Assume the AWSControlTowerExecution role in an account

Delegate Macie administration to an account Executes in: management account in all regions

Update the organization configuration to auto-enroll new accounts in Macie Executes in: delegated administrator account in all regio

Enable Macie Executes in: management account in all regions

List all of the accounts in an organization

List all the roots in an organization

Set up the organization in multiple regions

Activate organization access for CloudFormation StackSets Executes in: management account in all regions

Delegate Firewall Manager administration to an account Executes in: management account in all regions

Attach the AI opt-out policy to the root

Update the organization configuration to auto-enroll new accounts in GuardDuty Executes in: delegated administrator account in all r

Create finding aggregator to aggregate findings in the primary region Executes in: delegated administrator account in primary region

Create an account IAM access analyzer for the management account Executes in: management account in all regions

Create members in Securityhub

Create members in Macie

Create members in GuardDuty

Create an organizational IAM access analyzer Executes in: delegated administrator account in all regions

Describe the organization the account belongs to

Enable all features in an organization

Enables all policy types in an organization

Enable Service Catalog sharing with organization Executes in: management account in all regions

Enable AWS service access in organization

Delegate Inspector administration to an account Executes in: management account in all regions

Enable Resource Access Manager sharing with organization Executes in: management account in all regions

Return the Account ID for an account

Return the AI opt-out policy ID

Return all regions that don't require opt-in

List all of the policies in an organization

Delegate Security Lake administration to an account Executes in: management account in all regions

Register delegated administrators

Configure services in a region

Update the organization configuration to auto-enroll new accounts and controls in SecurityHub Executes in: delegated administrator a

Delegate SecurityHub administration to an account Executes in: management account in each region

Delegate Detective administration to an account Executes in: management account in all regions

Delegate GuardDuty administration to an account Executes in: management account in all regions