如何删除无法从 AWS 组织访问的成员账户？

Question

Context

I'm creating a new Organization in AWS to learn about how they function. This isn't for an organization as I'd need more units to set this up. The goal is a simple setup for a small company that would want staging and production accounts to isolate infrastructure.

For this, I have a master account and I've added two other accounts - staging and production which are attached to staging and production organizational units respectively.

The email attached to the master account is master@domain.com and the production account is master+production@domain.com while the staging is master+staging@domain.com.

I've read: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html and it seems that you cannot which is unfortunate but I was hoping there is some way around that.

Account Structure:

root 
  -> app 
    -> staging (master+staging@domain.com)
    -> production (master+production@domain.com)

Problems

I've run into several issues:

1. I cannot sign in because the provided email goes to my master account and AWS assumes I'm the root account.

2. I cannot rename the account and cannot find documentation into how to.

3. I cannot delete the account because it doesn't have billing information associated with it.

4. I cannot delete the organization to start over because you must remove all accounts first.

Questions

1. Any ideas on how to get out of this?

2. How can I setup a simple production | staging with an account for each?

I just want a simple setup of prod and staging that I can use to setup apps on for experimenting with infrastructure more.

Answer 1

To log into your member accounts from your master account, see this link: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_access-cross-account-role

When you create an AWS Org member account, you don't see the root user account. However, you need it to remove the account. Use the member account email to initiate a root user login and then use the "Forgot Password" process to reset the root user password. Then, login as root and add the info necessary to get rid of the account.

Even then you'll have problems, but ... you'll be closer to your goal.