How AWS Organizations Delegated Administration Can Help Security Teams
Summary
AWS delegated administration lets organizations grant member accounts limited visibility into accounts and policies or control specific SCPs. The article covers security use cases, example configurations, and risks such as self-lockout and uneven protection.
Key points
- The feature uses resource-based delegation policies to grant specific AWS Organization capabilities to member accounts without access to the management account.
- Security teams can delegate account and tag visibility to help identify account owners when investigating findings such as GuardDuty alerts.
- Organizations can let member accounts view effective service control policies (SCPs); the example restricts access to principals within the organization.
- A delegation policy can grant an account permission to update a specific SCP, but applying that policy to the delegated account's own OU could lock it out.
- The article says current limitations make generic ABAC-based delegation of policies difficult.
- Distributing policy control may improve flexibility but can create inconsistent exceptions and protection gaps across an organization.
Article Details
- Topic
- AWS Organizations Delegated Administrator capabilities, use cases, and security considerations