A company is implementing a multi-account governance framework using AWS Organizations and AWS Control Tower. The solutions architect needs to onboard an existing standalone AWS account that hosts a legacy production workload into the organization. The landing zone must apply the standard enterprise security baselines and detective guardrails without disrupting the legacy workload.
What is the correct sequence of steps to successfully onboard and govern this existing account using AWS Control Tower?
- 1Initiate and send an organization invitation to the standalone account from the Organizations management account.
- 2Sign in to the standalone account as the root user and accept the invitation to join the organization.
- 3Move the joined account from the Root organizational unit (OU) to a target OU that is registered with AWS Control Tower.
- 4Enroll the account in AWS Control Tower using the AWS Control Tower console or AWS Service Catalog Account Factory.
Cevap
The correct order to onboard the existing standalone account is: first, send the organization invitation from the management account; second, accept the invitation from the standalone account; third, move the joined account to a registered organizational unit (OU); and fourth, enroll the account in AWS Control Tower.
The correct sequence begins with initiating the invite from the management account, followed by accepting it in the member account. Next, the member account must be moved to an Organizational Unit that is registered with AWS Control Tower, and finally, the account is enrolled to apply the standard baselines and policies.
Adım Adım Çözüm
Anahtar Kavram
Onboarding existing accounts into AWS Control Tower requires first making them part of the AWS Organization, placing them in a registered OU, and then executing the enrollment process.