delegated_administrators

Creates, updates, deletes, gets or lists a delegated_administrators resource.

Overview

Name	delegated_administrators
Type	Resource
Id	aws.organizations.delegated_administrators

Fields

The following fields are returned by SELECT queries:

list_delegated_administrators

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of the delegated administrator's account. (pattern: <code>^arn:aws:organizations::\d{12}:account/o-[a-z0-9]{10,32}/\d{12}</code>)
delegation_enabled_date	string (date-time)	The date when the account was made a delegated administrator.
email	string	The email address that is associated with the delegated administrator's Amazon Web Services account. (pattern: <code>[^\s@]+@[^\s@]+.[^\s@]+</code>)
id	string	The unique identifier (ID) of the delegated administrator's account. (pattern: <code>^\d{12}$</code>)
joined_method	string	The method by which the delegated administrator's account joined the organization. (INVITED, CREATED)
joined_timestamp	string (date-time)	The date when the delegated administrator's account became a part of the organization.
name	string	The friendly name of the delegated administrator's account. (pattern: <code>[\s\S]*</code>)
state	string	Each state represents a specific phase in the account lifecycle. Use this information to manage account access, automate workflows, or trigger actions based on account state changes. For more information about account states and their implications, see Monitor the state of your Amazon Web Services accounts in the Organizations User Guide. (PENDING_ACTIVATION, ACTIVE, SUSPENDED, PENDING_CLOSURE, CLOSED)
status	string	The status of the delegated administrator's account in the organization. (ACTIVE, SUSPENDED, PENDING_CLOSURE)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_delegated_administrators	select	region		Lists the Amazon Web Services accounts that are designated as delegated administrators in this organization. You can only call this operation from the management account or a member account that is a delegated administrator.
register_delegated_administrator	insert	region, AccountId, ServicePrincipal		Enables the specified member account to administer the Organizations features of the specified Amazon Web Services service. It grants read-only access to Organizations service data. The account still requires IAM permissions to access and administer the Amazon Web Services service. You can run this action only for Amazon Web Services services that support this feature. For a current list of services that support it, see the column Supports Delegated Administrator in the table at Amazon Web Services Services that you can use with Organizations in the Organizations User Guide. You can only call this operation from the management account.
deregister_delegated_administrator	delete	region		Removes the specified member Amazon Web Services account as a delegated administrator for the specified Amazon Web Services service. Deregistering a delegated administrator can have unintended impacts on the functionality of the enabled Amazon Web Services service. See the documentation for the enabled service before you deregister a delegated administrator so that you understand any potential impacts. You can run this action only for Amazon Web Services services that support this feature. For a current list of services that support it, see the column Supports Delegated Administrator in the table at Amazon Web Services Services that you can use with Organizations in the Organizations User Guide. You can only call this operation from the management account.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_delegated_administrators

Lists the Amazon Web Services accounts that are designated as delegated administrators in this organization. You can only call this operation from the management account or a member account that is a delegated administrator.

SELECT
arn,
delegation_enabled_date,
email,
id,
joined_method,
joined_timestamp,
name,
state,
status
FROM aws.organizations.delegated_administrators
WHERE region = '{{ region }}' -- required
;

INSERT examples

register_delegated_administrator

Enables the specified member account to administer the Organizations features of the specified Amazon Web Services service. It grants read-only access to Organizations service data. The account still requires IAM permissions to access and administer the Amazon Web Services service. You can run this action only for Amazon Web Services services that support this feature. For a current list of services that support it, see the column Supports Delegated Administrator in the table at Amazon Web Services Services that you can use with Organizations in the Organizations User Guide. You can only call this operation from the management account.

INSERT INTO aws.organizations.delegated_administrators (
AccountId,
ServicePrincipal,
region
)
SELECT 
'{{ AccountId }}' /* required */,
'{{ ServicePrincipal }}' /* required */,
'{{ region }}'
;

Manifest

# Description fields are for documentation purposes
- name: delegated_administrators
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the delegated_administrators resource.
  - name: AccountId
    value: "{{ AccountId }}"
    description: |
      The account ID number of the member account in the organization to register as a delegated administrator.
  - name: ServicePrincipal
    value: "{{ ServicePrincipal }}"
    description: |
      The service principal of the Amazon Web Services service for which you want to make the member account a delegated administrator.

DELETE examples

deregister_delegated_administrator

Removes the specified member Amazon Web Services account as a delegated administrator for the specified Amazon Web Services service. Deregistering a delegated administrator can have unintended impacts on the functionality of the enabled Amazon Web Services service. See the documentation for the enabled service before you deregister a delegated administrator so that you understand any potential impacts. You can run this action only for Amazon Web Services services that support this feature. For a current list of services that support it, see the column Supports Delegated Administrator in the table at Amazon Web Services Services that you can use with Organizations in the Organizations User Guide. You can only call this operation from the management account.

DELETE FROM aws.organizations.delegated_administrators
WHERE region = '{{ region }}' --required
;