Organizations Delegated Admin Permission Auditor

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 15 mins

TL;DR

• What broke: Your delegated admin account is calling organizations:DescribeAccount but the management account's IAM policies and/or SCPs never explicitly authorized that API for the delegated principal — AWS Organizations does not auto-inherit permissions just because an account is registered as a delegated admin.
• How to fix it: Attach an explicit organizations:DescribeAccount allow either via a cross-account IAM role in the management account or a Resource Control Policy (RCP)/SCP exemption scoped to the delegated admin account's principal ARN.
• Fast path: Use our Client-Side Sandbox above to auto-refactor your failing policy — paste your IAM JSON or SCP and get a corrected diff without sending your ARNs to a third-party server.

An error occurred (AccessDenied) when calling the DescribeAccount operation:
  User: arn:aws:sts::111122223333:assumed-role/DelegatedAdminRole/session
  is not authorized to perform: organizations:DescribeAccount
  on resource: arn:aws:organizations::*:account/o-exampleorgid/*
  with an explicit deny in a service control policy

How to Fix It (The Solution)

Root Cause Checklist (run in order)

1. Check for explicit deny in SCPs — this overrides any IAM allow.
2. Check the IAM role in the delegated admin account — does it have organizations:DescribeAccount?
3. Check the trust policy — is the role assuming into the management account or calling directly?

Basic Fix — Add the missing permission to the delegated admin IAM role

{
  "Version": "2012-10-17",
  "Statement": [
    {
-     "Sid": "OrgReadOnly",
-     "Effect": "Allow",
-     "Action": [
-       "organizations:ListAccounts"
-     ],
+     "Sid": "OrgReadOnly",
+     "Effect": "Allow",
+     "Action": [
+       "organizations:ListAccounts",
+       "organizations:DescribeAccount",
+       "organizations:ListParents",
+       "organizations:DescribeOrganizationalUnit"
+     ],
      "Resource": "*"
    }
  ]
}

⚠️ organizations:DescribeAccount must be called against the management account's Organizations endpoint. If your delegated admin role lives in account 111122223333, it needs to assume a role in the management account 000000000000 that has this permission, OR the management account must have a resource-based delegation. Direct cross-account Organizations API calls do not work without a role assumption.

Enterprise Best Practice — Scoped cross-account assume-role with condition keys

Step 1: SCP — Remove the overly broad deny, replace with scoped deny

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyOrgWriteActions",
      "Effect": "Deny",
-     "Action": "organizations:*",
+     "Action": [
+       "organizations:CreateAccount",
+       "organizations:DeleteOrganization",
+       "organizations:MoveAccount",
+       "organizations:AttachPolicy",
+       "organizations:DetachPolicy",
+       "organizations:CreatePolicy",
+       "organizations:DeletePolicy"
+     ],
      "Resource": "*",
      "Condition": {
-       "": {}
+       "StringNotEquals": {
+         "aws:PrincipalArn": "arn:aws:iam::000000000000:role/OrgManagementBreakGlassRole"
+       }
      }
    }
  ]
}

Step 2: Management account — IAM role assumable by delegated admin account

+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowDelegatedAdminOrgRead",
+      "Effect": "Allow",
+      "Action": [
+        "organizations:DescribeAccount",
+        "organizations:ListAccounts",
+        "organizations:ListParents",
+        "organizations:DescribeOrganizationalUnit",
+        "organizations:ListTagsForResource"
+      ],
+      "Resource": "*"
+    }
+  ]
+}

Step 3: Trust policy on the management account role

+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "arn:aws:iam::111122223333:role/DelegatedAdminRole"
+      },
+      "Action": "sts:AssumeRole",
+      "Condition": {
+        "StringEquals": {
+          "sts:ExternalId": "delegated-admin-org-read-2024"
+        },
+        "Bool": {
+          "aws:MultiFactorAuthPresent": "false"
+        }
+      }
+    }
+  ]
+}

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

check:
  - CKV_AWS_110  # Ensure IAM policies do not allow wildcard actions
  - CKV_AWS_111  # Ensure IAM policies do not allow write access without constraints
skip_check:
  - CKV2_AWS_14  # adjust based on your org posture

checkov -d ./terraform/iam --framework terraform --check CKV_AWS_110,CKV_AWS_111 --hard-fail-on HIGH

package aws.organizations.scp

deny[msg] {
  stmt := input.Statement[_]
  stmt.Effect == "Deny"
  stmt.Action == "organizations:*"
  msg := sprintf(
    "SCP statement '%v' uses organizations:* wildcard deny. Enumerate specific write actions instead.",
    [stmt.Sid]
  )
}

# EventBridge rule pattern — fires on AccessDenied for Organizations APIs from delegated admin accounts
{
  "source": ["aws.organizations"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "errorCode": ["AccessDenied"],
    "eventName": ["DescribeAccount", "ListAccounts", "ListParents"],
    "userIdentity": {
      "type": ["AssumedRole"]
    }
  }
}