Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

AWS_PARENT

Summary

Forestall ACL Alias

AWS_PARENT

Affected Object Types

Org → OU/Account, OU → child OU/Account, Account → IAM entity

Exploitation Certainty

Medium

Description

AWS_PARENT is a single structural edge directed parent → child that models the entire AWS containment hierarchy. One relation covers all levels. The target node label tells you what kind of containment it is.

Edge semantics (parent → child):

  • (AWSOrganization)-[AWS_PARENT]->(AWSAccount | AWSOrganizationalUnit): the organization root directly contains a root-level account or top-level OU.

  • (AWSOrganizationalUnit)-[AWS_PARENT]->(AWSOrganizationalUnit | AWSAccount): a parent OU contains a nested child OU or a member account.

  • (AWSAccount)-[AWS_PARENT]->(AWSIAMUser | AWSIAMRole | AWSIAMGroup | AWSIAMPolicy): an account contains the IAM identities scoped to it.

The hierarchy flows top-down: Organization → OU → (nested OU) → Account → IAM entity. Nested OUs chain through AWS_PARENT to arbitrary depth (AWS allows up to 5 levels). Only root-level accounts and OUs link directly to the organization; nested entities reach back up through their immediate parent.

OUs are how SCPs get applied at scale. An attacker who can move accounts or OUs, or tamper with SCP attachments, affects the effective permissions of everything beneath that point in the hierarchy.

Identification

Look up the parent or children of any account or OU:

# List the parent of an account or OU
aws organizations list-parents --child-id <account-id-or-ou-id>

# List direct children (accounts and nested OUs) of a parent
aws organizations list-children --parent-id <ou-id-or-root-id> --child-type ACCOUNT
aws organizations list-children --parent-id <ou-id-or-root-id> --child-type ORGANIZATIONAL_UNIT

# Identify the account an IAM entity belongs to (from its ARN)
aws iam get-user --user-name TargetUser --query 'User.Arn' --output text | cut -d: -f5

Forestall ISPM creates this edge during org/OU/account collection by matching each child to its parent ID via ListRoots, ListOrganizationalUnitsForParent, and ListChildren. IAM collection adds the account-to-entity level by grouping identities by account ID.

Mitigation

  • Apply least-privilege SCPs at the OU level and avoid permissive policies on the root.

  • Keep the OU structure as shallow as workloads allow. Deeper hierarchies amplify the blast radius of a single misconfiguration.

  • Separate workload accounts from security and audit accounts at the OU level.

  • Lock down who can call organizations:MoveAccount, organizations:AttachPolicy, and organizations:DetachPolicy.

Detection

  • Watch CloudTrail for MoveAccount, CreateOrganizationalUnit, DeleteOrganizationalUnit, CreateAccount, and RemoveAccountFromOrganization.

  • Alert on AttachPolicy and DetachPolicy events on any OU, especially the root.

  • Regularly reconcile the org hierarchy against your expected structure to catch accounts that have drifted.

References

PreviousAWS_IN_GROUP
NextAWS_PARENT_ACCOUNT

Last updated

Was this helpful?