AWS_PARENT

Copy page

Summary


Forestall ACL Alias	AWS_PARENT
Affected Object Types	`Org → OU/Account`, `OU → child OU/Account`, `Account → IAM entity`
Exploitation Certainty	Medium

Description

AWS_PARENT is a single structural edge directed parent → child that models the entire AWS containment hierarchy. One relation covers all levels. The target node label tells you what kind of containment it is.

Edge semantics (parent → child):

(AWSOrganization)-[AWS_PARENT]->(AWSAccount | AWSOrganizationalUnit): the organization root directly contains a root-level account or top-level OU.
(AWSOrganizationalUnit)-[AWS_PARENT]->(AWSOrganizationalUnit | AWSAccount): a parent OU contains a nested child OU or a member account.
(AWSAccount)-[AWS_PARENT]->(AWSIAMUser | AWSIAMRole | AWSIAMGroup | AWSIAMPolicy): an account contains the IAM identities scoped to it.

The hierarchy flows top-down: Organization → OU → (nested OU) → Account → IAM entity. Nested OUs chain through AWS_PARENT to arbitrary depth (AWS allows up to 5 levels). Only root-level accounts and OUs link directly to the organization; nested entities reach back up through their immediate parent.

OUs are how SCPs get applied at scale. An attacker who can move accounts or OUs, or tamper with SCP attachments, affects the effective permissions of everything beneath that point in the hierarchy.

Identification

Look up the parent or children of any account or OU:

# List the parent of an account or OU
aws organizations list-parents --child-id <account-id-or-ou-id>

# List direct children (accounts and nested OUs) of a parent
aws organizations list-children --parent-id <ou-id-or-root-id> --child-type ACCOUNT
aws organizations list-children --parent-id <ou-id-or-root-id> --child-type ORGANIZATIONAL_UNIT

# Identify the account an IAM entity belongs to (from its ARN)
aws iam get-user --user-name TargetUser --query 'User.Arn' --output text | cut -d: -f5

Forestall ISPM creates this edge during org/OU/account collection by matching each child to its parent ID via ListRoots, ListOrganizationalUnitsForParent, and ListChildren. IAM collection adds the account-to-entity level by grouping identities by account ID.

Mitigation

Apply least-privilege SCPs at the OU level and avoid permissive policies on the root.
Keep the OU structure as shallow as workloads allow. Deeper hierarchies amplify the blast radius of a single misconfiguration.
Separate workload accounts from security and audit accounts at the OU level.
Lock down who can call organizations:MoveAccount, organizations:AttachPolicy, and organizations:DetachPolicy.

Detection

Watch CloudTrail for MoveAccount, CreateOrganizationalUnit, DeleteOrganizationalUnit, CreateAccount, and RemoveAccountFromOrganization.
Alert on AttachPolicy and DetachPolicy events on any OU, especially the root.
Regularly reconcile the org hierarchy against your expected structure to catch accounts that have drifted.

Ask AI