Designating a delegated administrator account for Amazon Inspector
The delegated administrator is an account that manages a service for an organiztion. This topic describes how to designate a delegated administrator for Amazon Inspector.
Considerations
Before designating a delegated administrator, note the following:
- The delegated administrator can manage a maximum of 10,000 members.
-
If you exceed 10,000 member accounts, you receive a notification through the Amazon CloudWatch Personal Health Dashboard and email to the delegated administrator account.
Note
When Amazon Inspector is enabled through AWS Organizations policies for organizations with more than 10,000 accounts (up to 50,000), the policy applies to all accounts. However, only 10,000 accounts will be associated with the Amazon Inspector organization. i.e. the delegated administrator can view findings and account status for only these 10,000 accounts in the Amazon Inspector console.
- The delegated administrator is Regional.
-
Amazon Inspector is a Regional service. You must repeat the steps in the procedure in every AWS Region where you plan to use Amazon Inspector.
- An organization can have only one delegated administrator.
-
If designate an account as the delegated administrator in one AWS Region, that account must be the delegated administrator in all other AWS Regions.
- Changing a delegated administrator does not deactivate Amazon Inspector for member accounts.
-
If you remove a delegated administrator, member accounts become standalone accounts and scan settings aren't affected.
- Your AWS Organization must have all features activated.
-
This is the default setting for AWS Organizations. If it's not activated, see Activating all features in your organization.
- Organization policies take precedence over delegated administrator settings.
-
If your organization uses AWS Organizations policies to enable Amazon Inspector, the policy settings determine which scan types are enabled. We recommend designating the delegated administrator before creating organization policies to ensure consistent governance. For more information, see Organization policy governance model.
Permissions required to designate a delegated administrator
You must have permission to activate Amazon Inspector and to designate an Amazon Inspector delegated administrator. Add the following statement to the end of your IAM policy to grant these permissions. For more information, see Managing IAM policies.
{ "Sid": "PermissionsForInspectorAdmin", "Effect": "Allow", "Action": [ "inspector2:EnableDelegatedAdminAccount", "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:ListDelegatedAdministrators", "organizations:ListAWSServiceAccessForOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": "*" }
Designating a delegated administrator for your AWS organization
The following procedure describes how to designate a delegated administrator for your organization. Before you complete the procedure, make sure you are in the same organization as the member accounts you want the delegated administrator to manage.
Note
You must use the AWS Organizations management account to complete this procedure. Only the AWS Organizations management account can designate a delegated administrator. Permissions might be required to designate a delegated administrator. For more information, see Permissions required to designate a delegated administrator.
When you activate Amazon Inspector for the first time, Amazon Inspector creates the service linked role AWSServiceRoleForAmazonInspector for the account.
For information about how Amazon Inspector uses service-linked roles, see Using service-linked roles for Amazon Inspector.
