CIRT insights: How to help prevent unauthorized account removals from AWS Organizations

This article describes a threat tactic where attackers remove AWS accounts from AWS Organizations to bypass security controls and monitoring.

• Threat actors use `organizations:LeaveOrganization` permission to remove compromised accounts from organizations
• Removed accounts lose SCPs, consolidated billing alerts, CloudTrail organization trails, and GuardDuty visibility
• Organizations lose visibility into accounts still containing organizational resources
• CloudTrail logs `LeaveOrganization` and `AcceptHandshake` API calls when accounts depart
• Implement SCP denying `organizations:LeaveOrganization` action as primary prevention
• Apply least privilege IAM permissions to limit unauthorized permission escalation paths
• Enable MFA on root users, delete root access keys, implement centralized root access management

AWS CIRT recommends immediately implementing the `DenyLeaveOrganizationSCP` policy as the highest-impact, lowest-effort control against this emerging threat technique.