When your AWS account joins Pump's Organization, Pump creates a role called PumpCustomerAccess in your organization's management account. This role gives your team direct access to organization-level
The role grants read/write access to organization-level services only. This includes:
Security and compliance
AWS CloudTrail, AWS Config, Amazon Inspector
Cost management
Cost allocation tags, billing preferences
Organization services
Other organization-wide features that require management account access
The PumpCustomerAccess role is scoped to organization-level services. It does not allow:
Resource creation
You cannot create EC2 instances, Lambda functions, ECS tasks, or any other resources in the management account
IAM access
You cannot modify IAM users, roles, or policies in the management account
SSO management
IAM Identity Center (formerly AWS SSO) is managed through the delegated administrator account, not through this role
Your existing account-level and billing-level setup is not affected by this role.
Confirm your IAM user or role is in a child account of the management account.
Confirm your user or role has the sts:AssumeRole permission.
Find your Management Account ID: navigate to AWS Organizations > Dashboard > Management Account ID.
In the AWS Console, click your username in the top-right corner.
Click Switch Role.
Enter:
Account ID: your Management Account ID
Role name: PumpCustomerAccess
Click Switch Role.
You now have access to organization-level services through the management account.
By default, any user in a child account with sts:AssumeRole permission can switch into the PumpCustomerAccess role. If you want to restrict access to specific accounts, users, or groups, contact Pump and the team can apply tighter trust policy constraints.
The full policy document for the PumpCustomerAccess role is available at:
https://pump-public-readonly.s3.us-west-2.amazonaws.com/PumpCustomerManagementAccess
Last updated
Was this helpful?
Was this helpful?
