AWS IAM: Removed delegated administration and account assignment documentation
Summary
Deleted extensive content covering delegated administration processes, IAM role trust policy configuration, account access assignments, and session management.
Security assessment
The removed content included security-adjacent IAM configuration guidance but showed no evidence of addressing a specific vulnerability or incident.
Evidence
## Delegated administration
Diff
diff --git a/IAM/latest/UserGuide/aam-manage-access-to-aws-accounts.md b/IAM/latest/UserGuide/aam-manage-access-to-aws-accounts.md index 09c5f5888..35b9c5b72 100644 --- a//IAM/latest/UserGuide/aam-manage-access-to-aws-accounts.md +++ b//IAM/latest/UserGuide/aam-manage-access-to-aws-accounts.md @@ -7,2 +6,0 @@ -Delegated administrationRegister a member accountDeregister a member accountView the registered delegated administrator accountIdentify IAM roles and update their trust policyAssign user or group access to an AWS accountRemove user or group access to an AWS accountView or search account assignmentsUnderstanding sessionsRevoke user accessAttribute-based access control - @@ -19,438 +16,0 @@ Within the context of account access manager, the terms _users_ and _groups_ exc -## Delegated administration - -When you enable account access manager, AWS creates it in the management account in AWS Organizations because account access manager manages IAM role assignments for an entire AWS Organization. You can choose to delegate administration of account access manager to a member account in AWS Organizations. - -If you choose to register a member account as a delegated administrator for account access manager, users in this account can perform most account access manager administrative tasks. The following table indicates whether an account access manager administrative task can be performed by users in an organization management account, a delegated administration member account, or another member account. IAM role management is excluded from the list of administrative tasks because it takes place outside of account access manager. - -Account access manager administrative tasks | Management account | Delegated administrator account | Member account ----|---|---|--- -Manage IAM role assignments* | Yes | Yes | No -Enable account access manager | Yes | No | No -Delete account access manager | Yes | No | No -Enable or disable user access in the management account | Yes | No | No -Enable or disable user access in a member account | Yes | Yes | No -Register or deregister a member account as a delegated administrator | Yes | No | No - -*Refer to the best practices for delegated administration regarding user and group assignments to the management account. - -## Register a member account - -To configure delegated administration, you must first register a member account in your organization as a delegated administrator. Users in that member account who have sufficient permissions will have administrative access to account access manager. - -Account access manager supports registering only one member account as a delegated administrator at a time. You can only register a member account while signed in with credentials from the management account. - -Use the following procedure to register a member account in your AWS organization as a delegated administrator. - -###### To register a member account - - 1. Sign in to the AWS Management Console using the credentials of your management account in AWS Organizations. Management account credentials are required to run the [RegisterDelegatedAdministrator](https://docs.aws.amazon.com/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html) API. - - 2. Select the Region where account access manager was enabled and then open the AWS Identity and Access Management console. - - 3. Choose **Account access manager** , and then choose the **Settings** tab. - - 4. In the **Delegated administrator** section, choose **Register**. - - 5. On the **Register delegated administrator** page, select the AWS account you want to register, and then choose **Register**. - - - - -## Deregister a member account - -You can only deregister a member account while signed in with credentials from the management account. - -Use the following procedure to deregister a member account in your AWS organization that had previously been designated as a delegated administrator. - -###### Important - -When you deregister an account, you remove the ability for all admin users to manage account access manager from that account. They can no longer administer AWS account access from this account. - -This operation does not affect permissions or assignments configured in account access manager. Your end users continue to access their AWS accounts from the account access portal. - -###### To deregister a member account - - 1. Sign in to the AWS Management Console using the credentials of your management account in AWS Organizations. Management account credentials are required to run the [DeregisterDelegatedAdministrator](https://docs.aws.amazon.com/organizations/latest/APIReference/API_DeregisterDelegatedAdministrator.html) API. - - 2. Select the Region where account access manager was enabled, and then open the AWS Identity and Access Management console. - - 3. Choose **Account access manager** , and then choose the **Settings** tab. - - 4. In the **Delegated administrator** section, choose **Deregister account**. - - 5. In the **Deregister delegated administrator** dialog box, review the security implications, and then confirm that you understand. - - 6. Choose **Deregister**. - - - - -## View the registered delegated administrator account - -Use the following procedure to find which member account in your AWS Organizations has been configured as the delegated administrator for account access manager. - -###### To view your registered member account - - 1. Sign in to the AWS Management Console using the credentials of your management account in AWS Organizations. - - 2. Select the Region where account access manager was enabled and then open the AWS Identity and Access Management console. - - 3. Choose **Account access manager** , and then choose the **Settings** tab. - - 4. In the **Delegated administrator** section, you can view the current delegated administrator account details. - - - - -## Identify IAM roles and update their trust policy - -Before you start assigning IAM roles to IAM Identity Center users and groups, you need to: - - 1. Identify the relevant IAM roles in the accounts of interest, and - - 2. Make sure the [trust policy](./id_roles.html#id_roles_terms-and-concepts) of the IAM roles contains the Statement provided below. - - - - -If the role has an existing trust policy, add this statement to its Statement array. If you're creating a new role, you can use the entire policy document. This policy statement allows account access manager to assume the role and set context on behalf of users. The `Condition` block provides confused-deputy protection by ensuring that account access manager can assume the role only on behalf of your own account and your account access manager application. For more information, see [Update a role trust policy](./id_roles_update-role-trust-policy.html). - -Replace `<your-account-id>` with your AWS account ID, `<region>` with your IAM Identity Center primary Region, and `<application-id>` with your account access manager application ID. You can find the application ARN on the **Settings** page in the account access manager console. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AccountAccessManagerIAMRoleTrustPolicyStatement", - "Effect": "Allow", - "Principal": { - "Service": "account-access.amazonaws.com" - }, - "Action": [ - "sts:AssumeRole", - "sts:SetContext" - ], - "Condition": { - "StringEquals": { - "aws:SourceAccount": "<your-account-id>", - "aws:SourceArn": "arn:aws:account-access:<region>:<your-account-id>:application/<application-id>" - } - } - } - ] - } - -**Optional —`sts:TagSession`**. Add `sts:TagSession` to the `Action` list if you want upstream assertion attributes from your identity provider (for example, group memberships, department, cost-center) to propagate as principal tags on the session that account access manager issues. Without this action, role assumption still succeeds; only session-tag propagation is suppressed. Add it when downstream IAM policies in the target account use principal tags (`aws:PrincipalTag/<key>`); leave it out otherwise. Keep the same `Condition` block. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AccountAccessManagerIAMRoleTrustPolicyStatement", - "Effect": "Allow", - "Principal": { - "Service": "account-access.amazonaws.com" - }, - "Action": [ - "sts:AssumeRole", - "sts:SetContext", - "sts:TagSession" - ], - "Condition": { - "StringEquals": { - "aws:SourceAccount": "<your-account-id>", - "aws:SourceArn": "arn:aws:account-access:<region>:<your-account-id>:application/<application-id>" - } - } - } - ] - } - -###### Note - -We recommend you update your IAM role creation workflows to add this trust policy statement automatically where needed. - -## Assign user or group access to an AWS account - -You can assign a user or group access to an AWS account by creating an assignment between the user or group, the account, and the IAM role that the user or group can assume in the account. Thus, a single assignment is a triplet consisting of the user or group ID, the account ID, and the IAM role ARN. - -If you want to perform bulk assignments such as assigning the same role to a number of users and groups, you must create each assignment individually. You can script this procedure using the account access API, and the AWS SDK/CLI. - -### Console - -The console provides a few different ways to assign new access depending on whether you want to first identify the account, the user, or the group. - -###### Note - -The account access manager console provides a search capability for users, groups, and accounts. To identify the role you want to assign, you must find its name (or ARN) beforehand. The account access manager console cannot detect IAM roles in AWS accounts. - -For all procedures in this section, sign in to the management account (or delegated admin account), select the Region where account access manager is enabled, and navigate to **Account access manager** in the IAM console. - -Accounts tab - - -###### To assign user or group access from the Accounts tab - - 1. Choose the **Accounts** tab. - - 2. If you already know the account ID, choose **Assign new access**. On the **Assign account access** page, look up the desired user or group, enter the account ID, and IAM role name, and then choose **Assign access**. - - 3. If you need to first find the account, you can search for the desired AWS account by its name, ID, or email address. Alternatively, you can review the organizational structure or account list to find the relevant AWS account. Choose the radio button in front of the account and then **Assign new access**. On the **Assign account access** page, look up the desired user or group, enter the IAM role name, and then choose **Assign access**. - - 4. The organizational structure or account list lets you choose an account to view account details and account access assignments. You can choose **Assign new access** from there too. - - - - -Users tab - - -###### To assign user access from the Users tab