For MSPs & AWS consultants

Jump into every client AWS Organization

AWS Hosted Client → Org → Account inventory plus temporary role assumption and console access with External ID.

Deploy a role or reuse one, without setting up Identity Center in every client Organization.

So you can see the whole book of client Orgs and jump into the account you need.

External ID is how AWS checks the assume-role request came from Quiverstone.

Start free Book 20 min Access Reality Check

No payment information required

Temporary STS credentials only. Your browser session, their CloudTrail. We never store long-term client credentials. How access works

Quiverstone home screen with Clients, Organizations, and Accounts counts and a list of client AWS Organizations

Enroll a client Org once, see every account

Everything in one place

Organizations

Portfolio of unrelated client Orgs in one place — not one customer’s landing zone.

Accounts

Member accounts discovered automatically when you enroll an Org; standalones sit beside them.

Resources

Search and discover details for resources across accounts or customer organizations.

Access

Assume-role with External ID (direct or chained). Your browser session, their CloudTrail.

as of Jan 2026

100+

Organizations managed

1K+

AWS accounts governed

10+

Years in AWS management

Quiverstone Organizations list showing multiple client AWS Organizations with member account counts

Assume Role dialog for an account in client Organization o-example, with browser session and role chain options

Deploy a role. Connect your clients.

Jump into any client account without Identity Center setup

Use temporary STS role assumption with External ID for access across unrelated client AWS environments.

Deploy or reuse a role. Use Quiverstone-managed roles through CloudFormation or StackSets, or existing roles with the required trust.
Connect directly or through a role chain. Work with the access arrangement your client provides.
Choose the permissions. Use Read-Only, Power User, Administrator, or custom policies. Team access is scoped by Group × Account × Role.

Know which accounts belong to each client

Bring enrolled AWS Organizations and standalone accounts into one inventory, so you can answer “what accounts does this customer even have?” Quiverstone discovers member accounts when you connect an Organization.

Plan limits apply to the Organizations and standalone accounts you enroll. Member accounts inside an enrolled Organization are unlimited.

Check out the Inventory

Quiverstone subnet calculator with a network address, mask bits, and subnet size

Quiverstone IP address list with private addresses, hostnames, and ping status

Tools for day-to-day client work

Keep useful references close

Keep common tools, references, and deployment templates alongside your client work. Teams can share their own libraries so operators can follow a consistent process.

Start with inventory and access across your client environments, then use the utilities that fit the work in front of you.

More Utilities

What changes when Quiverstone is in the loop

Save time

Stop hopping Identity Center portals, vaults, and spreadsheets. Discover Orgs and accounts once; assume a role in one click.

Save money

Fewer unbillable hours on access archaeology. Free to prove it; Consultant and Pro are priced for practice scale.

Get smarter

One inventory of how you actually reach each client estate — knowledge in the cockpit, not on a laptop.

Bill clients more

Practice economics: Customer, Org, Project, and engagement type (Resale, Managed Services, Professional Services) keep retainers and scoped work billable.

Ross Wickman

Founder / Principal

10+ years of AWS management and governance, including DOD/DOI work and GovCloud/FedRAMP environments.

Questions before you hand over a role

Quiverstone does not store long-term client credentials. Access is temporary STS role assumption with External ID, using your browser session, and the session is recorded in that account’s CloudTrail. This is the same process enterprise tools use: an IAM role with a trust policy and External ID.

Deploy a Quiverstone-managed role through CloudFormation or StackSets, or reuse an existing role that already has the required trust. You choose Read-Only, Power User, Administrator, or a custom policy. Team access is scoped by Group × Account × Role.

No. Member accounts inside an enrolled Organization are unlimited on every tier. Plan limits apply to the Organizations and standalone accounts you enroll, plus clients and seats.

Consultant and Pro include a 5-day trial so you can use that tier before you are charged. No credit card is required to begin. Free is $0 with no expiration.

From the blog