import type { MetadataBearer as __MetadataBearer } from "@smithy/types"; import type { CreateGovCloudAccountRequest, CreateGovCloudAccountResponse } from "../models/models_0"; /** * @public */ export type { __MetadataBearer }; /** * @public * * The input for {@link CreateGovCloudAccountCommand}. */ export interface CreateGovCloudAccountCommandInput extends CreateGovCloudAccountRequest { } /** * @public * * The output of {@link CreateGovCloudAccountCommand}. */ export interface CreateGovCloudAccountCommandOutput extends CreateGovCloudAccountResponse, __MetadataBearer { } declare const CreateGovCloudAccountCommand_base: { new (input: CreateGovCloudAccountCommandInput): import("@smithy/core/client").CommandImpl; new (input: CreateGovCloudAccountCommandInput): import("@smithy/core/client").CommandImpl; getEndpointParameterInstructions(): import("@smithy/types").EndpointParameterInstructions; }; /** *

This action is available if all of the following are true:

*
You're authorized to create accounts in the Amazon Web Services GovCloud (US) Region. For * more information on the Amazon Web Services GovCloud (US) Region, see the * Amazon Web Services GovCloud User Guide. *
*
*
You already have an account in the Amazon Web Services GovCloud (US) Region that is paired * with a management account of an organization in the commercial Region.
*
*
You call this action from the management account of your organization in the * commercial Region.
*
*
You have the organizations:CreateGovCloudAccount permission. *
*

Organizations automatically creates the required service-linked role named * AWSServiceRoleForOrganizations. For more information, see Organizations and service-linked roles in the * Organizations User Guide.

Amazon Web Services automatically enables CloudTrail for Amazon Web Services GovCloud (US) accounts, but you should also * do the following:

*
Verify that CloudTrail is enabled to store logs.
*
*
Create an Amazon S3 bucket for CloudTrail log storage.
*
For more information, see Verifying CloudTrail Is * Enabled in the Amazon Web Services GovCloud User Guide. *
*

If the request includes tags, then the requester must have the * organizations:TagResource permission. The tags are attached to the * commercial account associated with the GovCloud account, rather than the GovCloud * account itself. To add tags to the GovCloud account, call the TagResource operation in the GovCloud Region after the new GovCloud * account exists.

You call this action from the management account of your organization in the * commercial Region to create a standalone Amazon Web Services account in the Amazon Web Services GovCloud (US) * Region. After the account is created, the management account of an organization in the * Amazon Web Services GovCloud (US) Region can invite it to that organization. For more information on * inviting standalone accounts in the Amazon Web Services GovCloud (US) to join an organization, see * Organizations in the * Amazon Web Services GovCloud User Guide.

Calling CreateGovCloudAccount is an asynchronous request that Amazon Web Services * performs in the background. Because CreateGovCloudAccount operates * asynchronously, it can return a successful completion message even though account * initialization might still be in progress. You might need to wait a few minutes before * you can successfully access the account. To check the status of the request, do one of * the following:

*
Use the Id response element from this operation to * provide as a parameter to the DescribeCreateAccountStatus * operation.
*
*
Check the CloudTrail log for the CreateAccountResult event. For * information on using CloudTrail with Organizations, see Logging and * monitoring in Organizations in the * Organizations User Guide.
*

Additionally, the AccountJoinedOrganization event is logged in CloudTrail and * is available only in the management account's event history only for the linked * commercial account. This event includes joinedMethod:Created and * joinedTime fields to provide context on how and when the account joined * the organization.

When you call the CreateGovCloudAccount action, you create two accounts: * a standalone account in the Amazon Web Services GovCloud (US) Region and an associated account in the * commercial Region for billing and support purposes. The account in the commercial Region * is automatically a member of the organization whose credentials made the request. Both * accounts are associated with the same email address.

A role is created in the new account in the commercial Region that allows the * management account in the organization in the commercial Region to assume it. An Amazon Web Services * GovCloud (US) account is then created and associated with the commercial account that * you just created. A role is also created in the new Amazon Web Services GovCloud (US) account that can * be assumed by the Amazon Web Services GovCloud (US) account that is associated with the management * account of the commercial organization. For more information and to view a diagram that * explains how account access works, see Organizations in the * Amazon Web Services GovCloud User Guide.

For more information about creating accounts, see Creating * a member account in your organization in the * Organizations User Guide.

* *

*
When you create an account in an organization using the Organizations console, * API, or CLI commands, the information required for the account to operate as * a standalone account is not automatically collected. * This includes a payment method and signing the end user license agreement * (EULA). If you must remove an account from your organization later, you can * do so only after you provide the missing information. For more information, * see Considerations before removing an account from an organization * in the Organizations User Guide.
*
*
If you get an exception that indicates that you exceeded your account * limits for the organization, contact Amazon Web Services Support.
*
*
If you get an exception that indicates that the operation failed because * your organization is still initializing, wait one hour and then try again. * If the error persists, contact Amazon Web Services Support.
*
*
Using CreateGovCloudAccount to create multiple temporary * accounts isn't recommended. You can only close an account from the Amazon Web Services * Billing and Cost Management console, and you must be signed in as the root user. For information on * the requirements and process for closing an account, see Closing a member * account in your organization in the * Organizations User Guide.
*

* * *

When you create a member account with this operation, you can choose whether to * create the account with the IAM User and Role Access to * Billing Information switch enabled. If you enable it, IAM users and * roles that have appropriate permissions can view billing information for the * account. If you disable it, only the account root user can access billing * information. For information about how to disable this switch for an account, see * Granting * access to your billing information and tools.

* * @example * Use a bare-bones client and the command you need to make an API call. * ```javascript * import { OrganizationsClient, CreateGovCloudAccountCommand } from "@aws-sdk/client-organizations"; // ES Modules import * // const { OrganizationsClient, CreateGovCloudAccountCommand } = require("@aws-sdk/client-organizations"); // CommonJS import * // import type { OrganizationsClientConfig } from "@aws-sdk/client-organizations"; * const config = {}; // type is OrganizationsClientConfig * const client = new OrganizationsClient(config); * const input = { // CreateGovCloudAccountRequest * Email: "STRING_VALUE", // required * AccountName: "STRING_VALUE", // required * RoleName: "STRING_VALUE", * IamUserAccessToBilling: "ALLOW" || "DENY", * Tags: [ // Tags * { // Tag * Key: "STRING_VALUE", // required * Value: "STRING_VALUE", // required * }, * ], * }; * const command = new CreateGovCloudAccountCommand(input); * const response = await client.send(command); * // { // CreateGovCloudAccountResponse * // CreateAccountStatus: { // CreateAccountStatus * // Id: "STRING_VALUE", * // AccountName: "STRING_VALUE", * // State: "IN_PROGRESS" || "SUCCEEDED" || "FAILED", * // RequestedTimestamp: new Date("TIMESTAMP"), * // CompletedTimestamp: new Date("TIMESTAMP"), * // AccountId: "STRING_VALUE", * // GovCloudAccountId: "STRING_VALUE", * // FailureReason: "ACCOUNT_LIMIT_EXCEEDED" || "EMAIL_ALREADY_EXISTS" || "INVALID_ADDRESS" || "INVALID_EMAIL" || "CONCURRENT_ACCOUNT_MODIFICATION" || "INTERNAL_FAILURE" || "GOVCLOUD_ACCOUNT_ALREADY_EXISTS" || "MISSING_BUSINESS_VALIDATION" || "FAILED_BUSINESS_VALIDATION" || "PENDING_BUSINESS_VALIDATION" || "INVALID_IDENTITY_FOR_BUSINESS_VALIDATION" || "UNKNOWN_BUSINESS_VALIDATION" || "MISSING_PAYMENT_INSTRUMENT" || "INVALID_PAYMENT_INSTRUMENT" || "UPDATE_EXISTING_RESOURCE_POLICY_WITH_TAGS_NOT_SUPPORTED", * // }, * // }; * * ``` * * @param CreateGovCloudAccountCommandInput - {@link CreateGovCloudAccountCommandInput} * @returns {@link CreateGovCloudAccountCommandOutput} * @see {@link CreateGovCloudAccountCommandInput} for command's `input` shape. * @see {@link CreateGovCloudAccountCommandOutput} for command's `response` shape. * @see {@link OrganizationsClientResolvedConfig | config} for OrganizationsClient's `config` shape. * * @throws {@link AccessDeniedException} (client fault) *

You don't have permissions to perform the requested operation. The user or role that * is making the request must have at least one IAM permissions policy attached that * grants the required permissions. For more information, see Access Management in the * IAM User Guide.

* * @throws {@link AWSOrganizationsNotInUseException} (client fault) *

Your account isn't a member of an organization. To make this request, you must use the * credentials of an account that belongs to an organization.

* * @throws {@link ConcurrentModificationException} (client fault) *

The target of the operation is currently being modified by a different request. Try * again later.

* * @throws {@link ConstraintViolationException} (client fault) *

Performing this operation violates a minimum or maximum value limit. For example, * attempting to remove the last service control policy (SCP) from an OU or root, inviting * or creating too many accounts to the organization, or attaching too many policies to an * account, OU, or root. This exception includes a reason that contains additional * information about the violated limit:

* *

Some of the reasons in the following list might not be applicable to this specific * API or operation.

* *

*
ACCOUNT_CANNOT_LEAVE_ORGANIZATION: You attempted to remove the management * account from the organization. You can't remove the management account. Instead, * after you remove all member accounts, delete the organization itself.
*
*
ACCOUNT_CANNOT_LEAVE_WITHOUT_PHONE_VERIFICATION: You attempted to remove an * account from the organization that doesn't yet have enough information to exist * as a standalone account. This account requires you to first complete phone * verification. Follow the steps at Removing a member account from your organization in the * Organizations User Guide.
*
*
ACCOUNT_CREATION_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of * accounts that can be in progress at a time.
*
*
ACCOUNT_CREATION_NOT_COMPLETE: Your account setup isn't complete or your * account isn't fully active. You must complete the account setup before you * create an organization.
*
*
ACCOUNT_NOT_ACTIVE_FOR_TRANSFER_RESPONSIBILITY: Your account setup isn't * complete or your account isn't fully active to invite or accept a Billing * Transfer invitation.
*
*
ACTIVE_RESPONSIBILITY_TRANSFER_PROCESS: You cannot delete organization due to an ongoing responsibility transfer process. For example, a pending invitation or an in-progress transfer. To delete the organization, you must resolve the current transfer process.
*
*
ACCOUNT_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the limit on the number * of accounts in an organization. If you need more accounts, contact Amazon Web Services Support to * request an increase in your limit.
*
Or the number of invitations that you tried to send would cause you to exceed * the limit of accounts in your organization. Send fewer invitations or contact * Amazon Web Services Support to request an increase in the number of accounts.
* *
Deleted and closed accounts still count toward your limit.
* * *
If you get this exception when running a command immediately after * creating the organization, wait one hour and try again. After an hour, if * the command continues to fail with this error, contact Amazon Web Services Support.
* *
*
ALL_FEATURES_MIGRATION_ORGANIZATION_SIZE_LIMIT_EXCEEDED: Your organization has * more than 5000 accounts, and you can only use the standard migration process for * organizations with less than 5000 accounts. Use the assisted migration process * to enable all features mode, or create a support case for assistance if you are * unable to use assisted migration.
*
*
CANNOT_REGISTER_SUSPENDED_ACCOUNT_AS_DELEGATED_ADMINISTRATOR: You cannot * register a suspended account as a delegated administrator.
*
*
CANNOT_REGISTER_MASTER_AS_DELEGATED_ADMINISTRATOR: You attempted to register * the management account of the organization as a delegated administrator for an * Amazon Web Services service integrated with Organizations. You can designate only a member account as a * delegated administrator.
*
*
CANNOT_CLOSE_MANAGEMENT_ACCOUNT: You attempted to close the management * account. To close the management account for the organization, you must first * either remove or close all member accounts in the organization. Follow standard * account closure process using root credentials.
*
*
CANNOT_REMOVE_DELEGATED_ADMINISTRATOR_FROM_ORG: You attempted to remove an * account that is registered as a delegated administrator for a service integrated * with your organization. To complete this operation, you must first deregister * this account as a delegated administrator.
*
*
CLOSE_ACCOUNT_QUOTA_EXCEEDED: You have exceeded close account quota for the * past 30 days.
*
*
CLOSE_ACCOUNT_REQUESTS_LIMIT_EXCEEDED: You attempted to exceed the number of * accounts that you can close at a time.
*
*
CREATE_ORGANIZATION_IN_BILLING_MODE_UNSUPPORTED_REGION: To create an * organization in the specified region, you must enable all features mode.
*
*
DELEGATED_ADMINISTRATOR_EXISTS_FOR_THIS_SERVICE: You attempted to register an * Amazon Web Services account as a delegated administrator for an Amazon Web Services service that already has * a delegated administrator. To complete this operation, you must first deregister * any existing delegated administrators for this service.
*
*
EMAIL_VERIFICATION_CODE_EXPIRED: The email verification code is only valid for * a limited period of time. You must resubmit the request and generate a new * verification code.
*
*
HANDSHAKE_RATE_LIMIT_EXCEEDED: You attempted to exceed the number of * handshakes that you can send in one day.
*
*
INVALID_PAYMENT_INSTRUMENT: You cannot remove an account because no supported * payment method is associated with the account. Amazon Web Services does not support cards * issued by financial institutions in Russia or Belarus. For more information, see * Managing your * Amazon Web Services payments.
*
*
MASTER_ACCOUNT_ADDRESS_DOES_NOT_MATCH_MARKETPLACE: To create an account in * this organization, you first must migrate the organization's management account * to the marketplace that corresponds to the management account's address. All * accounts in an organization must be associated with the same marketplace.
*
*
MASTER_ACCOUNT_MISSING_BUSINESS_LICENSE: Applies only to the Amazon Web Services Regions in * China. To create an organization, the master must have a valid business license. * For more information, contact customer support.
*
*
MASTER_ACCOUNT_MISSING_CONTACT_INFO: To complete this operation, you must * first provide a valid contact address and phone number for the management * account. Then try the operation again.
*
*
MASTER_ACCOUNT_NOT_GOVCLOUD_ENABLED: To complete this operation, the * management account must have an associated account in the Amazon Web Services GovCloud * (US-West) Region. For more information, see Organizations * in the * Amazon Web Services GovCloud User Guide.
*
*
MASTER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To create an organization with * this management account, you first must associate a valid payment instrument, * such as a credit card, with the account. For more information, see Considerations before removing an account from an organization in * the Organizations User Guide.
*
*
MAX_DELEGATED_ADMINISTRATORS_FOR_SERVICE_LIMIT_EXCEEDED: You attempted to * register more delegated administrators than allowed for the service principal. *
*
*
MAX_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to exceed the number * of policies of a certain type that can be attached to an entity at one * time.
*
*
MAX_TAG_LIMIT_EXCEEDED: You have exceeded the number of tags allowed on this * resource.
*
*
MEMBER_ACCOUNT_PAYMENT_INSTRUMENT_REQUIRED: To complete this operation with * this member account, you first must associate a valid payment instrument, such * as a credit card, with the account. For more information, see Considerations before removing an account from an organization in * the Organizations User Guide.
*
*
MIN_POLICY_TYPE_ATTACHMENT_LIMIT_EXCEEDED: You attempted to detach a policy * from an entity that would cause the entity to have fewer than the minimum number * of policies of a certain type required.
*
*
ORGANIZATION_NOT_IN_ALL_FEATURES_MODE: You attempted to perform an operation * that requires the organization to be configured to support all features. An * organization that supports only consolidated billing features can't perform this * operation.
*
*
OU_DEPTH_LIMIT_EXCEEDED: You attempted to create an OU tree that is too many * levels deep.
*
*
OU_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of OUs that you * can have in an organization.
*
*
POLICY_CONTENT_LIMIT_EXCEEDED: You attempted to create a policy that is larger * than the maximum size.
*
*
POLICY_NUMBER_LIMIT_EXCEEDED: You attempted to exceed the number of policies * that you can have in an organization.
*
*
POLICY_TYPE_ENABLED_FOR_THIS_SERVICE: You attempted to disable service access * before you disabled the policy type (for example, SECURITYHUB_POLICY). To * complete this operation, you must first disable the policy type.
*
*
RESPONSIBILITY_TRANSFER_MAX_INBOUND_QUOTA_VIOLATION: You have exceeded your inbound * transfers limit.
*
*
RESPONSIBILITY_TRANSFER_MAX_LEVEL_VIOLATION: You have exceeded the maximum length of your * transfer chain.
*
*
RESPONSIBILITY_TRANSFER_MAX_OUTBOUND_QUOTA_VIOLATION: You have exceeded your outbound * transfers limit.
*
*
RESPONSIBILITY_TRANSFER_MAX_TRANSFERS_QUOTA_VIOLATION: You have exceeded the maximum * number of inbound transfers allowed in a transfer chain.
*
*
SERVICE_ACCESS_NOT_ENABLED:
*
- *
  You attempted to register a delegated administrator before you enabled * service access. Call the EnableAWSServiceAccess API * first.
  *
- *
  You attempted to enable a policy type before you enabled service * access. Call the EnableAWSServiceAccess API first.
  *
*
*
TAG_POLICY_VIOLATION: You attempted to create or update a resource with tags * that are not compliant with the tag policy requirements for this account.
*
*
TRANSFER_RESPONSIBILITY_SOURCE_DELETION_IN_PROGRESS: The source organization cannot accept * this transfer invitation because it is marked for deletion.
*
*
TRANSFER_RESPONSIBILITY_TARGET_DELETION_IN_PROGRESS: The source organization cannot accept * this transfer invitation because target organization is marked for deletion.
*
*
TRANSFER_RESPONSIBILITY_UPDATE_NOT_ALLOWED: You cannot update this transfer * because it is no longer active. Transfers that have been withdrawn, declined, * expired, or cancelled cannot be modified.
*
*
UNMET_BILLING_PREREQUISITE: Your current billing configuration is unsupported. * Contact Amazon Web Services Support for assistance.
*
*
UNSUPPORTED_PRICING: Ineligible for Billing Transfer. Your organization is * subject to a pricing agreement with Amazon Web Services that Billing Transfer does not * support.
*
*
WAIT_PERIOD_ACTIVE: After you create an Amazon Web Services account, you must wait until at * least four days after the account was created. Invited accounts aren't subject * to this waiting period.
*

* * @throws {@link FinalizingOrganizationException} (client fault) *

Organizations couldn't perform the operation because your organization hasn't finished * initializing. This can take up to an hour. Try again later. If after one hour you * continue to receive this error, contact Amazon Web Services Support.

* * @throws {@link InvalidInputException} (client fault) *

The requested operation failed because you provided invalid values for one or more of * the request parameters. This exception includes a reason that contains additional * information about the violated limit:

* *

Some of the reasons in the following list might not be applicable to this specific * API or operation.

* *

*
CALLER_REQUIRED_FIELD_MISSING: At least one of the required field is missing: Caller Account Id, Management Account Id or Organization Id.
*
*
DUPLICATE_TAG_KEY: Tag keys must be unique among the tags attached to the same * entity.
*
*
END_DATE_NOT_END_OF_MONTH: You provided an invalid end date. The end date must be the end * of the last day of the month (23.59.59.999).
*
*
END_DATE_TOO_EARLY: You provided an invalid end date. The end date is too early.
*
*
END_DATE_TOO_LATE: You provided an invalid end date. The end date is too late.
*
*
IMMUTABLE_POLICY: You specified a policy that is managed by Amazon Web Services and can't be * modified.
*
*
INPUT_REQUIRED: You must include a value for all required parameters.
*
*
INVALID_EMAIL_ADDRESS_TARGET: You specified an invalid email address for the * invited account owner.
*
*
INVALID_END_DATE: The selected withdrawal date doesn't meet the minimum notice * period required by your partner agreement. Visit Amazon Web Services Partner Central or contact your Amazon Web Services * Channel Partner for help.
*
*
INVALID_ENUM: You specified an invalid value.
*
*
INVALID_ENUM_POLICY_TYPE: You specified an invalid policy type string.
*
*
INVALID_FULL_NAME_TARGET: You specified a full name that contains invalid * characters.
*
*
INVALID_LIST_MEMBER: You provided a list to a parameter that contains at least * one invalid value.
*
*
INVALID_PAGINATION_TOKEN: Get the value for the NextToken * parameter from the response to a previous call of the operation.
*
*
INVALID_PARTY_TYPE_TARGET: You specified the wrong type of entity (account, * organization, or email) as a party.
*
*
INVALID_PATTERN: You provided a value that doesn't match the required * pattern. The service also validates your free-text field values against * common cross-site scripting (XSS) patterns and rejects requests that * contain matching values.
*
*
INVALID_PATTERN_TARGET_ID: You specified a policy target ID that doesn't match * the required pattern.
*
*
INVALID_PRINCIPAL: You specified an invalid principal element in the * policy.
*
*
INVALID_ROLE_NAME: You provided a role name that isn't valid. A role name * can't begin with the reserved prefix AWSServiceRoleFor.
*
*
INVALID_START_DATE: The start date doesn't meet the minimum requirements.
*
*
INVALID_SYNTAX_ORGANIZATION_ARN: You specified an invalid Amazon Resource Name * (ARN) for the organization.
*
*
INVALID_SYNTAX_POLICY_ID: You specified an invalid policy ID.
*
*
INVALID_SYSTEM_TAGS_PARAMETER: You specified a tag key that is a system tag. * You can’t add, edit, or delete system tag keys because they're reserved for * Amazon Web Services use. System tags don’t count against your tags per resource limit.
*
*
MAX_FILTER_LIMIT_EXCEEDED: You can specify only one filter parameter for the * operation.
*
*
MAX_LENGTH_EXCEEDED: You provided a string parameter that is longer than * allowed.
*
*
MAX_VALUE_EXCEEDED: You provided a numeric parameter that has a larger value * than allowed.
*
*
MIN_LENGTH_EXCEEDED: You provided a string parameter that is shorter than * allowed.
*
*
MIN_VALUE_EXCEEDED: You provided a numeric parameter that has a smaller value * than allowed.
*
*
MOVING_ACCOUNT_BETWEEN_DIFFERENT_ROOTS: You can move an account only between * entities in the same root.
*
*
NON_DETACHABLE_POLICY: You can't detach this Amazon Web Services Managed Policy.
*
*
START_DATE_NOT_BEGINNING_OF_DAY: You provided an invalid start date. The start date must * be the beginning of the day (00:00:00.000).
*
*
START_DATE_NOT_BEGINNING_OF_MONTH: You provided an invalid start date. The start date must * be the first day of the month.
*
*
START_DATE_TOO_EARLY: You provided an invalid start date. The start date is too early.
*
*
START_DATE_TOO_LATE: You provided an invalid start date. The start date is too late.
*
*
TARGET_NOT_SUPPORTED: You can't perform the specified operation on that target * entity.
*
*
UNRECOGNIZED_SERVICE_PRINCIPAL: You specified a service principal that isn't * recognized.
*
*
UNSUPPORTED_ACTION_IN_RESPONSIBILITY_TRANSFER: You provided a value that is not supported * by this operation.
*

* * @throws {@link ServiceException} (server fault) *

Organizations can't complete your request because of an internal service error. Try again * later.

* * @throws {@link TooManyRequestsException} (client fault) *

You have sent too many requests in too short a period of time. The quota helps protect * against denial-of-service attacks. Try again later.

For information about quotas that affect Organizations, see Quotas for Organizations in the * Organizations User Guide.

* * @throws {@link UnsupportedAPIEndpointException} (client fault) *

This action isn't available in the current Amazon Web Services Region.

* * @throws {@link OrganizationsServiceException} *

Base exception class for all service exceptions from Organizations service.

* * * @public */ export declare class CreateGovCloudAccountCommand extends CreateGovCloudAccountCommand_base { /** @internal type navigation helper, not in runtime. */ protected static __types: { api: { input: CreateGovCloudAccountRequest; output: CreateGovCloudAccountResponse; }; sdk: { input: CreateGovCloudAccountCommandInput; output: CreateGovCloudAccountCommandOutput; }; }; }