search

aws-ia / terraform-aws-control_tower_account_factory

AWS Control Tower Account Factory
Apache License 2.0
624 stars 413 forks source link

How to revert deployment of AFT? #307

Open oliversalzburg opened 1 year ago

oliversalzburg commented 1 year ago

Terraform Version & Prov: unknown

AFT Version: 1.7.0 (Can be found in the AFT Management Account in the SSM Parameter /aft/config/aft/version)

Bug Description A third party created an AFT management account in our AWS organization, with the plan to later migrate the local state to a remote state. This has never happened and the third party is now gone. This seems to leave us unable to update the AFT account through our desired IaC path.

I would like to revert this AFT deployment and start over. I assume I can just decomission the account and just deploy AFT again, but I'm not entirely sure if this could create potential conflicts. I wasn't able to find any official guidance on this.

To Reproduce Steps to reproduce the behavior:

  1. Follow the steps at https://github.com/aws-ia/terraform-aws-control_tower_account_factory#configure-and-launch-your-aws-control-tower-account-factory-for-terraform
  2. Delete your Terraform state
balltrev commented 1 year ago

Hello @oliversalzburg, you’re absolutely right that just decommissioning the account and provisioning another will cause conflicts as AFT deploys resources throughout your AWS Control Tower Landing Zone. You’ll need to verify the following resources do not exist in their respective accounts before attempting to re-deploy AFT in a new AFT management account:

Within the Control Tower Management Account:

  1. IAM Role: aft-control-tower-events-rule
  2. IAM Role: AWSAFTExecution
  3. IAM Role: AWSAFTService

Within the Log Archive Account:

  1. IAM Role: AWSAFTExecution
  2. IAM Role: AWSAFTService
  3. KMS Alias: alias/aft
  4. S3 Bucket: aws-aft-logs-$ACCOUNT_ID-$CT_HOME_REGION
  5. S3 Bucket: aws-aft-s3-access-logs-$ACCOUNT_ID-$CT_HOME_REGION

Within the Audit account:

  1. IAM Role: AWSAFTExecution
  2. IAM Role: AWSAFTService

Once you’ve confirmed the resources above are not present, you should be able to follow https://docs.aws.amazon.com/controltower/latest/userguide/aft-getting-started.html to get AFT up and running in your environment

oliversalzburg commented 1 year ago

Thanks a lot for providing all those details :)

I have since already manually decommissioned the account and cleaned up the resources you mentioned. I feel like it would help if these steps were part of the official AFT documentation (sorry, if I just missed them). At the very least, it gives more confidence knowing the recovery steps.