cis-aws-foundations-2-1-3

name	cis-aws-foundations-2.1.3
description	Ensure Organizations management account is not used for workloads
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","organizations","management-account","workload-isolation"]
cis_id	2.1.3
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.1.1","cis-aws-foundations-2.1.4"]
prerequisites	[]
severity_boost	{}

Ensure Organizations management account is not used for workloads

Description

Ensure that the AWS Organizations management account is used only for organizational governance tasks and does not host production workloads, applications, or business data. The management account is the most privileged account in an AWS Organization and performs sensitive administrative functions such as creating and managing member accounts, applying service control policies (SCPs), and managing consolidated billing. Workloads, applications, and associated data should be deployed in dedicated member accounts, not in the management account.

Rationale

The management account has unique privileges that cannot be restricted by SCPs, making it the highest-risk account in an organization. Deploying workloads or storing business data in the management account increases the attack surface and blast radius of a compromise. If a workload vulnerability or misconfiguration occurs in the management account, it could grant attackers access to organization-wide administrative capabilities.

Impact

Restricting the management account to governance-only use may require creating new member accounts, redesigning existing account boundaries, and migrating workloads and data out of the management account. This can introduce short-term complexity and operational overhead. However, it reduces the blast radius of a compromise, simplifies security controls in the most privileged account, and aligns the environment with AWS multi-account and workload-isolation best practices.

Audit Procedure

Using AWS CLI

1. Confirm which AWS account is the management account for the organization (for example, via AWS Organizations "Overview" page or organizational documentation).
2. Ensure you have read-only access to review resources in this account.
3. Use your organization's standard discovery methods (for example, AWS Config, CMDB/asset inventory, or CSPM) to obtain a list of services and resources running in the management account.
4. At a minimum, identify compute, storage, database, and application services (for example, EC2, Lambda, ECS, S3, RDS, DynamoDB, API Gateway, load balancers).

# List EC2 instances in the management account
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,Tags[?Key==`Name`].Value|[0]]' --output table

# List Lambda functions
aws lambda list-functions --query 'Functions[*].[FunctionName,Runtime]' --output table

# List RDS instances
aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,Engine,DBInstanceStatus]' --output table


aws ecs list-clusters


aws s3api list-buckets --query  --output table