Delegation Policies

Delegation policies let you grant a member account the right to manage AWS Organizations' own policies, scoped to one or more policy types, without granting that right to every account or leaving policy management solely in the management account.

What are Delegation Policies?

A delegation policy is a resource-based policy on the AWS Organizations service itself. It grants a specific member account permission to call Organizations' policy-management APIs, CreatePolicy, AttachPolicy, UpdatePolicy, DeletePolicy, DetachPolicy, TagResource, and UntagResource, scoped to the policy type(s) you choose (for example BACKUP_POLICY). With it in place, that account can create and attach its own policy documents of that type directly, instead of every policy change having to run from the management account.

This is a different mechanism from Delegated Administrators. Delegated administrators register a member account as the administrator of an AWS service (Security Hub, GuardDuty, AWS Backup, and so on) so it can configure that service across the organization. Delegation policies instead grant rights over AWS Organizations' own policy APIs. The two are complementary and, for services that manage their organization-wide reach through a policy type (AWS Backup being the current example), you typically need both configured on the same account: delegated administrator status for the service, and a delegation policy scoped to that service's policy type.

Supported Policy Types

delegation_policies accepts one or more of the AWS Organizations policy types:

• SERVICE_CONTROL_POLICY
• RESOURCE_CONTROL_POLICY
• BACKUP_POLICY
• TAG_POLICY
• AISERVICES_OPT_OUT_POLICY
• CHATBOT_POLICY
• DECLARATIVE_POLICY_EC2

Implementation with NTC Organizations

module "ntc_organizations" {
  source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-organizations?ref=X.X.X"

  # Other configuration...

  delegation_policies = [
    {
      delegate_account_id = "345678901234"  # Backup account ID
      policy_types        = ["BACKUP_POLICY"]
      target_ou_paths     = ["/root/workloads"]
      target_account_ids  = []
      include_root        = true
    }
  ]
}

Each entry specifies:

• delegate_account_id: the member account that receives the delegated policy-management rights.
• policy_types: which policy type(s) this delegation covers.
• target_ou_paths: friendly OU path strings, the same format used by organization_policies (for example /root/workloads/test). An empty list means every OU in organizational_unit_paths.
• target_account_ids: account IDs the delegation covers directly. An empty list means every account in the organization.
• include_root: whether the delegation also covers the organization root itself, separate from the OU/account targeting above. Defaults to true.

AWS Backup Global Settings

AWS Backup's UpdateGlobalSettings API can only be called from the AWS Organizations management account, a restriction AWS Backup enforces itself, so it isn't something the backup account's own stack can configure even once it's a delegated administrator. NTC Organizations exposes it as backup_global_settings for exactly this reason.

module "ntc_organizations" {
  source = "github.com/nuvibit-terraform-collection/terraform-aws-ntc-organizations?ref=X.X.X"

  # Other configuration...

  backup_global_settings = {
    enabled                        = true
    enable_cross_account_backup    = true
    enable_delegated_administrator = true
    enable_multi_party_approval    = false
  }
}

• enabled: whether NTC Organizations manages these settings at all. Defaults to false.
• enable_cross_account_backup: allows backup plans to copy recovery points across accounts. Defaults to true.
• enable_delegated_administrator: allows a delegated administrator account to manage AWS Backup organization-wide. Defaults to true.
• enable_multi_party_approval: requires multi-party approval for certain backup operations. Defaults to false.

Putting it together for a central backup account

To let a dedicated backup account own and attach BACKUP_POLICY documents across the organization, three things need to be configured together:

1. delegated_administrators — registers the backup account as delegated administrator for backup.amazonaws.com.
2. delegation_policies with policy_types = ["BACKUP_POLICY"] — grants that account rights to create and attach BACKUP_POLICY documents.
3. backup_global_settings — set once in the management account, with enable_delegated_administrator and enable_cross_account_backup both true.

See NTC Backup for the resource-selection and cross-account copy behavior this unlocks.

Conclusion

Delegation policies close the gap that delegated administrators leave open: they let a member account manage AWS Organizations' own policy documents for a given policy type, rather than routing every policy change through the management account. Combined with backup_global_settings for AWS Backup specifically, they're what makes a dedicated, self-service backup account possible.