> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Delegate AWS Organizations read access to a member account

> Grant a member account the AWS Organizations read access Plerion needs to collect account tags, organizational units, and policies

With a **resource-based delegation policy**, you can connect Plerion through a member account and still let it read your AWS organization. The management account applies the policy once, and the member account then reads organization data on every scan.

***

## When you need this

Plerion reads AWS Organizations data, including the account list and account tags, through the integration that can see your organization. The management account can always do this. Any other account is denied the account list and tag reads by AWS Organizations, no matter what IAM permissions its role carries.

If you onboard a member account instead of the management account, add a delegation policy to your organization naming that account. AWS calls this a [delegated administrator for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html).

Account tags collected this way power [Integration groups](/guides/platform/integration-groups). The same access keeps organizational units and organization policies flowing into your [asset inventory](/guides/platform/assets/supported-cloud-services/aws-services).

***

## The delegation policy

Integration groups need at least `organizations:DescribeOrganization`, `organizations:ListAccounts`, and `organizations:ListTagsForResource`. The policy below grants the full read-only set from AWS's "view organization" example, which also covers organizational units and policies, and includes `organizations:DescribeResourcePolicy` so the delegated administrator can read the delegation policy itself.

Replace `<member-account-id>` with the AWS account ID of the member account integrated with Plerion.

```json theme={"system"}
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DelegateOrganizationsReadAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::<member-account-id>:root"
            },
            "Action": [
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeAccount",
                "organizations:DescribePolicy",
                "organizations:DescribeEffectivePolicy",
                "organizations:DescribeResourcePolicy",
                "organizations:ListRoots",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListParents",
                "organizations:ListChildren",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListPolicies",
                "organizations:ListPoliciesForTarget",
                "organizations:ListTargetsForPolicy",
                "organizations:ListTagsForResource"
            ],
            "Resource": "*"
        }
    ]
}
```

***

## Steps to apply the policy

Run these commands from the management account.

<Warning>
  An organization has one resource policy, and `put-resource-policy` replaces the entire document. Always read the current policy first and carry its statements into the new document.
</Warning>

<Steps>
  <Step title="Check for an existing policy">
    ```bash theme={"system"}
    aws organizations describe-resource-policy
    ```

    If this returns a policy, merge its statements into your new document. If it returns `ResourcePolicyNotFoundException`, there is no existing policy.
  </Step>

  <Step title="Apply the policy">
    Save the policy document as `delegation.json`, then run:

    ```bash theme={"system"}
    aws organizations put-resource-policy --content file://delegation.json
    ```
  </Step>

  <Step title="Verify from the member account">
    With credentials from the member account, run:

    ```bash theme={"system"}
    aws organizations list-accounts
    ```

    It should return your account list instead of `AccessDeniedException`.
  </Step>
</Steps>

***

## What happens without delegation

A member account integration without delegation keeps scanning normally, and only the organization reads are denied. Plerion cannot read the account list or account tags through it, so integration groups do not pick up tag changes. Existing groups and previously collected tags stay as they are.