Organization Policies
Overview
AWS Organizations supports service-specific policy types for centralized configuration enforcement across member accounts. Multiple security services use this mechanism, each with its own policy type. Organization policies allow administrators to define and enforce service configurations from the management account or delegated administrator, ensuring consistent security posture across the organization.
Available Policy Types
| Policy Type | Service | Documentation |
|---|---|---|
SECURITYHUB_POLICY |
Security Hub | https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub.html |
INSPECTOR_POLICY |
Inspector | https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inspector.html |
Common Discovery Pattern
The same CLI pattern applies to all policy types — substitute the appropriate POLICY_TYPE value:
# List policies of a given type
aws organizations list-policies --filter <POLICY_TYPE>
# Get policy document details
aws organizations describe-policy --policy-id <id>
# Check which roots, OUs, or accounts a policy targets
aws organizations list-targets-for-policy --policy-id <id>These are organizations namespace APIs — not service-specific APIs like securityhub or inspector2.
Execution environment: The AWS MCP server is recommended for running these API calls but is not required — standard AWS CLI access is sufficient.
Read-Only APIs
| API | Purpose |
|---|---|
organizations:ListPolicies |
List policies by type |
organizations:DescribePolicy |
Get policy document and metadata |
organizations:ListTargetsForPolicy |
List OUs/accounts a policy applies to |
organizations:ListPoliciesForTarget |
List policies applied to a specific OU/account |
Operator Prerequisites
Organization policy APIs are organizations namespace APIs. Access requires one of:
- A role in the Organizations management account with
organizations:List*andorganizations:Describe*permissions, OR - A role in a delegated administrator account where the management account has configured the delegation policy to grant Organization policy API access to the service's delegated administrator. The standard service onboarding flow configures this delegation.
If list-policies returns AccessDeniedException, the current role lacks Organizations access. This typically means either:
- The account is not the management account or delegated administrator
- The delegation policy has not been configured to grant these permissions
Report policy status as Not checked - Organizations access unavailable and continue with service-specific checks that do not require Organizations permissions.
Output Sensitivity
Policy documents may reveal organizational structure (OU hierarchy, account assignments), security configuration enforcement rules, and service-specific settings applied across the organization. Present policy summary first; offer full policy document JSON on request.