Setting the file. One moment.
Subchapter 41.13
references/organization-policies.mdMarkdown3 KBView on GitHub
AWS Organizations supports service-specific policy types for centralized configuration enforcement across member accounts. Multiple security services use this mechanism, each with its own policy type. Organization policies allow administrators to define and enforce service configurations from the management account or delegated administrator, ensuring consistent security posture across the organization.
| Policy Type | Service | Documentation |
|---|---|---|
SECURITYHUB_POLICY | Security Hub | https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_security_hub.html (opens in a new tab) |
INSPECTOR_POLICY | Inspector | https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inspector.html (opens in a new tab) |
The same CLI pattern applies to all policy types — substitute the appropriate POLICY_TYPE value:
# List policies of a given type
aws organizations list-policies --filter <POLICY_TYPE>
# Get policy document details
aws organizations describe-policy --policy-id <id>
# Check which roots, OUs, or accounts a policy targets
aws organizations list-targets-for-policy --policy-id <id>These are organizations namespace APIs — not service-specific APIs like securityhub or inspector2.
Execution environment: The AWS MCP server is recommended for running these API calls but is not required — standard AWS CLI access is sufficient.
| API | Purpose |
|---|---|
organizations:ListPolicies | List policies by type |
organizations:DescribePolicy | Get policy document and metadata |
organizations:ListTargetsForPolicy | List OUs/accounts a policy applies to |
organizations:ListPoliciesForTarget | List policies applied to a specific OU/account |
Organization policy APIs are organizations namespace APIs. Access requires one of:
organizations:List* and organizations:Describe* permissions, ORIf list-policies returns AccessDeniedException, the current role lacks Organizations access. This typically means either:
Report policy status as Not checked - Organizations access unavailable and continue with service-specific checks that do not require Organizations permissions.
Policy documents may reveal organizational structure (OU hierarchy, account assignments), security configuration enforcement rules, and service-specific settings applied across the organization. Present policy summary first; offer full policy document JSON on request.