Onboard AWS Delegated Member Accounts

AWS permits the delegation of Organization management administrator permissions to its member accounts. These member accounts with delegated administrator permissions can create and manage StackSets with service-managed permissions for AWS Organizations. Learn more about AWS Delegated Member Accounts.

Use one of the options below to onboard delegated member accounts on Prisma Cloud.

Option 1: Unified IAM template

If you are using a unified IAM template to create IAM roles for master (delegated account) and member accounts, add the "CallAs": "DELEGATED_ADMIN" parameter to the downloaded template before deploying it in the CloudFormation stack of the delegated member account.

Option 2 : Separate templates for management account (delegated member accounts) and member accounts

1. Create an IAM role for the delegated account by running the Management IAM role template in the CloudFormation stack.
2. Create IAM roles for the rest of the member accounts by running the Member IAM role template under the service-managed CloudFormation StackSet of the delegated account as shown below.
3. Navigate to Advanced Settings to download separate templates for management and member accounts. Learn more about using advanced settings to onboard org with different templates for master and member accounts.

NOTE: Do not add `"CallAs": "DELEGATED_ADMIN"`` in this flow.

Limitation w.r.t Organization Management Account:

Due to AWS service-managed permission limitations, the CSP does not allow StackSets to deploy stack instances to the organization management account, even if the organization management account is in your organization or in an Organization unit in your organization.

As a result you may encounter an issue with IAM roles not being created in the organization management account. This can lead to an issue in Prisma Cloud during onboarding. Organization Management account status displays red under the Organization list. Use the workaround options outlined below to resolve this issue:

• Exclude the organization management account from the member accounts hierarchy selection during onboarding.

• If you still want to include the management account in the delegated member organization in Prisma Cloud, download the Management IAM role template from the advanced settings and deploy it in the CloudFormation stack of the management account. While executing the template, you must provide the PrismaCloudRoleName as equivalent to the member account (non-delegated member account). Provide either <rolename of master>-member or the customized role name given to the non-delegated member during onboarding.