AWS controltower: Add AWS Backup baseline disable step to decommissioning procedure
Summary
Adds a prerequisite step to disable the AWS Backup baseline on all OUs before decommissioning (otherwise it fails), notes recovery if decommissioning already failed, warns against closing member accounts during decommissioning, and renumbers the procedure steps.
Security assessment
This is a procedural/operational fix to the decommissioning runbook to prevent failures. It mentions AWS Backup and account closure but does not address a vulnerability, credential, or access-control issue.
Evidence
If the AWS Backup baseline is enabled on any registered OU, disable it on every OU where it is enabled before you decommission your landing zone. Otherwise, decommissioning fails.
Diff
diff --git a/controltower/latest/userguide/how-to-decommission.md b/controltower/latest/userguide/how-to-decommission.md index 4fb285568..04c580d9c 100644 --- a//controltower/latest/userguide/how-to-decommission.md +++ b//controltower/latest/userguide/how-to-decommission.md @@ -15 +15 @@ We recommend that you unmanage your enrolled accounts prior to decommissioning. - 1. Navigate to the **Landing Zone Settings** page in the AWS Control Tower console. + 1. If the AWS Backup baseline is enabled on any registered OU, disable it on every OU where it is enabled before you decommission your landing zone. Otherwise, decommissioning fails. For instructions, see [First step: Turn off backups on OUs](./stop-backups.html#turn-off-ou-backup). @@ -17 +17 @@ We recommend that you unmanage your enrolled accounts prior to decommissioning. - 2. Choose **Decommission your landing zone** within the **Decommission your landing zone** section. +If decommissioning has already failed for this reason, you can disable the AWS Backup baseline and run decommissioning again. @@ -19 +19,5 @@ We recommend that you unmanage your enrolled accounts prior to decommissioning. - 3. A dialog appears, explaining the action you are about to perform, with a required confirmation process. To confirm your intent to decommission, you must select every box and type the confirmation as requested. + 2. Navigate to the **Landing Zone Settings** page in the AWS Control Tower console. + + 3. Choose **Decommission your landing zone** within the **Decommission your landing zone** section. + + 4. A dialog appears, explaining the action you are about to perform, with a required confirmation process. To confirm your intent to decommission, you must select every box and type the confirmation as requested. @@ -25 +29,3 @@ We recommend that you unmanage your enrolled accounts prior to decommissioning. - 4. If you confirm your intent to decommission your landing zone, you are redirected to the AWS Control Tower home page while decommissioning is in progress. The process may require up to two hours. + 5. If you confirm your intent to decommission your landing zone, you are redirected to the AWS Control Tower home page while decommissioning is in progress. The process may require up to two hours. + +Do not close any member accounts in your organization while decommissioning is in progress. Decommissioning might fail. @@ -27 +33 @@ We recommend that you unmanage your enrolled accounts prior to decommissioning. - 5. When decommissioning has succeeded, you must delete remaining resources manually before setting up a new landing zone from the AWS Control Tower console. These remaining resources include some specific Amazon S3 buckets, organizations, and CloudWatch Logs log groups. + 6. When decommissioning has succeeded, you must delete remaining resources manually before setting up a new landing zone from the AWS Control Tower console. These remaining resources include some specific Amazon S3 buckets, organizations, and CloudWatch Logs log groups. @@ -35 +41 @@ For more information about how to delete resources manually, see [About removing - 6. If you intend to set up a new landing zone in a new AWS Region, follow this additional step. Enter the following command through the CLI: + 7. If you intend to set up a new landing zone in a new AWS Region, follow this additional step. Enter the following command through the CLI: