How can I migrate from a single-account to a multi-account Ref Arch in the future?

[rhoboat]

Gruntwork used to offer the single-account Ref Arch. If I have a setup like this today, how do I migrate to the multi-account set up?

[rhoboat]

Unfortunately we don’t have a dedicated guide to switch a single account deployment to multi-account, nor is it something we officially support. In general, we recommend purchasing a multi-account Reference Architecture and migrating your existing workloads there, as the amount of work to migrate the existing infrastructure is fairly significant. It is likely going to be cheaper and faster to migrate your workloads to a new fresh Reference Architecture than it is to adapt your existing one.

With that in mind, my recommendation for adopting multi-account infrastructure is to start by creating the 3 supporting accounts (security, logs, and shared) using the production example code as an example.

Once those accounts are setup, then you can create a new application account to act as your demo account that is hooked to those (e.g., having the security account as the gateway for IAM; having the shared account host docker images and AMIs; etc), and then migrate your demo workloads to there.

Once you have a successful demo workload, then you can repeat the step for stage and prod until you have everything migrated over.

However, be apprised that this DIY approach is basically deploying the Gruntwork multi-account Ref Arch from scratch, and it is pretty involved with a lot of nuance, such as the deployment order, cross-account permissions, and resource-sharing configs. If you're going this route, you might as well purchase a Reference Architecture from us and migrate to it.

credit to @yorinasub17