You have signed in to an AWS Organization`s master account using an admin IAM user. You need to move accounts to this Organization from one OU (Organizational Unit) to another or back to the root from an OU. However, the operation was disallowed due to a lack of permissions. So you started looking at the IAM policies attached to this user. What are the minimum permissions you need to move accounts among OUs? (Select TWO.)

Answer options:

A.organizations:DescribeAccount
B.organizations:DescribeOrganization
C.organizations:MoveAccount
D.organizations:AttachPolicy
E.organizations:*

Correct Answer – B, C
Users can move accounts between the Root and OUs in AWS Organization according to
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html.
However, permissions are needed to do that.
Option A is incorrect because organizations:DescribeAccount is used to retrieve Organization details about the account, which is not required.
Option B is CORRECT because organizations:DescribeOrganization is required if the move operation is done from console.
Option C is CORRECT because organizations:MoveAccount permits users to move accounts in an Organization.
Option D is incorrect because attaching SCP is not needed in this scenario.
Option E is incorrect: because this will allow all actions for Organizations, which will not meet the least privilege.