View a markdown version of this page

Enable a delegated admin account for Amazon Account Management - Amazon Account Management
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Enable a delegated admin account for Amazon Account Management

These instructions are for how to enable a delegated admin account for Amazon Account Management if you signed up for Amazon using Sign up for Amazon (advanced) or if you activated advanced features for your account. To compare sign-up options, see Compare sign-up options.

You can register one delegated admin account per organization for the Amazon Account Management service. After you register this account, users and roles in that account can call the Amazon CLI and Amazon SDK operations in the account namespace that can work in the Organizations mode by supporting an optional AccountId parameter. This enables the delegated admin to call Amazon Account Management API operations for other member accounts in Amazon Organizations.

To register a member account in your organization as a delegated admin account, use the following procedure.

Amazon CLI & SDKs
To register a delegated admin account for the Account Management service

You can use the following commands to enable a delegated admin for the Account Management service.

Minimum permissions

To perform these tasks, you must meet the following requirements:

You must specify the following service principal:

account.amazonaws.com

  • Amazon CLI: register-delegated-administrator

    The following example registers a member account of the organization as a delegated admin for the Account Management service. 

    $ aws organizations register-delegated-administrator \
    --account-id 123456789012 \
    --service-principal account.amazonaws.com

    This command produces no output if it's successful.

    After you run this command, you can use credentials from account 123456789012 to call Account Management Amazon CLI and SDK API operations that use the --account-id parameter to reference member accounts in an organization.

Amazon Web Services Management Console

This task isn't supported in the Amazon Account Management management console. You can perform this task only by using the Amazon CLI or an API operation from one of the Amazon SDKs.