AWS Organization has only trusted delegated administrators

​

What this check verifies

AWS Organizations delegated administrators are compared against a predefined trusted list to identify delegations that are not explicitly approved. The evaluation also notes when no delegated administrators exist.

​

Risk

Unapproved delegated administrators can alter SCPs, invite/move accounts, and create privileged roles, enabling privilege escalation. This undermines guardrails, risking loss of integrity, exposure of confidentiality across accounts, and impacts availability through organization-wide policy changes.

​

Recommendation

Restrict delegation to vetted accounts using least privilege and separation of duties. Maintain a centrally governed approved allowlist, review it regularly, and remove unused delegations. Enforce strong authentication for admin roles and monitor Organizations policy changes for defense in depth.

​

Remediation

Dashboard steps

1. Sign in to the AWS Management Console with the organization management account
2. Open AWS Organizations
3. In the left pane, select Delegated administrators
4. Select the untrusted account (by Account ID) from the list
5. For each service shown for that account, choose Deregister delegated administrator and confirm
6. Repeat for all untrusted accounts until only trusted accounts (or none) remain

​

References

• https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_delegated_administrators. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks