Skip to main content
With a resource-based delegation policy, you can connect Plerion through a member account and still let it read your AWS organization. The management account applies the policy once, and the member account then reads organization data on every scan.

​
When you need this

Plerion reads AWS Organizations data, including the account list and account tags, through the integration that can see your organization. The management account can always do this. Any other account is denied the account list and tag reads by AWS Organizations, no matter what IAM permissions its role carries. If you onboard a member account instead of the management account, add a delegation policy to your organization naming that account. AWS calls this a delegated administrator for AWS Organizations. Account tags collected this way power Integration groups. The same access keeps organizational units and organization policies flowing into your asset inventory.

​
The delegation policy

Integration groups need at least organizations:DescribeOrganization, organizations:ListAccounts, and organizations:ListTagsForResource. The policy below grants the full read-only set from AWS’s “view organization” example, which also covers organizational units and policies, and includes organizations:DescribeResourcePolicy so the delegated administrator can read the delegation policy itself. Replace <member-account-id> with the AWS account ID of the member account integrated with Plerion.

​
Steps to apply the policy

Run these commands from the management account.
An organization has one resource policy, and put-resource-policy replaces the entire document. Always read the current policy first and carry its statements into the new document.
1

Check for an existing policy

If this returns a policy, merge its statements into your new document. If it returns ResourcePolicyNotFoundException, there is no existing policy.
2

Apply the policy

Save the policy document as delegation.json, then run:
3

Verify from the member account

With credentials from the member account, run:
It should return your account list instead of AccessDeniedException.

​
What happens without delegation

A member account integration without delegation keeps scanning normally, and only the organization reads are denied. Plerion cannot read the account list or account tags through it, so integration groups do not pick up tag changes. Existing groups and previously collected tags stay as they are.