DelegatedAdministrator

Source: src/AWS/Organizations/DelegatedAdministrator.ts

Registers a member Account as the delegated administrator for a trusted AWS service, letting that account manage the service org-wide instead of the management account.

Requires trusted access for the same service principal (see TrustedServiceAccess). Existence-only resource: changing accountId or servicePrincipal replaces the registration.

Delegating Administration

const security = yield* Account("Security", {
  name: "security",
  email: "aws-security@example.com",
  parentId: root.rootId,
});

const guardDutyAccess = yield* TrustedServiceAccess("GuardDutyAccess", {
  servicePrincipal: "guardduty.amazonaws.com",
});

yield* DelegatedAdministrator("GuardDutyAdmin", {
  accountId: security.accountId,
  servicePrincipal: guardDutyAccess.servicePrincipal,
});