aws-sdk-organizations 1.37.0 → 1.38.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA256:
-  metadata.gz: 15054a9916309155409c216610991f0508b3347a4d8fd6e7f4851666cc2e21a3
-  data.tar.gz: db7c14b02206868628ae4909e823f8c90ed17fe87044c24c62c9f7f6fc1f8327
+SHA1:
+  metadata.gz: 3c32fbb5fc4cb1e3eed5d05c06f4c8913839fcaf
+  data.tar.gz: fd158e8f0f27455aa368031e70f4f3d0fbe98f6b
 SHA512:
-  metadata.gz: 866c0468c08aa087aabaf3fb962372ab9b4f36d0625ffbb07df3fa8b2a0616e79471a481ae972a9ad50456b7410dedc8b009628a0b066b2e4261424fc4fcd023
-  data.tar.gz: 5bd7ac2e884264595a206150c65406696d2001c1cf6d1fe452b1c9ca544be70f1d4297347ddaea953f6dfe9310443a6a9a12a5ef662545a570ab5c3109edce34
+  metadata.gz: e44f57b020eed187539027f0277ec4656a7d1b65fc9a170e0197a18d71819be3646dd4a114607ed392c7cba3ebd91ec852e1f89f66bb6ca5a0a9093ac3225467
+  data.tar.gz: ff68051eb15814cf07a043050099db87be93e75229c0689c43d81f8d70431379a51a5f7afff9cdac2aa5c497dedd3ebaf2079167dc258463ff634899cc7ade41

data/lib/aws-sdk-organizations.rb

@@ -45,6 +45,6 @@ require_relative 'aws-sdk-organizations/customizations'
 # @service
 module Aws::Organizations
 
-  GEM_VERSION = '1.37.0'
+  GEM_VERSION = '1.38.0'
 
 end

data/lib/aws-sdk-organizations/client.rb

@@ -457,23 +457,54 @@ module Aws::Organizations
     end
 
     # Attaches a policy to a root, an organizational unit (OU), or an
-    # individual account.
-    #
-    # How the policy affects accounts depends on the type of policy:
-    #
-    # * For more information about attaching SCPs, see [How SCPs Work][1] in
-    #   the *AWS Organizations User Guide.*
-    #
-    # * For information about attaching tag policies, see [How Policy
-    #   Inheritance Works][2] in the *AWS Organizations User Guide.*
+    # individual account. How the policy affects accounts depends on the
+    # type of policy:
+    #
+    # * **Service control policy (SCP)** - An SCP specifies what permissions
+    #   can be delegated to users in affected member accounts. The scope of
+    #   influence for a policy depends on what you attach the policy to:
+    #
+    #   * If you attach an SCP to a root, it affects all accounts in the
+    #     organization.
+    #
+    #   * If you attach an SCP to an OU, it affects all accounts in that OU
+    #     and in any child OUs.
+    #
+    #   * If you attach the policy directly to an account, it affects only
+    #     that account.
+    #
+    #   SCPs are JSON policies that specify the maximum permissions for an
+    #   organization or organizational unit (OU). You can attach one SCP to
+    #   a higher level root or OU, and a different SCP to a child OU or to
+    #   an account. The child policy can further restrict only the
+    #   permissions that pass through the parent filter and are available to
+    #   the child. An SCP that is attached to a child can't grant a
+    #   permission that the parent hasn't already granted. For example,
+    #   imagine that the parent SCP allows permissions A, B, C, D, and E.
+    #   The child SCP allows C, D, E, F, and G. The result is that the
+    #   accounts affected by the child SCP are allowed to use only C, D, and
+    #   E. They can't use A or B because the child OU filtered them out.
+    #   They also can't use F and G because the parent OU filtered them
+    #   out. They can't be granted back by the child SCP; child SCPs can
+    #   only filter the permissions they receive from the parent SCP.
+    #
+    #   AWS Organizations attaches a default SCP named `"FullAWSAccess` to
+    #   every root, OU, and account. This default SCP allows all services
+    #   and actions, enabling any new child OU or account to inherit the
+    #   permissions of the parent root or OU. If you detach the default
+    #   policy, you must replace it with a policy that specifies the
+    #   permissions that you want to allow in that OU or account.
+    #
+    #   For more information about how AWS Organizations policies
+    #   permissions work, see [Using Service Control Policies][1] in the
+    #   *AWS Organizations User Guide.*
     #
     # This operation can be called only from the organization's master
     # account.
     #
     #
     #
-    # [1]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html
-    # [2]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies-inheritance.html
+    # [1]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scp.html
     #
     # @option params [required, String] :policy_id
     #   The unique identifier (ID) of the policy that you want to attach to
@@ -704,14 +735,14 @@ module Aws::Organizations
     # Account in Your Organization][3] in the *AWS Organizations User
     # Guide.*
     #
-    # * When you create an account in an organization, the information
-    #   required for the account to operate as a standalone account is *not*
-    #   automatically collected. For example, information about the payment
-    #   method and signing the end user license agreement (EULA) is not
-    #   collected. If you must remove an account from your organization
-    #   later, you can do so only after you provide the missing information.
-    #   Follow the steps at [ To leave an organization as a member
-    #   account][4] in the *AWS Organizations User Guide*.
+    # * When you create an account in an organization using the AWS
+    #   Organizations console, API, or CLI commands, the information
+    #   required for the account to operate as a standalone account, such as
+    #   a payment method and signing the end user license agreement (EULA)
+    #   is *not* automatically collected. If you must remove an account from
+    #   your organization later, you can do so only after you provide the
+    #   missing information. Follow the steps at [ To leave an organization
+    #   as a member account][4] in the *AWS Organizations User Guide*.
     #
     # * If you get an exception that indicates that you exceeded your
     #   account limits for the organization, contact [AWS Support][5].
@@ -771,10 +802,13 @@ module Aws::Organizations
     #   `OrganizationAccountAccessRole`.
     #
     #   For more information about how to use this role to access the member
-    #   account, see [Accessing and Administering the Member Accounts in Your
-    #   Organization][1] in the *AWS Organizations User Guide*. Also see steps
-    #   2 and 3 in [Tutorial: Delegate Access Across AWS Accounts Using IAM
-    #   Roles][2] in the *IAM User Guide.*
+    #   account, see the following links:
+    #
+    #   * [Accessing and Administering the Member Accounts in Your
+    #     Organization][1] in the *AWS Organizations User Guide*
+    #
+    #   * Steps 2 and 3 in [Tutorial: Delegate Access Across AWS Accounts
+    #     Using IAM Roles][2] in the *IAM User Guide*
     #
     #   The [regex pattern][3] that is used to validate this parameter. The
     #   pattern can include uppercase letters, lowercase letters, digits with
@@ -794,9 +828,9 @@ module Aws::Organizations
     #   the Billing and Cost Management Console][1] in the *AWS Billing and
     #   Cost Management User Guide*.
     #
-    #   If you don't specify this parameter, the value defaults to `ALLOW`.
-    #   This value allows IAM users and roles with the required permissions to
-    #   access billing information for the new account.
+    #   If you don't specify this parameter, the value defaults to `ALLOW`,
+    #   and IAM users and roles with the required permissions can access
+    #   billing information for the new account.
     #
     #
     #
@@ -920,24 +954,24 @@ module Aws::Organizations
     # allows the master account in the organization in the commercial Region
     # to assume it. An AWS GovCloud (US) account is then created and
     # associated with the commercial account that you just created. A role
-    # is created in the new AWS GovCloud (US) account. This role can be
-    # assumed by the AWS GovCloud (US) account that is associated with the
-    # master account of the commercial organization. For more information
-    # and to view a diagram that explains how account access works, see [AWS
+    # is created in the new AWS GovCloud (US) account that can be assumed by
+    # the AWS GovCloud (US) account that is associated with the master
+    # account of the commercial organization. For more information and to
+    # view a diagram that explains how account access works, see [AWS
     # Organizations][4] in the *AWS GovCloud User Guide.*
     #
     # For more information about creating accounts, see [Creating an AWS
     # Account in Your Organization][6] in the *AWS Organizations User
     # Guide.*
     #
-    # * You can create an account in an organization using the AWS
-    #   Organizations console, API, or CLI commands. When you do, the
-    #   information required for the account to operate as a standalone
-    #   account, such as a payment method, is *not* automatically collected.
-    #   If you must remove an account from your organization later, you can
-    #   do so only after you provide the missing information. Follow the
-    #   steps at [ To leave an organization as a member account][7] in the
-    #   *AWS Organizations User Guide.*
+    # * When you create an account in an organization using the AWS
+    #   Organizations console, API, or CLI commands, the information
+    #   required for the account to operate as a standalone account, such as
+    #   a payment method and signing the end user license agreement (EULA)
+    #   is *not* automatically collected. If you must remove an account from
+    #   your organization later, you can do so only after you provide the
+    #   missing information. Follow the steps at [ To leave an organization
+    #   as a member account][7] in the *AWS Organizations User Guide.*
     #
     # * If you get an exception that indicates that you exceeded your
     #   account limits for the organization, contact [AWS Support][8].
@@ -985,8 +1019,8 @@ module Aws::Organizations
     #   of the account or remove an account that was created with an invalid
     #   email address. Like all request parameters for
     #   `CreateGovCloudAccount`, the request for the email address for the AWS
-    #   GovCloud (US) account originates from the commercial Region. It does
-    #   not come from the AWS GovCloud (US) Region.
+    #   GovCloud (US) account originates from the commercial Region, not from
+    #   the AWS GovCloud (US) Region.
     #
     # @option params [required, String] :account_name
     #   The friendly name of the member account.
@@ -1006,8 +1040,8 @@ module Aws::Organizations
     #
     #   For more information about how to use this role to access the member
     #   account, see [Accessing and Administering the Member Accounts in Your
-    #   Organization][1] in the *AWS Organizations User Guide*. See also steps
-    #   2 and 3 in [Tutorial: Delegate Access Across AWS Accounts Using IAM
+    #   Organization][1] in the *AWS Organizations User Guide* and steps 2 and
+    #   3 in [Tutorial: Delegate Access Across AWS Accounts Using IAM
     #   Roles][2] in the *IAM User Guide.*
     #
     #   The [regex pattern][3] that is used to validate this parameter. The
@@ -1078,11 +1112,12 @@ module Aws::Organizations
     # must also have the relevant IAM permissions.
     #
     # By default (or if you set the `FeatureSet` parameter to `ALL`), the
-    # new organization is created with all features enabled. In addition,
-    # service control policies are automatically enabled in the root. If you
-    # instead create the organization supporting only the consolidated
-    # billing features, no policy types are enabled by default, and you
-    # can't use organization policies.
+    # new organization is created with all features enabled and service
+    # control policies automatically enabled in the root. If you instead
+    # choose to create the organization supporting only the consolidated
+    # billing features by setting the `FeatureSet` parameter to
+    # `CONSOLIDATED_BILLING"`, no policy types are enabled by default, and
+    # you can't use organization policies
     #
     #
     #
@@ -1100,9 +1135,9 @@ module Aws::Organizations
     #     The consolidated billing feature subset isn't available for
     #     organizations in the AWS GovCloud (US) Region.
     #
-    #   * `ALL`\: In addition to all the features that consolidated billing
-    #     feature set supports, the master account can also apply any policy
-    #     type to any member account in the organization. For more
+    #   * `ALL`\: In addition to all the features supported by the
+    #     consolidated billing feature set, the master account can also apply
+    #     any policy type to any member account in the organization. For more
     #     information, see [All features][2] in the *AWS Organizations User
     #     Guide.*
     #
@@ -1291,12 +1326,12 @@ module Aws::Organizations
     # [1]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies.html
     #
     # @option params [required, String] :content
-    #   The policy content to add to the new policy. For example, you could
-    #   create a [service control policy][1] (SCP) that specifies the
-    #   permissions that administrators in attached accounts can delegate to
-    #   their users, groups, and roles. The string for this SCP must be JSON
-    #   text. For more information about the SCP syntax, see [Service Control
-    #   Policy Syntax][2] in the *AWS Organizations User Guide.*
+    #   The policy content to add to the new policy. For example, if you
+    #   create a [service control policy][1] (SCP), this string must be JSON
+    #   text that specifies the permissions that admins in attached accounts
+    #   can delegate to their users, groups, and roles. For more information
+    #   about the SCP syntax, see [Service Control Policy Syntax][2] in the
+    #   *AWS Organizations User Guide.*
     #
     #
     #
@@ -1319,6 +1354,11 @@ module Aws::Organizations
     # @option params [required, String] :type
     #   The type of policy to create.
     #
+    #   <note markdown="1"> In the current release, the only type of policy that you can create is
+    #   a service control policy (SCP).
+    #
+    #    </note>
+    #
     # @return [Types::CreatePolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreatePolicyResponse#policy #policy} => Types::Policy
@@ -1388,8 +1428,7 @@ module Aws::Organizations
     # reinitiate the process with a new handshake request.
     #
     # After you decline a handshake, it continues to appear in the results
-    # of relevant API operations for only 30 days. After that, it's
-    # deleted.
+    # of relevant APIs for only 30 days. After that, it's deleted.
     #
     # @option params [required, String] :handshake_id
     #   The unique identifier (ID) of the handshake that you want to decline.
@@ -1603,12 +1642,60 @@ module Aws::Organizations
       req.send_request(options)
     end
 
-    # Retrieves AWS Organizations related information about the specified
-    # account.
+    # Removes the specified member AWS account as a delegated administrator
+    # for the specified AWS service.
+    #
+    # You can run this action only for AWS services that support this
+    # feature. For a current list of services that support it, see [AWS
+    # Services That Support Using Delegated Administrators][1] in the *AWS
+    # Organizations User Guide.*
     #
     # This operation can be called only from the organization's master
     # account.
     #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrated-services-list.html#services-that-support-delegated-admin
+    #
+    # @option params [required, String] :account_id
+    #   The account ID number of the member account in the organization that
+    #   you want to deregister as a delegated administrator.
+    #
+    # @option params [required, String] :service_principal
+    #   The service principal name of an AWS service for which the account is
+    #   a delegated administrator.
+    #
+    #   Delegated administrator privileges are revoked for only the specified
+    #   AWS service from the member account. If the specified service is the
+    #   only service for which the member account is a delegated
+    #   administrator, the operation also revokes Organizations read action
+    #   permissions.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.deregister_delegated_administrator({
+    #     account_id: "AccountId", # required
+    #     service_principal: "ServicePrincipal", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/organizations-2016-11-28/DeregisterDelegatedAdministrator AWS API Documentation
+    #
+    # @overload deregister_delegated_administrator(params = {})
+    # @param [Hash] params ({})
+    def deregister_delegated_administrator(params = {}, options = {})
+      req = build_request(:deregister_delegated_administrator, params)
+      req.send_request(options)
+    end
+
+    # Retrieves AWS Organizations-related information about the specified
+    # account.
+    #
+    # This operation can be called only from the organization's master
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
+    #
     # @option params [required, String] :account_id
     #   The unique identifier (ID) of the AWS account that you want
     #   information about. You can get the ID from the ListAccounts or
@@ -1673,7 +1760,8 @@ module Aws::Organizations
     # account.
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :create_account_request_id
     #   Specifies the `operationId` that uniquely identifies the request. You
@@ -1747,7 +1835,9 @@ module Aws::Organizations
     # For more information on policy inheritance, see [How Policy
     # Inheritance Works][1] in the *AWS Organizations User Guide*.
     #
-    # This operation can be called from any account in the organization.
+    # This operation can be called only from the organization's master
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     #
     #
@@ -1963,7 +2053,8 @@ module Aws::Organizations
     # Retrieves information about an organizational unit (OU).
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :organizational_unit_id
     #   The unique identifier (ID) of the organizational unit that you want
@@ -2025,7 +2116,8 @@ module Aws::Organizations
     # Retrieves information about a policy.
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :policy_id
     #   The unique identifier (ID) of the policy that you want details about.
@@ -2099,15 +2191,15 @@ module Aws::Organizations
     # accounts are immediate.
     #
     # **Note:** Every root, OU, and account must have at least one SCP
-    # attached. You can replace the default `FullAWSAccess` policy with one
-    # that limits the permissions that can be delegated. To do that, you
-    # must attach the replacement policy before you can remove the default
-    # one. This is the authorization strategy of using an [allow list][1].
-    # You could instead attach a second SCP and leave the `FullAWSAccess`
-    # SCP still attached. You could then specify `"Effect": "Deny"` in the
-    # second SCP to override the `"Effect": "Allow"` in the `FullAWSAccess`
-    # policy (or any other attached SCP). If you take these steps, you're
-    # using the authorization strategy of a [deny list][2].
+    # attached. If you want to replace the default `FullAWSAccess` policy
+    # with one that limits the permissions that can be delegated, you must
+    # attach the replacement policy before you can remove the default one.
+    # This is the authorization strategy of an "[allow list][1]". If you
+    # instead attach a second SCP and leave the `FullAWSAccess` SCP still
+    # attached, and specify `"Effect": "Deny"` in the second SCP to override
+    # the `"Effect": "Allow"` in the `FullAWSAccess` policy (or any other
+    # attached SCP), you're using the authorization strategy of a "[deny
+    # list][2]".
     #
     # This operation can be called only from the organization's master
     # account.
@@ -2200,9 +2292,8 @@ module Aws::Organizations
     #
     # After you perform the `DisableAWSServiceAccess` operation, the
     # specified service can no longer perform operations in your
-    # organization's accounts. The only exception is when the operations
-    # are explicitly permitted by IAM policies that are attached to your
-    # roles.
+    # organization's accounts unless the operations are explicitly
+    # permitted by the IAM policies that are attached to your roles.
     #
     # For more information about integrating other services with AWS
     # Organizations, including the list of services that work with
@@ -2239,13 +2330,12 @@ module Aws::Organizations
       req.send_request(options)
     end
 
-    # Disables an organizational control policy type in a root and detaches
-    # all policies of that type from the organization root, OUs, and
-    # accounts. A policy of a certain type can be attached to entities in a
-    # root only if that type is enabled in the root. After you perform this
-    # operation, you no longer can attach policies of the specified type to
-    # that root or to any organizational unit (OU) or account in that root.
-    # You can undo this by using the EnablePolicyType operation.
+    # Disables an organizational control policy type in a root. A policy of
+    # a certain type can be attached to entities in a root only if that type
+    # is enabled in the root. After you perform this operation, you no
+    # longer can attach policies of the specified type to that root or to
+    # any organizational unit (OU) or account in that root. You can undo
+    # this by using the EnablePolicyType operation.
     #
     # This is an asynchronous request that AWS performs in the background.
     # If you disable a policy for a root, it still appears enabled for the
@@ -2381,7 +2471,7 @@ module Aws::Organizations
     # Enables all features in an organization. This enables the use of
     # organization policies that can restrict the services and actions that
     # can be called in each account. Until you enable all features, you have
-    # access only to consolidated billing. You can't use any of the
+    # access only to consolidated billing, and you can't use any of the
     # advanced account administration features that AWS Organizations
     # supports. For more information, see [Enabling All Features in Your
     # Organization][1] in the *AWS Organizations User Guide.*
@@ -2391,8 +2481,7 @@ module Aws::Organizations
     # Calling this operation sends a handshake to every invited account in
     # the organization. The feature set change can be finalized and the
     # additional features enabled only after all administrators in the
-    # invited accounts approve the change. Accepting the handshake approves
-    # the change.
+    # invited accounts approve the change by accepting the handshake.
     #
     # After you enable all features, you can separately enable or disable
     # individual policy types in a root using EnablePolicyType and
@@ -2574,18 +2663,18 @@ module Aws::Organizations
     # response.
     #
     # * You can invite AWS accounts only from the same seller as the master
-    #   account. For example, assume that your organization's master
-    #   account was created by Amazon Internet Services Pvt. Ltd (AISPL), an
-    #   AWS seller in India. You can invite only other AISPL accounts to
-    #   your organization. You can't combine accounts from AISPL and AWS or
-    #   from any other AWS seller. For more information, see [Consolidated
+    #   account. For example, if your organization's master account was
+    #   created by Amazon Internet Services Pvt. Ltd (AISPL), an AWS seller
+    #   in India, you can invite only other AISPL accounts to your
+    #   organization. You can't combine accounts from AISPL and AWS or from
+    #   any other AWS seller. For more information, see [Consolidated
     #   Billing in India][1].
     #
-    # * You might receive an exception that indicates that you exceeded your
+    # * If you receive an exception that indicates that you exceeded your
     #   account limits for the organization or that the operation failed
-    #   because your organization is still initializing. If so, wait one
-    #   hour and then try again. If the error persists after an hour,
-    #   contact [AWS Support][2].
+    #   because your organization is still initializing, wait one hour and
+    #   then try again. If the error persists after an hour, contact [AWS
+    #   Support][2].
     #
     # This operation can be called only from the organization's master
     # account.
@@ -2726,24 +2815,31 @@ module Aws::Organizations
     #
     # * The master account in an organization with all features enabled can
     #   set service control policies (SCPs) that can restrict what
-    #   administrators of member accounts can do. These restrictions can
-    #   include preventing member accounts from successfully calling
-    #   `LeaveOrganization`.
+    #   administrators of member accounts can do. This includes preventing
+    #   them from successfully calling `LeaveOrganization` and leaving the
+    #   organization.
     #
     # * You can leave an organization as a member account only if the
     #   account is configured with the information required to operate as a
     #   standalone account. When you create an account in an organization
-    #   using the AWS Organizations console, API, or CLI, the information
-    #   required of standalone accounts is *not* automatically collected.
-    #   For each account that you want to make standalone, you must accept
-    #   the end user license agreement (EULA). You must also choose a
-    #   support plan, provide and verify the required contact information,
-    #   and provide a current payment method. AWS uses the payment method to
-    #   charge for any billable (not free tier) AWS activity that occurs
-    #   while the account isn't attached to an organization. Follow the
-    #   steps at [ To leave an organization when all required account
-    #   information has not yet been provided][1] in the *AWS Organizations
-    #   User Guide.*
+    #   using the AWS Organizations console, API, or CLI commands, the
+    #   information required of standalone accounts is *not* automatically
+    #   collected. For each account that you want to make standalone, you
+    #   must do the following steps:
+    #
+    #   * Accept the end user license agreement (EULA)
+    #
+    #   * Choose a support plan
+    #
+    #   * Provide and verify the required contact information
+    #
+    #   * Provide a current payment method
+    #
+    #   AWS uses the payment method to charge for any billable (not free
+    #   tier) AWS activity that occurs while the account isn't attached to
+    #   an organization. Follow the steps at [ To leave an organization when
+    #   all required account information has not yet been provided][1] in
+    #   the *AWS Organizations User Guide.*
     #
     # * You can leave an organization only after you enable IAM user access
     #   to billing in your account. For more information, see [Activating
@@ -2785,35 +2881,39 @@ module Aws::Organizations
     # Services][1] in the *AWS Organizations User Guide.*
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     #
     #
     # [1]: http://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services.html
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListAWSServiceAccessForOrganizationResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListAWSServiceAccessForOrganizationResponse#enabled_service_principals #enabled_service_principals} => Array&lt;Types::EnabledServicePrincipal&gt;
     #   * {Types::ListAWSServiceAccessForOrganizationResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     # @example Request syntax with placeholder values
     #
     #   resp = client.list_aws_service_access_for_organization({
@@ -2850,31 +2950,35 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListAccountsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListAccountsResponse#accounts #accounts} => Array&lt;Types::Account&gt;
     #   * {Types::ListAccountsResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of all of the accounts in an organization
     #
@@ -2969,35 +3073,39 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :parent_id
     #   The unique identifier (ID) for the parent root or organization unit
     #   (OU) whose accounts you want to list.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListAccountsForParentResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListAccountsForParentResponse#accounts #accounts} => Array&lt;Types::Account&gt;
     #   * {Types::ListAccountsForParentResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of all of the accounts in a root or OU
     #
@@ -3074,7 +3182,8 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :parent_id
     #   The unique identifier (ID) for the parent root or OU whose children
@@ -3099,28 +3208,31 @@ module Aws::Organizations
     #   Filters the output to include only the specified child type.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListChildrenResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListChildrenResponse#children #children} => Array&lt;Types::Child&gt;
     #   * {Types::ListChildrenResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of all of the child accounts and OUs in a parent root or OU
     #
@@ -3182,7 +3294,8 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [Array<String>] :states
     #   A list of one or more states that you want included in the response.
@@ -3190,28 +3303,31 @@ module Aws::Organizations
     #   response.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListCreateAccountStatusResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListCreateAccountStatusResponse#create_account_statuses #create_account_statuses} => Array&lt;Types::CreateAccountStatus&gt;
     #   * {Types::ListCreateAccountStatusResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To get a list of completed account creation requests made in the organization
     #
@@ -3291,6 +3407,137 @@ module Aws::Organizations
       req.send_request(options)
     end
 
+    # Lists the AWS accounts that are designated as delegated administrators
+    # in this organization.
+    #
+    # This operation can be called only from the organization's master
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
+    #
+    # @option params [String] :service_principal
+    #   Specifies a service principal name. If specified, then the operation
+    #   lists the delegated administrators only for the specified service.
+    #
+    #   If you don't specify a service principal, the operation lists all
+    #   delegated administrators for all services in your organization.
+    #
+    # @option params [String] :next_token
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
+    #
+    # @option params [Integer] :max_results
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
+    #
+    # @return [Types::ListDelegatedAdministratorsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListDelegatedAdministratorsResponse#delegated_administrators #delegated_administrators} => Array&lt;Types::DelegatedAdministrator&gt;
+    #   * {Types::ListDelegatedAdministratorsResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_delegated_administrators({
+    #     service_principal: "ServicePrincipal",
+    #     next_token: "NextToken",
+    #     max_results: 1,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.delegated_administrators #=> Array
+    #   resp.delegated_administrators[0].id #=> String
+    #   resp.delegated_administrators[0].arn #=> String
+    #   resp.delegated_administrators[0].email #=> String
+    #   resp.delegated_administrators[0].name #=> String
+    #   resp.delegated_administrators[0].status #=> String, one of "ACTIVE", "SUSPENDED"
+    #   resp.delegated_administrators[0].joined_method #=> String, one of "INVITED", "CREATED"
+    #   resp.delegated_administrators[0].joined_timestamp #=> Time
+    #   resp.delegated_administrators[0].delegation_enabled_date #=> Time
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/organizations-2016-11-28/ListDelegatedAdministrators AWS API Documentation
+    #
+    # @overload list_delegated_administrators(params = {})
+    # @param [Hash] params ({})
+    def list_delegated_administrators(params = {}, options = {})
+      req = build_request(:list_delegated_administrators, params)
+      req.send_request(options)
+    end
+
+    # List the AWS services for which the specified account is a delegated
+    # administrator.
+    #
+    # This operation can be called only from the organization's master
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
+    #
+    # @option params [required, String] :account_id
+    #   The account ID number of a delegated administrator account in the
+    #   organization.
+    #
+    # @option params [String] :next_token
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
+    #
+    # @option params [Integer] :max_results
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
+    #
+    # @return [Types::ListDelegatedServicesForAccountResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::ListDelegatedServicesForAccountResponse#delegated_services #delegated_services} => Array&lt;Types::DelegatedService&gt;
+    #   * {Types::ListDelegatedServicesForAccountResponse#next_token #next_token} => String
+    #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.list_delegated_services_for_account({
+    #     account_id: "AccountId", # required
+    #     next_token: "NextToken",
+    #     max_results: 1,
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.delegated_services #=> Array
+    #   resp.delegated_services[0].service_principal #=> String
+    #   resp.delegated_services[0].delegation_enabled_date #=> Time
+    #   resp.next_token #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/organizations-2016-11-28/ListDelegatedServicesForAccount AWS API Documentation
+    #
+    # @overload list_delegated_services_for_account(params = {})
+    # @param [Hash] params ({})
+    def list_delegated_services_for_account(params = {}, options = {})
+      req = build_request(:list_delegated_services_for_account, params)
+      req.send_request(options)
+    end
+
     # Lists the current handshakes that are associated with the account of
     # the requesting user.
     #
@@ -3306,41 +3553,45 @@ module Aws::Organizations
     #
     #  </note>
     #
-    # This operation can be called from any account in the organization.
+    # This operation can be called only from the organization's master
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [Types::HandshakeFilter] :filter
     #   Filters the handshakes that you want included in the response. The
     #   default is all types. Use the `ActionType` element to limit the output
     #   to only a specified type, such as `INVITE`, `ENABLE_ALL_FEATURES`, or
-    #   `APPROVE_ALL_FEATURES`. Alternatively, you can specify the
-    #   `ENABLE_ALL_FEATURES` handshake, which generates a separate child
-    #   handshake for each member account. When you do specify
-    #   `ParentHandshakeId` to see only the handshakes that were generated by
-    #   that parent request.
+    #   `APPROVE_ALL_FEATURES`. Alternatively, for the `ENABLE_ALL_FEATURES`
+    #   handshake that generates a separate child handshake for each member
+    #   account, you can specify `ParentHandshakeId` to see only the
+    #   handshakes that were generated by that parent request.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListHandshakesForAccountResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListHandshakesForAccountResponse#handshakes #handshakes} => Array&lt;Types::Handshake&gt;
     #   * {Types::ListHandshakesForAccountResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of the handshakes sent to an account
     #
@@ -3454,41 +3705,44 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [Types::HandshakeFilter] :filter
     #   A filter of the handshakes that you want included in the response. The
     #   default is all types. Use the `ActionType` element to limit the output
     #   to only a specified type, such as `INVITE`, `ENABLE-ALL-FEATURES`, or
-    #   `APPROVE-ALL-FEATURES`. Alternatively, you can specify the
-    #   `ENABLE-ALL-FEATURES` handshake, which generates a separate child
-    #   handshake for each member account. When you do, specify the
-    #   `ParentHandshakeId` to see only the handshakes that were generated by
-    #   that parent request.
+    #   `APPROVE-ALL-FEATURES`. Alternatively, for the `ENABLE-ALL-FEATURES`
+    #   handshake that generates a separate child handshake for each member
+    #   account, you can specify the `ParentHandshakeId` to see only the
+    #   handshakes that were generated by that parent request.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListHandshakesForOrganizationResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListHandshakesForOrganizationResponse#handshakes #handshakes} => Array&lt;Types::Handshake&gt;
     #   * {Types::ListHandshakesForOrganizationResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of the handshakes associated with an organization
     #
@@ -3637,7 +3891,8 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :parent_id
     #   The unique identifier (ID) of the root or OU whose child OUs you want
@@ -3659,28 +3914,31 @@ module Aws::Organizations
     #   [1]: http://wikipedia.org/wiki/regex
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListOrganizationalUnitsForParentResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListOrganizationalUnitsForParentResponse#organizational_units #organizational_units} => Array&lt;Types::OrganizationalUnit&gt;
     #   * {Types::ListOrganizationalUnitsForParentResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of all of the child OUs in a parent root or OU
     #
@@ -3745,7 +4003,8 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # <note markdown="1"> In the current release, a child can have only a single parent.
     #
@@ -3770,28 +4029,31 @@ module Aws::Organizations
     #   [1]: http://wikipedia.org/wiki/regex
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListParentsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListParentsResponse#parents #parents} => Array&lt;Types::Parent&gt;
     #   * {Types::ListParentsResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of all of the parents of a child OU or account
     #
@@ -3847,34 +4109,38 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :filter
     #   Specifies the type of policy that you want to include in the response.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListPoliciesResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListPoliciesResponse#policies #policies} => Array&lt;Types::PolicySummary&gt;
     #   * {Types::ListPoliciesResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list policies in the organization
     #
@@ -3955,7 +4221,8 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :target_id
     #   The unique identifier (ID) of the root, organizational unit, or
@@ -3982,28 +4249,31 @@ module Aws::Organizations
     #   The type of policy that you want to include in the returned list.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListPoliciesForTargetResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListPoliciesForTargetResponse#policies #policies} => Array&lt;Types::PolicySummary&gt;
     #   * {Types::ListPoliciesForTargetResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list policies attached to a root, OU, or account
     #
@@ -4070,7 +4340,8 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # <note markdown="1"> Policy types can be enabled and disabled in roots. This is distinct
     # from whether they're available in the organization. When you enable
@@ -4082,28 +4353,31 @@ module Aws::Organizations
     #  </note>
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListRootsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListRootsResponse#roots #roots} => Array&lt;Types::Root&gt;
     #   * {Types::ListRootsResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of roots in the organization
     #
@@ -4161,22 +4435,26 @@ module Aws::Organizations
     # Currently, you can list tags on an account in AWS Organizations.
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :resource_id
     #   The ID of the resource that you want to retrieve tags for.
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @return [Types::ListTagsForResourceResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListTagsForResourceResponse#tags #tags} => Array&lt;Types::Tag&gt;
     #   * {Types::ListTagsForResourceResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     # @example Request syntax with placeholder values
     #
     #   resp = client.list_tags_for_resource({
@@ -4212,7 +4490,8 @@ module Aws::Organizations
     #  </note>
     #
     # This operation can be called only from the organization's master
-    # account.
+    # account or by a member account that is a delegated administrator for
+    # an AWS service.
     #
     # @option params [required, String] :policy_id
     #   The unique identifier (ID) of the policy whose attachments you want to
@@ -4227,28 +4506,31 @@ module Aws::Organizations
     #   [1]: http://wikipedia.org/wiki/regex
     #
     # @option params [String] :next_token
-    #   Use this parameter if you receive a `NextToken` response in a previous
-    #   request that indicates that there is more output available. Set it to
-    #   the value of the previous call's `NextToken` response to indicate
-    #   where the output should continue from.
+    #   The parameter for receiving additional results if you receive a
+    #   `NextToken` response in a previous request. A `NextToken` response
+    #   indicates that more output is available. Set this parameter to the
+    #   value of the previous call's `NextToken` response to indicate where
+    #   the output should continue from.
     #
     # @option params [Integer] :max_results
-    #   (Optional) Use this to limit the number of results you want included
-    #   per page in the response. If you do not include this parameter, it
-    #   defaults to a value that is specific to the operation. If additional
-    #   items exist beyond the maximum you specify, the `NextToken` response
-    #   element is present and has a value (is not null). Include that value
-    #   as the `NextToken` request parameter in the next call to the operation
-    #   to get the next part of the results. Note that Organizations might
-    #   return fewer results than the maximum even when there are more results
-    #   available. You should check `NextToken` after every operation to
-    #   ensure that you receive all of the results.
+    #   The total number of results that you want included on each page of the
+    #   response. If you do not include this parameter, it defaults to a value
+    #   that is specific to the operation. If additional items exist beyond
+    #   the maximum you specify, the `NextToken` response element is present
+    #   and has a value (is not null). Include that value as the `NextToken`
+    #   request parameter in the next call to the operation to get the next
+    #   part of the results. Note that Organizations might return fewer
+    #   results than the maximum even when there are more results available.
+    #   You should check `NextToken` after every operation to ensure that you
+    #   receive all of the results.
     #
     # @return [Types::ListTargetsForPolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::ListTargetsForPolicyResponse#targets #targets} => Array&lt;Types::PolicyTargetSummary&gt;
     #   * {Types::ListTargetsForPolicyResponse#next_token #next_token} => String
     #
+    # The returned {Seahorse::Client::Response response} is a pageable response and is Enumerable. For details on usage see {Aws::PageableResponse PageableResponse}.
+    #
     #
     # @example Example: To retrieve a list of roots, OUs, and accounts to which a policy is attached
     #
@@ -4393,6 +4675,49 @@ module Aws::Organizations
       req.send_request(options)
     end
 
+    # Enables the specified member account to administer the Organizations
+    # features of the specified AWS service. It grants read-only access to
+    # AWS Organizations service data. The account still requires IAM
+    # permissions to access and administer the AWS service.
+    #
+    # You can run this action only for AWS services that support this
+    # feature. For a current list of services that support it, see [AWS
+    # Services That Support Using Delegated Administrators][1] in the *AWS
+    # Organizations User Guide.*
+    #
+    # This operation can be called only from the organization's master
+    # account.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrated-services-list.html#services-that-support-delegated-admin
+    #
+    # @option params [required, String] :account_id
+    #   The account ID number of the member account in the organization to
+    #   register as a delegated administrator.
+    #
+    # @option params [required, String] :service_principal
+    #   The service principal of the AWS service for which you want to make
+    #   the member account a delegated administrator.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.register_delegated_administrator({
+    #     account_id: "AccountId", # required
+    #     service_principal: "ServicePrincipal", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/organizations-2016-11-28/RegisterDelegatedAdministrator AWS API Documentation
+    #
+    # @overload register_delegated_administrator(params = {})
+    # @param [Hash] params ({})
+    def register_delegated_administrator(params = {}, options = {})
+      req = build_request(:register_delegated_administrator, params)
+      req.send_request(options)
+    end
+
     # Removes the specified account from the organization.
     #
     # The removed account becomes a standalone account that isn't a member
@@ -4408,15 +4733,15 @@ module Aws::Organizations
     # You can remove an account from your organization only if the account
     # is configured with the information required to operate as a standalone
     # account. When you create an account in an organization using the AWS
-    # Organizations console, API, or CLI, the information required of
-    # standalone accounts is *not* automatically collected. For an account
-    # that you want to make standalone, you must accept the end user license
-    # agreement (EULA). You must also choose a support plan, provide and
-    # verify the required contact information, and provide a current payment
+    # Organizations console, API, or CLI commands, the information required
+    # of standalone accounts is *not* automatically collected. For an
+    # account that you want to make standalone, you must accept the end user
+    # license agreement (EULA), choose a support plan, provide and verify
+    # the required contact information, and provide a current payment
     # method. AWS uses the payment method to charge for any billable (not
     # free tier) AWS activity that occurs while the account isn't attached
     # to an organization. To remove an account that doesn't yet have this
-    # information, you must sign in as the member account. Then follow the
+    # information, you must sign in as the member account and follow the
     # steps at [ To leave an organization when all required account
     # information has not yet been provided][1] in the *AWS Organizations
     # User Guide.*
@@ -4744,7 +5069,7 @@ module Aws::Organizations
         params: params,
         config: config)
       context[:gem_name] = 'aws-sdk-organizations'
-      context[:gem_version] = '1.37.0'
+      context[:gem_version] = '1.38.0'
       Seahorse::Client::Request.new(handlers, context)
     end