+<GitHub discussion={{"id":"D_kwDOF8slf84AORie","number":101,"author":{"login":"rhoboat"},"title":"How can I migrate from a single-account to a multi-account Ref Arch in the future?","body":"Gruntwork used to offer the single-account Ref Arch. If I have a setup like this today, how do I migrate to the multi-account set up?","bodyHTML":"<p dir=\"auto\">Gruntwork used to offer the single-account Ref Arch. If I have a setup like this today, how do I migrate to the multi-account set up?</p>","answer":{"body":"Unfortunately we don’t have a dedicated guide to switch a single account deployment to multi-account, nor is it something we officially support. In general, we recommend purchasing a multi-account Reference Architecture and migrating your existing workloads there, as the amount of work to migrate the existing infrastructure is fairly significant. It is likely going to be cheaper and faster to migrate your workloads to a new fresh Reference Architecture than it is to adapt your existing one.\r\n\r\nWith that in mind, my recommendation for adopting multi-account infrastructure is to start by creating the 3 supporting accounts (`security`, `logs`, and `shared`) using [the production example code](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live) as an example.\r\n\r\nOnce those accounts are setup, then you can create a new application account to act as your demo account that is hooked to those (e.g., having the `security` account as the gateway for IAM; having the `shared` account host docker images and AMIs; etc), and then migrate your demo workloads to there.\r\n\r\nOnce you have a successful demo workload, then you can repeat the step for `stage` and `prod` until you have everything migrated over.\r\n\r\nHowever, be apprised that this DIY approach is basically deploying the Gruntwork multi-account Ref Arch from scratch, and it is pretty involved with a lot of nuance, such as the deployment order, cross-account permissions, and resource-sharing configs. If you're going this route, you might as well purchase a Reference Architecture from us and migrate to it.\r\n\r\ncredit to @yorinasub17","bodyHTML":"<p dir=\"auto\">Unfortunately we don’t have a dedicated guide to switch a single account deployment to multi-account, nor is it something we officially support. In general, we recommend purchasing a multi-account Reference Architecture and migrating your existing workloads there, as the amount of work to migrate the existing infrastructure is fairly significant. It is likely going to be cheaper and faster to migrate your workloads to a new fresh Reference Architecture than it is to adapt your existing one.</p>\n<p dir=\"auto\">With that in mind, my recommendation for adopting multi-account infrastructure is to start by creating the 3 supporting accounts (<code class=\"notranslate\">security</code>, <code class=\"notranslate\">logs</code>, and <code class=\"notranslate\">shared</code>) using <a href=\"https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/examples/for-production/infrastructure-live\">the production example code</a> as an example.</p>\n<p dir=\"auto\">Once those accounts are setup, then you can create a new application account to act as your demo account that is hooked to those (e.g., having the <code class=\"notranslate\">security</code> account as the gateway for IAM; having the <code class=\"notranslate\">shared</code> account host docker images and AMIs; etc), and then migrate your demo workloads to there.</p>\n<p dir=\"auto\">Once you have a successful demo workload, then you can repeat the step for <code class=\"notranslate\">stage</code> and <code class=\"notranslate\">prod</code> until you have everything migrated over.</p>\n<p dir=\"auto\">However, be apprised that this DIY approach is basically deploying the Gruntwork multi-account Ref Arch from scratch, and it is pretty involved with a lot of nuance, such as the deployment order, cross-account permissions, and resource-sharing configs. If you're going this route, you might as well purchase a Reference Architecture from us and migrate to it.</p>\n<p dir=\"auto\">credit to <a class=\"user-mention notranslate\" data-hovercard-type=\"user\" data-hovercard-url=\"/users/yorinasub17/hovercard\" data-octo-click=\"hovercard-link-click\" data-octo-dimensions=\"link_type:self\" href=\"https://github.com/yorinasub17\">@yorinasub17</a></p>"}}} />
0 commit comments