> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/aws/aws-organization-connection.md).

# AWS Organization Connection

Use this method to connect multiple AWS accounts managed through AWS Organizations.

The CloudFormation deployment creates the required IAM roles across your organization, allowing OX to analyze cloud security findings across all connected AWS accounts.

After completing the deployment, connect the AWS Organizations integration in OX using the AWS Role ARN generated for the management account.

### Before you begin

Deploy the CloudFormation StackSet to:

* The AWS Organizations management account
* All existing member accounts

Use the same values for the following settings across all accounts:

| Setting       | Value                       |
| ------------- | --------------------------- |
| External ID   | Same value for all accounts |
| IAM role name | Same value for all accounts |

Configure AWS credentials separately for each account during deployment.

### Step 1: Deploy the StackSet \[AWS]

1. Sign in to the AWS Management Console.
2. Open **CloudFormation**.
3. Select **StackSets**.
4. Select **Create StackSet**.

#### Choose a template

Configure the template using the following values.

| Setting                         | Value                                                                                                            |
| ------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Permissions                     | **Service-managed permissions**                                                                                  |
| Prerequisite – Prepare template | **Template is ready**                                                                                            |
| Specify template                | **Amazon S3 URL**                                                                                                |
| Amazon S3 URL                   | `https://ox-cloudformation-template.s3.eu-west-1.amazonaws.com/aws/ox_aws_integration_stackset_template_k8s.yml` |

5. Select **Next**.

#### Specify StackSet details

Configure the StackSet using the following values.

| Setting        | Value                                         |
| -------------- | --------------------------------------------- |
| StackSet name  | `ox-security` (must be unique)                |
| Description    | Optional                                      |
| External ID    | External ID generated in the OX AWS connector |
| IAMRoleName    | Leave the default value                       |
| OxAWSAccountId | Leave the default value                       |

6. Select **Next**.

#### Configure StackSet options

Configure the following setting.

| Setting           | Value        |
| ----------------- | ------------ |
| Managed execution | **Inactive** |

7. Select **Next**.

#### Set deployment options

Configure the deployment using the following values.

| Setting                     | Value                      |
| --------------------------- | -------------------------- |
| Add stacks to stack set     | **Deploy new stacks**      |
| Deployment targets          | **Deploy to organization** |
| Automatic deployment        | **Enabled**                |
| Account removal behavior    | **Delete stacks**          |
| Region                      | Select one AWS region      |
| Maximum concurrent accounts | `1`                        |
| Failure tolerance           | `0`                        |
| Region concurrency          | **Sequential**             |

8. Select **Next**.
9. Review the configuration.
10. Under **Capabilities**, select the acknowledgment checkbox.
11. Select **Submit**.
12. Wait for the StackSet deployment to complete.

> **Note**
>
> Select only one AWS region. Selecting multiple regions causes the deployment to fail.

### Step 2: Deploy the CloudFormation stack \[AWS]

1. In OX, on the AWS connector page, select **CloudFormation Assume Role**.
2. On the **Create stack** page:
   1. Select the acknowledgment checkbox.
   2. Select **Create stack**.
3. Wait for the deployment to complete.
4. Open the **Outputs** tab.
5. Copy the **OxRoleArn** value.

> **Note**
>
> If a CloudFormation stack named **ox-security** already exists, specify a different stack name. Otherwise, the deployment fails because the stack name must be unique.

### Step 3: Connect AWS \[OX]

1. In OX, go to **Settings** > **Connectors**.
2. Select **AWS**.
3. In the **AWS Role ARN** field, paste the **OxRoleArn** value generated by the management account deployment.
4. Select **Connect**.

Verify that the connector status changes to **Connected**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/aws/aws-organization-connection.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.