> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_parent.md).

# AWS\_PARENT

## Summary

|                        |                                                                     |
| ---------------------- | ------------------------------------------------------------------- |
| Forestall ACL Alias    | AWS\_PARENT                                                         |
| Affected Object Types  | `Org → OU/Account`, `OU → child OU/Account`, `Account → IAM entity` |
| Exploitation Certainty | Medium                                                              |

## Description

`AWS_PARENT` is a single structural edge directed **parent → child** that models the entire AWS containment hierarchy. One relation covers all levels. The **target node label** tells you what kind of containment it is.

**Edge semantics (parent → child):**

* `(AWSOrganization)-[AWS_PARENT]->(AWSAccount | AWSOrganizationalUnit)`: the organization root directly contains a root-level account or top-level OU.
* `(AWSOrganizationalUnit)-[AWS_PARENT]->(AWSOrganizationalUnit | AWSAccount)`: a parent OU contains a nested child OU or a member account.
* `(AWSAccount)-[AWS_PARENT]->(AWSIAMUser | AWSIAMRole | AWSIAMGroup | AWSIAMPolicy)`: an account contains the IAM identities scoped to it.

The hierarchy flows top-down: `Organization → OU → (nested OU) → Account → IAM entity`. Nested OUs chain through `AWS_PARENT` to arbitrary depth (AWS allows up to 5 levels). Only root-level accounts and OUs link directly to the organization; nested entities reach back up through their immediate parent.

OUs are how SCPs get applied at scale. An attacker who can move accounts or OUs, or tamper with SCP attachments, affects the effective permissions of everything beneath that point in the hierarchy.

## Identification

Look up the parent or children of any account or OU:

```bash
# List the parent of an account or OU
aws organizations list-parents --child-id <account-id-or-ou-id>

# List direct children (accounts and nested OUs) of a parent
aws organizations list-children --parent-id <ou-id-or-root-id> --child-type ACCOUNT
aws organizations list-children --parent-id <ou-id-or-root-id> --child-type ORGANIZATIONAL_UNIT

# Identify the account an IAM entity belongs to (from its ARN)
aws iam get-user --user-name TargetUser --query 'User.Arn' --output text | cut -d: -f5
```

Forestall ISPM creates this edge during org/OU/account collection by matching each child to its parent ID via `ListRoots`, `ListOrganizationalUnitsForParent`, and `ListChildren`. IAM collection adds the account-to-entity level by grouping identities by account ID.

## Mitigation

* Apply least-privilege SCPs at the OU level and avoid permissive policies on the root.
* Keep the OU structure as shallow as workloads allow. Deeper hierarchies amplify the blast radius of a single misconfiguration.
* Separate workload accounts from security and audit accounts at the OU level.
* Lock down who can call `organizations:MoveAccount`, `organizations:AttachPolicy`, and `organizations:DetachPolicy`.

## Detection

* Watch CloudTrail for `MoveAccount`, `CreateOrganizationalUnit`, `DeleteOrganizationalUnit`, `CreateAccount`, and `RemoveAccountFromOrganization`.
* Alert on `AttachPolicy` and `DetachPolicy` events on any OU, especially the root.
* Regularly reconcile the org hierarchy against your expected structure to catch accounts that have drifted.

## References

* [AWS Organizations: OU concepts](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html)
* [AWS Organizations: SCP inheritance](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_evaluation.html)
* [IAM identifiers / ARNs](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)
* [MITRE ATT\&CK T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)