How to Migrate Existing AWS Accounts into AWS Organizations

AWS Organization is not just a mere reorganization of your accounts; it's a game-changer that empowers you with centralized management and greater visibility across your AWS environment. Imagine enforcing policies, setting access controls, and streamlining billing across multiple accounts effortlessly. AWS Organizations brings these capabilities to the table, making it a must-have for organizations of all sizes.

This article will guide you through migrating your AWS accounts into AWS Organizations. It will also share best practices, common challenges, and troubleshooting tips to ensure a smooth transition. By the end, you'll have the knowledge and tools to optimize your account structure, simplify permissions management, and enhance overall control over your AWS resources.

 

Prerequisites

To follow through with this article, you need the following:

• Basic understanding of Amazon Web Services (AWS) and its account structure.

• Existing AWS accounts that need to be migrated into AWS Organizations.

• Access to an AWS Management Console with appropriate permissions to create and manage AWS Organizations.

• Web browsers like Google Chrome, Safari, Mozilla Firefox, and Microsoft Edge can handle different browsing sessions.

 

Understanding AWS Organizations

AWS Organizations is an effective service offered by Amazon Web Services (AWS) that allows you to manage multiple AWS accounts in a centralized and efficient manner. It acts as an umbrella or a management layer over your AWS accounts, enabling you to organize, govern, and control them effectively.

Imagine several AWS accounts within your organization, each serving different teams, departments, or projects. AWS Organizations helps you combine all these accounts under one umbrella, providing a unified view and management capabilities. It simplifies your account structure and allows you to set consistent policies, permissions, and controls across all accounts.

AWS Organizations are created within a standard AWS account, which will automatically be the “management, master or payment” account. Think of the management account as the central hub of AWS Organizations. The primary account controls and manages other AWS accounts within the organization. The management account is where you set up and configure AWS Organizations.

Now, let's talk about member accounts. Member accounts are the individual AWS accounts that are associated with the organization. These accounts can represent your organization's teams, departments, projects, or business units.

Member accounts inherit settings, policies, and permissions from the management account, providing a consistent framework across the organization. However, they still maintain their separate identities and can have their unique configurations and resources.

The management account has administrative control over the member accounts. It can invite existing AWS accounts to join the organization or create new accounts as needed. The management account also manages the hierarchy of accounts by creating Organizational Units (OUs) and organizing member accounts within them.

Organizational units (OUs) act as containers or groupings within AWS Organizations. They allow you to organize member accounts based on specific criteria like teams, projects, or regions. This hierarchical structure provides flexibility in managing and applying policies and permissions at different organizational levels.

 

Benefits of AWS Organizations

AWS Organizations offers many benefits that empower businesses to efficiently manage and scale their cloud infrastructure. Some of these benefits are:

• Simplified Account Management: AWS Organizations centralize the management of multiple AWS accounts. It provides a unified view and controls over your accounts from a single management account.

   

• Enhanced Security and Compliance: AWS Organizations allows you to enforce security policies and compliance standards across your accounts. You can set consistent security configurations, access controls, and governance policies that ensure your resources are protected and your organization complies with regulations.

   

• Cost Optimization and Consolidated Billing: With AWS Organizations, you can consolidate billing across multiple accounts. This streamlines cost management by providing a unified billing view and cost tracking. You can set budget limits, monitor spending, and optimize resource allocation for better cost control.

   

• Streamlined Resource Sharing and Collaboration: AWS Organizations simplifies resource sharing and collaboration between accounts. You can share resources such as Amazon S3 buckets, or AWS Lambda functions across accounts within the organization. This promotes efficient collaboration, eliminates the need for complex sharing setups, and enhances resource utilization.

   

Steps for Migrating Existing AWS Account into an Organization

 

Step 0: Gather information

Before you begin, ensure you have access to the account where you want to create the organization and the account(s) you wish to move into the organization!

 

Step 1: Create an Organization

It would be best if you first created an AWS organization to migrate existing AWS accounts into the organization. An AWS organization is created within a management account, so using your general AWS account is advisable.

• Sign in to the AWS Management Console using the AWS account credentials you want to set up as the management account. Ensure the account is not part of an AWS organization, i.e., neither a management nor a member account.

 

• Once logged in, navigate to the AWS Organizations service. You can find this by searching for “AWS Organizations” in the service bar.

 

 

• In the AWS Organizations console's Management console, click “Create Organization.” This starts the process of creating the organization. As part of that, it will convert your general account to the management account of the organization.

 

 

• Once the process is complete, your console should look like this.

 

 

Step 2: Inviting existing accounts into the Organization

• Open a new tab on your browser to log into other accounts you want to migrate to the created organization. Make sure this is an entirely separate session, and if in doubt, use a different web browser because you need to maintain logins to both the management account and the existing account you want to migrate.

   

• At this point, you must grab the account ID for the other account. To get this: navigate to the account dropdown at the top right side of the console. Click on the account dropdown and copy the account ID to your clipboard.

 

 

• Go back to the session where you have the management account open. Click the “Add an AWS account” button to invite an account to become a member.

 

 

• Select the method to add the account. You have two options:

a) Invite account: If you have administrative access, you can send an invitation to the email associated with that account. The account owner will receive the invitation and can accept it to join the organization.

 

b) Create an account: If you have permission to create accounts, you can choose this option to create a new account and add it to the organization.

 

• Choose the “Invite an existing AWS account” method for this article. You must provide the existing account's email address or the account ID.

• Paste the account ID you copied to the clipboard to the account ID field.

 

• If you are inviting an account, which you administer, you do not have to put any notes. If you invite an account administered by someone else, add a note.

   

 

• Once you’ve inputted the email address or account ID, scroll down and click on the “Send invitation” button.

 

• Depending on your specific AWS account, you may receive an error message telling you there are too many accounts within the organization. Different AWS accounts are created with different quotas, and you might get an error. If you get an error, you need to log a support request asking for an increase in the number of AWS accounts that can be part of an AWS Organization. This invite process has started if you do not get an error message.

 

Step 3: Accepting Invitations

• Finally, you need to accept the invitation to become a member account of the organization.

• On the member account console, navigate to the invitations page. You can find this on the left side of the page.

 

 

• You should see an overview of the invitation from the management account and all other invitations that apply to that account.

   

• Click on the “Accept invitation” button. This will complete the process of joining the organization. Now the existing account is a member account of the management account.

 

 

• Return to the tab where the management account session runs to verify the complete process. Hit the refresh button on your browser, and you should be able to see the newly added member account.

Step 4: Repeat steps 1-3 for any additional accounts you want to migrate into the AWS Organization.

 

Congratulations! You have successfully migrated your existing AWS account into an AWS Organization. The account is now part of the organization's hierarchy, and you can leverage the centralized management, security, and governance features provided by AWS Organizations.

 

Best Practices for a Smooth Migration

Following these best practices and guidelines ensures a smooth migration process. By implementing these recommendations, you can minimize potential disruptions, mitigate risks, and maximize the success of your migration:

• Review and Plan: Before migrating, assess your existing AWS account and identify any dependencies, resource configurations, or customizations. Plan the structure of your AWS Organization, including the hierarchy of Organizational Units (OUs) and policies you want to enforce.

   

• Communicate and Collaborate: Inform stakeholders, team members, and users about the upcoming migration to set expectations and address concerns, and establish a communication plan to provide updates and guidance throughout the migration process.

   

• Migrate in Phases: Consider a phased approach for migration, starting with a subset of accounts or resources to minimize disruption. Gradually migrate accounts or resources to the AWS Organization, ensuring each migration is successful before moving to the next phase. Monitor and evaluate the impact of the migration during each phase to address any issues proactively.

   

• Monitor and Optimize: Regularly monitor the migrated accounts within the AWS Organization to ensure they function as intended. Continuously optimize your AWS Organization structure, policies, and access controls based on evolving requirements and feedback. Leverage AWS monitoring and management tools to gain visibility into your accounts' performance, cost, and security.

   

Conclusion

Congratulations on completing this beginner-friendly guide on migrating existing AWS accounts into AWS Organizations! By following the steps outlined in this article, you have the knowledge and tools to simplify your AWS account management and unlock the benefits of a centralized organization.

Migrating your accounts into AWS Organizations offers several advantages, including streamlined management, enhanced security, and optimized resource sharing. To ensure a smooth transition, create a clear plan, communicate effectively, and conduct thorough testing.

Take advantage of features like consolidated billing and access controls to efficiently manage your AWS resources and enforce consistent policies across your organization. Monitor and optimize your AWS Organization to adapt to changing requirements and maximize the benefits.

Now it's time to embark on your migration journey and experience the power of AWS Organizations. Enjoy the streamlined management and increased efficiency that awaits you! Happy migrating!