AdminAccount

Source: src/AWS/FMS/AdminAccount.ts

The AWS Firewall Manager administrator account — an organization-level singleton that designates which account manages FMS security policies.

Caution

FMS requires the caller to be the AWS Organizations management account, and the organization must have AWS Config enabled. On accounts that are not an Organizations management account this resource fails at association time with a typed InvalidOperationException.

FMS admin-account APIs are served only from the us-east-1 endpoint; this resource pins every control-plane call there regardless of the ambient stack region.

This is a capture-and-restore singleton: FMS exposes no tags, so ownership is tracked by Alchemy state — adopting a pre-existing admin account that Alchemy did not create requires --adopt, and destroy disassociates the admin.

Designating the FMS admin

Designate the caller as the FMS admin

const admin = yield* FMS.AdminAccount("FmsAdmin", {});

Designate a specific member account

const admin = yield* FMS.AdminAccount("FmsAdmin", {
  adminAccount: "123456789012",
});