Detaching organization policies with AWS Organizations

This topic describes how to detach policies with AWS Organizations. A policy defines the controls that you want to apply to a group of AWS accounts.

Topics

Detach policies with AWS Organizations

Detach policies with AWS Organizations

Minimum permissions

To detach a policy from the organization root, OU, or account, you must have permission to run the following action:

organizations:DetachPolicy

Note

You can't detach the last authorization policy (SCP or RCP) from a root, an OU, or an account. There must be at least one SCP and RCP attached to every root, OU, and account at all times.

Service control policies (SCPs)

You can detach an SCP by either navigating to the policy or to the root, OU, or account that you want to detach the policy from.

To detach an SCP by navigating to the root, OU, or account it's attached to

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the AWS accounts page navigate to the Root, OU, or account that you want to detach a policy from. You might have to expand OUs (choose the ) to find the OU or account that you want. Choose the name of the Root, OU, or account.
On the Policies tab, choose the radio button next to the SCP that you want to detach, and then choose Detach.
In the confirmation dialog box, choose Detach policy.

The list of attached SCPs is updated. The policy change caused by detaching the SCP takes effect immediately. For example, detaching an SCP immediately affects the permissions of IAM users and roles in the formerly attached account or accounts under the formerly attached organization root or OU.

To detach an SCP by navigating to the policy

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the Service control policies page, choose the name of the policy that you want to detach from a root, OU, or account.
On the Targets tab, choose the radio button next to the root, OU, or account that you want to detach the policy from. You might have to expand OUs (choose the ) to find the OU or account that you want.
Choose Detach.
In the confirmation dialog box, choose Detach.

The list of attached SCPs is updated. The policy change caused by detaching the SCP takes effect immediately. For example, detaching an SCP immediately affects the permissions of IAM users and roles in the formerly attached account or accounts under the formerly attached organization root or OU.

Resource control policies (RCPs)

You can detach an RCP by either navigating to the policy or to the root, OU, or account that you want to detach the policy from. After you detach an RCP from an entity, that RCP no longer applies to any resources that were affected by the now detached entity.

Note

You cannot detach the RCPFullAWSAccess policy

The RCPFullAWSAccess policy is automatically attached to the root, every OU, and every account in your organization. You cannot detach this policy.

To detach an RCP by navigating to the root, OU, or account it's attached to

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the AWS accounts page navigate to the Root, OU, or account that you want to detach a policy from. You might have to expand OUs (choose the ) to find the OU or account that you want. Choose the name of the Root, OU, or account.
On the Policies tab, choose the radio button next to the RCP that you want to detach, and then choose Detach.
In the confirmation dialog box, choose Detach policy.

The list of attached RCPs is updated. The policy change caused by detaching the RCP takes effect immediately. For example, detaching an RCP immediately affects the permissions of IAM users and roles in the formerly attached account or accounts under the formerly attached organization root or OU.

To detach an RCP by navigating to the policy

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the Resource control policy page, choose the name of the policy that you want to detach from a root, OU, or account.
On the Targets tab, choose the radio button next to the root, OU, or account that you want to detach the policy from. You might have to expand OUs (choose the ) to find the OU or account that you want.
Choose Detach.
In the confirmation dialog box, choose Detach.

The list of attached RCPs is updated. The policy change caused by detaching the RCP takes effect immediately. For example, detaching an RCP immediately affects the permissions of IAM users and roles in the formerly attached account or accounts under the formerly attached organization root or OU.

Backup policies

You can detach a backup policy by either navigating to the policy or to the root, OU, or account that you want to detach the policy from.

To detach a backup policy by navigating to the root, OU, or account it's attached to

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the AWS accounts page navigate to the Root, OU, or account that you want to detach a policy from. You might have to expand OUs (choose the ) to find the OU or account that you want. Choose the name of the Root, OU, or account.
On the Policies tab, choose the radio button next to the backup policy that you want to detach, and then choose Detach.
In the confirmation dialog box, choose Detach policy.

The list of attached backup policies is updated. The policy change takes effect immediately.

To detach a backup policy by navigating to the policy

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the Backup policies page, choose the name of the policy that you want to detach from a root, OU, or account.
On the Targets tab, choose the radio button next to the root, OU, or account that you want to detach the policy from. You might have to expand OUs (choose the ) to find the OU or account that you want.
Choose Detach.
In the confirmation dialog box, choose Detach.

The list of attached backup policies is updated. The policy change takes effect immediately.

Tag policies

You can detach a tag policy by either navigating to the policy or to the root, OU, or account that you want to detach the policy from.

To detach a tag policy by navigating to the root, OU, or account it's attached to

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the AWS accounts page navigate to the Root, OU, or account that you want to detach a policy from. You might have to expand OUs (choose the ) to find the OU or account that you want. Choose the name of the Root, OU, or account.
On the Policies tab, choose the radio button next to the tag policy that you want to detach, and then choose Detach.
In the confirmation dialog box, choose Detach policy.

The list of attached tag policies is updated. The policy change takes effect immediately.

To detach a tag policy by navigating to the policy

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the Tag policies page, choose the name of the policy that you want to detach from a root, OU, or account.
On the Targets tab, choose the radio button next to the root, OU, or account that you want to detach the policy from. You might have to expand OUs (choose the ) to find the OU or account that you want.
Choose Detach.
In the confirmation dialog box, choose Detach.

The list of attached tag policies is updated. The policy change takes effect immediately.

Chatbot policies

You can detach a chatbot policy by either navigating to the policy or to the root, OU, or account that you want to detach the policy from.

To detach a chatbot policy by navigating to the root, OU, or account it's attached to

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the AWS accounts page navigate to the Root, OU, or account that you want to detach a policy from. You might have to expand OUs (choose the ) to find the OU or account that you want. Choose the name of the Root, OU, or account.
On the Policies tab, choose the radio button next to the chatbot policy that you want to detach, and then choose Detach.
In the confirmation dialog box, choose Detach policy.

The list of attached chatbot policies is updated. The policy change takes effect immediately.

To detach a chatbot policy by navigating to the policy

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the Chatbot policies page, choose the name of the policy that you want to detach from a root, OU, or account.
On the Targets tab, choose the radio button next to the root, OU, or account that you want to detach the policy from. You might have to expand OUs (choose the ) to find the OU or account that you want.
Choose Detach.
In the confirmation dialog box, choose Detach.

The list of attached chatbot policies is updated. The policy change takes effect immediately.

AI services opt-out policies

You can detach an AI services opt-out policy by either navigating to the policy or to the root, OU, or account that you want to detach the policy from.

To detach an AI services opt-out policy by navigating to the root, OU, or account it's attached to

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the AWS accounts page navigate to the Root, OU, or account that you want to detach a policy from. You might have to expand OUs (choose the ) to find the OU or account that you want. Choose the name of the Root, OU, or account.
On the Policies tab, choose the radio button next to the AI services opt-out policy that you want to detach, and then choose Detach.
In the confirmation dialog box, choose Detach policy.

The list of attached AI services opt-out policies is updated. The policy change takes effect immediately.

To detach an AI services opt-out policy by navigating to the policy

Sign in to the AWS Organizations console. You must sign in as an IAM user, assume an IAM role, or sign in as the root user (not recommended) in the organization’s management account.
On the AI services opt-out policies page, choose the name of the policy that you want to detach from a root, OU, or account.
On the Targets tab, choose the radio button next to the root, OU, or account that you want to detach the policy from. You might have to expand OUs (choose the ) to find the OU or account that you want.
Choose Detach.
In the confirmation dialog box, choose Detach.

The list of attached AI services opt-out policies is updated. The policy change takes effect immediately.

To attach a policy

The following code examples show how to use DetachPolicy.

.NET

AWS SDK for .NET

Note

There's more on GitHub. Find the complete example and learn how to set up and run in the AWS Code Examples Repository.


    using System;
    using System.Threading.Tasks;
    using Amazon.Organizations;
    using Amazon.Organizations.Model;

    /// <summary>
    /// Shows how to detach a policy from an AWS Organizations organization,
    /// organizational unit, or account.
    /// </summary>
    public class DetachPolicy
    {
        /// <summary>
        /// Initializes the Organizations client object and uses it to call
        /// DetachPolicyAsync to detach the policy.
        /// </summary>
        public static async Task Main()
        {
            // Create the client object using the default account.
            IAmazonOrganizations client = new AmazonOrganizationsClient();

            var policyId = "p-00000000";
            var targetId = "r-0000";

            var request = new DetachPolicyRequest
            {
                PolicyId = policyId,
                TargetId = targetId,
            };

            var response = await client.DetachPolicyAsync(request);

            if (response.HttpStatusCode == System.Net.HttpStatusCode.OK)
            {
                Console.WriteLine($"Successfully detached policy with Policy Id: {policyId}.");
            }
            else
            {
                Console.WriteLine("Could not detach the policy.");
            }
        }
    }

For API details, see DetachPolicy in AWS SDK for .NET API Reference.

CLI

AWS CLI

To detach a policy from a root, OU, or account

The following example shows how to detach a policy from an OU:


aws organizations  detach-policy  --target-id ou-examplerootid111-exampleouid111 --policy-id p-examplepolicyid111

For API details, see DetachPolicy in AWS CLI Command Reference.

Python

SDK for Python (Boto3)

Note

There's more on GitHub. Find the complete example and learn how to set up and run in the AWS Code Examples Repository.


def detach_policy(policy_id, target_id, orgs_client):
    """
    Detaches a policy from a target.

    :param policy_id: The ID of the policy to detach.
    :param target_id: The ID of the resource where the policy is currently attached.
    :param orgs_client: The Boto3 Organizations client.
    """
    try:
        orgs_client.detach_policy(PolicyId=policy_id, TargetId=target_id)
        logger.info("Detached policy %s from target %s.", policy_id, target_id)
    except ClientError:
        logger.exception(
            "Couldn't detach policy %s from target %s.", policy_id, target_id
        )
        raise

For API details, see DetachPolicy in AWS SDK for Python (Boto3) API Reference.

The policy change takes effect immediately, affecting the permissions of IAM users and roles and resources, if applicable, in the attached account or all accounts under the attached root or OU.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Attaching policies

Getting policy details