TrustedServiceAccess

Source: src/AWS/Organizations/TrustedServiceAccess.ts

Enables trusted access for an AWS service principal, allowing that service to operate across all accounts in the organization.

Typically paired with a DelegatedAdministrator that hands day-to-day administration of the service to a member account. Existence-only resource: changing servicePrincipal replaces it.

Enabling Trusted Access

Enable IAM Identity Center

yield* TrustedServiceAccess("SsoTrustedAccess", {
  servicePrincipal: "sso.amazonaws.com",
});

Trusted Access Plus a Delegated Administrator

const guardDutyAccess = yield* TrustedServiceAccess("GuardDutyAccess", {
  servicePrincipal: "guardduty.amazonaws.com",
});

yield* DelegatedAdministrator("GuardDutyAdmin", {
  accountId: securityAccount.accountId,
  servicePrincipal: guardDutyAccess.servicePrincipal,
});