> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/aws/aws-organization-connection.md).

# AWS Organization Connection

Use this method to connect multiple AWS accounts managed through AWS Organizations.

The CloudFormation deployment creates the required IAM roles across your organization, allowing OX to analyze cloud security findings across all connected AWS accounts.

After completing the deployment, connect the AWS Organizations integration in OX using the AWS Role ARN generated for the management account.

### Before you begin

Deploy the CloudFormation StackSet to:

* The AWS Organizations management account
* All existing member accounts

Use the same values for the following settings across all accounts:

| Setting       | Value                       |
| ------------- | --------------------------- |
| External ID   | Same value for all accounts |
| IAM role name | Same value for all accounts |

Configure AWS credentials separately for each account during deployment.

### Step 1: Deploy the StackSet \[AWS]

1. Sign in to the AWS Management Console.
2. Open **CloudFormation**.
3. Select **StackSets**.
4. Select **Create StackSet**.

#### Choose a template

Configure the template using the following values.

| Setting                         | Value                                                                                                            |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Permissions                     | **Service-managed permissions**                                                                                  |
| Prerequisite – Prepare template | **Template is ready**                                                                                            |
| Specify template                | **Amazon S3 URL**                                                                                                |
| Amazon S3 URL                   | `https://ox-cloudformation-template.s3.eu-west-1.amazonaws.com/aws/ox_aws_integration_stackset_template_k8s.yml` |

5. Select **Next**.

#### Specify StackSet details

Configure the StackSet using the following values.

| Setting        | Value                                         |
| -------------- | --------------------------------------------- |
| StackSet name  | `ox-security` (must be unique)                |
| Description    | Optional                                      |
| External ID    | External ID generated in the OX AWS connector |
| IAMRoleName    | Leave the default value                       |
| OxAWSAccountId | Leave the default value                       |

6. Select **Next**.

#### Configure StackSet options

Configure the following setting.

| Setting           | Value        |
| ----------------- | ------------ |
| Managed execution | **Inactive** |

7. Select **Next**.

#### Set deployment options

Configure the deployment using the following values.

| Setting                     | Value                      |
| --------------------------- | -------------------------- |
| Add stacks to stack set     | **Deploy new stacks**      |
| Deployment targets          | **Deploy to organization** |
| Automatic deployment        | **Enabled**                |
| Account removal behavior    | **Delete stacks**          |
| Region                      | Select one AWS region      |
| Maximum concurrent accounts | `1`                        |
| Failure tolerance           | `0`                        |
| Region concurrency          | **Sequential**             |

8. Select **Next**.
9. Review the configuration.
10. Under **Capabilities**, select the acknowledgment checkbox.
11. Select **Submit**.
12. Wait for the StackSet deployment to complete.

> **Note**
>
> Select only one AWS region. Selecting multiple regions causes the deployment to fail.

### Step 2: Deploy the CloudFormation stack \[AWS]

1. In OX, on the AWS connector page, select **CloudFormation Assume Role**.
2. On the **Create stack** page:
   1. Select the acknowledgment checkbox.
   2. Select **Create stack**.
3. Wait for the deployment to complete.
4. Open the **Outputs** tab.
5. Copy the **OxRoleArn** value.

> **Note**
>
> If a CloudFormation stack named **ox-security** already exists, specify a different stack name. Otherwise, the deployment fails because the stack name must be unique.

### Step 3: Connect AWS \[OX]

1. In OX, go to **Settings** > **Connectors**.
2. Select **AWS**.
3. In the **AWS Role ARN** field, paste the **OxRoleArn** value generated by the management account deployment.
4. Select **Connect**.

Verify that the connector status changes to **Connected**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/aws/aws-organization-connection.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.