organizations:ListAccounts

[ekkards]

Even when the permission is granted via policy, the operation may fail with AccessDeniedException

• Service: organizations
• Action: ListAccounts

This apparently can happen, if the operation is called from within an account, which is subordinated to another account, eg. for consolidated billing. Then the organization hierarchy supersedes the assigned permission.

[michaelwittig]

Just to make sure that I understand this: The API actions only work in the org's root account ?

[ekkards]

The API action ListAccounts works in the org's root account,
it does not work in the account, which has consolidated billing to the root account.
No information about other situations, i.e. not sure about "only".

[kalinon]

i am also seeing this behavior.