WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*You can close only 10% of member accounts, between 10 and 1000, within a * rolling 30 day period. This quota is not bound by a calendar month, but - * starts when you close an account. After you reach this limit, you can close + * starts when you close an account. After you reach this limit, you can't close * additional accounts. For more information, see Closing a member * account in your organization and Quotas for - * Organizationsin the Organizations User Guide.
+ * Organizations in the Organizations User Guide. *To reinstate a closed account, contact Amazon Web Services Support within the 90-day @@ -312,9 +312,8 @@ export interface CloseAccountCommandOutput extends __MetadataBearer {} * that are not compliant with the tag policy requirements for this account.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*Using CreateAccount to create multiple temporary accounts
- * isn't recommended. You can only close an account from the Billing and Cost Management console, and
- * you must be signed in as the root user. For information on the requirements
+ *
It isn't recommended to use CreateAccount to create multiple temporary accounts, and using
+ * the CreateAccount API to close accounts is subject to a 30-day usage quota. For information on the requirements
* and process for closing an account, see Closing a member
* account in your organization in the
* Organizations User Guide.
WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*Enables the integration of an Amazon Web Services service (the service that is specified by
- * ServicePrincipal) with Organizations. When you enable integration, you allow
- * the specified service to create a service-linked role in
- * all the accounts in your organization. This allows the service to perform operations on
- * your behalf in your organization and its accounts.
Provides an Amazon Web Services service (the service that is specified by
+ * ServicePrincipal) with permissions to view the structure of an organization,
+ * create a service-linked role in all the accounts in the organization,
+ * and allow the service to perform operations
+ * on behalf of the organization and its accounts. Establishing these permissions can be a first step
+ * in enabling the integration of an Amazon Web Services service with Organizations.
We recommend that you enable integration between Organizations and the specified Amazon Web Services * service by using the console or commands that are provided by the specified service. @@ -272,9 +273,8 @@ export interface EnableAWSServiceAccessCommandOutput extends __MetadataBearer {} * that are not compliant with the tag policy requirements for this account.
* *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*A newly created account has a waiting period before it can be removed from - * its organization. If you get an error that indicates that a wait period is - * required, then try again in a few days.
+ * its organization. + * You must wait until at least seven days after the account was created. Invited accounts aren't subject to this waiting period. *If you are using an organization principal to call @@ -322,9 +322,8 @@ export interface LeaveOrganizationCommandOutput extends __MetadataBearer {} * that are not compliant with the tag policy requirements for this account.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting - * period before you can remove it from the organization. If you get an error that - * indicates that a wait period is required, try again in a few days.
+ *WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created. + * Invited accounts aren't subject to this waiting period.
*The AvailablePolicyTypes part of the response is deprecated, and you
* shouldn't use it in your apps. It doesn't include any policy type supported by Organizations
- * other than SCPs. To determine which policy types are enabled in your organization,
+ * other than SCPs. In the China (Ningxia) Region, no policy type is included.
+ * To determine which policy types are enabled in your organization,
* use the
* ListRoots
* operation.
Closes an Amazon Web Services member account within an organization. You can close an account when\n all\n features are enabled . You can't close the management account with this API.\n This is an asynchronous request that Amazon Web Services performs in the background. Because\n CloseAccount operates asynchronously, it can return a successful\n completion message even though account closure might still be in progress. You need to\n wait a few minutes before the account is fully closed. To check the status of the\n request, do one of the following:
Use the AccountId that you sent in the CloseAccount\n request to provide as a parameter to the DescribeAccount\n operation.
While the close account request is in progress, Account status will indicate\n PENDING_CLOSURE. When the close account request completes, the status will\n change to SUSPENDED.
\nCheck the CloudTrail log for the CloseAccountResult event that gets\n published after the account closes successfully. For information on using CloudTrail\n with Organizations, see Logging and monitoring in Organizations in the\n Organizations User Guide.
You can close only 10% of member accounts, between 10 and 1000, within a\n rolling 30 day period. This quota is not bound by a calendar month, but\n starts when you close an account. After you reach this limit, you can close\n additional accounts. For more information, see Closing a member\n account in your organization and Quotas for\n Organizationsin the Organizations User Guide.
\nTo reinstate a closed account, contact Amazon Web Services Support within the 90-day\n grace period while the account is in SUSPENDED status.
\nIf the Amazon Web Services account you attempt to close is linked to an Amazon Web Services GovCloud\n (US) account, the CloseAccount request will close both\n accounts. To learn important pre-closure details, see \n Closing an Amazon Web Services GovCloud (US) account in the \n Amazon Web Services GovCloud User Guide.
Closes an Amazon Web Services member account within an organization. You can close an account when\n all\n features are enabled . You can't close the management account with this API.\n This is an asynchronous request that Amazon Web Services performs in the background. Because\n CloseAccount operates asynchronously, it can return a successful\n completion message even though account closure might still be in progress. You need to\n wait a few minutes before the account is fully closed. To check the status of the\n request, do one of the following:
Use the AccountId that you sent in the CloseAccount\n request to provide as a parameter to the DescribeAccount\n operation.
While the close account request is in progress, Account status will indicate\n PENDING_CLOSURE. When the close account request completes, the status will\n change to SUSPENDED.
\nCheck the CloudTrail log for the CloseAccountResult event that gets\n published after the account closes successfully. For information on using CloudTrail\n with Organizations, see Logging and monitoring in Organizations in the\n Organizations User Guide.
You can close only 10% of member accounts, between 10 and 1000, within a\n rolling 30 day period. This quota is not bound by a calendar month, but\n starts when you close an account. After you reach this limit, you can't close\n additional accounts. For more information, see Closing a member\n account in your organization and Quotas for\n Organizations in the Organizations User Guide.
\nTo reinstate a closed account, contact Amazon Web Services Support within the 90-day\n grace period while the account is in SUSPENDED status.
\nIf the Amazon Web Services account you attempt to close is linked to an Amazon Web Services GovCloud\n (US) account, the CloseAccount request will close both\n accounts. To learn important pre-closure details, see \n Closing an Amazon Web Services GovCloud (US) account in the \n Amazon Web Services GovCloud User Guide.
Performing this operation violates a minimum or maximum value limit. For example,\n attempting to remove the last service control policy (SCP) from an OU or root, inviting\n or creating too many accounts to the organization, or attaching too many policies to an\n account, OU, or root. This exception includes a reason that contains additional\n information about the violated limit:
\nSome of the reasons in the following list might not be applicable to this specific\n API or operation.
\nACCOUNT_CANNOT_LEAVE_ORGANIZATION: You attempted to remove the management\n account from the organization. You can't remove the management account. Instead,\n after you remove all member accounts, delete the organization itself.
\nACCOUNT_CANNOT_LEAVE_WITHOUT_PHONE_VERIFICATION: You attempted to remove an\n account from the organization that doesn't yet have enough information to exist\n as a standalone account. This account requires you to first complete phone\n verification. Follow the steps at Removing a member account from your organization in the\n Organizations User Guide.
\nACCOUNT_CREATION_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of\n accounts that you can create in one day.
\nACCOUNT_CREATION_NOT_COMPLETE: Your account setup isn't complete or your\n account isn't fully active. You must complete the account setup before you\n create an organization.
\nACCOUNT_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the limit on the number\n of accounts in an organization. If you need more accounts, contact Amazon Web Services Support to\n request an increase in your limit.
\nOr the number of invitations that you tried to send would cause you to exceed\n the limit of accounts in your organization. Send fewer invitations or contact\n Amazon Web Services Support to request an increase in the number of accounts.
\nDeleted and closed accounts still count toward your limit.
\nIf you get this exception when running a command immediately after\n creating the organization, wait one hour and try again. After an hour, if\n the command continues to fail with this error, contact Amazon Web Services Support.
\nCANNOT_REGISTER_SUSPENDED_ACCOUNT_AS_DELEGATED_ADMINISTRATOR: You cannot\n register a suspended account as a delegated administrator.
\nCANNOT_REGISTER_MASTER_AS_DELEGATED_ADMINISTRATOR: You attempted to register\n the management account of the organization as a delegated administrator for an\n Amazon Web Services service integrated with Organizations. You can designate only a member account as a\n delegated administrator.
\nCANNOT_CLOSE_MANAGEMENT_ACCOUNT: You attempted to close the management\n account. To close the management account for the organization, you must first\n either remove or close all member accounts in the organization. Follow standard\n account closure process using root credentials.
\nCANNOT_REMOVE_DELEGATED_ADMINISTRATOR_FROM_ORG: You attempted to remove an\n account that is registered as a delegated administrator for a service integrated\n with your organization. To complete this operation, you must first deregister\n this account as a delegated administrator.
\nCLOSE_ACCOUNT_QUOTA_EXCEEDED: You have exceeded close account quota for the\n past 30 days.
\nCLOSE_ACCOUNT_REQUESTS_LIMIT_EXCEEDED: You attempted to exceed the number of\n accounts that you can close at a time.
\nCREATE_ORGANIZATION_IN_BILLING_MODE_UNSUPPORTED_REGION: To create an\n organization in the specified region, you must enable all features mode.
\nDELEGATED_ADMINISTRATOR_EXISTS_FOR_THIS_SERVICE: You attempted to register an\n Amazon Web Services account as a delegated administrator for an Amazon Web Services service that already has\n a delegated administrator. To complete this operation, you must first deregister\n any existing delegated administrators for this service.
\nEMAIL_VERIFICATION_CODE_EXPIRED: The email verification code is only valid for\n a limited period of time. You must resubmit the request and generate a new\n verfication code.
\nHANDSHAKE_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of\n handshakes that you can send in one day.
\nINVALID_PAYMENT_INSTRUMENT: You cannot remove an account because no supported\n payment method is associated with the account. Amazon Web Services does not support cards\n issued by financial institutions in Russia or Belarus. For more information, see\n Managing your\n Amazon Web Services payments.
\nMASTER_ACCOUNT_ADDRESS_DOES_NOT_MATCH_MARKETPLACE: To create an account in\n this organization, you first must migrate the organization's management account\n to the marketplace that corresponds to the management account's address. All\n accounts in an organization must be associated with the same marketplace.
\nMASTER_ACCOUNT_MISSING_BUSINESS_LICENSE: Applies only to the Amazon Web Services Regions in\n China. To create an organization, the master must have a valid business license.\n For more information, contact customer support.
\nMASTER_ACCOUNT_MISSING_CONTACT_INFO: To complete this operation, you must\n first provide a valid contact address and phone number for the management\n account. Then try the operation again.
\nMASTER_ACCOUNT_NOT_GOVCLOUD_ENABLED: To complete this operation, the\n management account must have an associated account in the Amazon Web Services GovCloud\n (US-West) Region. For more information, see Organizations\n in the \n Amazon Web Services GovCloud User Guide.
\nMASTER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To create an organization with\n this management account, you first must associate a valid payment instrument,\n such as a credit card, with the account. For more information, see Considerations before removing an account from an organization in\n the Organizations User Guide.
\nMAX_DELEGATED_ADMINISTRATORS_FOR_SERVICE_LIMIT_EXCEEDED: You attempted to\n register more delegated administrators than allowed for the service principal.\n
\nMAX_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to exceed the number\n of policies of a certain type that can be attached to an entity at one\n time.
\nMAX_TAG_LIMIT_EXCEEDED: You have exceeded the number of tags allowed on this\n resource.
\nMEMBER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To complete this operation with\n this member account, you first must associate a valid payment instrument, such\n as a credit card, with the account. For more information, see Considerations before removing an account from an organization in\n the Organizations User Guide.
\nMIN_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to detach a policy\n from an entity that would cause the entity to have fewer than the minimum number\n of policies of a certain type required.
\nORGANIZATION_NOT_IN_ALL_FEATURES_MODE: You attempted to perform an operation\n that requires the organization to be configured to support all features. An\n organization that supports only consolidated billing features can't perform this\n operation.
\nOU_DEPTH_LIMIT_EXCEEDED: You attempted to create an OU tree that is too many\n levels deep.
\nOU_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of OUs that you\n can have in an organization.
\nPOLICY_CONTENT_LIMIT_EXCEEDED: You attempted to create a policy that is larger\n than the maximum size.
\nPOLICY_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of policies\n that you can have in an organization.
\nSERVICE_ACCESS_NOT_ENABLED: You attempted to register a delegated\n administrator before you enabled service access. Call the\n EnableAWSServiceAccess API first.
TAG_POLICY_VIOLATION: You attempted to create or update a resource with tags\n that are not compliant with the tag policy requirements for this account.
\nWAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, there is a waiting\n period before you can remove it from the organization. If you get an error that\n indicates that a wait period is required, try again in a few days.
\nPerforming this operation violates a minimum or maximum value limit. For example,\n attempting to remove the last service control policy (SCP) from an OU or root, inviting\n or creating too many accounts to the organization, or attaching too many policies to an\n account, OU, or root. This exception includes a reason that contains additional\n information about the violated limit:
\nSome of the reasons in the following list might not be applicable to this specific\n API or operation.
\nACCOUNT_CANNOT_LEAVE_ORGANIZATION: You attempted to remove the management\n account from the organization. You can't remove the management account. Instead,\n after you remove all member accounts, delete the organization itself.
\nACCOUNT_CANNOT_LEAVE_WITHOUT_PHONE_VERIFICATION: You attempted to remove an\n account from the organization that doesn't yet have enough information to exist\n as a standalone account. This account requires you to first complete phone\n verification. Follow the steps at Removing a member account from your organization in the\n Organizations User Guide.
\nACCOUNT_CREATION_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of\n accounts that you can create in one day.
\nACCOUNT_CREATION_NOT_COMPLETE: Your account setup isn't complete or your\n account isn't fully active. You must complete the account setup before you\n create an organization.
\nACCOUNT_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the limit on the number\n of accounts in an organization. If you need more accounts, contact Amazon Web Services Support to\n request an increase in your limit.
\nOr the number of invitations that you tried to send would cause you to exceed\n the limit of accounts in your organization. Send fewer invitations or contact\n Amazon Web Services Support to request an increase in the number of accounts.
\nDeleted and closed accounts still count toward your limit.
\nIf you get this exception when running a command immediately after\n creating the organization, wait one hour and try again. After an hour, if\n the command continues to fail with this error, contact Amazon Web Services Support.
\nCANNOT_REGISTER_SUSPENDED_ACCOUNT_AS_DELEGATED_ADMINISTRATOR: You cannot\n register a suspended account as a delegated administrator.
\nCANNOT_REGISTER_MASTER_AS_DELEGATED_ADMINISTRATOR: You attempted to register\n the management account of the organization as a delegated administrator for an\n Amazon Web Services service integrated with Organizations. You can designate only a member account as a\n delegated administrator.
\nCANNOT_CLOSE_MANAGEMENT_ACCOUNT: You attempted to close the management\n account. To close the management account for the organization, you must first\n either remove or close all member accounts in the organization. Follow standard\n account closure process using root credentials.
\nCANNOT_REMOVE_DELEGATED_ADMINISTRATOR_FROM_ORG: You attempted to remove an\n account that is registered as a delegated administrator for a service integrated\n with your organization. To complete this operation, you must first deregister\n this account as a delegated administrator.
\nCLOSE_ACCOUNT_QUOTA_EXCEEDED: You have exceeded close account quota for the\n past 30 days.
\nCLOSE_ACCOUNT_REQUESTS_LIMIT_EXCEEDED: You attempted to exceed the number of\n accounts that you can close at a time.
\nCREATE_ORGANIZATION_IN_BILLING_MODE_UNSUPPORTED_REGION: To create an\n organization in the specified region, you must enable all features mode.
\nDELEGATED_ADMINISTRATOR_EXISTS_FOR_THIS_SERVICE: You attempted to register an\n Amazon Web Services account as a delegated administrator for an Amazon Web Services service that already has\n a delegated administrator. To complete this operation, you must first deregister\n any existing delegated administrators for this service.
\nEMAIL_VERIFICATION_CODE_EXPIRED: The email verification code is only valid for\n a limited period of time. You must resubmit the request and generate a new\n verfication code.
\nHANDSHAKE_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of\n handshakes that you can send in one day.
\nINVALID_PAYMENT_INSTRUMENT: You cannot remove an account because no supported\n payment method is associated with the account. Amazon Web Services does not support cards\n issued by financial institutions in Russia or Belarus. For more information, see\n Managing your\n Amazon Web Services payments.
\nMASTER_ACCOUNT_ADDRESS_DOES_NOT_MATCH_MARKETPLACE: To create an account in\n this organization, you first must migrate the organization's management account\n to the marketplace that corresponds to the management account's address. All\n accounts in an organization must be associated with the same marketplace.
\nMASTER_ACCOUNT_MISSING_BUSINESS_LICENSE: Applies only to the Amazon Web Services Regions in\n China. To create an organization, the master must have a valid business license.\n For more information, contact customer support.
\nMASTER_ACCOUNT_MISSING_CONTACT_INFO: To complete this operation, you must\n first provide a valid contact address and phone number for the management\n account. Then try the operation again.
\nMASTER_ACCOUNT_NOT_GOVCLOUD_ENABLED: To complete this operation, the\n management account must have an associated account in the Amazon Web Services GovCloud\n (US-West) Region. For more information, see Organizations\n in the \n Amazon Web Services GovCloud User Guide.
\nMASTER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To create an organization with\n this management account, you first must associate a valid payment instrument,\n such as a credit card, with the account. For more information, see Considerations before removing an account from an organization in\n the Organizations User Guide.
\nMAX_DELEGATED_ADMINISTRATORS_FOR_SERVICE_LIMIT_EXCEEDED: You attempted to\n register more delegated administrators than allowed for the service principal.\n
\nMAX_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to exceed the number\n of policies of a certain type that can be attached to an entity at one\n time.
\nMAX_TAG_LIMIT_EXCEEDED: You have exceeded the number of tags allowed on this\n resource.
\nMEMBER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To complete this operation with\n this member account, you first must associate a valid payment instrument, such\n as a credit card, with the account. For more information, see Considerations before removing an account from an organization in\n the Organizations User Guide.
\nMIN_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to detach a policy\n from an entity that would cause the entity to have fewer than the minimum number\n of policies of a certain type required.
\nORGANIZATION_NOT_IN_ALL_FEATURES_MODE: You attempted to perform an operation\n that requires the organization to be configured to support all features. An\n organization that supports only consolidated billing features can't perform this\n operation.
\nOU_DEPTH_LIMIT_EXCEEDED: You attempted to create an OU tree that is too many\n levels deep.
\nOU_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of OUs that you\n can have in an organization.
\nPOLICY_CONTENT_LIMIT_EXCEEDED: You attempted to create a policy that is larger\n than the maximum size.
\nPOLICY_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of policies\n that you can have in an organization.
\nSERVICE_ACCESS_NOT_ENABLED: You attempted to register a delegated\n administrator before you enabled service access. Call the\n EnableAWSServiceAccess API first.
TAG_POLICY_VIOLATION: You attempted to create or update a resource with tags\n that are not compliant with the tag policy requirements for this account.
\nWAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at least seven days after the account was created.\n Invited accounts aren't subject to this waiting period.
\nCreates an Amazon Web Services account that is automatically a member of the organization whose\n credentials made the request. This is an asynchronous request that Amazon Web Services performs in the\n background. Because CreateAccount operates asynchronously, it can return a\n successful completion message even though account initialization might still be in\n progress. You might need to wait a few minutes before you can successfully access the\n account. To check the status of the request, do one of the following:
Use the Id value of the CreateAccountStatus response\n element from this operation to provide as a parameter to the DescribeCreateAccountStatus operation.
Check the CloudTrail log for the CreateAccountResult event. For\n information on using CloudTrail with Organizations, see Logging and monitoring in Organizations in the\n Organizations User Guide.
The user who calls the API to create an account must have the\n organizations:CreateAccount permission. If you enabled all features in\n the organization, Organizations creates the required service-linked role named\n AWSServiceRoleForOrganizations. For more information, see Organizations and service-linked roles in the\n Organizations User Guide.
If the request includes tags, then the requester must have the\n organizations:TagResource permission.
Organizations preconfigures the new member account with a role (named\n OrganizationAccountAccessRole by default) that grants users in the\n management account administrator permissions in the new member account. Principals in\n the management account can assume the role. Organizations clones the company name and address\n information for the new account from the organization's management account.
This operation can be called only from the organization's management account.
\nFor more information about creating accounts, see Creating\n a member account in your organization in the\n Organizations User Guide.
\nWhen you create an account in an organization using the Organizations console,\n API, or CLI commands, the information required for the account to operate\n as a standalone account, such as a payment method is not automatically\n collected. If you must remove an account from your organization later, you\n can do so only after you provide the missing information. For more\n information, see Considerations before removing an account from an organization\n in the Organizations User Guide.
\nIf you get an exception that indicates that you exceeded your account\n limits for the organization, contact Amazon Web Services Support.
\nIf you get an exception that indicates that the operation failed because\n your organization is still initializing, wait one hour and then try again.\n If the error persists, contact Amazon Web Services Support.
\nUsing CreateAccount to create multiple temporary accounts\n isn't recommended. You can only close an account from the Billing and Cost Management console, and\n you must be signed in as the root user. For information on the requirements\n and process for closing an account, see Closing a member\n account in your organization in the\n Organizations User Guide.
When you create a member account with this operation, you can choose whether to\n create the account with the IAM User and Role Access to\n Billing Information switch enabled. If you enable it, IAM users and\n roles that have appropriate permissions can view billing information for the\n account. If you disable it, only the account root user can access billing\n information. For information about how to disable this switch for an account, see\n Granting access to\n your billing information and tools.
\nCreates an Amazon Web Services account that is automatically a member of the organization whose\n credentials made the request. This is an asynchronous request that Amazon Web Services performs in the\n background. Because CreateAccount operates asynchronously, it can return a\n successful completion message even though account initialization might still be in\n progress. You might need to wait a few minutes before you can successfully access the\n account. To check the status of the request, do one of the following:
Use the Id value of the CreateAccountStatus response\n element from this operation to provide as a parameter to the DescribeCreateAccountStatus operation.
Check the CloudTrail log for the CreateAccountResult event. For\n information on using CloudTrail with Organizations, see Logging and monitoring in Organizations in the\n Organizations User Guide.
The user who calls the API to create an account must have the\n organizations:CreateAccount permission. If you enabled all features in\n the organization, Organizations creates the required service-linked role named\n AWSServiceRoleForOrganizations. For more information, see Organizations and service-linked roles in the\n Organizations User Guide.
If the request includes tags, then the requester must have the\n organizations:TagResource permission.
Organizations preconfigures the new member account with a role (named\n OrganizationAccountAccessRole by default) that grants users in the\n management account administrator permissions in the new member account. Principals in\n the management account can assume the role. Organizations clones the company name and address\n information for the new account from the organization's management account.
This operation can be called only from the organization's management account.
\nFor more information about creating accounts, see Creating\n a member account in your organization in the\n Organizations User Guide.
\nWhen you create an account in an organization using the Organizations console,\n API, or CLI commands, the information required for the account to operate\n as a standalone account, such as a payment method is not automatically\n collected. If you must remove an account from your organization later, you\n can do so only after you provide the missing information. For more\n information, see Considerations before removing an account from an organization\n in the Organizations User Guide.
\nIf you get an exception that indicates that you exceeded your account\n limits for the organization, contact Amazon Web Services Support.
\nIf you get an exception that indicates that the operation failed because\n your organization is still initializing, wait one hour and then try again.\n If the error persists, contact Amazon Web Services Support.
\nIt isn't recommended to use CreateAccount to create multiple temporary accounts, and using \n the CreateAccount API to close accounts is subject to a 30-day usage quota. For information on the requirements\n and process for closing an account, see Closing a member\n account in your organization in the\n Organizations User Guide.
When you create a member account with this operation, you can choose whether to\n create the account with the IAM User and Role Access to\n Billing Information switch enabled. If you enable it, IAM users and\n roles that have appropriate permissions can view billing information for the\n account. If you disable it, only the account root user can access billing\n information. For information about how to disable this switch for an account, see\n Granting access to\n your billing information and tools.
\nA structure that contains information about the organization.
\nThe AvailablePolicyTypes part of the response is deprecated, and you\n shouldn't use it in your apps. It doesn't include any policy type supported by Organizations\n other than SCPs. To determine which policy types are enabled in your organization,\n use the \n ListRoots\n operation.
A structure that contains information about the organization.
\nThe AvailablePolicyTypes part of the response is deprecated, and you\n shouldn't use it in your apps. It doesn't include any policy type supported by Organizations\n other than SCPs. In the China (Ningxia) Region, no policy type is included.\n To determine which policy types are enabled in your organization,\n use the \n ListRoots\n operation.
Enables the integration of an Amazon Web Services service (the service that is specified by\n ServicePrincipal) with Organizations. When you enable integration, you allow\n the specified service to create a service-linked role in\n all the accounts in your organization. This allows the service to perform operations on\n your behalf in your organization and its accounts.
We recommend that you enable integration between Organizations and the specified Amazon Web Services\n service by using the console or commands that are provided by the specified service.\n Doing so ensures that the service is aware that it can create the resources that are\n required for the integration. How the service creates those resources in the\n organization's accounts depends on that service. For more information, see the\n documentation for the other Amazon Web Services service.
\nFor more information about enabling services to integrate with Organizations, see Using\n Organizations with other Amazon Web Services services in the\n Organizations User Guide.
\nYou can only call this operation from the organization's management account and only\n if the organization has enabled all\n features.
" + "smithy.api#documentation": "Provides an Amazon Web Services service (the service that is specified by\n ServicePrincipal) with permissions to view the structure of an organization, \n create a service-linked role in all the accounts in the organization,\n and allow the service to perform operations\n on behalf of the organization and its accounts. Establishing these permissions can be a first step\n in enabling the integration of an Amazon Web Services service with Organizations.
We recommend that you enable integration between Organizations and the specified Amazon Web Services\n service by using the console or commands that are provided by the specified service.\n Doing so ensures that the service is aware that it can create the resources that are\n required for the integration. How the service creates those resources in the\n organization's accounts depends on that service. For more information, see the\n documentation for the other Amazon Web Services service.
\nFor more information about enabling services to integrate with Organizations, see Using\n Organizations with other Amazon Web Services services in the\n Organizations User Guide.
\nYou can only call this operation from the organization's management account and only\n if the organization has enabled all\n features.
" } }, "com.amazonaws.organizations#EnableAWSServiceAccessRequest": { @@ -5753,7 +5753,7 @@ } ], "traits": { - "smithy.api#documentation": "Removes a member account from its parent organization. This version of the operation\n is performed by the account that wants to leave. To remove a member account as a user in\n the management account, use RemoveAccountFromOrganization\n instead.
\nThis operation can be called only from a member account in the organization.
\nThe management account in an organization with all features enabled can\n set service control policies (SCPs) that can restrict what administrators of\n member accounts can do. This includes preventing them from successfully\n calling LeaveOrganization and leaving the organization.
You can leave an organization as a member account only if the account is\n configured with the information required to operate as a standalone account.\n When you create an account in an organization using the Organizations console,\n API, or CLI commands, the information required of standalone accounts is\n not automatically collected. For each account that\n you want to make standalone, you must perform the following steps. If any of\n the steps are already completed for this account, that step doesn't\n appear.
\nChoose a support plan
\nProvide and verify the required contact information
\nProvide a current payment method
\nAmazon Web Services uses the payment method to charge for any billable (not free tier)\n Amazon Web Services activity that occurs while the account isn't attached to an\n organization. For more information, see Considerations before removing an account from an organization\n in the Organizations User Guide.
\nThe account that you want to leave must not be a delegated administrator\n account for any Amazon Web Services service enabled for your organization. If the account\n is a delegated administrator, you must first change the delegated\n administrator account to another account that is remaining in the\n organization.
\nYou can leave an organization only after you enable IAM user access to\n billing in your account. For more information, see About IAM access to the Billing and Cost Management console in the\n Amazon Web Services Billing and Cost Management User Guide.
\nAfter the account leaves the organization, all tags that were attached to\n the account object in the organization are deleted. Amazon Web Services accounts outside\n of an organization do not support tags.
\nA newly created account has a waiting period before it can be removed from\n its organization. If you get an error that indicates that a wait period is\n required, then try again in a few days.
\nIf you are using an organization principal to call\n LeaveOrganization across multiple accounts, you can only do\n this up to 5 accounts per second in a single organization.
Removes a member account from its parent organization. This version of the operation\n is performed by the account that wants to leave. To remove a member account as a user in\n the management account, use RemoveAccountFromOrganization\n instead.
\nThis operation can be called only from a member account in the organization.
\nThe management account in an organization with all features enabled can\n set service control policies (SCPs) that can restrict what administrators of\n member accounts can do. This includes preventing them from successfully\n calling LeaveOrganization and leaving the organization.
You can leave an organization as a member account only if the account is\n configured with the information required to operate as a standalone account.\n When you create an account in an organization using the Organizations console,\n API, or CLI commands, the information required of standalone accounts is\n not automatically collected. For each account that\n you want to make standalone, you must perform the following steps. If any of\n the steps are already completed for this account, that step doesn't\n appear.
\nChoose a support plan
\nProvide and verify the required contact information
\nProvide a current payment method
\nAmazon Web Services uses the payment method to charge for any billable (not free tier)\n Amazon Web Services activity that occurs while the account isn't attached to an\n organization. For more information, see Considerations before removing an account from an organization\n in the Organizations User Guide.
\nThe account that you want to leave must not be a delegated administrator\n account for any Amazon Web Services service enabled for your organization. If the account\n is a delegated administrator, you must first change the delegated\n administrator account to another account that is remaining in the\n organization.
\nYou can leave an organization only after you enable IAM user access to\n billing in your account. For more information, see About IAM access to the Billing and Cost Management console in the\n Amazon Web Services Billing and Cost Management User Guide.
\nAfter the account leaves the organization, all tags that were attached to\n the account object in the organization are deleted. Amazon Web Services accounts outside\n of an organization do not support tags.
\nA newly created account has a waiting period before it can be removed from\n its organization.\n You must wait until at least seven days after the account was created. Invited accounts aren't subject to this waiting period.
\nIf you are using an organization principal to call\n LeaveOrganization across multiple accounts, you can only do\n this up to 5 accounts per second in a single organization.