User permissions
After the Master User creates the organization, they can create an IAM user with the same level of permissions. This IAM user can then be used to create other IAM users and delegate their permissions. For more information, see the Identity & Access Management (IAM) Administration Guide.
Accounts, Users and Permissions
| Account Type |
This role applies to the organization. There are different types of accounts:
|
| User Type | Under each account is a different type of user: Master User, IAM User , and IDP role. |
|
Permissions |
Each user type has permissions: Master User:
IAM user and IDP role:
|
|
Access Roles |
Admin access or Read-Only access within the selected account. |
|
While the organization is divided into a hierarchy, the user location within the hierarchy is independent of their permissions. The user's access is dependent on their permission profile and scope, including the available and selected scope. For more information, see Available and selected scope in the Identity & Access Management (IAM) Guide. |
Root Account
|
|
Master User |
Access Role |
|||
|---|---|---|---|---|---|
| View | Action | Root Account | Admin | Read Only | Not assigned |
| Organization | Update | ✓ | ✓ | ||
| Delete | ✓ | ✓ | |||
| Export | ✓ | ✓ | ✓ | ||
| Organizational Unit | Read | ✓ | ✓ | ✓ | |
| Add | ✓ | ✓ | |||
| Update | ✓ | ✓ | |||
| Delete | ✓ | ✓ | |||
| Bulk Delete | ✓ | ✓ | |||
| Move | ✓ | ✓ | |||
| Export | ✓ | ✓ | ✓ | ||
| Invitation Token | Read | ✓ | ✓ | ✓ | |
| Add | ✓ | ✓ | |||
| Update | ✓ | ✓ | |||
| Invitation Approval | Read | ✓ | ✓ | ✓ | |
| Approve | ✓ | ✓ | |||
| Decline | ✓ | ✓ | |||
| General | Read | ✓ | ✓ | ✓ | ✓ |
| Settings | Read | ✓ | ✓ | ||
|
|
Update |
✓ | ✓ |
|
|
Member Account
| View | Action | Master | No Org Role |
|---|---|---|---|
| General | Read | ✓ | ✓ |