> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/use-cases/secure-the-infrastructure/onboard-aws-delegated-member-accounts.md).

# Onboard AWS Delegated Member Accounts

AWS permits the delegation of Organization management administrator permissions to its member accounts. These member accounts with delegated administrator permissions can create and manage StackSets with service-managed permissions for AWS Organizations. Learn more about [AWS Delegated Member Accounts](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-delegated-admin.html).

Use one of the options below to onboard delegated member accounts on Prisma Cloud.

#### Option 1: Unified IAM template

If you are using a unified IAM template to create IAM roles for master (delegated account) and member accounts, add the "CallAs": "DELEGATED\_ADMIN" parameter to the downloaded template before deploying it in the CloudFormation stack of the delegated member account.

![](/files/Bx0pHwSdIrorAXRLwltO)

![](/files/HdKdsTACx6b8wdVDbPXn)

#### Option 2 : Separate templates for management account (delegated member accounts) and member accounts

1. Create an IAM role for the delegated account by running the Management IAM role template in the CloudFormation stack.
2. Create IAM roles for the rest of the member accounts by running the Member IAM role template under the service-managed **CloudFormation StackSet** of the delegated account as shown below.\
   ![](/files/3wr5SSZvXIKkLJVxMoYl)
3. Navigate to **Advanced Settings** to download separate templates for management and member accounts. Learn more about using [advanced settings](https://docs.prismacloud.io/en/enterprise-edition/content-collections/connect/connect-cloud-accounts/onboard-aws/onboard-aws-org#:~:text=To%20have%20separate%20CFTs) to onboard org with different templates for master and member accounts.

![](/files/Tx5hN327GIuM5XSoYxvv)

**NOTE:** Do not add \`"CallAs": "DELEGATED\_ADMIN"\`\` in this flow.

#### Limitation w\.r.t Organization Management Account:

Due to AWS service-managed permission limitations, the CSP does not allow StackSets to deploy stack instances to the [organization management account](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeploymentTargets.html), even if the organization management account is in your organization or in an Organization unit in your organization.

As a result you may encounter an issue with IAM roles not being created in the organization management account. This can lead to an issue in Prisma Cloud during onboarding. **Organization Management** account status displays red under the Organization list. Use the workaround options outlined below to resolve this issue:

* Exclude the organization management account from the member accounts hierarchy selection during onboarding.

![](/files/l06PdHSMJO29vKni86ok)

* If you still want to include the management account in the delegated member organization in Prisma Cloud, download the Management IAM role template from the advanced settings and deploy it in the CloudFormation stack of the management account. While executing the template, you must provide the *PrismaCloudRoleName* as equivalent to the member account (non-delegated member account). Provide either *\<rolename of master>-member* or the customized role name given to the non-delegated member during onboarding.

![](/files/uTTNNA21Gcd1PmsWB4q1)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/use-cases/secure-the-infrastructure/onboard-aws-delegated-member-accounts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.