aws-account

/app-kit:aws-account — provision a child account

Load config first

Read ~/.config/mesh44/config.json. You need:

• aws.mgt_account_id
• aws.sso_start_url
• aws.sso_region
• aws.default_region
• aws.sso_role_name (this is also the IAM Identity Center permission set name to assign, e.g., AdministratorAccess)
• aws.account_email_template (a string with {app_name} substitution, e.g., you+{app_name}@example.com)

If the file doesn't exist, stop and tell the user to copy config.json.example to ~/.config/mesh44/config.json.

Org facts (sourced from config)

• Management account: mgt profile, account ID = aws.mgt_account_id.
• SSO instance: aws.sso_start_url, region = aws.sso_region.
• Permission set: aws.sso_role_name — must already exist in IAM Identity Center.
• Profile naming: child-<app-name> for both the AWS profile and the SSO session.

Steps

1. Inputs

app_name (kebab-case). The account_email is computed from the config template by substituting {app_name}, then confirmed with the user before submission. AWS requires the email to be unique across all of AWS.

2. Create the account — confirm with user first

AWS_PROFILE=mgt aws organizations create-account \
  --email "$ACCOUNT_EMAIL" \
  --account-name "child-$APP_NAME" \
  --role-name OrganizationAccountAccessRole \
  --iam-user-access-to-billing ALLOW

Capture the CreateAccountRequestId.

3. Poll until creation succeeds

AWS_PROFILE=mgt aws organizations describe-create-account-status \
  --create-account-request-id "$REQUEST_ID"

Loop with 15s sleeps, up to 5 min. Record the resulting AccountId into $NEW_ACCOUNT_ID.

4. Assign the permission set via IAM Identity Center

A fresh child account has the OrganizationAccountAccessRole from step 2 (assumable only from mgt) but no IAM Identity Center permission set assignment. Without this step, aws sso login --profile child-<app> would fail with no roles to assume. Add the assignment.