Removing a delegated administrator
Removing the delegated administrator account stops further evidence collection for that account, but you retain access to the previously collected evidence.
If you need to remove your delegated administrator account for Audit Manager, you can follow the necessary steps on this page. Follow the prerequisites and procedures carefully, as they involve cleaning up resources to avoid unnecessary storage costs.
Prerequisites
Before you remove the delegated administrator account from Audit Manager, keep in mind the following considerations:
- Evidence finder cleanup task
-
If the current delegated administrator enabled evidence finder, you need to perform a cleanup task.
Before you use your management account to remove the current delegated administrator, make sure that the current delegated administrator account signs in to Audit Manager and disables evidence finder. Disabling evidence finder automatically deletes the event data store that was created in the account when evidence finder was enabled.
If this task isn’t completed, the event data store remains in their account. In this case, we recommend that the original delegated administrator uses CloudTrail Lake to manually delete the event data store.
This cleanup task is necessary to ensure that you don't end up with multiple event data stores. Audit Manager ignores an unused event data store after you remove or change a delegated administrator account. However, if you don't delete the unused event data store, the event data store continues to incur storage costs from CloudTrail Lake.
- Data deletion
-
When you remove a delegated administrator account for Audit Manager, the data for that account isn’t deleted. If you want to delete resource data for a delegated administrator account, you must perform that task separately before you remove the account. Either, you can do this in the Audit Manager console. Or, you can use one of the delete API operations that are provided by Audit Manager. For a list of available delete operations, see Deletion of Audit Manager data.
At this time, Audit Manager doesn't provide an option to delete evidence for a specific delegated administrator. Instead, when your management account deregisters Audit Manager, we perform a cleanup for the current delegated administrator account at the time of deregistration.
Procedure
You can remove a delegated administrator using the Audit Manager console, the AWS Command Line Interface (AWS CLI), or the Audit Manager API.
Warning
When you remove a delegated administrator, you continue to have access to the evidence that you previously collected under that delegated administrator account. However, Audit Manager stops collecting and attaching evidence to the old delegated administrator account.
Additional resources
