cis-aws-foundations-2-1-5

name	cis-aws-foundations-2.1.5
description	Ensure delegated admin manages AWS Organizations policies
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","organizations","delegated-admin","scp","policies"]
cis_id	2.1.5
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.1.6"]
prerequisites	[]
severity_boost	{}

Ensure delegated admin manages AWS Organizations policies

Description

Ensure that a dedicated member account is configured as a delegated administrator for AWS Organizations to manage organization policies (SCPs, RCPs, tag policies, backup policies, AI opt-out policies) and other Organizations features, instead of performing these tasks directly from the management account. The delegated administrator for AWS Organizations is configured via a resource-based delegation policy in the management account, which grants specific member accounts limited permissions to perform Organizations policy and account management actions across the organization. This allows policy management, OU operations, and other governance tasks to be handled from purpose-built accounts without requiring broad access to the management account.

Rationale

The management account has unique and high privileges to manage AWS Organizations (for example, creating/deleting accounts, managing org structures) and is not subject to guardrails like SCPs. Without a delegated administrator for Organizations, all policy management, OU changes, and account governance must be performed directly from the management account. This results in concentrating operational activity in the most powerful account. Configuring a dedicated member account as a delegated administrator for Organizations policy management distributes these tasks to a purpose-built AWS account that can be protected by SCPs and other controls, reduces the number of users and roles that need management-account access, and supports separation of duties while maintaining centralized control over organization-wide features.

Impact

Configuring a delegated administrator for AWS Organizations requires creating or identifying a dedicated member account for policy management and granting it specific permissions via a resource-based delegation policy. Existing workflows, automation, and user access patterns that currently perform Organizations policy tasks directly from the management account must be updated to use the delegated account instead. This introduces short-term operational overhead and testing to ensure policy creation, attachment, and management continue to function correctly from the new account.

Audit Procedure

Using AWS Console

1. Sign in to the AWS Organizations console. From the AWS Accounts section, verify that this is the management account for the organization.
2. In the AWS Organizations console, navigate to Settings. Scroll to the Delegated administrator for AWS Organizations section.
3. Review the delegation policy status:
   • If a delegation policy is configured and shows one or more member accounts registered to manage Organizations policies, proceed to step 4.
   • If no delegation policy is configured or the section shows No delegated administrator (or equivalent), the audit fails because Organizations management is performed directly from the management account.