Why the path exists

When the management account creates a member account through AWS Organizations, AWS automatically creates an IAM role in the new account. Its default name is OrganizationAccountAccessRole. The role trusts the management account and has the AWS managed AdministratorAccess policy attached by default.

The useful distinction is where the account came from. An account created through Organizations gets the role automatically. A pre-existing account that was merely invited does not; an administrator must create the role separately. The role name can also be changed during account creation.

Preconditions

  1. A foothold in the AWS Organizations management account.
  2. Permission to enumerate member accounts, or a known member-account ID.
  3. sts:AssumeRole permission on the member-account role.
  4. The default role exists under the expected or discovered name.

An SCP, permissions boundary, session policy, or changed trust policy can still prevent the pivot even when the role exists.

Reproduce in an authorised organization

Start from a named assessment profile in the management account. Record the source principal before enumerating anything.

aws sts get-caller-identity \
  --profile org-management

List active member accounts. The query keeps only the fields needed for the test and avoids burying the target in full account metadata.

aws organizations list-accounts \
  --profile org-management \
  --query 'Accounts[?Status==`ACTIVE`].[Id,Name]' \
  --output table

Attempt the role assumption against the approved test account. Use a session name that identifies the exercise in CloudTrail.

aws sts assume-role \
  --profile org-management \
  --role-arn arn:aws:iam::111122223333:role/OrganizationAccountAccessRole \
  --role-session-name authorized-org-pivot-20260829

Verify

Load the returned temporary credentials into an isolated shell or profile, then call sts:GetCallerIdentity. The account ID should be the approved member account and the ARN should contain the assessment session name.

Cleanup

STS credentials expire automatically. End the local session and remove exported environment variables. Do not delete or modify OrganizationAccountAccessRole as “cleanup”; it is an administrative control that may be in active use.

Detection

The signal is not simply “someone assumed a role.” The useful detection binds a sensitive target role to an unexpected source principal, account, session name, network, or time.

Event Fields to retain Why they matter
organizations.amazonaws.com / ListAccounts userIdentity.arn, sourceIPAddress, userAgent Shows organization discovery from the management account. Useful as context, not a standalone alert.
sts.amazonaws.com / AssumeRole userIdentity.accountId, userIdentity.arn, requestParameters.roleArn, requestParameters.roleSessionName Identifies the source account and principal, exact destination role, and operator-chosen session name.

High-value logic

  • Match requestParameters.roleArn against member-account roles with administrative policies, including custom names.
  • Flag assumptions originating from management-account principals that are not part of the approved account-provisioning or break-glass workflow.
  • Raise confidence when ListAccounts is followed by assumptions into several member accounts from the same source identity or network.
  • Keep expected automation by exact principal ARN. Avoid broad allowlists for the entire management account.

Hardening

  • Keep workloads and routine administration out of the management account.
  • Restrict sts:AssumeRole to the smallest set of account-administration principals and target role ARNs.
  • Review the role’s trust policy and attached permissions after account vending.
  • Use consistent, inventory-backed role names rather than assuming the default is present everywhere.
  • Monitor management-account sessions more aggressively than ordinary workload-account sessions.

References

  1. AWS Organizations documentation — Accessing member accounts
  2. Hacking the Cloud — AWS Organizations Defaults & Pivoting
  3. AWS STS API Reference — AssumeRole