> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/aws/onboarding/management-account-access.md).

# Management Account Access

### What the PumpCustomerAccess role provides

The role grants read/write access to organization-level services only. This includes:

| Service category        | Examples                                                                |
| ----------------------- | ----------------------------------------------------------------------- |
| Security and compliance | AWS CloudTrail, AWS Config, Amazon Inspector                            |
| Cost management         | Cost allocation tags, billing preferences                               |
| Organization services   | Other organization-wide features that require management account access |

### What the role does not provide

The PumpCustomerAccess role is scoped to organization-level services. It does not allow:

| Restriction       | Details                                                                                                              |
| ----------------- | -------------------------------------------------------------------------------------------------------------------- |
| Resource creation | You cannot create EC2 instances, Lambda functions, ECS tasks, or any other resources in the management account       |
| IAM access        | You cannot modify IAM users, roles, or policies in the management account                                            |
| SSO management    | IAM Identity Center (formerly AWS SSO) is managed through the delegated administrator account, not through this role |

Your existing account-level and billing-level setup is not affected by this role.

### How to access the management account

1. Confirm your IAM user or role is in a child account of the management account.
2. Confirm your user or role has the `sts:AssumeRole` permission.
3. Find your Management Account ID: navigate to **AWS Organizations > Dashboard > Management Account ID**.
4. In the AWS Console, click your username in the top-right corner.
5. Click **Switch Role**.
6. Enter:
   * **Account ID:** your Management Account ID
   * **Role name:** `PumpCustomerAccess`
7. Click **Switch Role**.

You now have access to organization-level services through the management account.

### Restricting access

By default, any user in a child account with `sts:AssumeRole` permission can switch into the PumpCustomerAccess role. If you want to restrict access to specific accounts, users, or groups, contact Pump and the team can apply tighter trust policy constraints.

### Viewing exact permissions

The full policy document for the PumpCustomerAccess role is available at:

<https://pump-public-readonly.s3.us-west-2.amazonaws.com/PumpCustomerManagementAccess>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.pump.co/aws/onboarding/management-account-access.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.