![[Tip] Multi-party approval passes once the set threshold of OKs is met, even if most of the team says no](https://images.ctfassets.net/ct0aopd36mqt/wp-thumbnail-2eddd7f989fa67416ea2d27b4223cc32/8f5b157eb82ee11cc288225119e0c290/aws-organizations?w=3840&fm=webp)
[Tip] Multi-party approval passes once the set threshold of OKs is met, even if most of the team says no
This page has been translated by machine translation. View original
Hello, I'm Airaira (@eiraces) from the Consulting Department, Cloud Business Division.
Multi-party approval is one of the features of AWS Organizations, and these days I think it often appears in combination with AWS Backup in the context of ransomware countermeasures.
This time, I'll run an experiment on a small topic related to multi-party approval and share it.
With an approval team of 5 members and a minimum number of approvals of 2, what happens when 3 people reject (NG) first, and then 2 people approve (OK)?
The documentation contains the following statement.
The team consists of approvers (effectively the party portion of multi-party approval) who receive email notifications of protected operation requests. These emails confirm that the approval session for the request has started. Approval is granted when the minimum required number of approvals is reached.
https://docs.aws.amazon.com/ja_jp/aws-backup/latest/devguide/multipartyapproval.html
Read plainly, it says approval is granted when the number of approvals reaches the threshold (2 in this case), so it appears the session would be approved at the moment the 5th person clicks OK.
Results first
As the title says, even if a majority of the team rejects, the request is approved as long as the configured threshold of OKs is met. This matches the AWS documentation.
Therefore, you need to be careful when setting the threshold. Design it according to the size of the approval team.
An approval team can have up to 20 members, but I think the minimum number of approvals should preferably be N/2 or (N+1)/2. In that case, a team size of around 5 to 8 people seems good.
Trying it out
Below, I'll experiment with an approval team of 5 members. The minimum number of approvals is set to 2.
Let's make a change to the team. Anything would do, but this time I'll change the minimum number of approvals from 2 to 3.
For the first 3 people's operations, I'll click "Reject (NG)".
You can check your own response status from "Operation history". (You can't see the approval status of other members.)
By the way, if you run the aws mpa get-session command from the management account side, you can check the members' approval status.
It apparently can't be displayed from the AWS Console.
$ aws mpa get-session --session-arn arn:aws:mpa:us-east-1:000000000000:session/approve-team-e0bfdb2vd4rp/129ff60c-4bce-3049-87d6-b6774f2de2c0
{
"SessionArn": "arn:aws:mpa:us-east-1:000000000000:session/approve-team-e0bfdb2vd4rp/129ff60c-4bce-3049-87d6-b6774f2de2c0",
"ApprovalTeamArn": "arn:aws:mpa:us-east-1:000000000000:approval-team/approve-team-e0bfdb2vd4rp",
"ApprovalTeamName": "approve-team",
"ProtectedResourceArn": "arn:aws:mpa:us-east-1:000000000000:approval-team/approve-team-e0bfdb2vd4rp",
"ApprovalStrategy": {
"MofN": {
"MinApprovalsRequired": 2
}
},
"NumberOfApprovers": 5,
"InitiationTime": "2026-04-29T13:22:22.825000+00:00",
"ExpirationTime": "2026-04-30T13:22:22.825000+00:00",
"Description": "A change to an approval team has been requested.",
"Metadata": {
"New minimum Approvers required": "3",
"Old minimum Approvers required": "2"
},
"Status": "PENDING",
"ActionName": "mpa:UpdateApprovalTeam",
"RequesterServicePrincipal": "mpa.amazonaws.com",
"RequesterPrincipalArn": "arn:aws:iam::000000000000:role/xxx",
"RequesterAccountId": "000000000000",
"RequesterRegion": "us-east-1",
"ActionCompletionStrategy": "AUTO_COMPLETION_UPON_APPROVAL",
"ApproverResponses": [
{
"ApproverId": "ff497bf8-085a-4293-819a-853aad27a4c2",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "97045ad8-00c1-7003-db10-a2cc80db58a9",
"Response": "REJECTED",
"ResponseTime": "2026-04-29T13:26:27.190000+00:00"
},
{
"ApproverId": "4d5461b9-3b23-458f-b6c6-c9c4d8a3a587",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "77e46a78-70e1-7059-c3cc-f7e844a83d91",
"Response": "REJECTED",
"ResponseTime": "2026-04-29T13:27:37.860000+00:00"
},
{
"ApproverId": "7ff74481-39e3-4338-a522-ac35baa9a1ef",
"Response": "NO_VOTE"
},
{
"ApproverId": "1e47a42a-419f-441f-9407-4436817c15f8",
"Response": "NO_VOTE"
},
{
"ApproverId": "bddb6940-eeae-4eb7-b291-397637a2c29a",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "37e42a38-9001-705f-05f7-98621cf905e7",
"Response": "REJECTED",
"ResponseTime": "2026-04-29T13:25:31.142000+00:00"
}
],
"AdditionalSecurityRequirements": [
"APPROVER_VERIFICATION_REQUIRED"
]
}
As it stands, there are 3 REJECTED, and you can see the approval task itself is PENDING.
Next, the 4th and 5th people respond with OK.
Then, the minimum required approvals (the parameter we requested to change this time) became 3, and the task was approved.
Let's run aws mpa get-session again to check.
~ $ aws mpa get-session --session-arn arn:aws:mpa:us-east-1:000000000000:session/approve-team-e0bfdb2vd4rp/129ff60c-4bce-3049-87d6-b6774f2de2c0
{
"SessionArn": "arn:aws:mpa:us-east-1:000000000000:session/approve-team-e0bfdb2vd4rp/129ff60c-4bce-3049-87d6-b6774f2de2c0",
"ApprovalTeamArn": "arn:aws:mpa:us-east-1:000000000000:approval-team/approve-team-e0bfdb2vd4rp",
"ApprovalTeamName": "approve-team",
"ProtectedResourceArn": "arn:aws:mpa:us-east-1:000000000000:approval-team/approve-team-e0bfdb2vd4rp",
"ApprovalStrategy": {
"MofN": {
"MinApprovalsRequired": 2
}
},
"NumberOfApprovers": 5,
"InitiationTime": "2026-04-29T13:22:22.825000+00:00",
"ExpirationTime": "2026-04-30T13:22:22.825000+00:00",
"CompletionTime": "2026-04-29T13:38:03.090000+00:00",
"Description": "A change to an approval team has been requested.",
"Metadata": {
"New minimum Approvers required": "3",
"Old minimum Approvers required": "2"
},
"Status": "APPROVED",
"ExecutionStatus": "EXECUTED",
"ActionName": "mpa:UpdateApprovalTeam",
"RequesterServicePrincipal": "mpa.amazonaws.com",
"RequesterPrincipalArn": "arn:aws:iam::000000000000:role/xxx",
"RequesterAccountId": "000000000000",
"RequesterRegion": "us-east-1",
"ActionCompletionStrategy": "AUTO_COMPLETION_UPON_APPROVAL",
"ApproverResponses": [
{
"ApproverId": "ff497bf8-085a-4293-819a-853aad27a4c2",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "97045ad8-00c1-7003-db10-a2cc80db58a9",
"Response": "REJECTED",
"ResponseTime": "2026-04-29T13:26:27.190000+00:00"
},
{
"ApproverId": "4d5461b9-3b23-458f-b6c6-c9c4d8a3a587",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "77e46a78-70e1-7059-c3cc-f7e844a83d91",
"Response": "REJECTED",
"ResponseTime": "2026-04-29T13:27:37.860000+00:00"
},
{
"ApproverId": "7ff74481-39e3-4338-a522-ac35baa9a1ef",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "67d4aa68-10c1-7036-b588-478fbf70317c",
"Response": "APPROVED",
"ResponseTime": "2026-04-29T13:37:52.842000+00:00"
},
{
"ApproverId": "1e47a42a-419f-441f-9407-4436817c15f8",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "37e42ac8-50d1-7040-0bb3-51020bd50a30",
"Response": "APPROVED",
"ResponseTime": "2026-04-29T13:37:15.004000+00:00"
},
{
"ApproverId": "bddb6940-eeae-4eb7-b291-397637a2c29a",
"IdentitySourceArn": "arn:aws:mpa:us-east-1:000000000000:identity-source/IamIdentityCenter",
"IdentityId": "37e42a38-9001-705f-05f7-98621cf905e7",
"Response": "REJECTED",
"ResponseTime": "2026-04-29T13:25:31.142000+00:00"
}
],
"AdditionalSecurityRequirements": [
"APPROVER_VERIFICATION_REQUIRED"
]
}
(END)
There are 3 REJECTED and 2 APPROVED, but since the minimum number of approvals was 2, the task was APPROVED/EXECUTED.
Conclusion
It feels a bit odd that the task is approved even though there are more NGs. To prevent this, it's important to set an appropriate threshold.
You can choose a minimum number of approvals starting from 2, but set an appropriate number according to the size of the approval team.
I hope this entry helps someone.
This was Airaira from the Consulting Department, Cloud Business Division!
