Multi-Account Setup

If your company runs multiple AWS accounts within an AWS Organization, setup requires coordination with the Pump team. This page covers the options for connecting multi-account environments to Pump.

Before you start

Run a savings estimate using your management account first. The management account provides the most complete view of your organization's spend and gives Pump an accurate baseline for savings projections.

To confirm which account is your management account, navigate to AWS Console > Organizations > Accounts and look for the account labeled "Management account."

[SCREENSHOT NEEDED: AWS Organizations accounts page showing management account designation]

Choosing your onboarding path

How you connect depends on your current AWS Organization setup. There are three paths.

Path	Best for	Setup method
Join Account(s)	Organizations with a single active account, no SSO, and no cross-account dependencies	Self-serve after dissolving your existing org
Join With Pre-Existing Org	Organizations with SSO, cross-account logging, or complex multi-account configurations	Assisted setup with a Pump solutions architect
Consent to Assign (CTA)	Organizations with security or compliance constraints that require a different ownership model	Assisted setup at Pump's discretion

Path 1: Join Account(s)

This path is recommended if you do not have SSO configured for your AWS Organization and do not have cross-account communication dependencies (shared logging, centralized security, cross-account IAM roles).

An AWS account can only belong to one Organization at a time. To join Pump's Organization, you first dissolve your existing one.

Steps

1. Log in to the AWS Console using your management account.

2. Navigate to Organizations > Settings.

3. Click Delete organization.

4. All member accounts become standalone accounts.

5. For each standalone account, follow the standard Pump onboarding flow (deploy the CloudFormation stack, authorize Pump as billing partner).

[SCREENSHOT NEEDED: AWS Organizations Settings page with Delete Organization button]

To add multiple standalone accounts to Pump, navigate to Settings > Integrations > New Account in the Pump dashboard and deploy a CloudFormation stack for each account.

What to evaluate before dissolving your org

Dissolving an AWS Organization affects several services. Review each before proceeding.

Area	Impact
Access control	If you have SSO configured through AWS IAM Identity Center, dissolving the org will disrupt SSO access. Do not use this path if SSO is active.
Cross-account logging	Centralized CloudTrail, AWS Config, or security logging may stop working if they depend on the org structure.
Service Control Policies (SCPs)	All SCPs are removed when the org is dissolved. Any access restrictions enforced by SCPs will no longer apply.
Consolidated billing	Member accounts begin accruing charges independently until they join Pump's org.
Organizational Units (OUs)	OU structure is lost. Pump can recreate your OU structure within its org if needed.

If any of these apply to your environment, use Path 2 instead.

Path 2: Join With Pre-Existing Org

This path is for organizations with SSO, cross-account configurations, or other dependencies that make dissolving the org impractical.

This is an assisted process. Contact the Pump team by booking a call, sending a message via Slack, or emailing [e-mail] to discuss the setup.

How it works

1. Pump provisions a new AWS Organization for your company.

2. Your accounts are moved into the Pump-managed org.

3. You run a Pump-provided script to export your existing organization infrastructure, including SSO configuration (IAM Identity Center), Resource Access Manager (RAM) shares, SCPs, and other org-level policies.

4. You are provided a delegated administrator account within the new org. You run an import script as the delegated admin to restore your org-level configuration.

5. Pump recreates your OU structure within the new org.

What you retain

Access	Details
Delegated admin account	Full access to org-level management services
Root access	You maintain root access over all of your accounts
SSO	Restored via the export/import process (see SSO on Pump)

Path 3: Consent to Assign (CTA)

See the dedicated Joining via CTA page for this path.

Adding accounts after initial setup

Once your initial setup is complete, you can add additional AWS accounts to Pump at any time.

1. Navigate to Settings > Integrations > New Account in the Pump dashboard.

2. Deploy a new CloudFormation stack for each account, following the same process as initial onboarding.

Each account requires its own CloudFormation stack and IAM role.

StackSets for bulk deployment

If you manage many AWS accounts, Pump supports CloudFormation StackSets to deploy the IAM role across multiple accounts in a single operation. This avoids deploying individual stacks per account.

Contact your Pump representative for StackSet configuration. The StackSet deploys the same read-only (and optionally Autopilot) IAM role to every target account in your org.