AWS solutions documentation change
Summary
Expanded account closure procedures with deployment-specific steps (Control Tower vs Organizations) and pipeline integration
Security assessment
Change improves operational procedures for account management but doesn't address a specific security vulnerability or introduce new security features
Diff
diff --git a/solutions/latest/landing-zone-accelerator-on-aws/performing-administrator-tasks.md b/solutions/latest/landing-zone-accelerator-on-aws/performing-administrator-tasks.md index 379742d42..b3ccfe3b0 100644 --- a//solutions/latest/landing-zone-accelerator-on-aws/performing-administrator-tasks.md +++ b//solutions/latest/landing-zone-accelerator-on-aws/performing-administrator-tasks.md @@ -204 +204 @@ When you use AWS Security Services, such as Macie, Security Hub, and GuardDuty w -To close an account that is managed by the solution, use the following procedure. +To close an account that is managed by the solution, use one of the following procedures based off of your deployment type: @@ -206 +206 @@ To close an account that is managed by the solution, use the following procedure - 1. If you’re using AWS Control Tower, follow the steps to [unmanage](https://docs.aws.amazon.com/controltower/latest/userguide/unmanage-account.html) and [close the Account Factory account](https://docs.aws.amazon.com/controltower/latest/userguide/delete-account.html). +For Control Tower deployments, use the following procedure: @@ -208 +208 @@ To close an account that is managed by the solution, use the following procedure - 2. If you’re only using AWS Organizations, follow the steps to [close the account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.html). + 1. [Unmanage](https://docs.aws.amazon.com/controltower/latest/userguide/unmanage-account.html) the account. @@ -210 +210 @@ To close an account that is managed by the solution, use the following procedure - 3. For all deployments, follow the steps in Ignoring an account from resource provisioning. + 2. Once the account is unmanaged, move it under an [ignored OU](https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/performing-administrator-tasks.html#ignoring-an-account-from-resource-provisioning). @@ -211,0 +212 @@ To close an account that is managed by the solution, use the following procedure + 3. Release changes to run the pipeline. @@ -212,0 +214 @@ To close an account that is managed by the solution, use the following procedure + 4. Once pipeline run is successful, [close the account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.html). @@ -214,0 +217,15 @@ To close an account that is managed by the solution, use the following procedure + + +For AWS Organizations deployments, use the following procedure: + + 1. Move the account under an [ignored OU](https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/performing-administrator-tasks.html#ignoring-an-account-from-resource-provisioning). + + 2. Release changes to run the pipeline. + + 3. Once pipeline run is successful, [close the account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.html). + + + + +For all deployments, follow the steps in Ignoring an account from resource provisioning. +