSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

AWS account membership in AWS Organizations with organization status ACTIVE.

Assesses if the account is associated with an organization and that the organization state is ACTIVE.

Prowler logoProwlerprowler-provider-aws

Risk

Absence of AWS Organizations weakens governance across accounts. Without SCP guardrails and centralized policy, excessive permissions, unsafe network settings, or risky services may be enabled, threatening confidentiality and integrity. Fragmented logging and response slow containment, impacting availability and increasing cost exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks organizations_account_part_of_organizations

Recommendation

Operate all accounts under AWS Organizations (preferably with all features). Structure OUs, enforce SCPs for least privilege, and apply separation of duties between management and member accounts. Centralize logging and billing to support defense-in-depth, and routinely review org membership and policies.

Remediation

CLI

aws organizations create-organization

Terraform

# Creates an AWS Organization so this account becomes a member (status ACTIVE)
resource "aws_organizations_organization" "<example_resource_name>" {
  # Critical: creating this resource makes the account part of an active AWS Organization
}

Other

1Sign in to the AWS Management Console with the account to remediate
2Open the AWS Organizations console
3Click "Create an organization"
4Confirm to create (default is All features)
5Verify the organization status shows Active on the Settings page

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.organizations.organizations_client import (
    organizations_client,
)


class organizations_account_part_of_organizations(Check):
    def execute(self):
        findings = []
        if organizations_client.organization:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=organizations_client.organization,
            )
            if organizations_client.organization.status == "ACTIVE":
                report.status = "PASS"
                report.status_extended = f"AWS Organization {organizations_client.organization.id} contains this AWS account."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    "AWS Organizations is not in-use for this AWS Account."
                )
            report.region = organizations_client.region
            findings.append(report)

        return findings

References