Delegated Administrators

src/config/service-integrations/delegated-admins.ts declares which member accounts act as delegated administrators for AWS Organizations integrated services. Delegation moves day-to-day service management out of the management account: the security account owns IAM, IAM Access Analyzer, Config, GuardDuty, Security Hub, Inspector, and Macie, the observability account owns CloudTrail and AWS User Notifications, the FinOps account owns Compute Optimizer, Cost Optimization Hub, and Resource Explorer, and the landing zone account owns CloudFormation StackSets. The organization phase (LandingZoneOrganizationStack) reads this file and performs the registrations after each account exists and its trusted access is enabled.

A service can only be delegated once its trusted access is enabled in trusted-access.ts, so keep the two files aligned: every account you list here needs matching trusted access for the same service principal.

organizationDelegatedAdministrators

The file exports a single list. Each entry is a DelegatedAdministratorProps that maps one account key to the service principals it administers.

List the account key and service principals you want to delegate. The foundation manages their registration during deployment.

The starter delegates the security account as administrator for the security services, the observability account for CloudTrail and AWS User Notifications, the FinOps account for cost and resource-search services, and the landing zone account for CloudFormation StackSets:

export const organizationDelegatedAdministrators: DelegatedAdministratorProps[] = [
  {
    accountKey: 'SecurityAccount',
    servicePrincipals: [
      'access-analyzer.amazonaws.com',
      'config.amazonaws.com',
      'config-multiaccountsetup.amazonaws.com',
      'guardduty.amazonaws.com',
      'iam.amazonaws.com',
      'inspector2.amazonaws.com',
      'macie.amazonaws.com',
      'securityhub.amazonaws.com',
    ],
  },
  {
    accountKey: 'ObservabilityAccount',
    servicePrincipals: ['cloudtrail.amazonaws.com', 'notifications.amazonaws.com'],
  },
  {
    accountKey: 'FinOpsAccount',
    servicePrincipals: [
      'compute-optimizer.amazonaws.com',
      'cost-optimization-hub.bcm.amazonaws.com',
      'resource-explorer-2.amazonaws.com',
    ],
  },
  {
    accountKey: 'LandingZoneAccount',
    servicePrincipals: ['member.org.stacksets.cloudformation.amazonaws.com'],
  },
];

To delegate another service, add its principal to the account's servicePrincipals list. Confirm the service supports delegated administration in the AWS Organizations integrated services table first, and add matching trusted access in trusted-access.ts. Keep the list limited to the services the landing zone configures rather than delegating every service that supports it.

How it's used

LandingZoneOrganizationStack passes this list into OrganizationConstruct, which registers each account as the delegated administrator for its service principals. The construct validates the configuration at synth time and fails the build if you delegate the same service principal to two different accounts, or repeat a principal. GuardDuty, Inspector, and Macie delegation covers the primary Region and every secondaryRegions entry from your settings.

The organization phase completes delegation before the Organization Security StackSet, the Observability StackSet, and the FinOps StackSet deploy. The Organization Security StackSet runs in the security account: IAM is delegated so it can manage centralized root access across member accounts, IAM Access Analyzer so it can create the organization external access analyzer, and GuardDuty, Security Hub, Inspector, and Macie so it can configure them organization-wide.

The observability account administers CloudTrail, so the organization trail and its log buckets live there. It also administers AWS User Notifications, so AWS managed notifications for the organization, such as AWS Health events, arrive there, and it emails the organization's security and operations alerts. The Observability StackSet deploys the trail and the alerts. CloudTrail supports up to three delegated administrators per organization.

The FinOps account's delegation pairs with three StackSets. The Provision Management StackSet opts the management account and every member account in to Compute Optimizer and Cost Optimization Hub, which only the management account can do. The FinOps StackSet manages the Cost Optimization Hub organization preferences from the FinOps account and creates an organization-wide Resource Explorer view there, so cost analysis can find resources in any account. The Resource Explorer StackSet turns on Resource Explorer in the other member accounts. Resource Explorer recommends a delegated administrator for multi-account search, and Compute Optimizer and Cost Optimization Hub each support delegated administration.

For routine security-service enablement changes, edit security-services.ts. Keep delegation and trusted access configured when a capability is disabled so you can enable it again.

Things to know

• Verify the service before adding it. Confirm the service supports delegated administrators in the integrated services table, then add its principal here and its trusted access in trusted-access.ts.
• accountKey must exist in your organization structure. The key is resolved to a real account ID at deploy time, so a typo or a renamed account key fails the build rather than silently skipping registration.
• Removing an entry deregisters the administrator on the next deploy. Deregistering a security service's delegated admin has service-level side effects (for example, it can disrupt org-wide GuardDuty or Security Hub), so treat removals with the same care as removing the Organization Security StackSet.
• One account per service principal. Delegating the same service principal to two accounts fails the build, so move a principal between accounts by editing both entries in one change.