Can customers delete the roles "AWSReservedSSO_AdministratorAccess_a9149395f7abc736" and "AWSServiceRoleForSSO" if the linked accounts are in a suspended state?

Hi

I would say this heavily depends on if the attacker that opened the accounts have access to the Root user for the account. If the account is suspended then it's not possible to access the account. It is however possible to delete the role in an active account.

Using service-linked roles for IAM Identity Center give instructions on how to manually delete the role, so that is possible.

Closing a member account in your organization states that: If you no longer need a member account in your organization, and want to ensure that no one can accrue charges for it, you can close the account which indicates that it can't be accessed and hence role can't be deleted in this state.

Can I reopen my closed AWS account? give instructions on how to open an closed account, within the 90 day grace period, using the Root user.

So if the attacker still has access to the Root user it is possible that they can reopen the account and delete the role.

I would investigate and create SCP policy that Deny any account to leave the organization and two prevents deleting the roles.

Hope it give some for of answer and help.