search

awslabs / landing-zone-accelerator-on-aws

Deploy a multi-account cloud foundation to support highly-regulated workloads and complex compliance requirements.
https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/
Apache License 2.0
541 stars 431 forks source link

feat: Deploy Control Tower with existing account in Org #588

Open mbevc1 opened 2 weeks ago

mbevc1 commented 2 weeks ago

Is your feature request related to a problem? Please describe. I wonder if there is a reason why installing LZA in an Org with existing (even Suspended) accounts fails the preflight check and errors out.

The only AWS account in the AWS Organization is the management account.

Describe the feature you'd like Install LZA in Org with existing accounts.

Additional context n/a

richardkeit commented 2 weeks ago

Hey @mbevc1 ,

Have you read this https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/prerequisites.html#for-aws-control-tower-based-installation ?

I believe this has been a design decision from the LZA team and they've done their best to describe the intended behaviour.

mbevc1 commented 2 weeks ago

Hi @richardkeit .

Thanks for the link and I've seen it. I think the mentioned docs is not explaining the reasoning, which i was interested in, but manually deploying CT seems to get around that check and starts the pipeline - I'll report back if that fails as it's still ongoing :)

mbevc1 commented 2 weeks ago

Seems manual CT deployment and then running works works fine. Just minor tweaks to to config to reflect existing OU/accounts. Perhaps this could be better documented at least :wink: