search

aws-ia / terraform-aws-control_tower_account_factory

AWS Control Tower Account Factory
Apache License 2.0
605 stars 386 forks source link

Onboarding account requires two steps to move to different OU #374

Open mxsoldaat opened 12 months ago

mxsoldaat commented 12 months ago

AFT Version: 1.10.3

Bug Description Moving account to correct target OU during onboarding requires additional update of ManagedOrganizationalUnit. Specifying target OU in single iteration does not move account to that target OU.

We would like to be able to move the account to the correct target OU during the first onboarding step, instead of requiring 2 separate PR's

To Reproduce Example steps to reproduce the behavior:

  1. Onboard account using AFT, specify target OU (e.g. Sandbox, not nested)
  2. Account is onboarded, but not moved to target OU

Expected behavior

  1. Onboard account using AFT, specify target OU (e.g. Sandbox, not nested)
  2. Account is onboarded and immediately moved to target OU

Workaround

  1. Onboard account using AFT, specify current OU (e.g. Migrated, not nested)
  2. Account is onboarded
  3. Update target OU (e.g. Sandbox)
  4. Account is moved to target OU
snebhu3 commented 11 months ago

@mxsoldaat thank you for reaching out. While on-boarding an existing account into AFT, AFT expects all the account parameters to be consistent with the current state in Control Tower and Organizations. AFT documentation for reference. You can update the OU after the account has been on-boarded to AFT.

mxsoldaat commented 11 months ago

@snebhu3 Thank you for your response. If I recall correctly we could move an account to the desired OU directly upon on-boarding, but this behavior was reverted at some point. Right now it takes 2 PR's to on-board an account, the second only to move it to the desired OU. Is there a chance it will be made possible again to directly on-board an account to the desired OU in the future?