resilience-hub-multi-account

Create an invoker role in the central account, create read-only cross-account roles in each member account trusting that invoker role, then register each service with `aws resiliencehubv2 create-service --permission-model` listing the cross-account role ARNs. Verify with list-services and list-input-sources.

The delegated administrator is an AWS Organizations integration for org-wide policy management and visibility, configured from the management account via trusted access and the console. The per-service cross-account permission model uses invoker and cross-account IAM roles to run actual cross-account assessments.

No. The resiliencehubv2 API has no register-delegated-administrator operation. Delegated administrator registration is done through AWS Organizations trusted access and the Resilience Hub console from the management account.

AccessDenied usually means the cross-account role ARN in the permission model does not match exactly, the member-account trust policy does not allow the central invoker role to assume it, or the externalId does not match. Also confirm the invoker role has sts:AssumeRole permission for every member-account role ARN.

The member-account role needs read-only discovery permissions such as cloudformation:DescribeStacks, ec2:DescribeInstances, rds:DescribeDBInstances, and elasticloadbalancing:DescribeLoadBalancers. Extend the action list based on the resource types in scope and the current Resilience Hub IAM permissions reference.

Generate the externalId with a cryptographically random generator, store it in AWS Secrets Manager or SSM Parameter Store as a SecureString, and reference it dynamically at deploy time. Avoid passing it in shell history or plaintext CI/CD logs, and rotate it periodically.