resilience-hub-multi-account

Create an invoker IAM role in the central account trusted by the resiliencehub.amazonaws.com service principal, then create read-only cross-account roles in each member account trusting that invoker role. Finally register services with aws resiliencehubv2 create-service including the permission model with each cross-account role ARN.

There is no resiliencehubv2 CLI operation for delegated-administrator registration. It is configured from the Organizations management account via trusted access plus the Resilience Hub console, and it covers org-wide policy management and visibility, not cross-account assessments.

AccessDenied usually means the cross-account role ARN in the permission model does not match exactly, the member-account trust policy does not allow the central invoker role to assume it, or the externalId does not match. Also confirm the invoker role has sts:AssumeRole permission for every member-account role ARN.

The member-account role needs read-only discovery permissions such as cloudformation:DescribeStacks, ec2:DescribeInstances, rds:DescribeDBInstances, and elasticloadbalancing:DescribeLoadBalancers. The required action list grows as Resilience Hub supports new resource types, so consult the current IAM permissions reference.

Discovery fails when the cross-account role lacks read permissions for the in-scope resource types or when input sources point to invalid resources or the wrong region. Verify the role's discovery policy and confirm the input sources reference valid resources in the correct region.