Create an administrator-like profile/role outside the management account

Question

I have multiple accounts in Organizations and wanted a way to manage them securely. I want to create a user or give my user permission as if they were an administrator (in this multiple accounts), so I don't have to use the management account. What's the best way to do this?

I saw that I can use permission boundaries, but I didn't find examples of how it would be applied to an administrator-like user or how I can write a policy and permission boundaries in this case for an administrator.
Besides that, would any other action be recommended? Any blockage on the management account?
Thanks!

Riku_Kobayashi · Answer

Hello.

If you are using Organizations, you can use SCP to restrict operations.  
You might be able to accomplish what you want using this.  
https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

mvmandel-aws · Answer

You might want to also check out delegated administration. Delegated administration provides a convenient way for assigned users in a registered member account to perform most IAM Identity Center administrative tasks. More here: https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html

Create an administrator-like profile/role outside the management account

Relevanter Inhalt