For the complete documentation index, see llms.txt. This page is also available as Markdown.

Multi-Account Setup

If your company runs multiple AWS accounts within an AWS Organization, setup requires coordination with the Pump team. This page covers the options for connecting multi-account environments to Pump.

Before you start

Run a savings estimate using your management account first. The management account provides the most complete view of your organization's spend and gives Pump an accurate baseline for savings projections.

To confirm which account is your management account, navigate to AWS Console > Organizations > Accounts and look for the account labeled "Management account."

[SCREENSHOT NEEDED: AWS Organizations accounts page showing management account designation]

Choosing your onboarding path

How you connect depends on your current AWS Organization setup. There are three paths.

Path
Best for
Setup method

Join Account(s)

Organizations with a single active account, no SSO, and no cross-account dependencies

Self-serve after dissolving your existing org

Join With Pre-Existing Org

Organizations with SSO, cross-account logging, or complex multi-account configurations

Assisted setup with a Pump solutions architect

Consent to Assign (CTA)

Organizations with security or compliance constraints that require a different ownership model

Assisted setup at Pump's discretion

Path 1: Join Account(s)

This path is recommended if you do not have SSO configured for your AWS Organization and do not have cross-account communication dependencies (shared logging, centralized security, cross-account IAM roles).

An AWS account can only belong to one Organization at a time. To join Pump's Organization, you first dissolve your existing one.

Steps

  1. Log in to the AWS Console using your management account.

  2. Navigate to Organizations > Settings.

  3. Click Delete organization.

  4. All member accounts become standalone accounts.

  5. For each standalone account, follow the standard Pump onboarding flow (deploy the CloudFormation stack, authorize Pump as billing partner).

[SCREENSHOT NEEDED: AWS Organizations Settings page with Delete Organization button]

To add multiple standalone accounts to Pump, navigate to Settings > Integrations > New Account in the Pump dashboard and deploy a CloudFormation stack for each account.

What to evaluate before dissolving your org

Dissolving an AWS Organization affects several services. Review each before proceeding.

Area
Impact

Access control

If you have SSO configured through AWS IAM Identity Center, dissolving the org will disrupt SSO access. Do not use this path if SSO is active.

Cross-account logging

Centralized CloudTrail, AWS Config, or security logging may stop working if they depend on the org structure.

Service Control Policies (SCPs)

All SCPs are removed when the org is dissolved. Any access restrictions enforced by SCPs will no longer apply.

Consolidated billing

Member accounts begin accruing charges independently until they join Pump's org.

Organizational Units (OUs)

OU structure is lost. Pump can recreate your OU structure within its org if needed.

If any of these apply to your environment, use Path 2 instead.

Path 2: Join With Pre-Existing Org

This path is for organizations with SSO, cross-account configurations, or other dependencies that make dissolving the org impractical.

This is an assisted process. Contact the Pump team by booking a call, sending a message via Slack, or emailing support@pump.co to discuss the setup.

How it works

  1. Pump provisions a new AWS Organization for your company.

  2. Your accounts are moved into the Pump-managed org.

  3. You run a Pump-provided script to export your existing organization infrastructure, including SSO configuration (IAM Identity Center), Resource Access Manager (RAM) shares, SCPs, and other org-level policies.

  4. You are provided a delegated administrator account within the new org. You run an import script as the delegated admin to restore your org-level configuration.

  5. Pump recreates your OU structure within the new org.

What you retain

Access
Details

Delegated admin account

Full access to org-level management services

Root access

You maintain root access over all of your accounts

SSO

Restored via the export/import process (see SSO on Pump)

See the dedicated Joining via CTA page for this path.

Adding accounts after initial setup

Once your initial setup is complete, you can add additional AWS accounts to Pump at any time.

  1. Navigate to Settings > Integrations > New Account in the Pump dashboard.

  2. Deploy a new CloudFormation stack for each account, following the same process as initial onboarding.

Each account requires its own CloudFormation stack and IAM role.

StackSets for bulk deployment

If you manage many AWS accounts, Pump supports CloudFormation StackSets to deploy the IAM role across multiple accounts in a single operation. This avoids deploying individual stacks per account.

Contact your Pump representative for StackSet configuration. The StackSet deploys the same read-only (and optionally Autopilot) IAM role to every target account in your org.

Last updated

Was this helpful?