AWS organizations documentation change
Summary
Streamlined account migration process documentation by removing standalone account requirements, renumbering steps, and simplifying invitation flow
Security assessment
Changes focus on procedural simplification rather than addressing security vulnerabilities. The removal of standalone account period and payment/verification checks could impact billing/account state management but doesn't directly indicate a security fix. No mention of CVE, vulnerabilities, or security incidents.
Diff
diff --git a/organizations/latest/userguide/orgs_account_migration.md b/organizations/latest/userguide/orgs_account_migration.md index 7cd96b813..34713f114 100644 --- a//organizations/latest/userguide/orgs_account_migration.md +++ b//organizations/latest/userguide/orgs_account_migration.md @@ -11 +11 @@ You can migrate an AWS account from one organization to another at any time. For -Whatever your use case, migrating an account between organizations requires for you to remove the account from the old organization, for you to make the account a standalone account, and for the account to accept the invitation from the new organization to join the new organization. Your workloads and services will continue to operate according to your specifications during the migration. However, it is important to be aware of any dependencies you might have in your organization. +Whatever your use case, migrating an account between organizations requires you to send an invite from the management account of the new organization, and to use the invited account to accept the invite to join the new organization. @@ -15 +15 @@ Whatever your use case, migrating an account between organizations requires for -**Closed or suspended accounts cannot be migrated** +**Closed or suspended accounts cannot be migrated.** @@ -82,16 +82 @@ For information about how to delete a role, see [Deleting roles or instance prof -### Step 3: Check your phone verification and payment method - -The migrating account must operate as a standalone account for a period of time before migrating to the new organization. - -**To allow an account operate as a standalone account, check the following:** - - * Make sure your phone verification is up-to-date. - - * Make sure have have added a valid payment method for the account to address any charges that are incurred while the account is migrating. - - * If you use invoicing for your payment method, make sure your invoice is up-to-date. - - - - -### Step 4: Back up all reports +### Step 3: Back up all reports @@ -107 +92 @@ For more information, see [Cost and Usage Reports](https://docs.aws.amazon.com/c -### Step 5: Check for organization dependencies +### Step 4: Check for organization dependencies @@ -124 +109 @@ Make sure the migrating account does not have any organization-related dependenc -### (Optional) Step 6: Review guidance if you use AWS Control Tower +### (Optional) Step 5: Review guidance if you use AWS Control Tower @@ -130 +115 @@ If you are migrating an account to or from an organization managed by AWS Contro -The migration process requires for the new organization to send an invitation to the migrating account, for the old organization to remove the migration account, and for the migrating account to accept the invitation from the new organization to join the new organization. +The migration process requires for the new organization to send an invitation to the migrating account, and for the migrating account to accept the invitation from the new organization to join the new organization. @@ -134,3 +119 @@ The migration process requires for the new organization to send an invitation to - 1. Send an invitation from the management account of the new organization to the migrating account. You should send the invitation to the account before it leaves the old organization. This helps to minimize the costs incurred when the migrating account temporarily operates as a standalone account. For information about inviting accounts, see [Inviting an AWS account to join your organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html). - - 2. Remove the migrating account from the old organization. You can [remove a member account from your organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove-member-account.html) using the management account or [leave an organization from as a member account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_leave-as-member.html). + 1. Send an invitation from the management account of the new organization to the migrating account. For information about inviting accounts, see [Inviting an AWS account to join your organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html). @@ -138 +121 @@ The migration process requires for the new organization to send an invitation to - 3. Accept the invitation to join the new organization. For more information, see [Accepting an invitation from an organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html#orgs_manage_accounts_accept-decline-invite). Accounts that are migrated from one another organization to another will be automatically added to the root of the new organization. Before moving an account to an organizational unit (OU) in the new organization, it is recommended that you check that migrating account has the appropriate organization policies and OU permissions. + 2. Accept the invitation to join the new organization. For more information, see [Accepting an invitation from an organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html#orgs_manage_accounts_accept-decline-invite). Accounts that are migrated from one another organization to another will be automatically added to the root of the new organization. Before moving an account to an organizational unit (OU) in the new organization, it is recommended that you check that migrating account has the appropriate organization policies and OU permissions. @@ -140 +123 @@ The migration process requires for the new organization to send an invitation to - 4. If you want to migrate the management account, you must [remove all member accounts](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html) from the organization and [delete the organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_delete.html) before migrating the management account to the new organization. After you have deleted the old organization, your management account will operate as a standalone account and can accept the invitation from the new organization to join the new organization. If you accept the invitation, the management account will be a member account of the new organization. + 3. If you want to migrate the management account, you must [remove all member accounts](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html) from the organization and [delete the organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_delete.html) before migrating the management account to the new organization. After you have deleted the old organization, your management account will operate as a standalone account and can accept the invitation from the new organization to join the new organization. If you accept the invitation, the management account will be a member account of the new organization.