> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/aws/onboarding/multi-account-setup.md). # Multi-Account Setup ### Before you start Run a savings estimate using your management account first. The management account provides the most complete view of your organization's spend and gives Pump an accurate baseline for savings projections. To confirm which account is your management account, navigate to **AWS Console > Organizations > Accounts** and look for the account labeled "Management account." \[SCREENSHOT NEEDED: AWS Organizations accounts page showing management account designation] ### Choosing your onboarding path How you connect depends on your current AWS Organization setup. There are three paths. | Path | Best for | Setup method | | ------------------------------ | ---------------------------------------------------------------------------------------------- | ---------------------------------------------- | | **Join Account(s)** | Organizations with a single active account, no SSO, and no cross-account dependencies | Self-serve after dissolving your existing org | | **Join With Pre-Existing Org** | Organizations with SSO, cross-account logging, or complex multi-account configurations | Assisted setup with a Pump solutions architect | | **Consent to Assign (CTA)** | Organizations with security or compliance constraints that require a different ownership model | Assisted setup at Pump's discretion | ### Path 1: Join Account(s) This path is recommended if you do not have SSO configured for your AWS Organization and do not have cross-account communication dependencies (shared logging, centralized security, cross-account IAM roles). An AWS account can only belong to one Organization at a time. To join Pump's Organization, you first dissolve your existing one. #### Steps 1. Log in to the AWS Console using your management account. 2. Navigate to **Organizations > Settings**. 3. Click **Delete organization**. 4. All member accounts become standalone accounts. 5. For each standalone account, follow the standard Pump onboarding flow (deploy the CloudFormation stack, authorize Pump as billing partner). \[SCREENSHOT NEEDED: AWS Organizations Settings page with Delete Organization button] To add multiple standalone accounts to Pump, navigate to **Settings > Integrations > New Account** in the Pump dashboard and deploy a CloudFormation stack for each account. #### What to evaluate before dissolving your org Dissolving an AWS Organization affects several services. Review each before proceeding. | Area | Impact | | ------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | Access control | If you have SSO configured through AWS IAM Identity Center, dissolving the org will disrupt SSO access. Do not use this path if SSO is active. | | Cross-account logging | Centralized CloudTrail, AWS Config, or security logging may stop working if they depend on the org structure. | | Service Control Policies (SCPs) | All SCPs are removed when the org is dissolved. Any access restrictions enforced by SCPs will no longer apply. | | Consolidated billing | Member accounts begin accruing charges independently until they join Pump's org. | | Organizational Units (OUs) | OU structure is lost. Pump can recreate your OU structure within its org if needed. | If any of these apply to your environment, use Path 2 instead. ### Path 2: Join With Pre-Existing Org This path is for organizations with SSO, cross-account configurations, or other dependencies that make dissolving the org impractical. This is an assisted process. Contact the Pump team by booking a call, sending a message via Slack, or emailing to discuss the setup. #### How it works 1. Pump provisions a new AWS Organization for your company. 2. Your accounts are moved into the Pump-managed org. 3. You run a Pump-provided script to export your existing organization infrastructure, including SSO configuration (IAM Identity Center), Resource Access Manager (RAM) shares, SCPs, and other org-level policies. 4. You are provided a delegated administrator account within the new org. You run an import script as the delegated admin to restore your org-level configuration. 5. Pump recreates your OU structure within the new org. #### What you retain | Access | Details | | ----------------------- | -------------------------------------------------------- | | Delegated admin account | Full access to org-level management services | | Root access | You maintain root access over all of your accounts | | SSO | Restored via the export/import process (see SSO on Pump) | ### Path 3: Consent to Assign (CTA) See the dedicated Joining via CTA page for this path. ### Adding accounts after initial setup Once your initial setup is complete, you can add additional AWS accounts to Pump at any time. 1. Navigate to **Settings > Integrations > New Account** in the Pump dashboard. 2. Deploy a new CloudFormation stack for each account, following the same process as initial onboarding. Each account requires its own CloudFormation stack and IAM role. ### StackSets for bulk deployment If you manage many AWS accounts, Pump supports CloudFormation StackSets to deploy the IAM role across multiple accounts in a single operation. This avoids deploying individual stacks per account. Contact your Pump representative for StackSet configuration. The StackSet deploys the same read-only (and optionally Autopilot) IAM role to every target account in your org. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.pump.co/aws/onboarding/multi-account-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.