title: AWS organization - I want all org users to be able to see and share all resources
body: <p>My AWS IAM use case is quite basic:</p>
  
  <p>We are building a quick MVP of an app and so we are quickly spinning up services that are part of it. Right now it's just 2 of us so it's not like we have a huge org to manage. We need to be able to work together quickly and all I want is a situation that results in the following:</p>
  
  <ul>
  <li>I created the master account. I created an organization and <em>invited</em> my friend to the org via his email (his email, and mine, and the root account email, all use the same domain, not that it matters here)</li>
  <li>I log into my account - my ORG account</li>
  <li>He logs into his account - his ORG account</li>
  <li>He creates functions in lambda.</li>
  <li>I go to the lambda dashboard and I can see and manage the functions he created</li>
  <li>I create something in Elastic Beanstalk</li>
  <li>He goes to the EB dashboard and sees and can manage the resources I created</li>
  </ul>
  
  <p>This doesn't seem like it should be so difficult but about the nearest I can tell is that someone somewhere has to create an IAM role between the two and it has to be given switch role permissions.</p>
  
  <p>Or something.</p>
  
  <p>This tutorial is impossible to follow because it starts using "account" interchangeably and I don't know which it is referring to.</p>
  
  <p><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_create-cross-account-role" rel="nofollow noreferrer">https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_create-cross-account-role</a></p>
  
  <p>I've also tried:
  <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html</a></p>
  
  <p>And that doesn't seem to be what I want. If I want to switch roles I'll just give my friend the username &amp; password to the admin role, which defeats the whole point. It seems more correct that there's a role we <em>share</em> that allows us to see the resources that the other creates.</p>
  
  <p>Someone who can shed some light on what should be an insanely simple thing, I'd much appreciate it...</p>
  
  <p>I am 100% willing to accept my assumptions are bad. I've never done this before.</p>