Skip to content

Commit fb0fa55

Browse files
ryanjwatersryanjwaters
authored
Document describing steps to move an ALZ linked account "as is" to ASEA (#750)
* Initial release * Update operations-import-ALZAccount.md * Update ToC
1 parent b6957f5 commit fb0fa55

File tree

1 file changed

+206
-0
lines changed

1 file changed

+206
-0
lines changed

‎docs/operations/operations-import-ALZAccount.md‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
# Operations - How to migrate an AWS Landing Zone (ALZ) account "as is" into an AWS Secure Environment Accelerator (ASEA)
2+
3+
<!-- TOC depthFrom:1 depthTo:4 -->
4+
5+
- [1. Prerequisites / Setup](#1-prerequisites--setup)
6+
- [2. Landing Zone - Disassociate the account from the ALZ](#2-landing-zone---disassociate-the-account-from-the-alz)
7+
- [3. Landing Zone - Remove the account from the ALZ organizations and make standalone](#3-landing-zone-alz---remove-the-account-from-the-alz-organizations-and-make-standalone)
8+
- [4. Accelerator - Invite the account into its organization](#4-accelerator---invite-the-account-into-its-organization)
9+
- [5. Accelerator - Move the linked account from the top level root OU into the appropriate OU managed by the ASEA](#5-accelerator---move-the-linked-account-from-the-top-level-root-ou-into-the-appropriate-ou-managed-by-the-asea)
10+
- [6. Accelerator - Verify access control with roles, SSO, etc](#6-accelerator-asea---verify-access-control-with-roles-sso-etc)
11+
- [7. Landing Zone - Close down the ALZ core accounts and then the management account](#7-landing-zone---close-down-the-alz-core-accounts-and-then-the-management-account)
12+
13+
# Purpose
14+
15+
This document describes the steps to migrate an existing linked account from an AWS Landing Zone (ALZ) to an AWS Secure Environment Accelerator (ASEA).
16+
17+
## 1. Prerequisites / Setup
18+
19+
### 1.0. Confirm ASEA SSO and OU configuration
20+
21+
On the ASEA, setup and run initial tests with SSO and permission sets with an account under the OU where the linked account will be migrated to. Confirm that SSO is properly configured with permissions required for the team members whose account is being migrated. This would include configuration of the ASEA’s AWS Managed Active Directory (MAD) which should align with how the team migrating their account has their AWS SSO and MAD configured today.
22+
23+
### 1.1. Switch the ALZ linked account payment method to invoicing
24+
25+
If working with your AWS account team (TAM/SA) they will reach out to an internal team within AWS to have the linked account payment method switched to invoicing. This way the customer doesn’t have to enter a credit card when making the account standalone in the upcoming steps.
26+
27+
### 1.2. Confirm console access to the ALZ linked account and also to the email account
28+
29+
Confirm you have access to login as root to the ALZ linked account AWS console. Confirm you have access to the email account associated to the ALZ linked account. The upcoming steps will first make the account standalone (remove from ALZ organizations) so you need to make sure you have root access to the account. If required, you can reset the password following: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_change-root.html
30+
31+
### 1.3. If an Enterprise Support (ES) customer, then confirm ES is enabled on the ALZ linked account
32+
33+
If the ALZ management account is on Enterprise Support (ES), then make sure ES is enabled on the linked account being migrated to the ASEA. If its not, then raise a support case to activate ES on the linked account. This is to make sure an ES support case can be created and escalated during step 2 if any unforeseen issue occurs.
34+
35+
### 1.4. Confirm the ALZ CodePipeline is executing successfully.
36+
37+
Make sure the ALZ CodePipeline is still running successfully. Execute the ALZ CodePipeline from the management account to make sure it runs successfully.
38+
- AWS Console -> CodePipeline
39+
- Select “AWS-Landing-Zone-CodePipeline”
40+
- Select “Release Change”
41+
- Click on the pipeline and confirm it successfully runs through to completion
42+
43+
### 1.5. Confirm CLI access and setup Python and the AWS Python SDK (boto3)
44+
45+
Confirm SSO temporary command line access from the management account with AdminAccess.
46+
- SSO login → Select linked account → “Command line or programmatic access”
47+
- Select Option 2 and add to your AWS credentials file under “[default]“
48+
- This is required as the python script in step 3 takes a “profile” parameter
49+
- Confirm you have the AWS CLI tool installed.
50+
- https://aws.amazon.com/cli/
51+
- Confirm by running a command such as “aws s3 ls”
52+
- Confirm you have python3 and the AWS python library (boto3) installed which is required in step 2 to confirm the account has been disassociated from the landing zone correctly.
53+
- https://boto3.amazonaws.com/v1/documentation/api/latest/guide/quickstart.html
54+
55+
## 2. Landing Zone - Disassociate the account from the ALZ
56+
57+
- 2.0 - Login to the ALZ management account, and go to “Service Catalog” -> “Provisioned products”
58+
- 2.1 - Select “Access Filter” -> “Account” to see a list of the account products
59+
60+
### 2.2. Select the product for the specific linked account
61+
- Put the linked account name in the provisioned products search bar
62+
- This will narrow down the list and show a product name “AWS-Landing-Zone-Account-Vending-Machine” with a name *“lz_applicaitons_<ACCOUNT_NAME>_<date>”*
63+
- Select that product and then “Actions->Terminate”
64+
65+
### 2.3. Confirm the product successfully terminates
66+
- The provisioned product entry will show a status of “Under change”
67+
- You can also verify by going to CloudFormation→Stacks and you will see “DELETE IN PROGRESS” for the AVM Template stack being deleted.
68+
- Go to the Resources tab to see the deleted resources associated to this stack.
69+
- Once the provisioned product no longer says “Under change” move to the next step.
70+
- Please note, this can take 1-2 hours.
71+
72+
### 2.4. Go to the linked account (assume role)
73+
- From the management account, assume the role “AWSCloudFormationStackSetExecutionRole” to the linked account
74+
- or optionally, SSO with console access to that account
75+
76+
### 2.5. Under “CloudFormation” verify that the ALZ Stacks (StackSets from ALZ mgmt) were deleted
77+
- There should be no stack left in the linked account with the prefix “StackSet-AWS-Landing-Zone-Baseline*". For example:
78+
- StackSet-AWS-Landing-Zone-Baseline-CentralizedLoggingSpoke-
79+
- StackSet-AWS-Landing-Zone-Baseline-EnableConfigRules-
80+
- StackSet-AWS-Landing-Zone-Baseline-EnableNotifications-
81+
- StackSet-AWS-Landing-Zone-Baseline-EnableConfigRulesGlobal-
82+
- StackSet-AWS-Landing-Zone-Baseline-EnableConfig-
83+
- StackSet-AWS-Landing-Zone-Baseline-ConfigRole-
84+
- StackSet-AWS-Landing-Zone-Baseline-IamPasswordPolicy-
85+
- StackSet-AWS-Landing-Zone-Baseline-SecurityRoles-
86+
- StackSet-AWS-Landing-Zone-Baseline-EnableCloudTrail-
87+
88+
### 2.6. Verify that the account is ready to be invited and baselined by the ASEA
89+
- You need to ensure that resources don’t exist in the default VPC, there is no config recorder channel, no CloudTrail Trail and STS is active in all regions.
90+
- This can be done manually, but ideally use this python script that can be run as well to automate the verification
91+
- https://github.com/paulbayer/Inventory_Scripts/blob/mainline/ALZ_CheckAccount.py
92+
- mkdir test; cd test
93+
- git clone https://github.com/paulbayer/Inventory_Scripts.git
94+
- python3 ALZ_CheckAccount.py -a LINKED ACCOUNT_HERE -p default
95+
- It will run through 5 steps and output the following. If you were to run this script before the “terminate” step above is complete you would have warnings in steps 2 and 3 below.
96+
- Step 0 completed without issues
97+
- Checking account 111122223333 for default VPCs in any region
98+
- Step 1 completed with no issues
99+
- Checking account 111122223333 for a Config Recorders and Delivery Channels in any region
100+
- Step 2 completed with no issues
101+
- Checking account 111122223333 for a specially named CloudTrail in all regions
102+
- Step 3 completed with no issues
103+
- Checking account 111122223333 for any GuardDuty invites
104+
- Step 4 completed with no issues
105+
- Checking that the account is part of the AWS Organization.
106+
- Step 5 completed with no issues
107+
- We've found NO issues that would hinder the adoption of this account ****
108+
109+
110+
## 3. Landing Zone (ALZ) - Remove the account from the ALZ organizations and make standalone
111+
112+
Removing the account from the ALZ organizations and making it standalone is required so it can be invited into the ASEA organization.
113+
114+
### 3.0. Read the following summary/considerations
115+
- https://aws.amazon.com/premiumsupport/knowledge-center/organizations-move-accounts/
116+
117+
### 3.1. Verify access
118+
- As stated in the previous sections, verify you have a mechanism to access the account post leaving the ALZ organization
119+
- Former SSO roles will no longer function nor will the “AWSCloudFormationStackSetExecutionRole” role as it will have a trust relationship to the ALZ management account.
120+
- Confirm the root credentials have been recovered and are usable
121+
- As an alternative, confirm access with a new role/IAM user with Admin permissions on the account
122+
123+
### 3.2. Verify billing flipped to invoicing
124+
- As stated in the previous sections, verify the account payment method has been flipped to “invoicing” to avoid having to enter a Credit Card when going standalone. This can be done working with your AWS account team who will coordinate internally, or by raising a support case describing the use case.
125+
126+
### 3.3. Remove the account from the organizations and make standalone
127+
- Follow the instructions on the following link to remove the account
128+
- The short version is select the account from the ALZ mgmt account Organizations and select "remove"
129+
- https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html
130+
- https://aws.amazon.com/blogs/security/aws-organizations-now-supports-self-service-removal-of-accounts-from-an-organization
131+
- Note, when moving the account standalone do not select Enterprise Support. You shouldn't get a popup dialog asking for a Credit Card and the Support level since the account should have been moved to invoicing. Support can be reenabled on the linked account once it’s invited into the ASEA organization.
132+
133+
## 4. Accelerator - Invite the account into its organization
134+
135+
### 4.1 From the ASEA mgmt account, send an invite to the standalone account
136+
- Follow the instructions on the following link to invite the account
137+
- The short version is go to the ASEA mgmt account organizations and select "Add an account" -> "Invite existing account" -> "enter the linked account account ID"
138+
- https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html
139+
140+
### 4.2 In the former ALZ account, Accept the invitation
141+
- https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html#orgs_manage_accounts_accept-decline-invite
142+
143+
### 4.3 Keep the linked account at the root level of the Organizations
144+
- Verify access to the linked account using your root login credentials
145+
- If you had created an IAM role/user with Admin permissions, then verify access as well
146+
147+
### 4.4 Activate Enterprise Support (ES) on this linked account
148+
- If ES is enabled on the ASEA management account, open a support case to enable ES on this linked account
149+
- Go to the Support center and create a billing support case with "Account" and "Activation"
150+
- Subject "Requesting ES enablement on linked account"
151+
- Body "Requesting ES enablement on linked account <ACCOUNT-ID-HERE>"
152+
- Your AWS TAM can escalate the case with the support team if it’s time sensitive.
153+
- This is to make sure an ES support case can be created and escalated during the next steps if any unforeseen issue occurs.
154+
155+
### 4.5 Update (or add) the Organization Adming Role so one can assume the role into the linked account.
156+
- Login to the linked account which just joined the organization.
157+
- Create a new Organization Admin role, as defined in the customers config file: "organization-admin-role": "OrganizationAccountAccessRole".
158+
- With newer customers the default is "OrganizationAccountAccessRole, with older customers it is "AWSCloudFormationStackSetExecutionRole".
159+
- If "AWSCloudFormationStackSetExecutionRole" then you can edit the trust relationship directly
160+
- Go to IAM -> Role -> AWSCloudFormationStackSetExecutionRole
161+
- Update the trust relationship to have the management account ID of the ASEA (instead of the account ID of the previous ALZ)
162+
- Verify that you can assume this role from the management account into the linked account
163+
164+
## 5. Accelerator - Move the linked account from the top level root OU into the appropriate OU managed by the ASEA
165+
166+
### 5.0. Plan what OU this account will be moved into
167+
- Option 1 - Create a new OU and move the account into that OU
168+
- Before the migration, the team would have created a new OU (ie-similar to the sandbox OU).
169+
- This would be needed if they need to isolate this account from TGW attachments/Networking and want to keep it isolated.
170+
- The state machine will run and start to baseline the account.
171+
- It will create a new VPC and deploy resources using CFN such as Config, CloudTrail, etc.
172+
- Note, if the OU is setup similar to the sandbox OU it does not provide access to the shared VPCs that have the TGW attachments.
173+
- Creating a new OU also requires adding that new OU and the OU persona to the config file in advance of the next state machine execution.
174+
- Option 2 - Move account into an existing OU (ie-prod)
175+
- The state machine will run and start to baseline the account.
176+
- It will create a new VPC and deploy resources using CFN such as Config, CloudTrail, etc.
177+
- The customers existing VPC will remain, as a 2nd DETACHED VPC.
178+
- Mote. if it is non-compliant to security rules, it remains non-compliant and needs to be cleaned up and brought into compliance
179+
- If the VPC is compliant and it has unique IP addresses, it could be attached to the TGW.
180+
181+
### 5.1. Move the account from the root OU to the correct OU
182+
- THIS CANNOT BE EASILY UNDONE - MAKE SURE YOU MOVE TO THE CORRECT OU
183+
- Follow the instructions on the following link to move the account to the correct OU
184+
- The short version is go to the ASEA management account organizations and "select the account" -> "actions" -> "move" -> "select the correct OU"
185+
- NOTE: The ASEA state machine will automatically start within 1-2 minutes of the account being moved into the OU
186+
- https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html#move_account_to_ou
187+
- Verify that the ASEA main state machine (under AWS->Step Functions) is triggered and runs cleanly (~30-45 minutes)
188+
189+
## 6. Accelerator (ASEA) - Verify access control with roles, SSO, etc
190+
- Update and verify SSO and permission sets for the linked account now part of the ASEA
191+
- Verify you still have access to the linked account via root (or other mechanisms)
192+
- Verify you still can assume the operations role into the linked account
193+
194+
## 7. Landing Zone - Close down the ALZ core accounts and then the management account
195+
196+
Once all workloads have been migrated from the ALZ to the ASEA, then you may decide to shutdown your ALZ.
197+
198+
### 7.1. Close down the ALZ linked accounts
199+
- Close all the linked accounts “as is” without making them standalone
200+
- This will be the ALZ core linked accounts, but you might have some remaining workload accounts you decided not to migrate to the ASEA.
201+
- https://aws.amazon.com/premiumsupport/knowledge-center/close-aws-account
202+
- The management account will remain with organizations and the core accounts will show as suspended for 90 days.
203+
204+
### 7.2. Close down the ALZ management account
205+
- After 90 days, the suspended linked accounts will be completely closed
206+
- Go to the root account and turn off Organizations and then close the root account

0 commit comments

Comments
 (0)