admin_accounts

Creates, updates, deletes, gets or lists an admin_accounts resource.

Overview

Name	admin_accounts
Type	Resource
Id	aws.fms.admin_accounts

Fields

The following fields are returned by SELECT queries:

get_admin_account

Name	Datatype	Description
admin_account	string	The account that is set as the Firewall Manager default administrator. (pattern: <code>^[0-9]+$</code>)
role_status	string	The status of the account that you set as the Firewall Manager default administrator. (READY, CREATING, PENDING_DELETION, DELETING, DELETED)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_admin_account	select	region		Returns the Organizations account that is associated with Firewall Manager as the Firewall Manager default administrator.
associate_admin_account	update	region, AdminAccount		Sets a Firewall Manager default administrator account. The Firewall Manager default administrator account can manage third-party firewalls and has full administrative scope that allows administration of all policy types, accounts, organizational units, and Regions. This account must be a member account of the organization in Organizations whose resources you want to protect. For information about working with Firewall Manager administrator accounts, see Managing Firewall Manager administrators in the Firewall Manager Developer Guide.
disassociate_admin_account	update	region		Disassociates an Firewall Manager administrator account. To set a different account as an Firewall Manager administrator, submit a PutAdminAccount request. To set an account as a default administrator account, you must submit an AssociateAdminAccount request. Disassociation of the default administrator account follows the first in, last out principle. If you are the default administrator, all Firewall Manager administrators within the organization must first disassociate their accounts before you can disassociate your account.
put_admin_account	replace	region, AdminAccount		Creates or updates an Firewall Manager administrator account. The account must be a member of the organization that was onboarded to Firewall Manager by AssociateAdminAccount. Only the organization's management account can create an Firewall Manager administrator account. When you create an Firewall Manager administrator account, the service checks to see if the account is already a delegated administrator within Organizations. If the account isn't a delegated administrator, Firewall Manager calls Organizations to delegate the account within Organizations. For more information about administrator accounts within Organizations, see Managing the Amazon Web Services Accounts in Your Organization.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_admin_account

Returns the Organizations account that is associated with Firewall Manager as the Firewall Manager default administrator.

SELECT
admin_account,
role_status
FROM aws.fms.admin_accounts
WHERE region = '{{ region }}' -- required
;

UPDATE examples

associate_admin_account

Sets a Firewall Manager default administrator account. The Firewall Manager default administrator account can manage third-party firewalls and has full administrative scope that allows administration of all policy types, accounts, organizational units, and Regions. This account must be a member account of the organization in Organizations whose resources you want to protect. For information about working with Firewall Manager administrator accounts, see Managing Firewall Manager administrators in the Firewall Manager Developer Guide.

UPDATE aws.fms.admin_accounts
SET 
AdminAccount = '{{ AdminAccount }}'
WHERE 
region = '{{ region }}' --required
AND AdminAccount = '{{ AdminAccount }}' --required;

disassociate_admin_account

Disassociates an Firewall Manager administrator account. To set a different account as an Firewall Manager administrator, submit a PutAdminAccount request. To set an account as a default administrator account, you must submit an AssociateAdminAccount request. Disassociation of the default administrator account follows the first in, last out principle. If you are the default administrator, all Firewall Manager administrators within the organization must first disassociate their accounts before you can disassociate your account.

UPDATE aws.fms.admin_accounts
SET 
-- No updatable properties
WHERE 
region = '{{ region }}' --required;

REPLACE examples

put_admin_account

Creates or updates an Firewall Manager administrator account. The account must be a member of the organization that was onboarded to Firewall Manager by AssociateAdminAccount. Only the organization's management account can create an Firewall Manager administrator account. When you create an Firewall Manager administrator account, the service checks to see if the account is already a delegated administrator within Organizations. If the account isn't a delegated administrator, Firewall Manager calls Organizations to delegate the account within Organizations. For more information about administrator accounts within Organizations, see Managing the Amazon Web Services Accounts in Your Organization.

REPLACE aws.fms.admin_accounts
SET 
AdminAccount = '{{ AdminAccount }}',
AdminScope = '{{ AdminScope }}'
WHERE 
region = '{{ region }}' --required
AND AdminAccount = '{{ AdminAccount }}' --required;