Delegated administration
Delegated administration provides a convenient way for assigned users in a registered member account to perform most IAM Identity Center administrative tasks. When you enable IAM Identity Center, your IAM Identity Center instance is created in the management account in AWS Organizations by default. This was originally designed this way so that IAM Identity Center can provision, de-provision, and update roles across all your organization's member accounts. Even though your IAM Identity Center instance must always reside in the management account, you can choose to delegate administration of IAM Identity Center to a member account in AWS Organizations, thereby extending the ability to manage IAM Identity Center from outside the management account.
Enabling delegated administration provides the following benefits:
-
Minimizes the number of people who require access to the management account to help mitigate security concerns
-
Allows select administrators to assign users and groups to applications and to your organization's member accounts
For more information about how IAM Identity Center works with AWS Organizations, see AWS account access. For
additional information and to review an example company scenario showing how to
configure delegated administration, see Getting started with IAM Identity Center delegated administration
Topics
Best practices
Here are some best practices to consider before you configure delegated administration.
-
Grant least privilege to the management account – Knowing that the management account is a highly privileged account and to adhere to the principal of least privilege, we highly recommend that you restrict access to the management account to as few people as possible. The delegated administrator feature is intended to minimize the number of people who require access to the management account.
-
Create permission sets for use only in the management account – This makes it easier to administer permission sets tailored just for users accessing your management account and helps to differentiate them from permission sets managed by your delegated administrator account.
-
Consider your Active Directory location – If you plan on using Active Directory as your IAM Identity Center identity source, locate the directory in the member account where you have enabled the IAM Identity Center delegated administrator feature. If you decide to change the IAM Identity Center identity source from any other source to Active Directory, or change it from Active Directory to any other source, the directory must reside in (be owned by) the IAM Identity Center delegated administrator member account if one exists; otherwise, it must be in the management account.
-
Create user assignments only in the management account – The delegated administrator can't alter permission sets provisioned in the management account. However, delegated administrators can add, edit, and delete groups and group assignments.
Prerequisites
Before you can register an account as a delegated administrator you must first have the following environment deployed:
-
AWS Organizations must be enabled and configured with at least one member account in addition to your default management account.
-
If your identity source is set to Active Directory, the IAM Identity Center configurable AD sync feature must be enabled.
