Question

A security engineer at a financial services company manages an AWS Organization with all features enabled and Control Tower deployed. Recently, an administrator in a member account attempted to remove that account from the organization using the LeaveOrganization API, which would have bypassed centralized guardrails and billing consolidation. The engineer must ensure that member account administrators can never detach their accounts from the organization, while still allowing normal workloads to function. Which approach best meets this requirement?

Accepted Answer

Attach an SCP to the organization root (and OUs) that includes an explicit Deny on the organizations:LeaveOrganization action

Answer

Enable an AWS Config managed rule that detects when an account leaves the organization and triggers an SSM Automation to re-invite it

Answer

Add an IAM permission boundary to every role in each member account that denies the organizations:LeaveOrganization action

Answer

Create a Security Hub custom control that flags any account attempting to call LeaveOrganization and route the finding to the security team