Delegated administrator accounts can separate organization management tasks from business management tasks. You can use the management account of a resource directory to perform the organization management tasks of the resource directory, and use delegated administrator accounts to perform the business management tasks of Resource Orchestration Service (ROS). This is in line with the best practices. You can specify a member account of the resource directory as a delegated administrator account based on your business requirements. This way, you can use the member account as the administrator account to deploy stacks within other member accounts in ROS.
- The Resource Directory service is activated. For more information, see Enable a resource directory.
- Member accounts are created in the resource directory, or members are requested to create member accounts in the resource directory. For more information, see Create a member and Invite an Alibaba Cloud account to join a resource directory.
Add a delegated administrator account
You can log on to the Resource Management console with the management account and add a delegated administrator account to the resource directory. For more information, see Add a delegated administrator account.
Remove a delegated administrator account
If you remove a delegated administrator account, specific configurations may become temporarily invalid. Exercise caution when you remove a delegated administrator account. For more information about how to remove a delegated administrator account, see Remove a delegated administrator account.
After you remove the delegated administrator account, the account becomes a member account and the following changes take effect for the account:
- The stack groups and stack instances within the account are automatically retained.
- The account cannot perform operations on the stack instances that are created in the service-managed stack groups. For example, the account cannot create, update, or delete the stack instances.
- The trusted access feature is automatically disabled for the account.