Back to Checks
aws

AWS Organization has only trusted delegated administrators

organizations_delegated_administrators
Service: organizationsSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

AWS Organizations delegated administrators are compared against a predefined trusted list to identify delegations that are not explicitly approved. The evaluation also notes when no delegated administrators exist.

Prowler logoProwlerprowler-provider-aws

Risk

Unapproved delegated administrators can alter SCPs, invite/move accounts, and create privileged roles, enabling privilege escalation. This undermines guardrails, risking loss of integrity, exposure of confidentiality across accounts, and impacts availability through organization-wide policy changes.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks organizations_delegated_administrators

Recommendation

Restrict delegation to vetted accounts using least privilege and separation of duties. Maintain a centrally governed approved allowlist, review it regularly, and remove unused delegations. Enforce strong authentication for admin roles and monitor Organizations policy changes for defense in depth.

Remediation

Other

1Sign in to the AWS Management Console with the organization management account
2Open AWS Organizations
3In the left pane, select **Delegated administrators**
4Select the untrusted account (by Account ID) from the list
5For each service shown for that account, choose **Deregister delegated administrator** and confirm
6Repeat for all untrusted accounts until only trusted accounts (or none) remain

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.organizations.organizations_client import (
    organizations_client,
)


class organizations_delegated_administrators(Check):
    def execute(self):
        findings = []

        organizations_trusted_delegated_administrators = (
            organizations_client.audit_config.get(
                "organizations_trusted_delegated_administrators", []
            )
        )

        if (
            organizations_client.organization
            and organizations_client.organization.status == "ACTIVE"
        ):
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=organizations_client.organization,
            )
            report.region = organizations_client.region
            if (
                organizations_client.organization.delegated_administrators is not None
            ):  # Check if Access Denied to list_delegated_administrators
                if organizations_client.organization.delegated_administrators:
                    for (
                        delegated_administrator
                    ) in organizations_client.organization.delegated_administrators:
                        if (
                            delegated_administrator.id
                            not in organizations_trusted_delegated_administrators
                        ):
                            report.status = "FAIL"
                            report.status_extended = f"AWS Organization {organizations_client.organization.id} has an untrusted Delegated Administrator: {delegated_administrator.id}."
                        else:
                            report.status = "PASS"
                            report.status_extended = f"AWS Organization {organizations_client.organization.id} has a trusted Delegated Administrator: {delegated_administrator.id}."
                else:
                    report.status = "PASS"
                    report.status_extended = f"AWS Organization {organizations_client.organization.id} has no Delegated Administrators."

                findings.append(report)

        return findings

References