The management account of a resource directory can designate a member as the delegated administrator account for Cloud Config. This authorization allows the delegated administrator account to manage account groups, view member resources, manage compliance packages and rules, and configure resource data delivery on behalf of the management account.
Prerequisites
You must log on with the management account.
Ensure that you have enabled the resource directory. For more information, see Enable a resource directory.
Members are created in or invited to the resource directory. For more information, see Create a member and Invite an Alibaba Cloud account to join a resource directory.
Background information
For more information about delegated administrator accounts, see What is a delegated administrator account?.
Scenarios
Adding a delegated administrator account for Cloud Config separates organizational management from audit management in your IT architecture. This separation is vital for your enterprise's cloud IT security.
By default, the management account has super administrator permissions. As a best practice, the management account should focus on managing the resource directory. This reduces its other cloud management duties and helps prevent errors that can result from overly broad permissions. If an enterprise uses multiple accounts, some operations must be applied to the entire resource directory. The management account can then delegate these tasks to a delegated administrator account. For example, a management account can assign a member as the delegated administrator account for Cloud Config. The enterprise's audit department can then use this account to audit resource compliance and configure data delivery.
Add a delegated administrator account
An enterprise can designate a member in its resource directory as a dedicated audit account. This account becomes the delegated administrator account for Cloud Config. The delegated administrator account for Cloud Config is granted all Cloud Config operation permissions by the management account. It can then manage account groups, view member resources, manage compliance packages and rules, and set up resource data delivery alongside the management account.
Use a management account to add a delegated administrator account in the Resource Management console. For more information, see Add a delegated administrator account.
A management account can add only one delegated administrator account for Cloud Config.
Replace a delegated administrator account
After you add a delegated administrator account for Cloud Config, do not replace it unless necessary. If you must replace the delegated administrator account, first remove the original account (Account A) and then add the new account (Account B).
In the Resource Management console, use the management account to remove the original delegated administrator account for Cloud Config (Account A).
For more information, see Remove a delegated administrator account.
NoteThis action only removes the Cloud Config management permissions from the original delegated administrator account (Account A). All of its configurations are retained.
In the Resource Management console, add the new delegated administrator account (Account B).
For more information, see Add a delegated administrator account.
NoteThe new delegated administrator account (Account B) inherits all configurations from the original delegated administrator account (Account A).
In the Cloud Config console, the new delegated administrator account (Account B) can continue to manage account groups, view member resources, manage compliance packages and rules, and set up resource data delivery.
For information about how to manage account groups, see Manage account groups.
For information about how to set up resource data delivery, see Deliver data to Simple Log Service (SLS), Deliver data to Object Storage Service (OSS), and Deliver data to Simple Message Queue (formerly MNS).