[New Resource]: Delegated Administrator for CloudTrail

[posquit0]

Description

• AWS CloudTrail announces delegated administrator account support for AWS Organizations
• AWS provides a CloudTrail API, not AWS Organization, for configuring delegated administrators.

Requested Resource(s) and/or Data Source(s)

• aws_cloudtrail_organization_admin_account

Potential Terraform Configuration

resource "aws_cloudtrail_organization_admin_account" "example" {
  delegated_admin_account_id = data.aws_caller_identity.delegated.account_id
}

data "aws_caller_identity" "delegated" {
  provider = aws.ipam_delegate_account
}

References

• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_ipam_organization_admin_account
• https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_RegisterOrganizationDelegatedAdmin.html

Would you like to implement a fix?

None

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[rojones94]

You can delegate admin control in the following way.

resource "aws_organizations_delegated_administrator" "this" {
  account_id        = "your-account-id"
  service_principal = "cloudtrail.amazonaws.com"
}

[posquit0]

@rojones94 No, there is a dedicated API for registering cloudtrail delegated administrator. Your suggested AWS Organization API is not working for many AWS services.

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-delegated-administrator.html

[jorhett]

You can delegate admin control in the following way.

resource "aws_organizations_delegated_administrator" "this" {
  account_id        = "your-account-id"
  service_principal = "cloudtrail.amazonaws.com"
}

Actually, this will not work and will prevent delegation from working. Just to explain how bad this is, if you do the delegation this way it appears to work, but you can't do anything.

If you try to run this command after applying the resource quoted above you'll see this:

$ aws cloudtrail register-organization-delegated-admin --member-account-id="123456789012"
An error occurred (AccountRegisteredException) when calling the RegisterOrganizationDelegatedAdmin operation: The specified AWS account 370208956287 is already registered as the CloudTrail delegated administrator.

You must delete the aws_organizations_delegated_administrator resource, apply the change, then run this CLI command to achieve the working solution:

$ aws cloudtrail register-organization-delegated-admin --member-account-id="123456789012"

This is why a new resource utilizing the Cloudtrail APIs is required.

[AugustoEMoreira]

You can delegate admin control in the following way.

resource "aws_organizations_delegated_administrator" "this" {
  account_id        = "your-account-id"
  service_principal = "cloudtrail.amazonaws.com"
}

I'm curious did you have already implemented delegated admin for cloudtrail using this? If so, could you explain? Because AWS has absolutely no documentation on how to do it using the organization's APIs instead of Cloudtrail's

[AugustoEMoreira]

@posquit0 After some research, I found the solution. When enabling delegated administrator access using Organizations API, AWS doesn't create a service-linked role to cloudtrail. To make this work, you will need to create a new resource like this:

resource "aws_iam_service_linked_role" "cloudtrail_service_role" {
    aws_service_name = "cloudtrail.amazonaws.com"
}

This resource should be in your root account. Also, you are going to need to set up s3's policy manually; I will assume you know how to do it, but let me know if you need further help.

[github-actions[bot]]

[!WARNING] This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions[bot]]

This functionality has been released in v5.63.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!